0b909c97aba0af87516cf00b6c1f801f3086f1e306e39cee002c789b214e4e98

Analysis

max time kernel
76s
max time network
80s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 12:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
unlockall.exe
Size 9.2MB
Sample260708-pee4naft2y
SHA256 0b909c97aba0af87516cf00b6c1f801f3086f1e306e39cee002c789b214e4e98
MD5 1c14bf639f139cfca507a25c733bd275
SHA1 3666db337909ef59747855820d04a79c122bddc9
SHA512 ff9bb52dba94e9b9d4769370395e5b779d8599e5c1e37edbcd3fe9c4edc5bcc79887861f4f20a289d22c839825d94fe6a152c7dc58e28c8dc52a517cded2d48a
SSDEEP 98304:TM3LuygWEZAug/efGr4bJpmkKdqYCdFUzviVGE24RDejIXOT4LKdYCbc3Y+2CkP:TMiJZYfk2nULBCbPFXP
TLSH
T10DA61827ED6610DCC5EBC170825EAE73B931BA140137FEFA5A50DE701F21E521A6BB24
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

execution persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1924	SecurityHealthService.exe
1936	SecurityHealthService.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppReadinessService = "wscript.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\AppReadiness\\AppReadinessService.vbs\""	SecurityHealthService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppReadinessService = "wscript.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\AppReadiness\\AppReadinessService.vbs\""	SecurityHealthService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthService = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\SecurityHealthService.exe"	unlockall.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppReadinessService = "wscript.exe \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\AppReadiness\\AppReadinessService.vbs\""	unlockall.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthService = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\SecurityHealthService.exe"	SecurityHealthService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-515251955-468707340-1782030364-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthService = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\SecurityHealthService.exe"	SecurityHealthService.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	api.ipify.org

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
932	powershell.exe
4744	powershell.exe
5776	powershell.exe
4244	powershell.exe

Gathers network information 2 TTPs 4 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4232	ipconfig.exe
1048	ipconfig.exe
6044	ipconfig.exe
2744	ipconfig.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4148	schtasks.exe
2400	schtasks.exe
1676	schtasks.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
932	powershell.exe
932	powershell.exe
4744	powershell.exe
4744	powershell.exe
4744	powershell.exe
5776	powershell.exe
5776	powershell.exe
4244	powershell.exe
4244	powershell.exe
5776	powershell.exe
4244	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	932	powershell.exe
Token: SeIncreaseQuotaPrivilege	932	powershell.exe
Token: SeSecurityPrivilege	932	powershell.exe
Token: SeTakeOwnershipPrivilege	932	powershell.exe
Token: SeLoadDriverPrivilege	932	powershell.exe
Token: SeSystemProfilePrivilege	932	powershell.exe
Token: SeSystemtimePrivilege	932	powershell.exe
Token: SeProfSingleProcessPrivilege	932	powershell.exe
Token: SeIncBasePriorityPrivilege	932	powershell.exe
Token: SeCreatePagefilePrivilege	932	powershell.exe
Token: SeBackupPrivilege	932	powershell.exe
Token: SeRestorePrivilege	932	powershell.exe
Token: SeShutdownPrivilege	932	powershell.exe
Token: SeDebugPrivilege	932	powershell.exe
Token: SeSystemEnvironmentPrivilege	932	powershell.exe
Token: SeRemoteShutdownPrivilege	932	powershell.exe
Token: SeUndockPrivilege	932	powershell.exe
Token: SeManageVolumePrivilege	932	powershell.exe
Token: 33	932	powershell.exe
Token: 34	932	powershell.exe
Token: 35	932	powershell.exe
Token: 36	932	powershell.exe
Token: SeDebugPrivilege	4744	powershell.exe
Token: SeDebugPrivilege	5776	powershell.exe
Token: SeDebugPrivilege	4244	powershell.exe
Token: SeIncreaseQuotaPrivilege	4744	powershell.exe
Token: SeSecurityPrivilege	4744	powershell.exe
Token: SeTakeOwnershipPrivilege	4744	powershell.exe
Token: SeLoadDriverPrivilege	4744	powershell.exe
Token: SeSystemProfilePrivilege	4744	powershell.exe
Token: SeSystemtimePrivilege	4744	powershell.exe
Token: SeProfSingleProcessPrivilege	4744	powershell.exe
Token: SeIncBasePriorityPrivilege	4744	powershell.exe
Token: SeCreatePagefilePrivilege	4744	powershell.exe
Token: SeBackupPrivilege	4744	powershell.exe
Token: SeRestorePrivilege	4744	powershell.exe
Token: SeShutdownPrivilege	4744	powershell.exe
Token: SeDebugPrivilege	4744	powershell.exe
Token: SeSystemEnvironmentPrivilege	4744	powershell.exe
Token: SeRemoteShutdownPrivilege	4744	powershell.exe
Token: SeUndockPrivilege	4744	powershell.exe
Token: SeManageVolumePrivilege	4744	powershell.exe
Token: 33	4744	powershell.exe
Token: 34	4744	powershell.exe
Token: 35	4744	powershell.exe
Token: 36	4744	powershell.exe
Token: SeIncreaseQuotaPrivilege	5776	powershell.exe
Token: SeSecurityPrivilege	5776	powershell.exe
Token: SeTakeOwnershipPrivilege	5776	powershell.exe
Token: SeLoadDriverPrivilege	5776	powershell.exe
Token: SeSystemProfilePrivilege	5776	powershell.exe
Token: SeSystemtimePrivilege	5776	powershell.exe
Token: SeProfSingleProcessPrivilege	5776	powershell.exe
Token: SeIncBasePriorityPrivilege	5776	powershell.exe
Token: SeCreatePagefilePrivilege	5776	powershell.exe
Token: SeBackupPrivilege	5776	powershell.exe
Token: SeRestorePrivilege	5776	powershell.exe
Token: SeShutdownPrivilege	5776	powershell.exe
Token: SeDebugPrivilege	5776	powershell.exe
Token: SeSystemEnvironmentPrivilege	5776	powershell.exe
Token: SeRemoteShutdownPrivilege	5776	powershell.exe
Token: SeUndockPrivilege	5776	powershell.exe
Token: SeManageVolumePrivilege	5776	powershell.exe
Token: 33	5776	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5968	LogonUI.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 4148	4848	unlockall.exe	88
PID 4848 wrote to memory of 5640	4848	unlockall.exe	90
PID 4848 wrote to memory of 3544	4848	unlockall.exe	92
PID 3544 wrote to memory of 4232	3544	cmd.exe	94
PID 4848 wrote to memory of 4592	4848	unlockall.exe	95
PID 4592 wrote to memory of 932	4592	cmd.exe	97
PID 1936 wrote to memory of 1676	1936	SecurityHealthService.exe	104
PID 1924 wrote to memory of 2400	1924	SecurityHealthService.exe	105
PID 1924 wrote to memory of 3700	1924	SecurityHealthService.exe	106
PID 1936 wrote to memory of 1792	1936	SecurityHealthService.exe	108
PID 4848 wrote to memory of 5564	4848	unlockall.exe	110
PID 5564 wrote to memory of 1048	5564	cmd.exe	112
PID 1924 wrote to memory of 3204	1924	SecurityHealthService.exe	113
PID 1936 wrote to memory of 5860	1936	SecurityHealthService.exe	114
PID 4848 wrote to memory of 6048	4848	unlockall.exe	117
PID 5860 wrote to memory of 6044	5860	cmd.exe	119
PID 3204 wrote to memory of 2744	3204	cmd.exe	120
PID 6048 wrote to memory of 4744	6048	cmd.exe	121
PID 1936 wrote to memory of 1816	1936	SecurityHealthService.exe	122
PID 1924 wrote to memory of 624	1924	SecurityHealthService.exe	123
PID 1816 wrote to memory of 5776	1816	cmd.exe	126
PID 624 wrote to memory of 4244	624	cmd.exe	127
PID 4848 wrote to memory of 5116	4848	unlockall.exe	130
PID 5116 wrote to memory of 5752	5116	cmd.exe	132

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\unlockall.exe
"C:\Users\Admin\AppData\Local\Temp\unlockall.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Create /F /SC ONLOGON /TN "\Microsoft\Windows\Security\SecurityHealthService" /TR "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\SecurityHealthService.exe\"" /RL HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4148
- C:\Windows\SYSTEM32\wscript.exe
  wscript.exe "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AppReadiness\AppReadinessService.vbs"
  2⤵
  PID:5640
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c ipconfig /all
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3544
- - C:\Windows\system32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:4232
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell -NoProfile -Command "try { if ((Get-MpPreference).DisableRealtimeMonitoring -eq $false) { write-host 'ON' } else { write-host 'OFF' } } catch { write-host 'UNKNOWN' }"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4592
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "try { if ((Get-MpPreference).DisableRealtimeMonitoring -eq $false) { write-host 'ON' } else { write-host 'OFF' } } catch { write-host 'UNKNOWN' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:932
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c ipconfig /all
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5564
- - C:\Windows\system32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:1048
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell -NoProfile -Command "try { if ((Get-MpPreference).DisableRealtimeMonitoring -eq $false) { write-host 'ON' } else { write-host 'OFF' } } catch { write-host 'UNKNOWN' }"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6048
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "try { if ((Get-MpPreference).DisableRealtimeMonitoring -eq $false) { write-host 'ON' } else { write-host 'OFF' } } catch { write-host 'UNKNOWN' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4744
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c shutdown /r /t 0 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5116
- - C:\Windows\system32\shutdown.exe
    shutdown /r /t 0 /f
    3⤵
    PID:5752

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\SecurityHealthService.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\SecurityHealthService.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\System32\schtasks.exe
  schtasks /Create /F /SC ONLOGON /TN "\Microsoft\Windows\Security\SecurityHealthService" /TR "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\SecurityHealthService.exe\"" /RL HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2400
- C:\Windows\System32\wscript.exe
  wscript.exe "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AppReadiness\AppReadinessService.vbs"
  2⤵
  PID:3700
- C:\Windows\System32\cmd.exe
  cmd.exe /c ipconfig /all
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3204
- - C:\Windows\System32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:2744
- C:\Windows\System32\cmd.exe
  cmd.exe /c powershell -NoProfile -Command "try { if ((Get-MpPreference).DisableRealtimeMonitoring -eq $false) { write-host 'ON' } else { write-host 'OFF' } } catch { write-host 'UNKNOWN' }"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:624
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "try { if ((Get-MpPreference).DisableRealtimeMonitoring -eq $false) { write-host 'ON' } else { write-host 'OFF' } } catch { write-host 'UNKNOWN' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4244

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\SecurityHealthService.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\SecurityHealthService.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\System32\schtasks.exe
  schtasks /Create /F /SC ONLOGON /TN "\Microsoft\Windows\Security\SecurityHealthService" /TR "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\SecurityHealthService.exe\"" /RL HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1676
- C:\Windows\System32\wscript.exe
  wscript.exe "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AppReadiness\AppReadinessService.vbs"
  2⤵
  PID:1792
- C:\Windows\System32\cmd.exe
  cmd.exe /c ipconfig /all
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5860
- - C:\Windows\System32\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:6044
- C:\Windows\System32\cmd.exe
  cmd.exe /c powershell -NoProfile -Command "try { if ((Get-MpPreference).DisableRealtimeMonitoring -eq $false) { write-host 'ON' } else { write-host 'OFF' } } catch { write-host 'UNKNOWN' }"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1816
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "try { if ((Get-MpPreference).DisableRealtimeMonitoring -eq $false) { write-host 'ON' } else { write-host 'OFF' } } catch { write-host 'UNKNOWN' }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5776

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a2a855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1784

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:5784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

READ_ME.txt

Path C:\Users\Admin\AppData\Local\Adobe\READ_ME.txt
Size 600B
SHA256 1eec3adf6ac2861b7f048273bb1f7e0967cd02a459b4cf3c9ab4ffded216c319
MD5 f06cc1e84a091ce5772742be70325125
SHA1 363984202ed1de6237f6c8a2c5e371d6fcef1797
SHA512 32bc0cb5e07579e7937ee07caa09788283b33f5404f3573d597837db5040a94ad782845f5a307efa37e2b3378a9f9497f2dbb13fdbd716af4833b45ba0df9d3e
TLSH
T1BDF0AC9FBE5FE6A250D2205E359DA191FB55A66C2B2A43222C9D811D11502F3EAB30E8
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 435471b87a1a97b0e29f7d5dd0878e63031511f063629d7e750852c068e7c4f5
MD5 81b56f1dad28119d54bf23c83fc570b9
SHA1 cb9a89a716465611149ce3c700bd60681d434faf
SHA512 77bd4d53ca86d66d29ba662dd424e94e5cef46c6a460cbf9f8d87a40c627401c0f6d0fe30258c23ed1cf63df1a70b19288885a33c206fb85a19f12efaab61927
TLSH
T1F3216833B3DD8614C89A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 05a3138d9f2e0a01d89abfd90e281dc68c59b37f3240c9b376819dde06600d1c
MD5 22c5905f4afad44fdf583d80d32813f9
SHA1 2746963e649ab54757b4c96264a9113820b2a418
SHA512 e3bac9e825bc6668aa4ab6858d1ebbad43f8f85025c79529acf7db31ddb8cbe7c47bec8b818e75efaf156e4872aa5737c6b42d97a4df42ddb826a5c7603b4f1f
TLSH
T14E219833B3CC8624CC9A013A10CDAC1036B6C7CB40DECFAB7B80E655A43F698CE60160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 e6ccd04f26fc2d26a9664b367a7c1cf7a184cf7fbe7e711bd59f5965c9fcac7f
MD5 7723e548dee328d34dfb579a62c58157
SHA1 62b1dc118197b8db7fbacd7229e66d6a3bcd8e2f
SHA512 49557082a7bf18385ac0e06da814be2066f56f6bc8288b8c2a250005bb760482576191cdc0d39f1eab12a5638833ac6a67a5218071db1b0e5e87dc5bd6e1be32
TLSH
T167219833B3CC8624C89A413A10CDAC1036B6C7CB40DECFAB7B80E655A43F698DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_w34sso34.pbc.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_w34sso34.pbc.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

AppReadinessService.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AppReadiness\AppReadinessService.vbs
Size 748B
SHA256 e80c2c4728fc6809976c244b9ae7fccebc9ed82eb61cfb228008afd90efa2853
MD5 810a27b8dfb3f64a271be6898235887b
SHA1 4111b43919e7f3f3c934b61bd5a1edb1fcf10272
SHA512 2145903584f27e0f530a85628ce052d931f960591ffedffccfe3949c0f709cc5c0806bfa47173f7819b0a77e7832b395fd65f4aee561a42f2de37352df970ebe
TLSH
T133011009D555C934E871DC097138F10AE1662116B662D5BBFE4581CE9FB077CC608487
MD5 SHA1 SHA512 TLSH

Submit Download

SecurityHealthService.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\SecurityHealthService.exe
Size 9.2MB
SHA256 0b909c97aba0af87516cf00b6c1f801f3086f1e306e39cee002c789b214e4e98
MD5 1c14bf639f139cfca507a25c733bd275
SHA1 3666db337909ef59747855820d04a79c122bddc9
SHA512 ff9bb52dba94e9b9d4769370395e5b779d8599e5c1e37edbcd3fe9c4edc5bcc79887861f4f20a289d22c839825d94fe6a152c7dc58e28c8dc52a517cded2d48a
SSDEEP 98304:TM3LuygWEZAug/efGr4bJpmkKdqYCdFUzviVGE24RDejIXOT4LKdYCbc3Y+2CkP:TMiJZYfk2nULBCbPFXP
TLSH
T10DA61827ED6610DCC5EBC170825EAE73B931BA140137FEFA5A50DE701F21E521A6BB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/932-5-0x00000163E9E30000-0x00000163E9E52000-memory.dmp

Download

memory/932-9-0x00000163EA0F0000-0x00000163EA10E000-memory.dmp

Download

memory/932-11-0x00000163EA110000-0x00000163EA1C2000-memory.dmp

Download

memory/932-12-0x00000163E9ED0000-0x00000163E9EDA000-memory.dmp

Download

memory/1924-141-0x00007FF79EF70000-0x00007FF79F8BA000-memory.dmp

Download

memory/1924-144-0x00007FF79EF70000-0x00007FF79F8BA000-memory.dmp

Download

memory/1924-33-0x00007FF79EF70000-0x00007FF79F8BA000-memory.dmp

Download

memory/1924-148-0x00007FF79EF70000-0x00007FF79F8BA000-memory.dmp

Download

memory/1924-138-0x00007FF79EF70000-0x00007FF79F8BA000-memory.dmp

Download

memory/1924-135-0x00007FF79EF70000-0x00007FF79F8BA000-memory.dmp

Download

memory/1936-139-0x00007FF79EF70000-0x00007FF79F8BA000-memory.dmp

Download

memory/1936-136-0x00007FF79EF70000-0x00007FF79F8BA000-memory.dmp

Download

memory/1936-142-0x00007FF79EF70000-0x00007FF79F8BA000-memory.dmp

Download

memory/1936-34-0x00007FF79EF70000-0x00007FF79F8BA000-memory.dmp

Download

memory/1936-145-0x00007FF79EF70000-0x00007FF79F8BA000-memory.dmp

Download

memory/1936-147-0x00007FF79EF70000-0x00007FF79F8BA000-memory.dmp

Download

memory/4848-137-0x00007FF779820000-0x00007FF77A16A000-memory.dmp

Download

memory/4848-140-0x00007FF779820000-0x00007FF77A16A000-memory.dmp

Download

memory/4848-32-0x00007FF779820000-0x00007FF77A16A000-memory.dmp

Download

memory/4848-143-0x00007FF779820000-0x00007FF77A16A000-memory.dmp

Download

memory/4848-146-0x00007FF779820000-0x00007FF77A16A000-memory.dmp

Download

memory/4848-134-0x00007FF779820000-0x00007FF77A16A000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads