db29e8a8465bd7f89f0d16197411deae8afd55b63ba701de3465b4915de9c620

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 03:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_85673340369daeee5f2aa9c0a59ef114_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
Size 4.6MB
Sample260714-d45j3adv6m
SHA256 db29e8a8465bd7f89f0d16197411deae8afd55b63ba701de3465b4915de9c620
MD5 85673340369daeee5f2aa9c0a59ef114
SHA1 1fb2dd82ce9f88e9071958a99a4cc26e85e3fe22
SHA512 5115f054fb619d8386890a1435a77abe226cd028f1bdd26ef3cce46bdfc91287589fba53ed4fa1563dbe1f3fead9a6c239d7fddc8efd829bd9d63b3dfbab75b3
SSDEEP 98304:lMUqJLCXJzJLOWRnO3oOP2w/gGiAjRCEkAFop:l+1CX5bROtcAjup
TLSH
T12B26BF03F69250FDC01AC174875AA623FA71B8494B107EEB5790DB363E76AE06F39724
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery evasion execution persistence spyware stealer trojan

Malware Config

Signatures

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 2 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	svc_host.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	svc_host.exe

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c557-17.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c557-17.dat	INDICATOR_SUSPICIOUS_EXE_SandboxHookingDLL

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c557-17.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c557-17.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Detects executables referencing many IR and analysis tools 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c557-17.dat	INDICATOR_SUSPICIOUS_References_SecTools

Command and Scripting Interpreter: PowerShell 1 TTPs 14 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1236	powershell.exe
1248	powershell.exe
264	powershell.exe
2408	powershell.exe
5784	powershell.exe
2700	powershell.exe
3404	powershell.exe
3544	powershell.exe
1236	powershell.exe
1248	powershell.exe
264	powershell.exe
2408	powershell.exe
5784	powershell.exe
2700	powershell.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 4 IoCs

pid	Process
6084	Quantum Entropy Candle.exe
5936	svc_host.exe
5240	svc_host.exe
2344	OSK4RRVUpdate.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\OSK4RRVUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\osk4rrv_240759500\\svc_host.exe"	svc_host.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\OSK4RRVUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\OSK4RRVUpdate.exe"	svc_host.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\OSK4RRVUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\osk4rrv_240759500\\svc_host.exe"	svc_host.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\OSK4RRVUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\OSK4RRVUpdate.exe"	svc_host.exe

Looks up external IP address via web service 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
5	api.ipify.org
8	api.ipify.org
10	api.ipify.org
11	api.ipify.org
1	api.ipify.org

Launches sc.exe 64 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6024	sc.exe
1548	sc.exe
2864	sc.exe
5040	sc.exe
5888	sc.exe
5528	sc.exe
2084	sc.exe
4764	sc.exe
4084	sc.exe
3016	sc.exe
3040	sc.exe
4256	sc.exe
4604	sc.exe
4592	sc.exe
3352	sc.exe
2516	sc.exe
1132	sc.exe
2492	sc.exe
5168	sc.exe
5204	sc.exe
3952	sc.exe
2332	sc.exe
5532	sc.exe
3204	sc.exe
5024	sc.exe
1148	sc.exe
4536	sc.exe
4608	sc.exe
4776	sc.exe
4920	sc.exe
2696	sc.exe
2648	sc.exe
5280	sc.exe
4668	sc.exe
5600	sc.exe
2620	sc.exe
5928	sc.exe
3116	sc.exe
2864	sc.exe
5540	sc.exe
3892	sc.exe
4384	sc.exe
5728	sc.exe
5892	sc.exe
2028	sc.exe
1780	sc.exe
1336	sc.exe
1252	sc.exe
3964	sc.exe
108	sc.exe
940	sc.exe
3868	sc.exe
2916	sc.exe
5440	sc.exe
1732	sc.exe
2260	sc.exe
900	sc.exe
5900	sc.exe
3760	sc.exe
5384	sc.exe
1712	sc.exe
5624	sc.exe
4748	sc.exe
5124	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
5936	svc_host.exe
5936	svc_host.exe
1236	powershell.exe
1236	powershell.exe
1248	powershell.exe
1248	powershell.exe
264	powershell.exe
264	powershell.exe
5936	svc_host.exe
5936	svc_host.exe
5936	svc_host.exe
5936	svc_host.exe
5240	svc_host.exe
5240	svc_host.exe
2408	powershell.exe
2408	powershell.exe
5784	powershell.exe
5784	powershell.exe
2700	powershell.exe
2700	powershell.exe
5240	svc_host.exe
5240	svc_host.exe
5240	svc_host.exe
5240	svc_host.exe
5936	svc_host.exe
5936	svc_host.exe
5240	svc_host.exe
5240	svc_host.exe
3404	powershell.exe
3404	powershell.exe
3404	powershell.exe
3544	powershell.exe
3544	powershell.exe
3544	powershell.exe
5936	svc_host.exe
5936	svc_host.exe
5936	svc_host.exe
5936	svc_host.exe
5240	svc_host.exe
5240	svc_host.exe
5240	svc_host.exe
5240	svc_host.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1236	powershell.exe
Token: SeIncreaseQuotaPrivilege	1236	powershell.exe
Token: SeSecurityPrivilege	1236	powershell.exe
Token: SeTakeOwnershipPrivilege	1236	powershell.exe
Token: SeLoadDriverPrivilege	1236	powershell.exe
Token: SeSystemProfilePrivilege	1236	powershell.exe
Token: SeSystemtimePrivilege	1236	powershell.exe
Token: SeProfSingleProcessPrivilege	1236	powershell.exe
Token: SeIncBasePriorityPrivilege	1236	powershell.exe
Token: SeCreatePagefilePrivilege	1236	powershell.exe
Token: SeBackupPrivilege	1236	powershell.exe
Token: SeRestorePrivilege	1236	powershell.exe
Token: SeShutdownPrivilege	1236	powershell.exe
Token: SeDebugPrivilege	1236	powershell.exe
Token: SeSystemEnvironmentPrivilege	1236	powershell.exe
Token: SeRemoteShutdownPrivilege	1236	powershell.exe
Token: SeUndockPrivilege	1236	powershell.exe
Token: SeManageVolumePrivilege	1236	powershell.exe
Token: 33	1236	powershell.exe
Token: 34	1236	powershell.exe
Token: 35	1236	powershell.exe
Token: 36	1236	powershell.exe
Token: SeIncreaseQuotaPrivilege	1236	powershell.exe
Token: SeSecurityPrivilege	1236	powershell.exe
Token: SeTakeOwnershipPrivilege	1236	powershell.exe
Token: SeLoadDriverPrivilege	1236	powershell.exe
Token: SeSystemProfilePrivilege	1236	powershell.exe
Token: SeSystemtimePrivilege	1236	powershell.exe
Token: SeProfSingleProcessPrivilege	1236	powershell.exe
Token: SeIncBasePriorityPrivilege	1236	powershell.exe
Token: SeCreatePagefilePrivilege	1236	powershell.exe
Token: SeBackupPrivilege	1236	powershell.exe
Token: SeRestorePrivilege	1236	powershell.exe
Token: SeShutdownPrivilege	1236	powershell.exe
Token: SeDebugPrivilege	1236	powershell.exe
Token: SeSystemEnvironmentPrivilege	1236	powershell.exe
Token: SeRemoteShutdownPrivilege	1236	powershell.exe
Token: SeUndockPrivilege	1236	powershell.exe
Token: SeManageVolumePrivilege	1236	powershell.exe
Token: 33	1236	powershell.exe
Token: 34	1236	powershell.exe
Token: 35	1236	powershell.exe
Token: 36	1236	powershell.exe
Token: SeDebugPrivilege	1248	powershell.exe
Token: SeIncreaseQuotaPrivilege	1248	powershell.exe
Token: SeSecurityPrivilege	1248	powershell.exe
Token: SeTakeOwnershipPrivilege	1248	powershell.exe
Token: SeLoadDriverPrivilege	1248	powershell.exe
Token: SeSystemProfilePrivilege	1248	powershell.exe
Token: SeSystemtimePrivilege	1248	powershell.exe
Token: SeProfSingleProcessPrivilege	1248	powershell.exe
Token: SeIncBasePriorityPrivilege	1248	powershell.exe
Token: SeCreatePagefilePrivilege	1248	powershell.exe
Token: SeBackupPrivilege	1248	powershell.exe
Token: SeRestorePrivilege	1248	powershell.exe
Token: SeShutdownPrivilege	1248	powershell.exe
Token: SeDebugPrivilege	1248	powershell.exe
Token: SeSystemEnvironmentPrivilege	1248	powershell.exe
Token: SeRemoteShutdownPrivilege	1248	powershell.exe
Token: SeUndockPrivilege	1248	powershell.exe
Token: SeManageVolumePrivilege	1248	powershell.exe
Token: 33	1248	powershell.exe
Token: 34	1248	powershell.exe
Token: 35	1248	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 6084	1208	2026-07-14_85673340369daeee5f2aa9c0a59ef114_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe	88
PID 1208 wrote to memory of 5936	1208	2026-07-14_85673340369daeee5f2aa9c0a59ef114_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe	89
PID 5936 wrote to memory of 1236	5936	svc_host.exe	180
PID 5936 wrote to memory of 1248	5936	svc_host.exe	93
PID 5936 wrote to memory of 264	5936	svc_host.exe	254
PID 5936 wrote to memory of 5540	5936	svc_host.exe	97
PID 5936 wrote to memory of 4668	5936	svc_host.exe	99
PID 5936 wrote to memory of 2260	5936	svc_host.exe	190
PID 5936 wrote to memory of 4608	5936	svc_host.exe	103
PID 5936 wrote to memory of 2864	5936	svc_host.exe	279
PID 5936 wrote to memory of 4108	5936	svc_host.exe	107
PID 5936 wrote to memory of 5280	5936	svc_host.exe	109
PID 5936 wrote to memory of 5368	5936	svc_host.exe	111
PID 5936 wrote to memory of 1732	5936	svc_host.exe	113
PID 5936 wrote to memory of 3116	5936	svc_host.exe	115
PID 5936 wrote to memory of 4748	5936	svc_host.exe	117
PID 5936 wrote to memory of 2512	5936	svc_host.exe	119
PID 5936 wrote to memory of 2084	5936	svc_host.exe	121
PID 5936 wrote to memory of 3204	5936	svc_host.exe	123
PID 5936 wrote to memory of 3952	5936	svc_host.exe	125
PID 5936 wrote to memory of 5624	5936	svc_host.exe	127
PID 5936 wrote to memory of 5040	5936	svc_host.exe	129
PID 5936 wrote to memory of 2648	5936	svc_host.exe	131
PID 5936 wrote to memory of 1892	5936	svc_host.exe	133
PID 5936 wrote to memory of 2028	5936	svc_host.exe	135
PID 5936 wrote to memory of 1712	5936	svc_host.exe	137
PID 5936 wrote to memory of 5532	5936	svc_host.exe	139
PID 5936 wrote to memory of 4104	5936	svc_host.exe	141
PID 5936 wrote to memory of 5424	5936	svc_host.exe	143
PID 5936 wrote to memory of 5440	5936	svc_host.exe	145
PID 5936 wrote to memory of 3352	5936	svc_host.exe	147
PID 5936 wrote to memory of 3040	5936	svc_host.exe	149
PID 5936 wrote to memory of 5796	5936	svc_host.exe	151
PID 5936 wrote to memory of 3528	5936	svc_host.exe	153
PID 5936 wrote to memory of 2332	5936	svc_host.exe	155
PID 5936 wrote to memory of 4196	5936	svc_host.exe	157
PID 5936 wrote to memory of 5384	5936	svc_host.exe	159
PID 5936 wrote to memory of 5168	5936	svc_host.exe	161
PID 5936 wrote to memory of 5928	5936	svc_host.exe	163
PID 5936 wrote to memory of 5628	5936	svc_host.exe	165
PID 5936 wrote to memory of 5528	5936	svc_host.exe	167
PID 5936 wrote to memory of 3232	5936	svc_host.exe	169
PID 5936 wrote to memory of 2916	5936	svc_host.exe	171
PID 5936 wrote to memory of 3760	5936	svc_host.exe	173
PID 5936 wrote to memory of 5900	5936	svc_host.exe	175
PID 5936 wrote to memory of 1136	5936	svc_host.exe	177
PID 5936 wrote to memory of 4384	5936	svc_host.exe	179
PID 5936 wrote to memory of 3868	5936	svc_host.exe	181
PID 5936 wrote to memory of 5888	5936	svc_host.exe	183
PID 5240 wrote to memory of 2408	5240	svc_host.exe	189
PID 5240 wrote to memory of 5784	5240	svc_host.exe	191
PID 5240 wrote to memory of 2700	5240	svc_host.exe	193
PID 5240 wrote to memory of 1780	5240	svc_host.exe	195
PID 5240 wrote to memory of 6024	5240	svc_host.exe	197
PID 5240 wrote to memory of 5728	5240	svc_host.exe	199
PID 5240 wrote to memory of 4256	5240	svc_host.exe	201
PID 5240 wrote to memory of 1336	5240	svc_host.exe	203
PID 5240 wrote to memory of 4268	5240	svc_host.exe	205
PID 5240 wrote to memory of 4604	5240	svc_host.exe	207
PID 5240 wrote to memory of 5600	5240	svc_host.exe	209
PID 5240 wrote to memory of 3812	5240	svc_host.exe	211
PID 5240 wrote to memory of 1252	5240	svc_host.exe	213
PID 5240 wrote to memory of 3860	5240	svc_host.exe	215
PID 5240 wrote to memory of 4776	5240	svc_host.exe	217

C:\Users\Admin\AppData\Local\Temp\2026-07-14_85673340369daeee5f2aa9c0a59ef114_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_85673340369daeee5f2aa9c0a59ef114_akira_icedid_luca-stealer_njrat_rusty-stealer_stealc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Users\Admin\AppData\Local\Temp\osk4rrv_240759500\Quantum Entropy Candle.exe
  "C:\Users\Admin\AppData\Local\Temp\osk4rrv_240759500\Quantum Entropy Candle.exe"
  2⤵
  - Executes dropped EXE
  PID:6084
- C:\Users\Admin\AppData\Local\Temp\osk4rrv_240759500\svc_host.exe
  "C:\Users\Admin\AppData\Local\Temp\osk4rrv_240759500\svc_host.exe"
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5936
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath '" + std::string(dirs[i]) + "' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionProcess '" + std::string(dirs[i]) + "' -ErrorAction SilentlyContinue"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1236
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath '" + std::string(dirs[i]) + "' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionProcess '" + std::string(dirs[i]) + "' -ErrorAction SilentlyContinue"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1248
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath '" + std::string(dirs[i]) + "' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionProcess '" + std::string(dirs[i]) + "' -ErrorAction SilentlyContinue"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:264
- - C:\Windows\SYSTEM32\sc.exe
    sc stop "WinDefend"
    3⤵
    - Launches sc.exe
    PID:5540
- - C:\Windows\SYSTEM32\sc.exe
    sc config "WinDefend" start= disabled
    3⤵
    - Launches sc.exe
    PID:4668
- - C:\Windows\SYSTEM32\sc.exe
    sc stop "WdNisSvc"
    3⤵
    - Launches sc.exe
    PID:2260
- - C:\Windows\SYSTEM32\sc.exe
    sc config "WdNisSvc" start= disabled
    3⤵
    - Launches sc.exe
    PID:4608
- - C:\Windows\SYSTEM32\sc.exe
    sc stop "Sense"
    3⤵
    - Launches sc.exe
    PID:2864
- - C:\Windows\SYSTEM32\sc.exe
    sc config "Sense" start= disabled
    3⤵
    PID:4108
- - C:\Windows\SYSTEM32\sc.exe
    sc stop "WdBoot"
    3⤵
    - Launches sc.exe
    PID:5280
- - C:\Windows\SYSTEM32\sc.exe
    sc config "WdBoot" start= disabled
    3⤵
    PID:5368
- - C:\Windows\SYSTEM32\sc.exe
    sc stop "MBAMService"
    3⤵
    - Launches sc.exe
    PID:1732
- - C:\Windows\SYSTEM32\sc.exe
    sc config "MBAMService" start= disabled
    3⤵
    - Launches sc.exe
    PID:3116
- - C:\Windows\SYSTEM32\sc.exe
    sc stop "McAfeeDLPAgentService"
    3⤵
    - Launches sc.exe
    PID:4748
- - C:\Windows\SYSTEM32\sc.exe
    sc config "McAfeeDLPAgentService" start= disabled
    3⤵
    PID:2512
- - C:\Windows\SYSTEM32\sc.exe
    sc stop "AVP16.0.0"
    3⤵
    - Launches sc.exe
    PID:2084
- - C:\Windows\SYSTEM32\sc.exe
    sc config "AVP16.0.0" start= disabled
    3⤵
    - Launches sc.exe
    PID:3204
- - C:\Windows\SYSTEM32\sc.exe
    sc stop "kavfs"
    3⤵
    - Launches sc.exe
    PID:3952
- - C:\Windows\SYSTEM32\sc.exe
    sc config "kavfs" start= disabled
    3⤵
    - Launches sc.exe
    PID:5624
- - C:\Windows\SYSTEM32\sc.exe
    sc stop "kavfss"
    3⤵
    - Launches sc.exe
    PID:5040
- - C:\Windows\SYSTEM32\sc.exe
    sc config "kavfss" start= disabled
    3⤵
    - Launches sc.exe
    PID:2648
- - C:\Windows\SYSTEM32\sc.exe
    sc stop "avgsvc"
    3⤵
    PID:1892
- - C:\Windows\SYSTEM32\sc.exe
    sc config "avgsvc" start= disabled
    3⤵
    - Launches sc.exe
    PID:2028
- - C:\Windows\SYSTEM32\sc.exe
    sc stop "AVG Service"
    3⤵
    - Launches sc.exe
    PID:1712
- - C:\Windows\SYSTEM32\sc.exe
    sc config "AVG Service" start= disabled
    3⤵
    - Launches sc.exe
    PID:5532
- - C:\Windows\SYSTEM32\sc.exe
    sc stop "bdagent"
    3⤵
    PID:4104
- - C:\Windows\SYSTEM32\sc.exe
    sc config "bdagent" start= disabled
    3⤵
    PID:5424
- - C:\Windows\SYSTEM32\sc.exe
    sc stop "vsserv"
    3⤵
    - Launches sc.exe
    PID:5440
- - C:\Windows\SYSTEM32\sc.exe
    sc config "vsserv" start= disabled
    3⤵
    - Launches sc.exe
    PID:3352
- - C:\Windows\SYSTEM32\sc.exe
    sc stop "fsma32"
    3⤵
    - Launches sc.exe
    PID:3040
- - C:\Windows\SYSTEM32\sc.exe
    sc config "fsma32" start= disabled
    3⤵
    PID:5796
- - C:\Windows\SYSTEM32\sc.exe
    sc stop "f-secure"
    3⤵
    PID:3528
- - C:\Windows\SYSTEM32\sc.exe
    sc config "f-secure" start= disabled
    3⤵
    - Launches sc.exe
    PID:2332
- - C:\Windows\SYSTEM32\sc.exe
    sc stop "clamd"
    3⤵
    PID:4196
- - C:\Windows\SYSTEM32\sc.exe
    sc config "clamd" start= disabled
    3⤵
    - Launches sc.exe
    PID:5384
- - C:\Windows\SYSTEM32\sc.exe
    sc stop "ClamWin"
    3⤵
    - Launches sc.exe
    PID:5168
- - C:\Windows\SYSTEM32\sc.exe
    sc config "ClamWin" start= disabled
    3⤵
    - Launches sc.exe
    PID:5928
- - C:\Windows\SYSTEM32\sc.exe
    sc stop "savservice"
    3⤵
    PID:5628
- - C:\Windows\SYSTEM32\sc.exe
    sc config "savservice" start= disabled
    3⤵
    - Launches sc.exe
    PID:5528
- - C:\Windows\SYSTEM32\sc.exe
    sc stop "Sophos Agent"
    3⤵
    PID:3232
- - C:\Windows\SYSTEM32\sc.exe
    sc config "Sophos Agent" start= disabled
    3⤵
    - Launches sc.exe
    PID:2916
- - C:\Windows\SYSTEM32\sc.exe
    sc stop "tmbmsrv"
    3⤵
    - Launches sc.exe
    PID:3760
- - C:\Windows\SYSTEM32\sc.exe
    sc config "tmbmsrv" start= disabled
    3⤵
    - Launches sc.exe
    PID:5900
- - C:\Windows\SYSTEM32\sc.exe
    sc stop "HouseCall"
    3⤵
    PID:1136
- - C:\Windows\SYSTEM32\sc.exe
    sc config "HouseCall" start= disabled
    3⤵
    - Launches sc.exe
    PID:4384
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1236
- - C:\Windows\SYSTEM32\sc.exe
    sc stop "zaservice"
    3⤵
    - Launches sc.exe
    PID:3868
- - C:\Windows\SYSTEM32\sc.exe
    sc config "zaservice" start= disabled
    3⤵
    - Launches sc.exe
    PID:5888
- - C:\Program Files\7-Zip\7z.exe
    "C:\Program Files\7-Zip\7z.exe" a -r -p"B5j1yN3K88" -mhe=off "C:\Users\Admin\AppData\Local\Temp\osk4rrv_data_240791500.zip" *
    3⤵
    PID:908
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -WindowStyle Hidden -Command "Compress-Archive -Path * -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\osk4rrv_data_240791500.zip' -Force"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3404

C:\Users\Admin\AppData\Local\Temp\osk4rrv_240759500\svc_host.exe
C:\Users\Admin\AppData\Local\Temp\osk4rrv_240759500\svc_host.exe
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5240
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath '" + std::string(dirs[i]) + "' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionProcess '" + std::string(dirs[i]) + "' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2408
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2260
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath '" + std::string(dirs[i]) + "' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionProcess '" + std::string(dirs[i]) + "' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5784
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath '" + std::string(dirs[i]) + "' -ErrorAction SilentlyContinue; Add-MpPreference -ExclusionProcess '" + std::string(dirs[i]) + "' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2700
- C:\Windows\SYSTEM32\sc.exe
  sc stop "WinDefend"
  2⤵
  - Launches sc.exe
  PID:1780
- C:\Windows\SYSTEM32\sc.exe
  sc config "WinDefend" start= disabled
  2⤵
  - Launches sc.exe
  PID:6024
- C:\Windows\SYSTEM32\sc.exe
  sc stop "WdNisSvc"
  2⤵
  - Launches sc.exe
  PID:5728
- C:\Windows\SYSTEM32\sc.exe
  sc config "WdNisSvc" start= disabled
  2⤵
  - Launches sc.exe
  PID:4256
- C:\Windows\SYSTEM32\sc.exe
  sc stop "Sense"
  2⤵
  - Launches sc.exe
  PID:1336
- C:\Windows\SYSTEM32\sc.exe
  sc config "Sense" start= disabled
  2⤵
  PID:4268
- C:\Windows\SYSTEM32\sc.exe
  sc stop "WdBoot"
  2⤵
  - Launches sc.exe
  PID:4604
- C:\Windows\SYSTEM32\sc.exe
  sc config "WdBoot" start= disabled
  2⤵
  - Launches sc.exe
  PID:5600
- C:\Windows\SYSTEM32\sc.exe
  sc stop "MBAMService"
  2⤵
  PID:3812
- C:\Windows\SYSTEM32\sc.exe
  sc config "MBAMService" start= disabled
  2⤵
  - Launches sc.exe
  PID:1252
- C:\Windows\SYSTEM32\sc.exe
  sc stop "McAfeeDLPAgentService"
  2⤵
  PID:3860
- C:\Windows\SYSTEM32\sc.exe
  sc config "McAfeeDLPAgentService" start= disabled
  2⤵
  - Launches sc.exe
  PID:4776
- C:\Windows\SYSTEM32\sc.exe
  sc stop "AVP16.0.0"
  2⤵
  PID:1832
- C:\Windows\SYSTEM32\sc.exe
  sc config "AVP16.0.0" start= disabled
  2⤵
  PID:4332
- C:\Windows\SYSTEM32\sc.exe
  sc stop "kavfs"
  2⤵
  PID:3128
- C:\Windows\SYSTEM32\sc.exe
  sc config "kavfs" start= disabled
  2⤵
  - Launches sc.exe
  PID:3964
- C:\Windows\SYSTEM32\sc.exe
  sc stop "kavfss"
  2⤵
  - Launches sc.exe
  PID:108
- C:\Windows\SYSTEM32\sc.exe
  sc config "kavfss" start= disabled
  2⤵
  - Launches sc.exe
  PID:4764
- C:\Windows\SYSTEM32\sc.exe
  sc stop "avgsvc"
  2⤵
  - Launches sc.exe
  PID:2516
- C:\Windows\SYSTEM32\sc.exe
  sc config "avgsvc" start= disabled
  2⤵
  - Launches sc.exe
  PID:5892
- C:\Windows\SYSTEM32\sc.exe
  sc stop "AVG Service"
  2⤵
  PID:5948
- C:\Windows\SYSTEM32\sc.exe
  sc config "AVG Service" start= disabled
  2⤵
  - Launches sc.exe
  PID:5024
- C:\Windows\SYSTEM32\sc.exe
  sc stop "bdagent"
  2⤵
  - Launches sc.exe
  PID:1148
- C:\Windows\SYSTEM32\sc.exe
  sc config "bdagent" start= disabled
  2⤵
  - Launches sc.exe
  PID:4920
- C:\Windows\SYSTEM32\sc.exe
  sc stop "vsserv"
  2⤵
  PID:5640
- C:\Windows\SYSTEM32\sc.exe
  sc config "vsserv" start= disabled
  2⤵
  - Launches sc.exe
  PID:5204
- C:\Windows\SYSTEM32\sc.exe
  sc stop "fsma32"
  2⤵
  PID:6132
- C:\Windows\SYSTEM32\sc.exe
  sc config "fsma32" start= disabled
  2⤵
  PID:3708
- C:\Windows\SYSTEM32\sc.exe
  sc stop "f-secure"
  2⤵
  - Launches sc.exe
  PID:4536
- C:\Windows\SYSTEM32\sc.exe
  sc config "f-secure" start= disabled
  2⤵
  - Launches sc.exe
  PID:5124
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:264
- C:\Windows\SYSTEM32\sc.exe
  sc stop "clamd"
  2⤵
  - Launches sc.exe
  PID:2620
- C:\Windows\SYSTEM32\sc.exe
  sc config "clamd" start= disabled
  2⤵
  - Launches sc.exe
  PID:2696
- C:\Windows\SYSTEM32\sc.exe
  sc stop "ClamWin"
  2⤵
  - Launches sc.exe
  PID:1132
- C:\Windows\SYSTEM32\sc.exe
  sc config "ClamWin" start= disabled
  2⤵
  PID:5720
- C:\Windows\SYSTEM32\sc.exe
  sc stop "savservice"
  2⤵
  - Launches sc.exe
  PID:4084
- C:\Windows\SYSTEM32\sc.exe
  sc config "savservice" start= disabled
  2⤵
  - Launches sc.exe
  PID:900
- C:\Windows\SYSTEM32\sc.exe
  sc stop "Sophos Agent"
  2⤵
  - Launches sc.exe
  PID:4592
- C:\Windows\SYSTEM32\sc.exe
  sc config "Sophos Agent" start= disabled
  2⤵
  - Launches sc.exe
  PID:3892
- C:\Windows\SYSTEM32\sc.exe
  sc stop "tmbmsrv"
  2⤵
  - Launches sc.exe
  PID:940
- C:\Windows\SYSTEM32\sc.exe
  sc config "tmbmsrv" start= disabled
  2⤵
  PID:5388
- C:\Windows\SYSTEM32\sc.exe
  sc stop "HouseCall"
  2⤵
  - Launches sc.exe
  PID:1548
- C:\Windows\SYSTEM32\sc.exe
  sc config "HouseCall" start= disabled
  2⤵
  - Launches sc.exe
  PID:2492
- C:\Windows\SYSTEM32\sc.exe
  sc stop "zaservice"
  2⤵
  - Launches sc.exe
  PID:2864
- C:\Windows\SYSTEM32\sc.exe
  sc config "zaservice" start= disabled
  2⤵
  - Launches sc.exe
  PID:3016
- C:\Program Files\7-Zip\7z.exe
  "C:\Program Files\7-Zip\7z.exe" a -r -p"rI2WRlSs0E" -mhe=off "C:\Users\Admin\AppData\Local\Temp\osk4rrv_data_240795312.zip" *
  2⤵
  PID:4800
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4332
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -WindowStyle Hidden -Command "Compress-Archive -Path * -DestinationPath 'C:\Users\Admin\AppData\Local\Temp\osk4rrv_data_240795312.zip' -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3544

C:\Users\Admin\AppData\Roaming\OSK4RRVUpdate.exe
C:\Users\Admin\AppData\Roaming\OSK4RRVUpdate.exe
1⤵
- Executes dropped EXE
PID:2344

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004EC 0x00000000000004E8
1⤵
PID:2432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489