ab1ce68402465263b86581b371aaaa09bee9ca3df19ee3471a090829faf1c762

Analysis

max time kernel
148s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 05:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ab1ce68402465263b86581b371aaaa09bee9ca3df19ee3471a090829faf1c762.exe
Size 1.9MB
Sample260715-fxfcpsct6k
SHA256 ab1ce68402465263b86581b371aaaa09bee9ca3df19ee3471a090829faf1c762
MD5 94effb7d923cfab3cff6856d4e199dcb
SHA1 93fb0fdec312d5f1476b8a680d196bdcedc002ec
SHA512 fee708f1724907076e98a6db7d5174c65b9e60471eea0b0214e919277f5c236007afbe2a18e72b4327490cf364eec269092af3d192cff388084ec1fa80afd012
SSDEEP 49152:exXXm66O7Mr92ZT2X8OEaZKSEohy/SsDlMCsdbFqZ3:exHX7Mrc52XxEaZHEoMVDqvqt
TLSH
T1D095CF13B2CB653FF07E8A364977E212593BBA6165124C679BF8086CCF260D41E3F646
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution installer spyware stealer

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
4164	ab1ce68402465263b86581b371aaaa09bee9ca3df19ee3471a090829faf1c762.tmp
820	MicrosoftPhotos.exe
5544	MicrosoftPhotos.exe

Loads dropped DLL 2 IoCs

pid	Process
4164	ab1ce68402465263b86581b371aaaa09bee9ca3df19ee3471a090829faf1c762.tmp
1728	rundll32.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	MicrosoftPhotos.exe
File opened (read-only)	\??\O:	MicrosoftPhotos.exe
File opened (read-only)	\??\B:	MicrosoftPhotos.exe
File opened (read-only)	\??\G:	MicrosoftPhotos.exe
File opened (read-only)	\??\H:	MicrosoftPhotos.exe
File opened (read-only)	\??\J:	MicrosoftPhotos.exe
File opened (read-only)	\??\X:	MicrosoftPhotos.exe
File opened (read-only)	\??\Y:	MicrosoftPhotos.exe
File opened (read-only)	\??\Q:	MicrosoftPhotos.exe
File opened (read-only)	\??\R:	MicrosoftPhotos.exe
File opened (read-only)	\??\T:	MicrosoftPhotos.exe
File opened (read-only)	\??\V:	MicrosoftPhotos.exe
File opened (read-only)	\??\W:	MicrosoftPhotos.exe
File opened (read-only)	\??\N:	MicrosoftPhotos.exe
File opened (read-only)	\??\P:	MicrosoftPhotos.exe
File opened (read-only)	\??\D:	MicrosoftPhotos.exe
File opened (read-only)	\??\I:	MicrosoftPhotos.exe
File opened (read-only)	\??\K:	MicrosoftPhotos.exe
File opened (read-only)	\??\M:	MicrosoftPhotos.exe
File opened (read-only)	\??\S:	MicrosoftPhotos.exe
File opened (read-only)	\??\U:	MicrosoftPhotos.exe
File opened (read-only)	\??\L:	MicrosoftPhotos.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api64.ipify.org

Enumerates processes with tasklist 1 TTPs 31 IoCs

discovery

Process Discovery

T1057

pid	Process
5488	tasklist.exe
2432	tasklist.exe
3584	tasklist.exe
4852	tasklist.exe
2504	tasklist.exe
6064	tasklist.exe
4852	tasklist.exe
4240	tasklist.exe
5332	tasklist.exe
5848	tasklist.exe
3292	tasklist.exe
5784	tasklist.exe
2452	tasklist.exe
1276	tasklist.exe
5312	tasklist.exe
932	tasklist.exe
704	tasklist.exe
2828	tasklist.exe
2940	tasklist.exe
1524	tasklist.exe
4468	tasklist.exe
3740	tasklist.exe
5524	tasklist.exe
1232	tasklist.exe
5924	tasklist.exe
3004	tasklist.exe
1216	tasklist.exe
2000	tasklist.exe
5320	tasklist.exe
4464	tasklist.exe
4872	tasklist.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\u.bat	MicrosoftPhotos.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3464	sc.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4196	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ab1ce68402465263b86581b371aaaa09bee9ca3df19ee3471a090829faf1c762.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftPhotos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/1948-0-0x0000000000520000-0x00000000005F8000-memory.dmp	innosetup
behavioral2/memory/1948-19-0x0000000000520000-0x00000000005F8000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MicrosoftPhotos.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MicrosoftPhotos.exe

Delays execution with timeout.exe 31 IoCs

defense_evasion

pid	Process
6060	timeout.exe
2940	timeout.exe
2176	timeout.exe
412	timeout.exe
5456	timeout.exe
3228	timeout.exe
3520	timeout.exe
3412	timeout.exe
1908	timeout.exe
4940	timeout.exe
4644	timeout.exe
3728	timeout.exe
752	timeout.exe
4164	timeout.exe
3488	timeout.exe
5408	timeout.exe
1428	timeout.exe
1208	timeout.exe
3828	timeout.exe
5108	timeout.exe
3516	timeout.exe
1032	timeout.exe
4972	timeout.exe
4376	timeout.exe
1368	timeout.exe
3524	timeout.exe
2796	timeout.exe
1376	timeout.exe
2256	timeout.exe
5940	timeout.exe
3040	timeout.exe

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
2452	taskkill.exe
4484	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4164	ab1ce68402465263b86581b371aaaa09bee9ca3df19ee3471a090829faf1c762.tmp
4164	ab1ce68402465263b86581b371aaaa09bee9ca3df19ee3471a090829faf1c762.tmp
5544	MicrosoftPhotos.exe
5544	MicrosoftPhotos.exe
5544	MicrosoftPhotos.exe
5544	MicrosoftPhotos.exe
5544	MicrosoftPhotos.exe
5544	MicrosoftPhotos.exe
5544	MicrosoftPhotos.exe
5544	MicrosoftPhotos.exe
5544	MicrosoftPhotos.exe
5544	MicrosoftPhotos.exe
5544	MicrosoftPhotos.exe
5544	MicrosoftPhotos.exe
4196	powershell.exe
4196	powershell.exe
5544	MicrosoftPhotos.exe
5544	MicrosoftPhotos.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

description	pid	Process
Token: SeDebugPrivilege	4196	powershell.exe
Token: SeDebugPrivilege	2452	taskkill.exe
Token: SeDebugPrivilege	2940	tasklist.exe
Token: SeDebugPrivilege	1524	tasklist.exe
Token: SeDebugPrivilege	3584	tasklist.exe
Token: SeDebugPrivilege	5332	tasklist.exe
Token: SeDebugPrivilege	5488	tasklist.exe
Token: SeDebugPrivilege	1276	tasklist.exe
Token: SeDebugPrivilege	4852	tasklist.exe
Token: SeDebugPrivilege	5320	tasklist.exe
Token: SeDebugPrivilege	5848	tasklist.exe
Token: SeDebugPrivilege	5312	tasklist.exe
Token: SeDebugPrivilege	3292	tasklist.exe
Token: SeDebugPrivilege	2504	tasklist.exe
Token: SeDebugPrivilege	5924	tasklist.exe
Token: SeDebugPrivilege	3004	tasklist.exe
Token: SeDebugPrivilege	4468	tasklist.exe
Token: SeDebugPrivilege	6064	tasklist.exe
Token: SeDebugPrivilege	5784	tasklist.exe
Token: SeDebugPrivilege	1216	tasklist.exe
Token: SeDebugPrivilege	3740	tasklist.exe
Token: SeDebugPrivilege	5524	tasklist.exe
Token: SeDebugPrivilege	2000	tasklist.exe
Token: SeDebugPrivilege	2452	tasklist.exe
Token: SeDebugPrivilege	932	tasklist.exe
Token: SeDebugPrivilege	704	tasklist.exe
Token: SeDebugPrivilege	2828	tasklist.exe
Token: SeDebugPrivilege	4464	tasklist.exe
Token: SeDebugPrivilege	4872	tasklist.exe
Token: SeDebugPrivilege	1232	tasklist.exe
Token: SeDebugPrivilege	4852	tasklist.exe
Token: SeDebugPrivilege	2432	tasklist.exe
Token: SeDebugPrivilege	4240	tasklist.exe
Token: SeDebugPrivilege	4484	taskkill.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4164	ab1ce68402465263b86581b371aaaa09bee9ca3df19ee3471a090829faf1c762.tmp

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 4164	1948	ab1ce68402465263b86581b371aaaa09bee9ca3df19ee3471a090829faf1c762.exe	87
PID 5544 wrote to memory of 1520	5544	MicrosoftPhotos.exe	93
PID 4232 wrote to memory of 1728	4232	rundll32.exe	96
PID 5544 wrote to memory of 1756	5544	MicrosoftPhotos.exe	98
PID 1756 wrote to memory of 5444	1756	cmd.exe	100
PID 5444 wrote to memory of 1216	5444	net.exe	101
PID 1756 wrote to memory of 5648	1756	cmd.exe	102
PID 5648 wrote to memory of 3464	5648	cmd.exe	103
PID 5648 wrote to memory of 4444	5648	cmd.exe	104
PID 1756 wrote to memory of 1596	1756	cmd.exe	105
PID 1756 wrote to memory of 4196	1756	cmd.exe	106
PID 1756 wrote to memory of 2452	1756	cmd.exe	107
PID 1756 wrote to memory of 2248	1756	cmd.exe	109
PID 1756 wrote to memory of 4888	1756	cmd.exe	110
PID 1756 wrote to memory of 5856	1756	cmd.exe	111
PID 1756 wrote to memory of 1748	1756	cmd.exe	112
PID 1756 wrote to memory of 4832	1756	cmd.exe	113
PID 1756 wrote to memory of 544	1756	cmd.exe	114
PID 1756 wrote to memory of 2940	1756	cmd.exe	115
PID 1756 wrote to memory of 3032	1756	cmd.exe	116
PID 1756 wrote to memory of 5968	1756	cmd.exe	117
PID 1756 wrote to memory of 2176	1756	cmd.exe	118
PID 1756 wrote to memory of 1524	1756	cmd.exe	119
PID 1756 wrote to memory of 4684	1756	cmd.exe	120
PID 1756 wrote to memory of 5940	1756	cmd.exe	121
PID 1756 wrote to memory of 1428	1756	cmd.exe	122
PID 1756 wrote to memory of 3584	1756	cmd.exe	123
PID 1756 wrote to memory of 4972	1756	cmd.exe	124
PID 1756 wrote to memory of 4504	1756	cmd.exe	125
PID 1756 wrote to memory of 3520	1756	cmd.exe	126
PID 1756 wrote to memory of 5332	1756	cmd.exe	127
PID 1756 wrote to memory of 4464	1756	cmd.exe	128
PID 1756 wrote to memory of 5568	1756	cmd.exe	129
PID 1756 wrote to memory of 1208	1756	cmd.exe	130
PID 1756 wrote to memory of 5488	1756	cmd.exe	131
PID 1756 wrote to memory of 3504	1756	cmd.exe	132
PID 1756 wrote to memory of 3896	1756	cmd.exe	133
PID 1756 wrote to memory of 1368	1756	cmd.exe	134
PID 1756 wrote to memory of 1276	1756	cmd.exe	135
PID 1756 wrote to memory of 4868	1756	cmd.exe	136
PID 1756 wrote to memory of 4092	1756	cmd.exe	137
PID 1756 wrote to memory of 3524	1756	cmd.exe	138
PID 1756 wrote to memory of 4852	1756	cmd.exe	139
PID 1756 wrote to memory of 3328	1756	cmd.exe	140
PID 1756 wrote to memory of 2608	1756	cmd.exe	141
PID 1756 wrote to memory of 3412	1756	cmd.exe	142
PID 1756 wrote to memory of 5320	1756	cmd.exe	143
PID 1756 wrote to memory of 4772	1756	cmd.exe	144
PID 1756 wrote to memory of 2240	1756	cmd.exe	145
PID 1756 wrote to memory of 2796	1756	cmd.exe	146
PID 1756 wrote to memory of 5848	1756	cmd.exe	147
PID 1756 wrote to memory of 2668	1756	cmd.exe	148
PID 1756 wrote to memory of 3696	1756	cmd.exe	149
PID 1756 wrote to memory of 4164	1756	cmd.exe	150
PID 1756 wrote to memory of 5312	1756	cmd.exe	151
PID 1756 wrote to memory of 1116	1756	cmd.exe	152
PID 1756 wrote to memory of 6012	1756	cmd.exe	153
PID 1756 wrote to memory of 3828	1756	cmd.exe	154
PID 1756 wrote to memory of 3292	1756	cmd.exe	155
PID 1756 wrote to memory of 4628	1756	cmd.exe	156
PID 1756 wrote to memory of 1504	1756	cmd.exe	157
PID 1756 wrote to memory of 1908	1756	cmd.exe	158
PID 1756 wrote to memory of 2504	1756	cmd.exe	159
PID 1756 wrote to memory of 2464	1756	cmd.exe	160

C:\Users\Admin\AppData\Local\Temp\ab1ce68402465263b86581b371aaaa09bee9ca3df19ee3471a090829faf1c762.exe
"C:\Users\Admin\AppData\Local\Temp\ab1ce68402465263b86581b371aaaa09bee9ca3df19ee3471a090829faf1c762.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Users\Admin\AppData\Local\Temp\is-NKT9S.tmp\ab1ce68402465263b86581b371aaaa09bee9ca3df19ee3471a090829faf1c762.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-NKT9S.tmp\ab1ce68402465263b86581b371aaaa09bee9ca3df19ee3471a090829faf1c762.tmp" /SL5="$400B2,1003135,821760,C:\Users\Admin\AppData\Local\Temp\ab1ce68402465263b86581b371aaaa09bee9ca3df19ee3471a090829faf1c762.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  PID:4164

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\ProgramData\MicrosoftDevKit\619ad87d.dll,GXHzj9df
1⤵
- Suspicious use of WriteProcessMemory
PID:4232
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\ProgramData\MicrosoftDevKit\619ad87d.dll,GXHzj9df
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1728

C:\ProgramData\MicrosoftDevKit\MicrosoftPhotos.exe
"C:\ProgramData\MicrosoftDevKit\MicrosoftPhotos.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:820

C:\ProgramData\MicrosoftDevKit\MicrosoftPhotos.exe
C:\ProgramData\MicrosoftDevKit\MicrosoftPhotos.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5544
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /tn MicrosoftToolKit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1520
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c u.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1756
- - C:\Windows\SysWOW64\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5444
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      System Location Discovery: System Language Discovery
      PID:1216
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c sc qc "MicrosoftPhotos" 2>nul | findstr /i "BINARY_PATH_NAME"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5648
  - - C:\Windows\SysWOW64\sc.exe
      sc qc "MicrosoftPhotos"
      4⤵
      Launches sc.exe
      PID:3464
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /i "BINARY_PATH_NAME"
      4⤵
      PID:4444
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /query /tn "\MicrosoftDevKit" /xml
    3⤵
    PID:1596
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "$d=[xml](Get-Content 'C:\Users\Admin\AppData\Local\Temp\cf_task.xml'); $e=$d.Task.Actions.Exec; if($e){ $c=$e.Command; $a=$e.Arguments; if($c -and $a){ Write-Output ($c + ' ' + $a) } elseif($c){ Write-Output $c } elseif($a){ Write-Output $a } }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4196
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im rundll32.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2452
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /end /tn "\MicrosoftToolKit"
    3⤵
    PID:2248
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "\MicrosoftToolKit" /f
    3⤵
    PID:4888
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /end /tn "MicrosoftToolKit"
    3⤵
    PID:5856
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftToolKit" /f
    3⤵
    PID:1748
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /end /tn "\MicrosoftDevKit"
    3⤵
    PID:4832
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /end /tn "MicrosoftDevKit"
    3⤵
    PID:544
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq MicrosoftPhotos.exe"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2940
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3032
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe" "C:\Users\Admin\AppData\Local\Temp\taskchk.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5968
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:2176
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq MicrosoftPhotos.exe"
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1524
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4684
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe" "C:\Users\Admin\AppData\Local\Temp\taskchk.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5940
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:1428
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq MicrosoftPhotos.exe"
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3584
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4972
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe" "C:\Users\Admin\AppData\Local\Temp\taskchk.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4504
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:3520
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq MicrosoftPhotos.exe"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5332
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4464
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe" "C:\Users\Admin\AppData\Local\Temp\taskchk.tmp"
    3⤵
    PID:5568
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:1208
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq MicrosoftPhotos.exe"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5488
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe"
    3⤵
    PID:3504
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe" "C:\Users\Admin\AppData\Local\Temp\taskchk.tmp"
    3⤵
    PID:3896
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:1368
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq MicrosoftPhotos.exe"
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1276
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe"
    3⤵
    PID:4868
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe" "C:\Users\Admin\AppData\Local\Temp\taskchk.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4092
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:3524
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq MicrosoftPhotos.exe"
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4852
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe"
    3⤵
    PID:3328
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe" "C:\Users\Admin\AppData\Local\Temp\taskchk.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2608
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:3412
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq MicrosoftPhotos.exe"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5320
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4772
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe" "C:\Users\Admin\AppData\Local\Temp\taskchk.tmp"
    3⤵
    PID:2240
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:2796
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq MicrosoftPhotos.exe"
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5848
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2668
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe" "C:\Users\Admin\AppData\Local\Temp\taskchk.tmp"
    3⤵
    PID:3696
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:4164
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq MicrosoftPhotos.exe"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5312
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe"
    3⤵
    PID:1116
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe" "C:\Users\Admin\AppData\Local\Temp\taskchk.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6012
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:3828
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq MicrosoftPhotos.exe"
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3292
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe"
    3⤵
    PID:4628
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe" "C:\Users\Admin\AppData\Local\Temp\taskchk.tmp"
    3⤵
    PID:1504
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:1908
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq MicrosoftPhotos.exe"
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2504
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe"
    3⤵
    PID:2464
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe" "C:\Users\Admin\AppData\Local\Temp\taskchk.tmp"
    3⤵
    PID:4332
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:1376
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq MicrosoftPhotos.exe"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5924
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe"
    3⤵
    PID:5736
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe" "C:\Users\Admin\AppData\Local\Temp\taskchk.tmp"
    3⤵
    PID:820
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:3488
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq MicrosoftPhotos.exe"
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3004
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe"
    3⤵
    PID:2876
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe" "C:\Users\Admin\AppData\Local\Temp\taskchk.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4256
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:5108
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq MicrosoftPhotos.exe"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4468
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4144
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe" "C:\Users\Admin\AppData\Local\Temp\taskchk.tmp"
    3⤵
    PID:1260
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:2256
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq MicrosoftPhotos.exe"
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6064
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe"
    3⤵
    PID:4272
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe" "C:\Users\Admin\AppData\Local\Temp\taskchk.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3912
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:3516
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq MicrosoftPhotos.exe"
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5784
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3904
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe" "C:\Users\Admin\AppData\Local\Temp\taskchk.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:476
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:3728
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq MicrosoftPhotos.exe"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1216
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe"
    3⤵
    PID:1336
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe" "C:\Users\Admin\AppData\Local\Temp\taskchk.tmp"
    3⤵
    PID:1560
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:3228
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq MicrosoftPhotos.exe"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3740
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe"
    3⤵
    PID:944
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe" "C:\Users\Admin\AppData\Local\Temp\taskchk.tmp"
    3⤵
    PID:5636
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:6060
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq MicrosoftPhotos.exe"
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5524
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe"
    3⤵
    PID:3568
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe" "C:\Users\Admin\AppData\Local\Temp\taskchk.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3596
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:1032
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq MicrosoftPhotos.exe"
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2000
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2456
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe" "C:\Users\Admin\AppData\Local\Temp\taskchk.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1748
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:412
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq MicrosoftPhotos.exe"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2452
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe"
    3⤵
    PID:1484
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe" "C:\Users\Admin\AppData\Local\Temp\taskchk.tmp"
    3⤵
    PID:3032
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:2940
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq MicrosoftPhotos.exe"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:932
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe"
    3⤵
    PID:2176
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe" "C:\Users\Admin\AppData\Local\Temp\taskchk.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1524
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:5940
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq MicrosoftPhotos.exe"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:704
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2972
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe" "C:\Users\Admin\AppData\Local\Temp\taskchk.tmp"
    3⤵
    PID:5492
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:4972
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq MicrosoftPhotos.exe"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2828
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe"
    3⤵
    PID:4504
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe" "C:\Users\Admin\AppData\Local\Temp\taskchk.tmp"
    3⤵
    PID:5548
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:4940
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq MicrosoftPhotos.exe"
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4464
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe"
    3⤵
    PID:1380
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe" "C:\Users\Admin\AppData\Local\Temp\taskchk.tmp"
    3⤵
    PID:3164
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:3040
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq MicrosoftPhotos.exe"
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4872
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe"
    3⤵
    PID:5752
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe" "C:\Users\Admin\AppData\Local\Temp\taskchk.tmp"
    3⤵
    PID:1368
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:4644
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq MicrosoftPhotos.exe"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1232
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5644
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe" "C:\Users\Admin\AppData\Local\Temp\taskchk.tmp"
    3⤵
    PID:3524
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:5408
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq MicrosoftPhotos.exe"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4852
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe"
    3⤵
    PID:2976
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe" "C:\Users\Admin\AppData\Local\Temp\taskchk.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3412
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:5456
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq MicrosoftPhotos.exe"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2432
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe"
    3⤵
    PID:3576
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe" "C:\Users\Admin\AppData\Local\Temp\taskchk.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6000
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:752
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist /FI "IMAGENAME eq MicrosoftPhotos.exe"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4240
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1084
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /c:"MicrosoftPhotos.exe" "C:\Users\Admin\AppData\Local\Temp\taskchk.tmp"
    3⤵
    PID:3236
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im "MicrosoftPhotos.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4484
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:4376
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "\MicrosoftDevKit" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4440
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /delete /tn "MicrosoftDevKit" /f
    3⤵
    PID:3292
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo "C:\ProgramData\MicrosoftDevKit\" "
    3⤵
    PID:2952
- - C:\Windows\SysWOW64\findstr.exe
    findstr /i /b /c:"C:\Windows\"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1408
- - C:\Windows\SysWOW64\wscript.exe
    wscript "C:\Users\Admin\AppData\Local\Temp\del_10895.vbs"
    3⤵
    PID:1096
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c del /f /q "C:\Windows\u.bat"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2052
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c del /f /q "C:\Users\Admin\AppData\Local\Temp\del_10895.vbs"
      4⤵
      PID:6020

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
1⤵
PID:4428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

619ad87d.dll

Path C:\ProgramData\MicrosoftDevKit\619ad87d.dll
Size 145KB
SHA256 21310bb28fc51ce12622c09f40d75fe28323da25c602710d261c80de9c507796
MD5 0a76b75502e626448e8b7de16e8abdb0
SHA1 b7a910b5b50a6c5ff759bd3f47dc9d59d9a1327f
SHA512 faf1bf70bd3741bf99ea5f714e1d6d62e65704a1ad214a56831615b8df027292174c698da7ab5ec863bf9538fbc0e476306a8a719be1424b7d57210a3a018e74
SSDEEP 3072:1UkDK10tNYU09IF1D6Ag6WxF6FXFHWDg2CIjyRf9QGwcnP6V:VDTtN7FtPWfxDg2VeNdPI
TLSH
T105E39D4178C1C072C97E19340AB9CF724B3D78505F789ECB67D85EBA9E306C09A35E6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftPhotos.exe

Path C:\ProgramData\MicrosoftDevKit\MicrosoftPhotos.exe
Size 96KB
SHA256 caacc3984c6379ab96506b418390384638dd42f5fb7a8d575ca2540977b6525a
MD5 d69f69b6703e9427d7db2bddc3ca4cb5
SHA1 c3fec05c09653288e883e2bb90d09749f93b53bb
SHA512 db668331f9b0d963c63491645037c5dd40d5e2157a7e1af9acc346ea581cdbc44e529c441296d2d9360d707e0e3623d3f84e228022f0724a5755361ee7cc614b
SSDEEP 1536:M75aCuMt8+MzrtPfSY7CIAuXSruoJZZ8NN9WZP3RFP8Mne/Kzt7ZSYJBDYbmg:SSzrYCCcSrfjZ4AnP8MnZzBnB2
TLSH
T175A3022BFA66CFBBF31698368A51D17D8A3063097B7670D7539982783D1B8F84633406
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cf_task.xml

Path C:\Users\Admin\AppData\Local\Temp\cf_task.xml
Size 1KB
SHA256 6523acce123be675faee65f4fc961727e1c2dfad415763a17be2bd49790714a0
MD5 a7561215104528150bd9ad192a07159e
SHA1 ba972cae2c02f34b95d3b21a19444e945d749c2f
SHA512 deba5a6fc2b5a5c1e41699514e7c23c6bed31f2b4da9785b6917acffc1814a737f094b1a064bf3e6897bb2fedd69b86995f8e3cff5b256822b70679e4707567c
TLSH
T17221FC49D843DA0B5936291D27510601EF7BA3CB8545B46CB4CC46382FBA9CF514316B
MD5 SHA1 SHA512 TLSH

Submit Download

del_10895.vbs

Path C:\Users\Admin\AppData\Local\Temp\del_10895.vbs
Size 225B
SHA256 4fa58c6cd73c51dc5ef41e3305ff182ab1729c584a60d1ec0efd240658c05592
MD5 7afd4d234b320d216e00bb862c382354
SHA1 8b186f416952aa01ca275236834152cbcddd17a1
SHA512 bcd3f384d205205612046d8cfd4f14e35deb8b9dd4173eed97222abf458d016434289b70bb464d7fc78366d4199f781feb311d417ee22a24e27b55d024f4880c
TLSH
T189D0A714EC4EC578102581B20AB5C21D4AC8F40495367E269684811CA10B0E566527D6
MD5 SHA1 SHA512 TLSH

Submit Download

635a4fb0.dll

Path C:\Users\Admin\AppData\Local\Temp\is-0G43S.tmp\635a4fb0.dll
Size 104KB
SHA256 872d4660ccb6873c624b35e0bedeb08a7947a884db695150284e9fdb441d5840
MD5 1f3e02683c29da8cd017c1f21777bf5d
SHA1 0a9b50ce9bc38eacd7360d1fdce9cc3d4bf4e54c
SHA512 ccbf06e53a58056e056b93ebf4ac5e8adda75bbac1ed6f01248fe2aea2c8434798ae9f5ca6764000c33a39ce4ef9b1cb188e43f88d54806c90ac5a6dc2f419aa
SSDEEP 3072:rDVEIZ1h0QcfY20XVTb4sCJFFH7O8Z6t//T4JI5sA:rDVHZj0QcgblzAFhym6sA
TLSH
T18BA37B41B580C073D5EE163E89788B799B3FA810DF619DDB33545ABE0E342D19E31A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ab1ce68402465263b86581b371aaaa09bee9ca3df19ee3471a090829faf1c762.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-NKT9S.tmp\ab1ce68402465263b86581b371aaaa09bee9ca3df19ee3471a090829faf1c762.tmp
Size 3.3MB
SHA256 174a79d951cdf00b65a987e5a1e8aa628481b0f1fa0fad667fb4bc66e88f2013
MD5 6b43973e1b89f2be3703919ccb9913dc
SHA1 c8eb439107a299e57e150f09c76dda98a0f29381
SHA512 97faffd1588384e8fcafbba0251167de8efa1e25e818aef0e28d8e8395fe21a55a76bdf8a23d5510cd0f02d2ed7516164b963d6432dbaea9442f0dfaa49d1c91
SSDEEP 49152:cDwGHAkqMu7Ht6SCiGognuzsDaarpQAB1KkX/q52guQk3332C:cMGdPvuzEVTBoPdur3339
TLSH
T143F55C23F24D693ED05B3E3D673792A4987B76602D128C57A7EC3A4C4F391812E2A747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

taskchk.tmp

Path C:\Users\Admin\AppData\Local\Temp\taskchk.tmp
Size 78B
SHA256 0063c4995c3a1dd941166d3ba5dc64247a4fb2fcc563ad636e117d38ca6ece37
MD5 d655b51c5e09544fe0e519ca96dc1567
SHA1 5ea2364d77f41a0f7a9caabd92c82ba93f0f2955
SHA512 c419c8e0d0d6ff97c363fbc2246cafdb593902fb612b1f560095630ee78f170719d683f72b2e7fdb42b70a29cf9a68c670dc0291b273af8d0fc658a69dcf342f
TLSH
T1B0A002215D494A659285729419321440A60D455365509994305C180D1353B5456C50C4
MD5 SHA1 SHA512 TLSH

Submit Download

taskchk.tmp

Path C:\Users\Admin\AppData\Local\Temp\taskchk.tmp
Size 78B
SHA256 6b4b871426a18bfe97608fe8d1ae330f2a40371b0232d86929cf41a94e2c782e
MD5 4823c74c7825ceaee7f4aa5e910dfcbf
SHA1 d4e7a255a512a1673782e7aa7e6da45b4979c747
SHA512 8e6d4eb79063e72a44e610efa40b8a4a634f95fadd8d8f28d0dae56691b9071aaea0a106590d5d0466c77d61144fd3f5d5c36f81bbb46f060358c4ec4a5fbb58
TLSH
T190A002215D494965D284B29419321440A60D465365509994305C180D1B4375456C40C4
MD5 SHA1 SHA512 TLSH

Submit Download

taskchk.tmp

Path C:\Users\Admin\AppData\Local\Temp\taskchk.tmp
Size 78B
SHA256 f998a63ec0d22ec43c967ca5e6b15032e16894b79100a78a56a28598c0916944
MD5 dd08f57a86b6f42e2767b8c232183b40
SHA1 b75eb4607c938989f76a69d2250e1baa76f69031
SHA512 2fa419f99d519428ce28d3deb8033b6813feed01197d8a1b520f6a32f02fb203738a0c977067efe745a63d460012f8f844f0f3a870a51f9dc1a82aa73ceba989
TLSH
T118A002214D494965528C71D419321440A64D855264549994309C1845134775456C40C4
MD5 SHA1 SHA512 TLSH

Submit Download

taskchk.tmp

Path C:\Users\Admin\AppData\Local\Temp\taskchk.tmp
Size 78B
SHA256 8cf044b3afc23f84ad3a26a10394212783672788acdedfb25f91502a448f8792
MD5 0695b50136894d3ddfac028d456b267c
SHA1 23e085506984429f07e31deb205610a7e05f2b1a
SHA512 9b52c4950e4306c1a145c996c429d47b3e923c5abf7cca806d8c693680ac27b0a3f12f216d560d61505ecc1857ab120590b59cea167681fd4499117f0c3e6562
TLSH
T1EFA002314D494DE95185728419321841A70D5593681095A5325C18041B4BB5866C4484
MD5 SHA1 SHA512 TLSH

Submit Download

taskchk.tmp

Path C:\Users\Admin\AppData\Local\Temp\taskchk.tmp
Size 78B
SHA256 49eb7f5a5e1166a7452e20016b9127da659ed408426c3ecbf1dda149d1f519bc
MD5 1161ef8fd8eef88cf08b88f62fbafc11
SHA1 04b312f2e1a2e25f875cefdc04b167067a11e71c
SHA512 2c2030107882dfa01ef9182e0a679099c31a7c8b770d5270a1f46b2d3d952d67b29824f3f5f2a5b55b4d5a6a3f78edf0e0449d8c738ea40f0e60c5ccad04c550
TLSH
T1F0A002214D494DE6518475841A321481A6096952641055E4325C1C18178375456C8084
MD5 SHA1 SHA512 TLSH

Submit Download

taskchk.tmp

Path C:\Users\Admin\AppData\Local\Temp\taskchk.tmp
Size 78B
SHA256 c119d25b0c2d71688e4210cd8e6308e2c29c7478c023eb3d2f78fa2a64eea42f
MD5 8198d1cbc6352e8b30c1d11a4584bd11
SHA1 5744ddb78cdb223ef8fb04a5c1c3476b87166d81
SHA512 c9c649086e7e5ca30e42e7f7316a8c3b5f541aac00778349a704ea86511736ea3def1ae9753d5654098b06ae2b63650a4963f58115a1108db43b0f46d0c4b5e3
TLSH
T123A002214D5D4DE65184718419321451A6096552642455E4315C1C14134375456C80C4
MD5 SHA1 SHA512 TLSH

Submit Download

taskchk.tmp

Path C:\Users\Admin\AppData\Local\Temp\taskchk.tmp
Size 78B
SHA256 dd19ffcc2c6e7b8cbc7f9b28dadc1f1fbf1b71d354b7c992fe5447310b0d160f
MD5 d709acec5fe0f420e2b2ce66303c40d9
SHA1 fa44414f96211a81f8967434119f7f61a226b601
SHA512 fdd10951bac2b760345819ffcb9d0ed996d6032c9361139da2154e1a1eadc08c455e95b92ae2d1065292f873e502f6cc1c4dc4b7a99cba58c676713509eae21f
TLSH
T118A002214E494DE55199718519721441A60D6556641095A4315C18141353F6496C80C4
MD5 SHA1 SHA512 TLSH

Submit Download

taskchk.tmp

Path C:\Users\Admin\AppData\Local\Temp\taskchk.tmp
Size 78B
SHA256 9ce3b10f5c560ff51eda795d47479be26725c67f7ad140b25d7b015b144be4a4
MD5 c09ef7c6b4ed742d0583bf45db690dbd
SHA1 76ad0408a8c72366fe0ca57f76f387cc84382c37
SHA512 fc870a9fc268312616811292ba0fcc22606fed4556a9741646a203a614194dc4c7db71f97d1941813f91af6534fdf103f7b0b1a640a77be9bbe7455b4339c711
TLSH
T109A00229494A497651C5728419321440B60D4552643055A4305C1C441393B5552C4494
MD5 SHA1 SHA512 TLSH

Submit Download

u.bat

Path C:\Windows\u.bat
Size 5KB
SHA256 db136e719b0e0f8542265802d648eab897868daa4a0f7bad806c23b28325feac
MD5 ce85775fe604eb68442d6bd9aa77f84a
SHA1 f4741be84b76eba60d05abc73c57717b90bae576
SHA512 24e00ad9a421befe3814ac4b406f5ae70bc9d4c79b104bd9142e34cdfdbaf8ad222349d10db9399d0d4ac2f95d30260b1014fd4829537b2d1a8ea24a3b52e11e
SSDEEP 96:xGhu22BqgRwVnHUvqpuKHYJyfE9nfzWmH3VUflTRYI6npgnp+TWiOrxNeVbhVenh:xe24gRwyvqpuKHYCE9fKmX2tdYPp0pUY
TLSH
T1C3B1DF1F2C05981213B1C7F0A6DB240BE7EE81B70F25E9D9318194B43B6E21652EE3E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1948-19-0x0000000000520000-0x00000000005F8000-memory.dmp

Download

memory/1948-0-0x0000000000520000-0x00000000005F8000-memory.dmp

Download

memory/4164-6-0x0000000003210000-0x0000000003211000-memory.dmp

Download

memory/4164-17-0x0000000000CD0000-0x0000000001034000-memory.dmp

Download

memory/4196-54-0x0000000008650000-0x0000000008CCC000-memory.dmp

Download

memory/4196-50-0x00000000068F0000-0x000000000690A000-memory.dmp

Download

memory/4196-51-0x0000000006940000-0x0000000006962000-memory.dmp

Download

memory/4196-52-0x0000000007A10000-0x0000000007FCA000-memory.dmp

Download

memory/4196-49-0x0000000007370000-0x0000000007406000-memory.dmp

Download

memory/4196-48-0x00000000063F0000-0x000000000643C000-memory.dmp

Download

memory/4196-47-0x0000000006390000-0x00000000063AE000-memory.dmp

Download

memory/4196-46-0x0000000005FB0000-0x000000000630B000-memory.dmp

Download

memory/4196-45-0x0000000005F40000-0x0000000005FA6000-memory.dmp

Download

memory/4196-44-0x0000000005ED0000-0x0000000005F36000-memory.dmp

Download

memory/4196-41-0x0000000005D30000-0x0000000005D52000-memory.dmp

Download

memory/4196-40-0x00000000056B0000-0x0000000005CFA000-memory.dmp

Download

memory/4196-39-0x0000000002EB0000-0x0000000002EE6000-memory.dmp

Download

memory/5544-25-0x0000000010000000-0x0000000010158000-memory.dmp

Download

memory/5544-21-0x0000000002DA0000-0x0000000002DC2000-memory.dmp

Download