Overview
overview
8Static
static
3plutonium.exe
windows10-2004-x64
8plutonium.exe
windows11-ltsc_2024-x64
8controlzex.dll
windows10-2004-x64
1controlzex.dll
windows11-ltsc_2024-x64
1costura.dll
windows10-2004-x64
1costura.dll
windows11-ltsc_2024-x64
8de.mahapps...es.dll
windows10-2004-x64
1de.mahapps...es.dll
windows11-ltsc_2024-x64
1mahapps.metro.dll
windows10-2004-x64
1mahapps.metro.dll
windows11-ltsc_2024-x64
6materialde...rs.dll
windows10-2004-x64
1materialde...rs.dll
windows11-ltsc_2024-x64
1materialde...ps.dll
windows10-2004-x64
1materialde...ps.dll
windows11-ltsc_2024-x64
8materialde...pf.dll
windows10-2004-x64
1materialde...pf.dll
windows11-ltsc_2024-x64
1microsoft....es.dll
windows10-2004-x64
1microsoft....es.dll
windows11-ltsc_2024-x64
1microsoft....rs.dll
windows10-2004-x64
1microsoft....rs.dll
windows11-ltsc_2024-x64
1plutonium....re.dll
windows10-2004-x64
1plutonium....re.dll
windows11-ltsc_2024-x64
1sentry.dll
windows10-2004-x64
1sentry.dll
windows11-ltsc_2024-x64
1system.buffers.dll
windows10-2004-x64
1system.buffers.dll
windows11-ltsc_2024-x64
6system.col...le.dll
windows10-2004-x64
1system.col...le.dll
windows11-ltsc_2024-x64
1system.dia...ce.dll
windows10-2004-x64
1system.dia...ce.dll
windows11-ltsc_2024-x64
1system.memory.dll
windows10-2004-x64
1system.memory.dll
windows11-ltsc_2024-x64
6Analysis
- max time kernel
599s - max time network
548s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/07/2026, 02:50
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
plutonium.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
20 signatures
600 seconds
Behavioral task
behavioral2
Sample
plutonium.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
21 signatures
600 seconds
Behavioral task
behavioral3
Sample
controlzex.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral4
Sample
controlzex.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
600 seconds
Behavioral task
behavioral5
Sample
costura.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral6
Sample
costura.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
600 seconds
Behavioral task
behavioral7
Sample
de.mahapps.metro.resources.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral8
Sample
de.mahapps.metro.resources.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
600 seconds
Behavioral task
behavioral9
Sample
mahapps.metro.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral10
Sample
mahapps.metro.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
600 seconds
Behavioral task
behavioral11
Sample
materialdesigncolors.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral12
Sample
materialdesigncolors.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
600 seconds
Behavioral task
behavioral13
Sample
materialdesignthemes.mahapps.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral14
Sample
materialdesignthemes.mahapps.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
600 seconds
Behavioral task
behavioral15
Sample
materialdesignthemes.wpf.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral16
Sample
materialdesignthemes.wpf.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
600 seconds
Behavioral task
behavioral17
Sample
microsoft.bcl.asyncinterfaces.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral18
Sample
microsoft.bcl.asyncinterfaces.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
600 seconds
Behavioral task
behavioral19
Sample
microsoft.xaml.behaviors.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral20
Sample
microsoft.xaml.behaviors.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
600 seconds
Behavioral task
behavioral21
Sample
plutonium.updater.core.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral22
Sample
plutonium.updater.core.dll
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
600 seconds
Behavioral task
behavioral23
Sample
sentry.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral24
Sample
sentry.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
600 seconds
Behavioral task
behavioral25
Sample
system.buffers.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral26
Sample
system.buffers.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
600 seconds
Behavioral task
behavioral27
Sample
system.collections.immutable.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral28
Sample
system.collections.immutable.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
600 seconds
Behavioral task
behavioral29
Sample
system.diagnostics.diagnosticsource.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral30
Sample
system.diagnostics.diagnosticsource.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
600 seconds
Behavioral task
behavioral31
Sample
system.memory.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
600 seconds
Behavioral task
behavioral32
Sample
system.memory.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
14 signatures
600 seconds
General
- Target plutonium.exe
- Size 4.6MB
- Sample260718-db1qeahv4x
- SHA256 85d1d1ca4d5881d9b98928c2006fb0eec9655e2705fe74088e6f974a19703f0f
- MD5 72cb7c6d98e9e47274733825c9176679
- SHA1 8681469349254c5203a7f9a189833d22a14f5cd9
- SHA512 d18d306ca9a311df1a96244ecc67a3e61ffc8b9b465a1301263e11d500cc2f38847e922c57d4a3321196d6ceb32310113d7d790b4dfb2c05c3ff1e2af26dc708
- SSDEEP 98304:zUaMwIBAoUcmmxVA5/xDnLx0yu+5TeRXExXYAx:Ia+AobhATd0yH0RXUo2
- TLSH T1C1363306A6A9FA0BD52432F070A5E67C45327E6EDC0A8B2D89B5306F513BF5FCC2254D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Executes dropped EXE 2 IoCs
pid Process 2196 40c9f01d-84b6-47a7-a07e-eee6544fbf4b.exe 3424 dxwsetup.exe - Loads dropped DLL 1 IoCs
pid Process 3424 dxwsetup.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 40c9f01d-84b6-47a7-a07e-eee6544fbf4b.exe - Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: dxwsetup.exe File opened (read-only) \??\G: dxwsetup.exe File opened (read-only) \??\P: dxwsetup.exe File opened (read-only) \??\S: dxwsetup.exe File opened (read-only) \??\U: dxwsetup.exe File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\B: dxwsetup.exe File opened (read-only) \??\D: dxwsetup.exe File opened (read-only) \??\M: dxwsetup.exe File opened (read-only) \??\O: dxwsetup.exe File opened (read-only) \??\Q: dxwsetup.exe File opened (read-only) \??\Y: dxwsetup.exe File opened (read-only) \??\J: dxwsetup.exe File opened (read-only) \??\K: dxwsetup.exe File opened (read-only) \??\L: dxwsetup.exe File opened (read-only) \??\R: dxwsetup.exe File opened (read-only) \??\T: dxwsetup.exe File opened (read-only) \??\V: dxwsetup.exe File opened (read-only) \??\X: dxwsetup.exe File opened (read-only) \??\Z: dxwsetup.exe File opened (read-only) \??\H: dxwsetup.exe File opened (read-only) \??\I: dxwsetup.exe File opened (read-only) \??\N: dxwsetup.exe File opened (read-only) \??\W: dxwsetup.exe File opened (read-only) \??\F: explorer.exe - Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\directx\websetup\dsetup.dll dxwsetup.exe File created C:\Windows\SysWOW64\directx\websetup\SET6A26.tmp dxwsetup.exe File opened for modification C:\Windows\SysWOW64\DirectX\WebSetup\filelist.dat dxwsetup.exe File opened for modification C:\Windows\SysWOW64\directx\websetup\SET6A26.tmp dxwsetup.exe File opened for modification C:\Windows\SysWOW64\directx\websetup\dsetup32.dll dxwsetup.exe File opened for modification C:\Windows\SysWOW64\DirectX\WebSetup dxwsetup.exe File created C:\Windows\SysWOW64\DirectX\WebSetup\dxupdate.cab dxwsetup.exe File opened for modification C:\Windows\SysWOW64\directx\websetup\SET6A25.tmp dxwsetup.exe File created C:\Windows\SysWOW64\directx\websetup\SET6A25.tmp dxwsetup.exe - Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\msdownld.tmp\AS5A71DC.tmp dxwsetup.exe File opened for modification C:\Windows\Logs\DirectX.log dxwsetup.exe File opened for modification C:\Windows\msdownld.tmp dxwsetup.exe File created C:\Windows\msdownld.tmp\AS5A71DC.tmp\dxupdate.cab dxwsetup.exe File opened for modification C:\Windows\msdownld.tmp\AS5A71DC.tmp\dxupdate.cab dxwsetup.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 40c9f01d-84b6-47a7-a07e-eee6544fbf4b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dxwsetup.exe - Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\Main explorer.exe - Modifies registry class 44 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2301830172-776172150-2531349243-1000\{D3CEDC51-BE9C-4973-8F8B-37178FE964E4} explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix StartMenuExperienceHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ dxwsetup.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2301830172-776172150-2531349243-1000\{5C5E2E42-3E11-425A-8E6B-664B36E3A64A} explorer.exe Key created \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\MuiCache SearchHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" StartMenuExperienceHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56" SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ dxwsetup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ dxwsetup.exe Key created \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Key created \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23" SearchHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ dxwsetup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ dxwsetup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ dxwsetup.exe Key created \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings explorer.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4292 explorer.exe 4292 explorer.exe - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 4108 plutonium.exe Token: SeShutdownPrivilege 4292 explorer.exe Token: SeCreatePagefilePrivilege 4292 explorer.exe Token: SeShutdownPrivilege 4292 explorer.exe Token: SeCreatePagefilePrivilege 4292 explorer.exe Token: SeShutdownPrivilege 4292 explorer.exe Token: SeCreatePagefilePrivilege 4292 explorer.exe Token: SeShutdownPrivilege 4292 explorer.exe Token: SeCreatePagefilePrivilege 4292 explorer.exe Token: SeShutdownPrivilege 4292 explorer.exe Token: SeCreatePagefilePrivilege 4292 explorer.exe Token: SeShutdownPrivilege 4292 explorer.exe Token: SeCreatePagefilePrivilege 4292 explorer.exe Token: SeShutdownPrivilege 4292 explorer.exe Token: SeCreatePagefilePrivilege 4292 explorer.exe Token: SeShutdownPrivilege 4292 explorer.exe Token: SeCreatePagefilePrivilege 4292 explorer.exe Token: SeShutdownPrivilege 4292 explorer.exe Token: SeCreatePagefilePrivilege 4292 explorer.exe Token: SeShutdownPrivilege 4292 explorer.exe Token: SeCreatePagefilePrivilege 4292 explorer.exe Token: SeShutdownPrivilege 4292 explorer.exe Token: SeCreatePagefilePrivilege 4292 explorer.exe Token: SeShutdownPrivilege 4292 explorer.exe Token: SeCreatePagefilePrivilege 4292 explorer.exe Token: SeShutdownPrivilege 4292 explorer.exe Token: SeCreatePagefilePrivilege 4292 explorer.exe Token: SeShutdownPrivilege 4292 explorer.exe Token: SeCreatePagefilePrivilege 4292 explorer.exe Token: SeShutdownPrivilege 4292 explorer.exe Token: SeCreatePagefilePrivilege 4292 explorer.exe Token: SeShutdownPrivilege 4292 explorer.exe Token: SeCreatePagefilePrivilege 4292 explorer.exe Token: SeShutdownPrivilege 4292 explorer.exe Token: SeCreatePagefilePrivilege 4292 explorer.exe Token: SeShutdownPrivilege 4292 explorer.exe Token: SeCreatePagefilePrivilege 4292 explorer.exe Token: SeShutdownPrivilege 4292 explorer.exe Token: SeCreatePagefilePrivilege 4292 explorer.exe Token: SeShutdownPrivilege 4292 explorer.exe Token: SeCreatePagefilePrivilege 4292 explorer.exe Token: SeShutdownPrivilege 4292 explorer.exe Token: SeCreatePagefilePrivilege 4292 explorer.exe - Suspicious use of FindShellTrayWindow 54 IoCs
pid Process 2328 sihost.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe - Suspicious use of SendNotifyMessage 43 IoCs
pid Process 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe 4292 explorer.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4992 StartMenuExperienceHost.exe 3832 SearchHost.exe 4292 explorer.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4108 wrote to memory of 2196 4108 plutonium.exe 90 PID 2196 wrote to memory of 3424 2196 40c9f01d-84b6-47a7-a07e-eee6544fbf4b.exe 91 PID 2328 wrote to memory of 4292 2328 sihost.exe 105 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\plutonium.exe"C:\Users\Admin\AppData\Local\Temp\plutonium.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\40c9f01d-84b6-47a7-a07e-eee6544fbf4b.exe"C:\Users\Admin\AppData\Local\Temp\40c9f01d-84b6-47a7-a07e-eee6544fbf4b.exe" /Q2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe /windowsupdate3⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3424
-
-
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4292
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4992
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3832
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 599B
- SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
- MD5 658ab8c32d4cc5deb36ac5f63da4658b
- SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
- SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
- TLSH T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
- Size 595B
- SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
- MD5 4454c8e578515db43fadd90604ae7675
- SHA1 3912ffa00c3a5c86fae6500a0074284d9f668976
- SHA512 b17559d466cb6954554c4f879b396ff8431c730f837205547ab46329c6517cd35a719378efa55d78c01b739414dd320157f120feb12e28e1ae90ce7c53a0c75c
- TLSH T117F0DC47E7B15216C926123CC89724E1B730F5917DD1162341056F5D2C373101F17CB8
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\40c9f01d-84b6-47a7-a07e-eee6544fbf4b.exe
- Size 288KB
- SHA256 2cf71d098c608c56e07f4655855a886c3102553f648df88458df616b26fd612f
- MD5 2cbd6ad183914a0c554f0739069e77d7
- SHA1 7bf35f2afca666078db35ca95130beb2e3782212
- SHA512 ff1af2d2a883865f2412dddcd68006d1907a719fe833319c833f897c93ee750bac494c0991170dc1cf726b3f0406707daa361d06568cd610eeb4ed1d9c0fbb10
- SSDEEP 6144:kWK8fc2liXmrLxcdRDLiH1vVRGVOhMp421/7YQV:VcvgLARDI1KIOzO0
- TLSH T19654F15197E4817BE4FA1B311DF2025327797DE86CB9E32E838658881D71780BE35B27
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\DXI7541.tmp
- Size 56KB
- SHA256 ed710d035ccaab0914810becf2f5db2816dba3a351f3666a38a903c80c16997a
- MD5 2c4d9e4773084f33092ced15678a2c46
- SHA1 bad603d543470157effd4876a684b9cfd5075524
- SHA512 d2e34cac195cfede8bc64bdc92721c574963ff522618eda4d7172f664aeb4c8675fd3d4f3658391ee5eaa398bcd2ce5d8f80deecf51af176f5c4bb2d2695e04e
- SSDEEP 768:eNIkdgBl0DBU0qwUqB7otN4PTHhy4m1Io/sF6UcmI2rIEoguD0dpY4rI8dgXl0dl:epECjtutVj072Xwt7O49vQzztSZs5KLz
- TLSH T15343FB00F0F22DEE405A5C5A27895D6A0C9F64557C5D202EB9CE83B89FFC1ED93899E3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dsetup.dll
- Size 93KB
- SHA256 57bc22850bb8e0bcc511a9b54cd3da18eec61f3088940c07d63b9b74e7fe2308
- MD5 984cad22fa542a08c5d22941b888d8dc
- SHA1 3e3522e7f3af329f2235b0f0850d664d5377b3cd
- SHA512 8ef171218b331f0591a4b2a5e68dcbae98f5891518ce877f1d8d1769c59c0f4ddae43cc43da6606975078f889c832f0666484db9e047782e7a0ae4a2d41f5bef
- SSDEEP 1536:BG8tBKv1HCyODN2wjIqlLmqxY3AMVI4I9okOEvc0/c/sZRYltL26VVE2S+JJqsHM:BptQv1iyODswNLmqxY3AMV71Ev54EAxa
- TLSH T186937D107694D176D9D220BD718CD7715ABEA6B01FA880CBBB461BDA8C653C0BA3D30F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dsetup32.dll
- Size 1.5MB
- SHA256 8a011da043a4b81e2b3d41a332e0ff23a65d546bd7636e8bc74885e8746927d6
- MD5 a5412a144f63d639b47fcc1ba68cb029
- SHA1 81bd5f1c99b22c0266f3f59959dfb4ea023be47e
- SHA512 2679a4cb690e8d709cb5e57b59315d22f69f91efa6c4ee841943751c882b0c0457fd4a3376ac3832c757c6dfaffb7d844909c5665b86a95339af586097ee0405
- SSDEEP 24576:GIQ+ddddddddddddddxOOOOOOOOOOOOOO2iWeXiWeXiWeXiWeXiWeXiWeXiWeXig:GIQsOOOOOOOOOOOOOO2iWeXiWeXiWeXV
- TLSH T1EB759D31B1D40332EA7103B177128AB7F63EEB9DE119D62579AE82592182B9CC37E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxupdate.cif
- Size 65KB
- SHA256 c6c5e877e92d387e977c135765075b7610df2500e21c16e106a225216e6442ae
- MD5 b36d3f105d18e55534ad605cbf061a92
- SHA1 788ef2de1dea6c8fe1d23a2e1007542f7321ed79
- SHA512 35ae00da025fd578205337a018b35176095a876cd3c3cf67a3e8a8e69cd750a4ccc34ce240f11fae3418e5e93caf5082c987f0c63f9d953ed7cb8d9271e03b62
- SSDEEP 768:Wn+OeDyG6lG9CVGQM6UP8XUUkw8KlNxLkPkjdARflPp0VZRTBM9oZPFASJu71N1F:V
- TLSH T147633209734ED9FE900FF9A70EA66D4D686E81AB344D680E78FF52C50B3B4DD628D091
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxupdate.dll
- Size 173KB
- SHA256 fb4f297e295c802b1377c6684734b7249d55743dfb7c14807bef59a1b5db63a2
- MD5 7ed554b08e5b69578f9de012822c39c9
- SHA1 036d04513e134786b4758def5aff83d19bf50c6e
- SHA512 7af5f9c4a3ad5c120bcdd681b958808ada4d885d21aeb4a009a36a674ad3ece9b51837212a982db6142a6b5580e5b68d46971b802456701391ce40785ae6ebd9
- SSDEEP 3072:KU6LKKnw8i/9S7BLGKm/nuFV3uNgosUBxr+2y97CqGIpHtWMeJnQRLj+bTHyKaY:Iw8aIMrfuFVeNgosUBxra4rIZsqq
- TLSH T133047C19F640E871D4D20178311C6B3119FEA87017A980CBF3472BCEE9A97D5A67E36B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxupdate.inf
- Size 12KB
- SHA256 93f5589499ee4ee2812d73c0d8feacbbcfe8c47b6d98572486bc0eff3c5906ca
- MD5 e6a74342f328afa559d5b0544e113571
- SHA1 a08b053dfd061391942d359c70f9dd406a968b7d
- SHA512 1e35e5bdff1d551da6c1220a1a228c657a56a70dedf5be2d9273fc540f9c9f0bb73469595309ea1ff561be7480ee92d16f7acbbd597136f4fc5f9b8b65ecdfad
- SSDEEP 384:eXTiDxtV0xxmBxbD6Ys7s6xHOJYwYdDxAp8xXZyUxIJM:eXiM
- TLSH T121429976B5168259F40EB3A016AF3EC95E3B008FB53164CD79EF11B0572E1ACA2FE464
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.cif
- Size 56KB
- SHA256 762ff640013db2bd4109d7df43a867303093815751129bd1e33f16bf02e52cce
- MD5 7b1fbe9f5f43b2261234b78fe115cf8e
- SHA1 dd0f256ae38b4c4771e1d1ec001627017b7bb741
- SHA512 d21935a9867c0f2f7084917c79fbb1da885a1bfd4793cf669ff4da8c777b3a201857250bfb7c2b616625a8d3573c68395d210446d2c284b41cf09cc7cbb07885
- SSDEEP 768:eNIkdgBl0DBU0qwUqB7otN4PTHhy4m1Io/sF6UcmI2rIEoguD0dpY4rI8dgXl0dL:epECjtutVj072Xwt7O49vQzztSZs5KLV
- TLSH T17443FB00F0F22DEE405A5C5A27895D6A0C9F64557C5D202EB9CE83B89FFC1ED93899E3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.exe
- Size 515KB
- SHA256 8f5e89298e3dc2e22d47515900c37cca4ee121c5ba06a6d962d40ad6e1a595da
- MD5 ac3a5f7be8cd13a863b50ab5fe00b71c
- SHA1 eee417cd92e263b84dd3b5dcc2b4b463fe6e84d9
- SHA512 c8bbe791373dad681f0ac9f5ab538119bde685d4f901f5db085c73163fc2e868972b2de60e72ccd44f745f1fd88fcde2e27f32302d8cbd3c1f43e6e657c79fba
- SSDEEP 3072:diqLKVd9Aqq3Z/yKxAG2ur4IhUNJ4g3nO9hpRH0gQSpHt+akOC8BTDmsikzWX+us:DFAKJr4IWNJ4MOrpRBQS3kydI+xyS
- TLSH T1EEB4F05032F4D926F2F32B743ABDE26148BA7D90AA38C24D2502565D1BF3B40A56CF77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\dxwsetup.inf
- Size 477B
- SHA256 d63c35e9b43eb0f28ffc28f61c9c9a306da9c9de3386770a7eb19faa44dbfc00
- MD5 ad8982eaa02c7ad4d7cdcbc248caa941
- SHA1 4ccd8e038d73a5361d754c7598ed238fc040d16b
- SHA512 5c805d78bafff06c36b5df6286709ddf2d36808280f92e62dc4c285edd9176195a764d5cf0bb000da53ca8bbf66ddd61d852e4259e3113f6529e2d7bdbdd6e28
- TLSH T191F05C5F6D438D0C30A535207AA346CBFF4C107051C5A08EB54DE05A87E87AD49AC0FF
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Logs\DirectX.log
- Size 56KB
- SHA256 788c52c056a45c95d752d0fc347e76c3370b3836639c9e64d8a45f9350c1b45b
- MD5 5a96135f129090e689b768e9bac66dcf
- SHA1 12463da675f953716778865902cf4b126b04ca74
- SHA512 08caa0d3e191187d5f508a8d9a2a0cb0a623ece9eddd9a6875e71a2cf0ee091951717f1ce74b2e06bb9f0d4b7fbb745e40af75c1b6b29d63beef4ae496370379
- SSDEEP 192:AX9O0H6oi/hIyNRE4r8uoxmaHW/bUv0G75dskJNcuz2Df2ICi7Js6dvqvOe3qfWF:AzX
- TLSH T14B43D15E7865DF203961C384448A17C92538F7431A4050B1A7AD5E4FAE32EBE2E1B6FF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
- Size 55B
- SHA256 e86cfa47eb11b2bf6a7d5d25e24630d800e71fc936624b685a4ea7f81d1d30f3
- MD5 4096eb383b2222649cf13d3b9d52663f
- SHA1 c3ad9535cacacd835cbe299479917ff4e8fff763
- SHA512 4165508e2dbc2df01000c6472f6b7e69cbc51d1cfb96c0df821393e6a1becf35bf8b8b74812818d68e6d55e8a5cd645184dbd28c945b98c5f953e21509be986f
- TLSH T1FD90020E0200E03901115B445532215416F852867555D02D114005556785A2D898D824
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\directx\websetup\filelist.dat
- Size 137B
- SHA256 f960075a7b1c2590e18700f3230f7baea9aced3e6ba5dc93dac193027b5cec48
- MD5 cec960807fa5bec11ad4a31c3512da4d
- SHA1 a3ac60a3518747d3bbead5edfd17e155cf7ce9f7
- SHA512 2da2d935f9b96bd36536f3a7a494775c8ed9bfef6538ffe66307b73cd5c82210fc43bbe6706d74d99dd5b924fb78a0d1beceee8c0e22d91e17b1346dd85690ec
- TLSH T129C02B850100F0BE000E6616483734E410B401E778828C1C004A41982F4055C448CC24
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\msdownld.tmp\AS5A71DC.tmp\dxupdate.cab
- Size 98KB
- SHA256 6e39b3fdb6722ea8aa0dc8f46ae0d8bd6496dd0f5f56bac618a0a7dd22d6cfb2
- MD5 4afd7f5c0574a0efd163740ecb142011
- SHA1 3ebca5343804fe94d50026da91647442da084302
- SHA512 6f974acec7d6c1b6a423b28810b0840e77a9f9c1f9632c5cba875bd895e076c7e03112285635cf633c2fa9a4d4e2f4a57437ae8df88a7882184ff6685ee15f3f
- SSDEEP 3072:lvknxJpNYAzRstaRkz0BwwnNbSa+vp5647S:FkZNXsERk6wwBSa+vnl2
- TLSH T16FA302EC8B5D8F93C5723CA5A1A8E90B7D7EF59E491CD02585B4F2442CA2BC9F3A045C
- MD5 SHA1 SHA512 SSDEEP TLSH