Analysis
- max time kernel
300s - max time network
302s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/07/2026, 09:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Vat.No.20260715231017.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
300 seconds
Behavioral task
behavioral2
Sample
Vat.No.20260715231017.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
15 signatures
300 seconds
Behavioral task
behavioral3
Sample
pdfcOrE8.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
300 seconds
Behavioral task
behavioral4
Sample
pdfcOrE8.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
300 seconds
General
- Target Vat.No.20260715231017.exe
- Size 3.3MB
- Sample260718-lll9rsft4m
- SHA256 5dabdd4b418ca8b4034b5dea3684da0c10022ca5793c84439e4698e338e25db3
- MD5 13b01f46ec5078298548cdf8380f4c76
- SHA1 8b1af1ebc15b474dc6284f169f9ffdbe7e3cefb9
- SHA512 c64ee8e31261813e1f53a3e572c7759650e81cf36ac80c706da2cf7f6ad060ccb72b83820a7df51637c5248dbd2e5134940fc23ca80c37fe63d68318d63ed60a
- SSDEEP 98304:4xJgBc/Esdil3UQwcvEPiXZqkZMYy16I7Pk7H56s5Qz/S2:4xYxZGxqNW6I7c7H56qkS2
- TLSH T1B2F59E20BAD24076C173113159AAA3797379FA303B3586C7A6913F7D3E302D25D396AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: CopilotUpdate.exe File opened (read-only) \??\Y: CopilotUpdate.exe File opened (read-only) \??\Q: CopilotUpdate.exe File opened (read-only) \??\R: CopilotUpdate.exe File opened (read-only) \??\G: CopilotUpdate.exe File opened (read-only) \??\L: CopilotUpdate.exe File opened (read-only) \??\O: CopilotUpdate.exe File opened (read-only) \??\V: CopilotUpdate.exe File opened (read-only) \??\M: CopilotUpdate.exe File opened (read-only) \??\P: CopilotUpdate.exe File opened (read-only) \??\T: CopilotUpdate.exe File opened (read-only) \??\U: CopilotUpdate.exe File opened (read-only) \??\D: CopilotUpdate.exe File opened (read-only) \??\H: CopilotUpdate.exe File opened (read-only) \??\I: CopilotUpdate.exe File opened (read-only) \??\J: CopilotUpdate.exe File opened (read-only) \??\K: CopilotUpdate.exe File opened (read-only) \??\W: CopilotUpdate.exe File opened (read-only) \??\X: CopilotUpdate.exe File opened (read-only) \??\Z: CopilotUpdate.exe File opened (read-only) \??\B: CopilotUpdate.exe File opened (read-only) \??\N: CopilotUpdate.exe - Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 api.ipify.org 9 api.ipify.org - Enumerates processes with tasklist 1 TTPs 10 IoCs
pid Process 2436 tasklist.exe 3404 tasklist.exe 4992 tasklist.exe 4008 tasklist.exe 6104 tasklist.exe 2544 tasklist.exe 2988 tasklist.exe 4912 tasklist.exe 4660 tasklist.exe 2892 tasklist.exe - Executes dropped EXE 2 IoCs
pid Process 5584 CopilotUpdate.exe 4836 CopilotUpdate.exe - Loads dropped DLL 2 IoCs
pid Process 5584 CopilotUpdate.exe 4836 CopilotUpdate.exe - Executes a command shell one-liner 1 TTPs 3 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1680 cmd.exe 2424 cmd.exe 2060 cmd.exe - Program crash 1 IoCs
pid pid_target Process procid_target 3964 4836 WerFault.exe 103 - System Location Discovery: System Language Discovery 1 TTPs 38 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CopilotUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Vat.No.20260715231017.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ComputerDefaults.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CopilotUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe - Delays execution with timeout.exe 10 IoCs
pid Process 3744 timeout.exe 5724 timeout.exe 5996 timeout.exe 5812 timeout.exe 5952 timeout.exe 3924 timeout.exe 4804 timeout.exe 1544 timeout.exe 5740 timeout.exe 3800 timeout.exe - Kills process with taskkill 1 IoCs
pid Process 1204 taskkill.exe - Modifies registry class 10 IoCs
description ioc Process Key deleted \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\ms-settings\Shell\open\command Vat.No.20260715231017.exe Key deleted \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\ms-settings\Shell\open Vat.No.20260715231017.exe Key deleted \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\ms-settings Vat.No.20260715231017.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\ms-settings\Shell\open\command Vat.No.20260715231017.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\ms-settings Vat.No.20260715231017.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\ms-settings\Shell\open Vat.No.20260715231017.exe Set value (str) \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\ms-settings\Shell\open\command\DelegateExecute = "Ā" Vat.No.20260715231017.exe Key deleted \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\ms-settings\Shell Vat.No.20260715231017.exe Key created \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\ms-settings\Shell Vat.No.20260715231017.exe Set value (str) \REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/8E0ABD8F-476E-471F-9583-E69223248BAC_20833rnixe6s8/Installers/CopilotUpdate.exe" Vat.No.20260715231017.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5584 CopilotUpdate.exe 5584 CopilotUpdate.exe 5584 CopilotUpdate.exe 5584 CopilotUpdate.exe 5584 CopilotUpdate.exe 5584 CopilotUpdate.exe 5584 CopilotUpdate.exe 5584 CopilotUpdate.exe 5584 CopilotUpdate.exe 5584 CopilotUpdate.exe 5584 CopilotUpdate.exe 5584 CopilotUpdate.exe 5584 CopilotUpdate.exe 5584 CopilotUpdate.exe 5584 CopilotUpdate.exe 5584 CopilotUpdate.exe 5584 CopilotUpdate.exe 5584 CopilotUpdate.exe 5584 CopilotUpdate.exe 5584 CopilotUpdate.exe 5584 CopilotUpdate.exe 5584 CopilotUpdate.exe 5584 CopilotUpdate.exe 5584 CopilotUpdate.exe 5584 CopilotUpdate.exe 5584 CopilotUpdate.exe 5584 CopilotUpdate.exe 5584 CopilotUpdate.exe 5584 CopilotUpdate.exe 5584 CopilotUpdate.exe 5584 CopilotUpdate.exe 5584 CopilotUpdate.exe 5584 CopilotUpdate.exe 5584 CopilotUpdate.exe 5584 CopilotUpdate.exe 5584 CopilotUpdate.exe 5584 CopilotUpdate.exe 5584 CopilotUpdate.exe 5584 CopilotUpdate.exe 5584 CopilotUpdate.exe 5584 CopilotUpdate.exe 5584 CopilotUpdate.exe 5584 CopilotUpdate.exe 5584 CopilotUpdate.exe 5584 CopilotUpdate.exe 5584 CopilotUpdate.exe 5584 CopilotUpdate.exe 5584 CopilotUpdate.exe 5584 CopilotUpdate.exe 5584 CopilotUpdate.exe 5584 CopilotUpdate.exe 5584 CopilotUpdate.exe 5584 CopilotUpdate.exe 5584 CopilotUpdate.exe 5584 CopilotUpdate.exe 5584 CopilotUpdate.exe 5584 CopilotUpdate.exe 5584 CopilotUpdate.exe 5584 CopilotUpdate.exe 5584 CopilotUpdate.exe 5584 CopilotUpdate.exe 5584 CopilotUpdate.exe 5584 CopilotUpdate.exe 5584 CopilotUpdate.exe - Suspicious use of AdjustPrivilegeToken 51 IoCs
description pid Process Token: SeDebugPrivilege 5584 CopilotUpdate.exe Token: SeIncBasePriorityPrivilege 5584 CopilotUpdate.exe Token: SeLoadDriverPrivilege 5584 CopilotUpdate.exe Token: SeTakeOwnershipPrivilege 5584 CopilotUpdate.exe Token: SeTcbPrivilege 5584 CopilotUpdate.exe Token: SeDebugPrivilege 1204 taskkill.exe Token: SeDebugPrivilege 4008 tasklist.exe Token: SeDebugPrivilege 5584 CopilotUpdate.exe Token: SeCreateTokenPrivilege 5584 CopilotUpdate.exe Token: SeAssignPrimaryTokenPrivilege 5584 CopilotUpdate.exe Token: SeLockMemoryPrivilege 5584 CopilotUpdate.exe Token: SeIncreaseQuotaPrivilege 5584 CopilotUpdate.exe Token: SeMachineAccountPrivilege 5584 CopilotUpdate.exe Token: SeTcbPrivilege 5584 CopilotUpdate.exe Token: SeSecurityPrivilege 5584 CopilotUpdate.exe Token: SeTakeOwnershipPrivilege 5584 CopilotUpdate.exe Token: SeLoadDriverPrivilege 5584 CopilotUpdate.exe Token: SeSystemProfilePrivilege 5584 CopilotUpdate.exe Token: SeSystemtimePrivilege 5584 CopilotUpdate.exe Token: SeProfSingleProcessPrivilege 5584 CopilotUpdate.exe Token: SeIncBasePriorityPrivilege 5584 CopilotUpdate.exe Token: SeCreatePagefilePrivilege 5584 CopilotUpdate.exe Token: SeCreatePermanentPrivilege 5584 CopilotUpdate.exe Token: SeBackupPrivilege 5584 CopilotUpdate.exe Token: SeRestorePrivilege 5584 CopilotUpdate.exe Token: SeShutdownPrivilege 5584 CopilotUpdate.exe Token: SeDebugPrivilege 5584 CopilotUpdate.exe Token: SeAuditPrivilege 5584 CopilotUpdate.exe Token: SeSystemEnvironmentPrivilege 5584 CopilotUpdate.exe Token: SeChangeNotifyPrivilege 5584 CopilotUpdate.exe Token: SeRemoteShutdownPrivilege 5584 CopilotUpdate.exe Token: SeUndockPrivilege 5584 CopilotUpdate.exe Token: SeSyncAgentPrivilege 5584 CopilotUpdate.exe Token: SeEnableDelegationPrivilege 5584 CopilotUpdate.exe Token: SeManageVolumePrivilege 5584 CopilotUpdate.exe Token: SeImpersonatePrivilege 5584 CopilotUpdate.exe Token: SeCreateGlobalPrivilege 5584 CopilotUpdate.exe Token: 31 5584 CopilotUpdate.exe Token: 32 5584 CopilotUpdate.exe Token: 33 5584 CopilotUpdate.exe Token: 34 5584 CopilotUpdate.exe Token: 35 5584 CopilotUpdate.exe Token: SeDebugPrivilege 6104 tasklist.exe Token: SeDebugPrivilege 2544 tasklist.exe Token: SeDebugPrivilege 2892 tasklist.exe Token: SeDebugPrivilege 2988 tasklist.exe Token: SeDebugPrivilege 2436 tasklist.exe Token: SeDebugPrivilege 3404 tasklist.exe Token: SeDebugPrivilege 4992 tasklist.exe Token: SeDebugPrivilege 4912 tasklist.exe Token: SeDebugPrivilege 4660 tasklist.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1252 Vat.No.20260715231017.exe 5584 CopilotUpdate.exe 5584 CopilotUpdate.exe 4836 CopilotUpdate.exe - Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 1252 wrote to memory of 1680 1252 Vat.No.20260715231017.exe 89 PID 1680 wrote to memory of 1596 1680 cmd.exe 91 PID 1596 wrote to memory of 5584 1596 ComputerDefaults.exe 92 PID 5584 wrote to memory of 1204 5584 CopilotUpdate.exe 93 PID 5584 wrote to memory of 2424 5584 CopilotUpdate.exe 96 PID 2424 wrote to memory of 2060 2424 cmd.exe 98 PID 2060 wrote to memory of 4008 2060 cmd.exe 99 PID 2060 wrote to memory of 2336 2060 cmd.exe 100 PID 2060 wrote to memory of 3744 2060 cmd.exe 101 PID 2060 wrote to memory of 6104 2060 cmd.exe 108 PID 2060 wrote to memory of 2956 2060 cmd.exe 109 PID 2060 wrote to memory of 5724 2060 cmd.exe 110 PID 2060 wrote to memory of 2544 2060 cmd.exe 111 PID 2060 wrote to memory of 4700 2060 cmd.exe 112 PID 2060 wrote to memory of 3924 2060 cmd.exe 113 PID 2060 wrote to memory of 2892 2060 cmd.exe 114 PID 2060 wrote to memory of 5612 2060 cmd.exe 115 PID 2060 wrote to memory of 5996 2060 cmd.exe 116 PID 2060 wrote to memory of 2988 2060 cmd.exe 117 PID 2060 wrote to memory of 5920 2060 cmd.exe 118 PID 2060 wrote to memory of 5812 2060 cmd.exe 119 PID 2060 wrote to memory of 2436 2060 cmd.exe 120 PID 2060 wrote to memory of 3420 2060 cmd.exe 121 PID 2060 wrote to memory of 4804 2060 cmd.exe 122 PID 2060 wrote to memory of 3404 2060 cmd.exe 123 PID 2060 wrote to memory of 4432 2060 cmd.exe 124 PID 2060 wrote to memory of 1544 2060 cmd.exe 125 PID 2060 wrote to memory of 4992 2060 cmd.exe 126 PID 2060 wrote to memory of 2940 2060 cmd.exe 127 PID 2060 wrote to memory of 5740 2060 cmd.exe 128 PID 2060 wrote to memory of 4912 2060 cmd.exe 129 PID 2060 wrote to memory of 2620 2060 cmd.exe 130 PID 2060 wrote to memory of 5952 2060 cmd.exe 131 PID 2060 wrote to memory of 4660 2060 cmd.exe 132 PID 2060 wrote to memory of 4908 2060 cmd.exe 133 PID 2060 wrote to memory of 3800 2060 cmd.exe 134
Processes
-
C:\Users\Admin\AppData\Local\Temp\Vat.No.20260715231017.exe"C:\Users\Admin\AppData\Local\Temp\Vat.No.20260715231017.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Windows\SysWOW64\cmd.exe/c C:\Windows\System32\ComputerDefaults.exe2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Windows\SysWOW64\ComputerDefaults.exeC:\Windows\System32\ComputerDefaults.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\ProgramData\8E0ABD8F-476E-471F-9583-E69223248BAC_20833rnixe6s8\Installers\CopilotUpdate.exe"CopilotUpdate.exe"4⤵
- Enumerates connected drives
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5584 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im cmd.exe5⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1204
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start "" /B cmd /C C:\Users\Admin\AppData\Local\Temp\65BB6CE32B875E9DB34.BAT5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Windows\SysWOW64\cmd.execmd /C C:\Users\Admin\AppData\Local\Temp\65BB6CE32B875E9DB34.BAT6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4008
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:2336
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:3744
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:6104
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:2956
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:5724
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2544
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:4700
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:3924
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2892
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:5612
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:5996
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2988
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:5920
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:5812
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2436
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:3420
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4804
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3404
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:4432
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1544
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4992
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:2940
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:5740
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4912
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:2620
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:5952
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4660
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:4908
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:3800
-
-
-
-
-
-
-
C:\ProgramData\8E0ABD8F-476E-471F-9583-E69223248BAC_20833rnixe6s8\Installers\CopilotUpdate.exeC:\ProgramData\8E0ABD8F-476E-471F-9583-E69223248BAC_20833rnixe6s8\Installers\CopilotUpdate.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4836 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4836 -s 6962⤵
- Program crash
PID:3964
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4836 -ip 48361⤵PID:5328
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\8E0ABD8F-476E-471F-9583-E69223248BAC_20833rnixe6s8\Installers\CopilotUpdate.exe
- Size 3.3MB
- SHA256 5dabdd4b418ca8b4034b5dea3684da0c10022ca5793c84439e4698e338e25db3
- MD5 13b01f46ec5078298548cdf8380f4c76
- SHA1 8b1af1ebc15b474dc6284f169f9ffdbe7e3cefb9
- SHA512 c64ee8e31261813e1f53a3e572c7759650e81cf36ac80c706da2cf7f6ad060ccb72b83820a7df51637c5248dbd2e5134940fc23ca80c37fe63d68318d63ed60a
- SSDEEP 98304:4xJgBc/Esdil3UQwcvEPiXZqkZMYy16I7Pk7H56s5Qz/S2:4xYxZGxqNW6I7c7H56qkS2
- TLSH T1B2F59E20BAD24076C173113159AAA3797379FA303B3586C7A6913F7D3E302D25D396AB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\8E0ABD8F-476E-471F-9583-E69223248BAC_20833rnixe6s8\Installers\pdFcOrE8.dLl
- Size 3.4MB
- SHA256 7c1ab2209ed95a0a98fb5c23e007b3bf3e8a7e7f8424a5cf5ff3331dac6ae4d7
- MD5 c056b0db5b3c2c7c7b1a3f7e71fa0e3a
- SHA1 83d6eba7a7f6cf5386be61a1aa67ccbb5d2a3198
- SHA512 52b4ca35f8575b866e7035a7a39d33d1becc2ada34864012482fc9d03c5502ef4ed75166c339344f8e412c699ed279ac5c6ea93656d0f06766f2036ab225bcd2
- SSDEEP 98304:Ojrm+RpaivYWX78aMXa3UxSODUUZn98L48lhnjk:srdaBWX7BUxSODUUZO
- TLSH T133F5C031B998007BDD6B12705A0BB3ADF1FD727819F58863F294C62C2D7AC8285195EF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\65BB6CE32B875E9DB34.BAT
- Size 862B
- SHA256 63ea4293c215783848f5d21d1f26235ba1b10c328e74c822f50c76c3ccc61534
- MD5 ed94a104f2fa51a4dc280264483eb8b7
- SHA1 618796a5a3f6cd03f2a5bb4cf25e5866ef78094c
- SHA512 daa3e18b6a178d009d37d7293a84cc633e6f558cf883f0d37626ef68085f2ca87afbbba77a16ceb57f0e3e6dc87b125eb0fbf7438b21d4d4d65326b08ada4d89
- TLSH T16311508F520B286C07F482B778914E464F99D083F737A1D87004D7086B5A54F55D935C
- MD5 SHA1 SHA512 TLSH