Analysis
- max time kernel
151s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/07/2026, 07:14
Static task
static1
Behavioral task
behavioral1
Sample
5f1c6059cbca3d1ba33c9834e845d290d8bfde3c4e0a37a71207b1a9b31593a7.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
5f1c6059cbca3d1ba33c9834e845d290d8bfde3c4e0a37a71207b1a9b31593a7.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
General
- Target 5f1c6059cbca3d1ba33c9834e845d290d8bfde3c4e0a37a71207b1a9b31593a7.exe
- Size 5.5MB
- Sample260720-h2vdjact8y
- SHA256 5f1c6059cbca3d1ba33c9834e845d290d8bfde3c4e0a37a71207b1a9b31593a7
- MD5 0084596140bfc8121401216f3d0873aa
- SHA1 dda1f796c86a0d4c94c6087cd9112eb37a0f2b14
- SHA512 a94ea105afc60a03a8ab93e31b2f7087194597be7418529e246e002e0e9548b40bccea3b14eddb69c1591f3e8773d469a787d8519384a2f86fd41bcacac3d4c1
- SSDEEP 98304:GNGUycYxOMevV0rzpcSdAy0ZxO47tqKfa1iLQLEtr/VeT+bQDWQKFD:GNGNcWdDiSdbAO47Hy13Lwb8ibBH9
- TLSH T14F4633791277EAABCA4D427603EE3D75252B6738304E9FDBC160D0006F65796C29B23E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- UAC bypass 3 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" rdclient.exe - Deletes itself 1 IoCs
pid Process 2476 WScript.exe - Drops file in System32 directory 10 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\30069012ED3CF5DB92F9F4FC78D55E2D_87238437CEFCADF00F1385E31A888EF4 rdclient.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4E4160FB650E5091C535216313A4ECD3_C47ED8EE7F5A9F96A4CA5A4E077920F9 rdclient.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4E4160FB650E5091C535216313A4ECD3_C47ED8EE7F5A9F96A4CA5A4E077920F9 rdclient.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 rdclient.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 rdclient.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData rdclient.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content rdclient.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft rdclient.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache rdclient.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\30069012ED3CF5DB92F9F4FC78D55E2D_87238437CEFCADF00F1385E31A888EF4 rdclient.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
pid Process 2476 WScript.exe -
resource yara_rule behavioral2/memory/3844-3-0x0000000010000000-0x00000000100BE000-memory.dmp upx behavioral2/memory/3844-5-0x0000000010000000-0x00000000100BE000-memory.dmp upx behavioral2/memory/3844-6-0x0000000010000000-0x00000000100BE000-memory.dmp upx behavioral2/memory/3844-9-0x0000000010000000-0x00000000100BE000-memory.dmp upx behavioral2/memory/3844-14-0x0000000010000000-0x00000000100BE000-memory.dmp upx behavioral2/memory/3844-19-0x0000000010000000-0x00000000100BE000-memory.dmp upx behavioral2/memory/3844-21-0x0000000010000000-0x00000000100BE000-memory.dmp upx - Executes dropped EXE 2 IoCs
pid Process 1764 rdService.exe 724 rdclient.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5f1c6059cbca3d1ba33c9834e845d290d8bfde3c4e0a37a71207b1a9b31593a7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rdService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rdclient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WScript.exe - Modifies data under HKEY_USERS 49 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CTLs rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CRLs rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CTLs rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CRLs rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople rdclient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs rdclient.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings 5f1c6059cbca3d1ba33c9834e845d290d8bfde3c4e0a37a71207b1a9b31593a7.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3844 5f1c6059cbca3d1ba33c9834e845d290d8bfde3c4e0a37a71207b1a9b31593a7.exe 3844 5f1c6059cbca3d1ba33c9834e845d290d8bfde3c4e0a37a71207b1a9b31593a7.exe 1764 rdService.exe 1764 rdService.exe 1764 rdService.exe 1764 rdService.exe 1764 rdService.exe 1764 rdService.exe 1764 rdService.exe 1764 rdService.exe 1764 rdService.exe 1764 rdService.exe 1764 rdService.exe 1764 rdService.exe 1764 rdService.exe 1764 rdService.exe 1764 rdService.exe 1764 rdService.exe 1764 rdService.exe 1764 rdService.exe 1764 rdService.exe 1764 rdService.exe 1764 rdService.exe 1764 rdService.exe 1764 rdService.exe 1764 rdService.exe 1764 rdService.exe 1764 rdService.exe 724 rdclient.exe 724 rdclient.exe 1764 rdService.exe 1764 rdService.exe 1764 rdService.exe 1764 rdService.exe 1764 rdService.exe 1764 rdService.exe 1764 rdService.exe 1764 rdService.exe 1764 rdService.exe 1764 rdService.exe 1764 rdService.exe 1764 rdService.exe 1764 rdService.exe 1764 rdService.exe 1764 rdService.exe 1764 rdService.exe 1764 rdService.exe 1764 rdService.exe 1764 rdService.exe 1764 rdService.exe 1764 rdService.exe 1764 rdService.exe 1764 rdService.exe 1764 rdService.exe 1764 rdService.exe 1764 rdService.exe 1764 rdService.exe 1764 rdService.exe 1764 rdService.exe 1764 rdService.exe 1764 rdService.exe 1764 rdService.exe 1764 rdService.exe 1764 rdService.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1764 rdService.exe Token: SeDebugPrivilege 1764 rdService.exe Token: SeDebugPrivilege 724 rdclient.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3844 5f1c6059cbca3d1ba33c9834e845d290d8bfde3c4e0a37a71207b1a9b31593a7.exe 3844 5f1c6059cbca3d1ba33c9834e845d290d8bfde3c4e0a37a71207b1a9b31593a7.exe 724 rdclient.exe 724 rdclient.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1764 wrote to memory of 724 1764 rdService.exe 92 PID 3844 wrote to memory of 2476 3844 5f1c6059cbca3d1ba33c9834e845d290d8bfde3c4e0a37a71207b1a9b31593a7.exe 93 - System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System rdclient.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" rdclient.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f1c6059cbca3d1ba33c9834e845d290d8bfde3c4e0a37a71207b1a9b31593a7.exe"C:\Users\Admin\AppData\Local\Temp\5f1c6059cbca3d1ba33c9834e845d290d8bfde3c4e0a37a71207b1a9b31593a7.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\tem.vbs"2⤵
- Deletes itself
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
PID:2476
-
-
C:\Users\Admin\AppData\Roaming\cvOkiPCL\rdpro\rdService.exeC:\Users\Admin\AppData\Roaming\cvOkiPCL\rdpro\rdService.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Users\Admin\AppData\Roaming\cvOkiPCL\rdpro\rdclient.exeC:\Users\Admin\AppData\Roaming\cvOkiPCL\rdpro\rdclient.exe quiet2⤵
- UAC bypass
- Drops file in System32 directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:724
-
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\Microsoft\Crypto\RSA\S-1-5-18\f2b2259abe14d0e1a3ec40f0c3934404_dbb21806-baa1-4fee-bd71-4bba0b9aeeac
- Size 50B
- SHA256 aaa402e6cd6e2a07d85d721868d50eac45a51a180e207e187c8e4eb13a0f433c
- MD5 328ffc4c2b4fdf0f5973af4e0007f7a1
- SHA1 169ab8db767eb377a99693474af5b8a3d0b7bcf8
- SHA512 9806db498ce24a2691d393a0e26483ad16a6ed7a5be74e51a13ad3296de29ffd2e1f2547d4ece9b4f6c2aa243d03c19a716a372d367bee5885f45dd169899985
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\tem.vbs
- Size 275B
- SHA256 468cffe2d9d9136179a5e6c77642c6b0f98700fe888f90376f891c0a91845df0
- MD5 610794ddf12a33a899e7d51dfa1883fc
- SHA1 5bdf78b62222a90236640e1a408038168726eaef
- SHA512 21e907e3967d9a10abcbe3460cd8951736be03dec588f9eed6a9671a2a34d05b462aad6d06fad84e9e0cb2c3193defe7a5a5acc9cb56006ac368953a8e8f532a
- TLSH T18FD02B61DE42C56E083241134462490EE034080D6A60BB147695DAC86FD3739FB8B387
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\cvOkiPCL\rdpro\cfg.ini
- Size 171B
- SHA256 4cbe2d163c52041b29d02f85d76c93d5a3df1d66698d3d8374d54db6531ec059
- MD5 3d4c40a6e8280e553ac669b8f7bb2fa4
- SHA1 2a0543adb6c6dada6048efffbd535b0fda7f56fa
- SHA512 c9da8f4e47faa16fcc2583c350e9724d8eced0ea6724db342d038b5a2056a100df03d6ea3814de2ef7736e33c4a8c984feed5bd202b6dad8d1f9400a5df97183
- TLSH T196C08059691FF45719F8103A9045454C89917D14EC3F624489706087DBFC7F56AC1E18
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\cvOkiPCL\rdpro\host.dat
- Size 130B
- SHA256 13d092859c2648ce7eab0e820793ee1c0960f8032f1853113e256daf9dd30c25
- MD5 da9c3a36d10f026124111e9f9413cafd
- SHA1 9c50626ec07a319c07f70ecb9a7b075c394571b6
- SHA512 ceec819fa4b7390325d6921916048241859869bb982ffc1f96f226a288e1a4079052bbd040541fa16d4acb4858b973195d82ed6bfc7388d66469bf087c0abeb9
- TLSH T12CC02B0F1024D680E661030C6704881601012F3DB44C085ADA808D03820C80C00C7006
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\cvOkiPCL\rdpro\rdService.exe
- Size 2.5MB
- SHA256 7ed2a077a1ce34fcb182e5135ae75ad7bd96207c3204c9f343095f967bfa109f
- MD5 db3d3a7f82f0c7afb258a98c50a66a36
- SHA1 8cc26bec161dc58472e848c427310ae396520f88
- SHA512 73b54dc39fbb512054168ad59acaf00b2177138091869f6df46a8fa24b98e977092617cc89d32cad5690f8e930715352003adde7d3a0ac9a1c9fcb942f62471e
- SSDEEP 24576:dEGJjsQPX8V/vLGUFAyzEVSg1F2+kkROf4pY7DH7cpFVBqSRg/lIhu/WST5V2tSw:Ts8Xi3LdFb0MR7uVASC/rWSrU3
- TLSH T127C55B23B2D9653ED06B173A5827B6145C3BB7A13A2A9C0797F4084C9F296C13E3B747
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\cvOkiPCL\rdpro\rdclient.exe
- Size 13.9MB
- SHA256 5bea7f348d4ff47afb4abbb06909b894434d4df83318780da23bbe49bc0fb233
- MD5 122c481e44221fefd34c808ff679b1ba
- SHA1 d002ac7ca106776410881727705618c7e2a6e6f6
- SHA512 7f6d2ad71d0caa2cbcce915283fee74c56e38a75d04d989dfb4032edcbd763a88f663df7ecd021fa311dc67267c2a7a7c1cd9c9ed93a7e2b37729553bf428773
- SSDEEP 196608:adkzWu3D5fHvGDYXtAUEhry3idpjMUFd3mptq9:ayzW+D5fHuD6ghr5XgdpG
- TLSH T138E69E07B680A03BD4672A3A982BD3D0283BBE316A15CD573BB8BD4C6F356417D29747
- MD5 SHA1 SHA512 SSDEEP TLSH