Analysis
- max time kernel
151s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
20/07/2026, 07:51
General
- Target 2026-07-20_3480ab31c9f1b32e8b40768ca280e665_amadey_darkgate_glassworm_icedid.exe
- Size 50.0MB
- Sample260720-jp6fpsdt9s
- SHA256 1518d06c127ab15a628c2f9760dec4b726b3531757b5d689692e2b8292c6f37f
Score
10/10
Malware Config
Signatures
- Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Detects Sheetrat Payload 4 IoCs
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 3 IoCs
- UAC bypass 3 TTPs 12 IoCs
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 4 IoCs
- Detects executables (downlaoders) containing URLs to raw contents of a paste 4 IoCs
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen 4 IoCs
- Modifies Windows Firewall 2 TTPs 3 IoCs
- Creates new service(s) 2 TTPs
- Executes dropped EXE 8 IoCs
- Loads dropped DLL 4 IoCs
- Registers new Windows logon scripts automatically executed at logon. 1 TTPs 2 IoCs
- Stops running service(s) 4 TTPs
- Checks whether UAC is enabled 1 TTPs 6 IoCs
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory 1 IoCs
- Drops file in Windows directory 4 IoCs
- Launches sc.exe 9 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Executes a command shell one-liner 1 TTPs 16 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 7 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 29 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 18 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_3480ab31c9f1b32e8b40768ca280e665_amadey_darkgate_glassworm_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-20_3480ab31c9f1b32e8b40768ca280e665_amadey_darkgate_glassworm_icedid.exe"1⤵
- Modifies WinLogon for persistence
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Registers new Windows logon scripts automatically executed at logon.
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\2026-07-20_3480ab31c9f1b32e8b40768ca280e665_amadey_darkgate_glassworm_icedid.exe" enable=yes & exit2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\2026-07-20_3480ab31c9f1b32e8b40768ca280e665_amadey_darkgate_glassworm_icedid.exe" enable=yes3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /S2⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete "WindowsUpdaterDefenderMicrosoft"2⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-07-20_3480ab31c9f1b32e8b40768ca280e665_amadey_darkgate_glassworm_icedid.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"2⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" start "WindowsUpdaterDefenderMicrosoft"2⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /D2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /D2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /D2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /D2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /S2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_2b3f4a5a" /F2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" L: /S2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_2b3f4a5a" /XML "C:\Users\Admin\AppData\Local\Temp\7abf37cf-35ea-4309-855f-def1b4093f66.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 12 /tn "MicrosoftEdgeUpdate" /tr "C:\Windows\System32\BootFiles\BootExecutor.exe" /RL HIGHEST & exit2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 12 /tn "MicrosoftEdgeUpdate" /tr "C:\Windows\System32\BootFiles\BootExecutor.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_4b0502c3" /F2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_4b0502c3" /XML "C:\Users\Admin\AppData\Local\Temp\a60081c7-7808-4326-91b0-232204838fb9.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" netsh advfirewall firewall add rule name="WindowsControl" dir=in action=allow program="C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" enable=yes & exit2⤵
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c schtasks /delete /F /TN "Holy Check" & exit2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /delete /F /TN "Holy Check"3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc onlogon /tn "Holy Check" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" & exit2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /tn "Holy Check" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c schtasks /create /f /tn "Holy Check_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /tn "Holy Check_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c schtasks /create /f /tn "Holy Check_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /tn "Holy Check_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c schtasks /create /f /tn "Holy Check_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance" & exit2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /tn "Holy Check_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c schtasks /create /f /tn "Holy Check_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance" & exit2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /tn "Holy Check_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "Microsoft Compatibility Appraiser_823d9c2d" /F2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" L: /D2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "Microsoft Compatibility Appraiser_823d9c2d" /XML "C:\Users\Admin\AppData\Local\Temp\c639b58f-376b-40ab-b698-a2002ef8fbb5.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" M: /S2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_a957dc4f" /F2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" M: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_a957dc4f" /XML "C:\Users\Admin\AppData\Local\Temp\c71a412b-11a2-4ba5-abc3-65b05317949d.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" N: /S2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "Adobe Acrobat Update Task_647b1bfe" /F2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" N: /D2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "Adobe Acrobat Update Task_647b1bfe" /XML "C:\Users\Admin\AppData\Local\Temp\abebdc15-4d91-4639-98e6-545d0546e560.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" O: /S2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "Adobe Acrobat Update Task_1411dbcd" /F2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" O: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" P: /S2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "Adobe Acrobat Update Task_1411dbcd" /XML "C:\Users\Admin\AppData\Local\Temp\e04c4b6f-8a50-473b-895e-c41bc68531c5.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_3480ab31c9f1b32e8b40768ca280e665_amadey_darkgate_glassworm_icedid.exeC:\Users\Admin\AppData\Local\Temp\2026-07-20_3480ab31c9f1b32e8b40768ca280e665_amadey_darkgate_glassworm_icedid.exe1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exeC:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Executes dropped EXE
- Registers new Windows logon scripts automatically executed at logon.
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" enable=yes & exit2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" enable=yes3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /S2⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete "WindowsUpdaterDefenderMicrosoft"2⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"2⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" start "WindowsUpdaterDefenderMicrosoft"2⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /S2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "UsbCeip_92a5abb6" /F2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "UsbCeip_92a5abb6" /XML "C:\Users\Admin\AppData\Local\Temp\bfe5bf98-b4b9-49ae-bfad-fc1c3a1dbc08.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c schtasks /delete /F /TN "Holy Check" & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /delete /F /TN "Holy Check"3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc onlogon /tn "Holy Check" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /tn "Holy Check" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c schtasks /create /f /tn "Holy Check_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /tn "Holy Check_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c schtasks /create /f /tn "Holy Check_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /tn "Holy Check_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c schtasks /create /f /tn "Holy Check_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance" & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /tn "Holy Check_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c schtasks /create /f /tn "Holy Check_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance" & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /tn "Holy Check_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /D2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /S2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "User_Feed_Synchronization-fa68eda9-5b44-4371-81a4-06d6417f4f13" /F2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "User_Feed_Synchronization-fa68eda9-5b44-4371-81a4-06d6417f4f13" /XML "C:\Users\Admin\AppData\Local\Temp\a8709f16-3b17-4c6d-b0be-8743d1586b55.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /S2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_4b7314b7" /F2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_4b7314b7" /XML "C:\Users\Admin\AppData\Local\Temp\109b1876-c981-440c-a274-95f488fafcf8.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /D2⤵
- Enumerates connected drives
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" L: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" L: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" M: /S2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_5979d722" /F2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_5979d722" /XML "C:\Users\Admin\AppData\Local\Temp\63ac55cd-2300-4880-9677-989eda3854c8.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" M: /D2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" N: /S2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "Adobe Acrobat Update Task_4a13b000" /F2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "Adobe Acrobat Update Task_4a13b000" /XML "C:\Users\Admin\AppData\Local\Temp\20d261bb-6571-42f0-abd6-ca6122634851.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" N: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" O: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" O: /D2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" P: /S2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "Adobe Acrobat Update Task_18727001" /F2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "Adobe Acrobat Update Task_18727001" /XML "C:\Users\Admin\AppData\Local\Temp\4dda4667-fc2d-4deb-8c87-034248cba533.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" P: /D2⤵
- Enumerates connected drives
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Q: /S2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Q: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" R: /S2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" R: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" S: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" S: /D2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" T: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" T: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" U: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" U: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" V: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" V: /D2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" W: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" W: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" X: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" X: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Y: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Y: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /D2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /D2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /D2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /D2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" L: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" L: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" M: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" M: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" N: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" N: /D2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" O: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" O: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" P: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" P: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Q: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Q: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" R: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" R: /D2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" S: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" S: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" T: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" T: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" U: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" U: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" V: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" V: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" W: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" W: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" X: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" X: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Y: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Y: /D2⤵
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\SkypeHost.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\SkypeHost.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ApplicationFrameHost.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ApplicationFrameHost.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\History\SecurityHealthSystray.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\History\SecurityHealthSystray.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Notifications\SgrmBroker.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\Notifications\SgrmBroker.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\BootFiles\BootExecutor.exeC:\Windows\System32\BootFiles\BootExecutor.exe1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\System32\BootFiles\BootExecutor.exe" enable=yes & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\System32\BootFiles\BootExecutor.exe" enable=yes3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /S2⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete "WindowsUpdaterDefenderMicrosoft"2⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\System32\BootFiles\BootExecutor.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"2⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" start "WindowsUpdaterDefenderMicrosoft"2⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /S2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "ProgramDataUpdater_32adedcd" /F2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "ProgramDataUpdater_32adedcd" /XML "C:\Users\Admin\AppData\Local\Temp\15b88fe1-05a3-455d-a4e4-3950fb22f626.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /D2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /D2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "Adobe Acrobat Update Task_d3d2dc2d" /F2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /S2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "Adobe Acrobat Update Task_d3d2dc2d" /XML "C:\Users\Admin\AppData\Local\Temp\c32fd732-2045-4d65-bf08-96c8c2084b10.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /D2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_3fc2880b" /F2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /S2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_3fc2880b" /XML "C:\Users\Admin\AppData\Local\Temp\1b45b151-c595-49ae-ab43-980ae7597d13.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "OneDrive Standalone Update Task_c42cf3f1" /F2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "OneDrive Standalone Update Task_c42cf3f1" /XML "C:\Users\Admin\AppData\Local\Temp\64baadbc-f65a-48cc-a095-374b3e487e0f.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" L: /S2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "OneDrive Standalone Update Task_9ce1df38" /F2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "OneDrive Standalone Update Task_9ce1df38" /XML "C:\Users\Admin\AppData\Local\Temp\790f3bde-e3e0-4366-b4b3-026a58bd2746.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" L: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" M: /S2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "FamilySafetyMonitor_a17b1d65" /F2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "FamilySafetyMonitor_a17b1d65" /XML "C:\Users\Admin\AppData\Local\Temp\14aba635-d9cb-4027-8469-3f79a5975382.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" M: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" N: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" N: /D2⤵
- Enumerates connected drives
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" O: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" O: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" P: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" P: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Q: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Q: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" R: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" R: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" S: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" S: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" T: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" T: /D2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" U: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" U: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" V: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" V: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" W: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" W: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" X: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" X: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Y: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Y: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /D2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /D2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /D2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" L: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" L: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" M: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" M: /D2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" N: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" N: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" O: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" O: /D2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" P: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" P: /D2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Q: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Q: /D2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" R: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" R: /D2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" S: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" S: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" T: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" T: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" U: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" U: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" V: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" V: /D2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" W: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" W: /D2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" X: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" X: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Y: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Y: /D2⤵
- Enumerates connected drives
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Create or Modify System Process
4Windows Service
4Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Create or Modify System Process
4Windows Service
4Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
2Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
109b1876-c981-440c-a274-95f488fafcf8.xml
14aba635-d9cb-4027-8469-3f79a5975382.xml
15b88fe1-05a3-455d-a4e4-3950fb22f626.xml
1b45b151-c595-49ae-ab43-980ae7597d13.xml
20d261bb-6571-42f0-abd6-ca6122634851.xml
4dda4667-fc2d-4deb-8c87-034248cba533.xml
63ac55cd-2300-4880-9677-989eda3854c8.xml
64baadbc-f65a-48cc-a095-374b3e487e0f.xml
790f3bde-e3e0-4366-b4b3-026a58bd2746.xml
7abf37cf-35ea-4309-855f-def1b4093f66.xml
84a424fdb2eb40c4b9baee2a45642c60.dll
a60081c7-7808-4326-91b0-232204838fb9.xml
a8709f16-3b17-4c6d-b0be-8743d1586b55.xml
abebdc15-4d91-4639-98e6-545d0546e560.xml
bfe5bf98-b4b9-49ae-bfad-fc1c3a1dbc08.xml
c32fd732-2045-4d65-bf08-96c8c2084b10.xml
c639b58f-376b-40ab-b698-a2002ef8fbb5.xml
c71a412b-11a2-4ba5-abc3-65b05317949d.xml
e04c4b6f-8a50-473b-895e-c41bc68531c5.xml
SkypeHost.exe
memory/1752-33-0x0000000003290000-0x0000000003291000-memory.dmp
memory/1752-50-0x0000000003660000-0x0000000003661000-memory.dmp
memory/1752-11-0x00007FFB5B9E0000-0x00007FFB5B9F0000-memory.dmp
memory/3188-7-0x00007FFB78A40000-0x00007FFB793E4000-memory.dmp
memory/3188-6-0x00007FFB98CE0000-0x00007FFB99081000-memory.dmp
memory/3188-5-0x00007FFB99A20000-0x00007FFB99AE7000-memory.dmp
memory/3188-4-0x00007FFB9B8A0000-0x00007FFB9BB03000-memory.dmp
memory/3188-3-0x00007FFB78A40000-0x00007FFB793E4000-memory.dmp
memory/3188-13-0x00007FFB78A40000-0x00007FFB793E4000-memory.dmp
memory/3188-2-0x00007FFB78A40000-0x00007FFB793E4000-memory.dmp
memory/3188-1-0x00007FFB78BCF000-0x00007FFB78BD0000-memory.dmp
memory/3188-12-0x00007FFB78A40000-0x00007FFB793E4000-memory.dmp
memory/3188-0-0x0000028AC20B0000-0x0000028AC2124000-memory.dmp
memory/3188-14-0x00007FFB78A40000-0x00007FFB793E4000-memory.dmp
memory/3188-82-0x00007FFB78A40000-0x00007FFB793E4000-memory.dmp
memory/3596-93-0x000002CDF60E0000-0x000002CDF610B000-memory.dmp
memory/3596-109-0x00007FFB99A20000-0x00007FFB99AE7000-memory.dmp
memory/3596-103-0x00007FFB5B9E0000-0x00007FFB5B9F0000-memory.dmp
memory/3596-102-0x000002CDF60E0000-0x000002CDF610B000-memory.dmp
memory/3596-105-0x000002CDF5DE0000-0x000002CDF5E54000-memory.dmp
memory/3596-101-0x000002CDF60E0000-0x000002CDF610B000-memory.dmp
memory/3596-100-0x000002CDF60E0000-0x000002CDF610B000-memory.dmp
memory/3596-99-0x000002CDF60E0000-0x000002CDF610B000-memory.dmp
memory/3596-98-0x000002CDF60E0000-0x000002CDF610B000-memory.dmp
memory/3596-110-0x00007FFB98CE0000-0x00007FFB99081000-memory.dmp
memory/3596-108-0x00007FFB9B8A0000-0x00007FFB9BB03000-memory.dmp
memory/4248-76-0x00007FFB9B8A0000-0x00007FFB9BB03000-memory.dmp
memory/4248-77-0x00007FFB99A20000-0x00007FFB99AE7000-memory.dmp
memory/4248-78-0x00007FFB98CE0000-0x00007FFB99081000-memory.dmp
memory/4248-62-0x0000020112890000-0x00000201128BB000-memory.dmp
memory/4248-63-0x0000020112890000-0x00000201128BB000-memory.dmp
memory/4248-68-0x0000020112890000-0x00000201128BB000-memory.dmp
memory/4248-69-0x0000020112890000-0x00000201128BB000-memory.dmp
memory/4248-70-0x0000020112890000-0x00000201128BB000-memory.dmp
memory/4248-75-0x0000020112670000-0x00000201126E4000-memory.dmp
memory/4248-71-0x0000020112890000-0x00000201128BB000-memory.dmp
memory/4248-72-0x0000020112890000-0x00000201128BB000-memory.dmp
memory/4248-73-0x00007FFB5B9E0000-0x00007FFB5B9F0000-memory.dmp
memory/4248-57-0x0000020112760000-0x0000020112785000-memory.dmp
memory/5820-138-0x00007FFB5B9E0000-0x00007FFB5B9F0000-memory.dmp