Analysis
- user interaction
yes - max time kernel
599s - max time network
595s - platform
windows10-2004_x64 - resource
win10v2004-20260513-ja - resource tags
arch:x64arch:x86image:win10v2004-20260513-jalocale:ja-jpos:windows10-2004-x64systemwindows - submitted
27/07/2026, 09:03
Behavioral task
behavioral1
Sample
J-A20260727022544.zip
Resource
win10v2004-20260513-ja
windows10-2004-x64
18 signatures
600 seconds
Behavioral task
behavioral2
Sample
J-A20260727022544.zip
Resource
win11ltsc2024-20260709-ja
windows11-ltsc_2024-x64
18 signatures
600 seconds
Behavioral task
behavioral3
Sample
PdFcOrE8.dll
Resource
win10v2004-20260513-ja
windows10-2004-x64
3 signatures
600 seconds
Behavioral task
behavioral4
Sample
PdFcOrE8.dll
Resource
win11ltsc2024-20260709-ja
windows11-ltsc_2024-x64
3 signatures
600 seconds
Behavioral task
behavioral5
Sample
Vat.No.20260727022528.exe
Resource
win10v2004-20260513-ja
windows10-2004-x64
18 signatures
600 seconds
Behavioral task
behavioral6
Sample
Vat.No.20260727022528.exe
Resource
win11ltsc2024-20260709-ja
windows11-ltsc_2024-x64
18 signatures
600 seconds
General
- Target J-A20260727022544.zip
- Size 4.4MB
- Sample260727-k1dqhack5x
- SHA256 ee0ef34a4402dea54ec8b4e0557de9605a038a4f2b82380f2978296fd60f9791
- MD5 7c5fe652c8059fa01219d3d24585617a
- SHA1 54d1e6d3ced1cc9fffd64dd7ffa36c4c96bfe27e
- SHA512 39d9497e2c26fd6145d50d359a5999697525c3566b06df1c1ac200c4f701b0c339c296127405cd581d10dcb66f409f78d4b7f66db934e5edd4485a44faa74d0f
- SSDEEP 98304:ccl6iskaJ7RSCMdWj671UtcJwvFqqL/fTwg5KQv+xuJrYjmwo/qc1STeKAC4okL:lqh7IY6ZUysz/7wOKi+8omwGSeDCm
- TLSH T1472633A20442AB8B5B633FA5B1033D6B284BD1F06478FB85E3DBD8C3F69D156116B52C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: valleyrat
- Windows_Trojan_Winos_464b8a2e 5 IoCs
resource yara_rule behavioral1/memory/2364-15-0x0000000003920000-0x0000000003978000-memory.dmp Windows_Trojan_Winos_464b8a2e behavioral1/memory/2364-14-0x0000000003920000-0x0000000003978000-memory.dmp Windows_Trojan_Winos_464b8a2e behavioral1/memory/2364-17-0x0000000003920000-0x0000000003978000-memory.dmp Windows_Trojan_Winos_464b8a2e behavioral1/memory/2364-18-0x0000000003920000-0x0000000003978000-memory.dmp Windows_Trojan_Winos_464b8a2e behavioral1/memory/2364-19-0x0000000003920000-0x0000000003978000-memory.dmp Windows_Trojan_Winos_464b8a2e - https://www.esentire.com/blog/winos4-0-online-module-staging-component-used-in-cleversoar-campaign 6 IoCs
resource yara_rule behavioral1/files/0x00070000000244a3-4.dat WinosStager behavioral1/memory/2364-15-0x0000000003920000-0x0000000003978000-memory.dmp WinosStager behavioral1/memory/2364-14-0x0000000003920000-0x0000000003978000-memory.dmp WinosStager behavioral1/memory/2364-17-0x0000000003920000-0x0000000003978000-memory.dmp WinosStager behavioral1/memory/2364-18-0x0000000003920000-0x0000000003978000-memory.dmp WinosStager behavioral1/memory/2364-19-0x0000000003920000-0x0000000003978000-memory.dmp WinosStager - Executes dropped EXE 2 IoCs
pid Process 2364 CopilotUpdate.exe 4592 CopilotUpdate.exe - Loads dropped DLL 2 IoCs
pid Process 2364 CopilotUpdate.exe 4592 CopilotUpdate.exe - Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: CopilotUpdate.exe File opened (read-only) \??\E: ComputerDefaults.exe File opened (read-only) \??\K: CopilotUpdate.exe File opened (read-only) \??\B: CopilotUpdate.exe File opened (read-only) \??\G: CopilotUpdate.exe File opened (read-only) \??\J: CopilotUpdate.exe File opened (read-only) \??\M: CopilotUpdate.exe File opened (read-only) \??\N: CopilotUpdate.exe File opened (read-only) \??\S: CopilotUpdate.exe File opened (read-only) \??\T: CopilotUpdate.exe File opened (read-only) \??\U: CopilotUpdate.exe File opened (read-only) \??\H: CopilotUpdate.exe File opened (read-only) \??\L: CopilotUpdate.exe File opened (read-only) \??\O: CopilotUpdate.exe File opened (read-only) \??\Q: CopilotUpdate.exe File opened (read-only) \??\V: CopilotUpdate.exe File opened (read-only) \??\X: CopilotUpdate.exe File opened (read-only) \??\I: CopilotUpdate.exe File opened (read-only) \??\P: CopilotUpdate.exe File opened (read-only) \??\R: CopilotUpdate.exe File opened (read-only) \??\W: CopilotUpdate.exe File opened (read-only) \??\Y: CopilotUpdate.exe - Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 52 api.ipify.org 58 icanhazip.com - Enumerates processes with tasklist 1 TTPs 19 IoCs
pid Process 2360 tasklist.exe 4272 tasklist.exe 2836 tasklist.exe 440 tasklist.exe 628 tasklist.exe 1676 tasklist.exe 208 tasklist.exe 4844 tasklist.exe 3092 tasklist.exe 4836 tasklist.exe 4560 tasklist.exe 1480 tasklist.exe 4724 tasklist.exe 4820 tasklist.exe 952 tasklist.exe 2268 tasklist.exe 3840 tasklist.exe 4920 tasklist.exe 4892 tasklist.exe - Executes a command shell one-liner 1 TTPs 3 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2008 cmd.exe 1764 cmd.exe 4276 cmd.exe - Program crash 1 IoCs
pid pid_target Process procid_target 992 4592 WerFault.exe 117 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CopilotUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Vat.No.20260727022528.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ComputerDefaults.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CopilotUpdate.exe - Delays execution with timeout.exe 19 IoCs
pid Process 4312 timeout.exe 564 timeout.exe 2780 timeout.exe 2156 timeout.exe 3992 timeout.exe 3328 timeout.exe 5072 timeout.exe 216 timeout.exe 4216 timeout.exe 1736 timeout.exe 3564 timeout.exe 3096 timeout.exe 984 timeout.exe 848 timeout.exe 5028 timeout.exe 1052 timeout.exe 3876 timeout.exe 2380 timeout.exe 4052 timeout.exe - Kills process with taskkill 1 IoCs
pid Process 1788 taskkill.exe - Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\ms-settings\Shell\open\command Vat.No.20260727022528.EXE Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\ms-settings\Shell\open Vat.No.20260727022528.EXE Set value (str) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/{2F3E7196-76B5-4D66-AF86-E69FB46FAE3E}v39.41.69799.4474/packages/CopilotUpdate.exe" Vat.No.20260727022528.EXE Set value (str) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\ms-settings\Shell\open\command\DelegateExecute Vat.No.20260727022528.EXE Key deleted \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\ms-settings\Shell\open\command Vat.No.20260727022528.EXE Key deleted \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\ms-settings\Shell\open Vat.No.20260727022528.EXE Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\ms-settings Vat.No.20260727022528.EXE Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\ms-settings\Shell Vat.No.20260727022528.EXE Key deleted \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\ms-settings\Shell Vat.No.20260727022528.EXE Key deleted \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\ms-settings Vat.No.20260727022528.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2364 CopilotUpdate.exe 2364 CopilotUpdate.exe 2364 CopilotUpdate.exe 2364 CopilotUpdate.exe 2364 CopilotUpdate.exe 2364 CopilotUpdate.exe 2364 CopilotUpdate.exe 2364 CopilotUpdate.exe 2364 CopilotUpdate.exe 2364 CopilotUpdate.exe 2364 CopilotUpdate.exe 2364 CopilotUpdate.exe 2364 CopilotUpdate.exe 2364 CopilotUpdate.exe 2364 CopilotUpdate.exe 2364 CopilotUpdate.exe 2364 CopilotUpdate.exe 2364 CopilotUpdate.exe 2364 CopilotUpdate.exe 2364 CopilotUpdate.exe 2364 CopilotUpdate.exe 2364 CopilotUpdate.exe 2364 CopilotUpdate.exe 2364 CopilotUpdate.exe 2364 CopilotUpdate.exe 2364 CopilotUpdate.exe 2364 CopilotUpdate.exe 2364 CopilotUpdate.exe 2364 CopilotUpdate.exe 2364 CopilotUpdate.exe 2364 CopilotUpdate.exe 2364 CopilotUpdate.exe 2364 CopilotUpdate.exe 2364 CopilotUpdate.exe 2364 CopilotUpdate.exe 2364 CopilotUpdate.exe 2364 CopilotUpdate.exe 2364 CopilotUpdate.exe 2364 CopilotUpdate.exe 2364 CopilotUpdate.exe 2364 CopilotUpdate.exe 2364 CopilotUpdate.exe 2364 CopilotUpdate.exe 2364 CopilotUpdate.exe 2364 CopilotUpdate.exe 2364 CopilotUpdate.exe 2364 CopilotUpdate.exe 2364 CopilotUpdate.exe 2364 CopilotUpdate.exe 2364 CopilotUpdate.exe 2364 CopilotUpdate.exe 2364 CopilotUpdate.exe 2364 CopilotUpdate.exe 2364 CopilotUpdate.exe 2364 CopilotUpdate.exe 2364 CopilotUpdate.exe 2364 CopilotUpdate.exe 2364 CopilotUpdate.exe 2364 CopilotUpdate.exe 2364 CopilotUpdate.exe 2364 CopilotUpdate.exe 2364 CopilotUpdate.exe 2364 CopilotUpdate.exe 2364 CopilotUpdate.exe - Suspicious use of AdjustPrivilegeToken 60 IoCs
description pid Process Token: SeDebugPrivilege 2364 CopilotUpdate.exe Token: SeIncBasePriorityPrivilege 2364 CopilotUpdate.exe Token: SeLoadDriverPrivilege 2364 CopilotUpdate.exe Token: SeTakeOwnershipPrivilege 2364 CopilotUpdate.exe Token: SeTcbPrivilege 2364 CopilotUpdate.exe Token: SeDebugPrivilege 1788 taskkill.exe Token: SeDebugPrivilege 1676 tasklist.exe Token: SeDebugPrivilege 2364 CopilotUpdate.exe Token: SeCreateTokenPrivilege 2364 CopilotUpdate.exe Token: SeAssignPrimaryTokenPrivilege 2364 CopilotUpdate.exe Token: SeLockMemoryPrivilege 2364 CopilotUpdate.exe Token: SeIncreaseQuotaPrivilege 2364 CopilotUpdate.exe Token: SeMachineAccountPrivilege 2364 CopilotUpdate.exe Token: SeTcbPrivilege 2364 CopilotUpdate.exe Token: SeSecurityPrivilege 2364 CopilotUpdate.exe Token: SeTakeOwnershipPrivilege 2364 CopilotUpdate.exe Token: SeLoadDriverPrivilege 2364 CopilotUpdate.exe Token: SeSystemProfilePrivilege 2364 CopilotUpdate.exe Token: SeSystemtimePrivilege 2364 CopilotUpdate.exe Token: SeProfSingleProcessPrivilege 2364 CopilotUpdate.exe Token: SeIncBasePriorityPrivilege 2364 CopilotUpdate.exe Token: SeCreatePagefilePrivilege 2364 CopilotUpdate.exe Token: SeCreatePermanentPrivilege 2364 CopilotUpdate.exe Token: SeBackupPrivilege 2364 CopilotUpdate.exe Token: SeRestorePrivilege 2364 CopilotUpdate.exe Token: SeShutdownPrivilege 2364 CopilotUpdate.exe Token: SeDebugPrivilege 2364 CopilotUpdate.exe Token: SeAuditPrivilege 2364 CopilotUpdate.exe Token: SeSystemEnvironmentPrivilege 2364 CopilotUpdate.exe Token: SeChangeNotifyPrivilege 2364 CopilotUpdate.exe Token: SeRemoteShutdownPrivilege 2364 CopilotUpdate.exe Token: SeUndockPrivilege 2364 CopilotUpdate.exe Token: SeSyncAgentPrivilege 2364 CopilotUpdate.exe Token: SeEnableDelegationPrivilege 2364 CopilotUpdate.exe Token: SeManageVolumePrivilege 2364 CopilotUpdate.exe Token: SeImpersonatePrivilege 2364 CopilotUpdate.exe Token: SeCreateGlobalPrivilege 2364 CopilotUpdate.exe Token: 31 2364 CopilotUpdate.exe Token: 32 2364 CopilotUpdate.exe Token: 33 2364 CopilotUpdate.exe Token: 34 2364 CopilotUpdate.exe Token: 35 2364 CopilotUpdate.exe Token: SeDebugPrivilege 4836 tasklist.exe Token: SeDebugPrivilege 2836 tasklist.exe Token: SeDebugPrivilege 4920 tasklist.exe Token: SeDebugPrivilege 4560 tasklist.exe Token: SeDebugPrivilege 1480 tasklist.exe Token: SeDebugPrivilege 4892 tasklist.exe Token: SeDebugPrivilege 4724 tasklist.exe Token: SeDebugPrivilege 4820 tasklist.exe Token: SeDebugPrivilege 440 tasklist.exe Token: SeDebugPrivilege 208 tasklist.exe Token: SeDebugPrivilege 952 tasklist.exe Token: SeDebugPrivilege 4272 tasklist.exe Token: SeDebugPrivilege 2360 tasklist.exe Token: SeDebugPrivilege 628 tasklist.exe Token: SeDebugPrivilege 4844 tasklist.exe Token: SeDebugPrivilege 2268 tasklist.exe Token: SeDebugPrivilege 3840 tasklist.exe Token: SeDebugPrivilege 3092 tasklist.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1044 Vat.No.20260727022528.EXE 2364 CopilotUpdate.exe 2364 CopilotUpdate.exe 4592 CopilotUpdate.exe - Suspicious use of WriteProcessMemory 63 IoCs
description pid Process procid_target PID 1044 wrote to memory of 2008 1044 Vat.No.20260727022528.EXE 102 PID 2008 wrote to memory of 4660 2008 cmd.exe 104 PID 4660 wrote to memory of 2364 4660 ComputerDefaults.exe 105 PID 2364 wrote to memory of 1788 2364 CopilotUpdate.exe 107 PID 2364 wrote to memory of 1764 2364 CopilotUpdate.exe 110 PID 1764 wrote to memory of 4276 1764 cmd.exe 112 PID 4276 wrote to memory of 1676 4276 cmd.exe 113 PID 4276 wrote to memory of 4256 4276 cmd.exe 114 PID 4276 wrote to memory of 4312 4276 cmd.exe 115 PID 4276 wrote to memory of 4836 4276 cmd.exe 121 PID 4276 wrote to memory of 784 4276 cmd.exe 122 PID 4276 wrote to memory of 3564 4276 cmd.exe 123 PID 4276 wrote to memory of 2836 4276 cmd.exe 124 PID 4276 wrote to memory of 4824 4276 cmd.exe 125 PID 4276 wrote to memory of 5072 4276 cmd.exe 126 PID 4276 wrote to memory of 4920 4276 cmd.exe 127 PID 4276 wrote to memory of 4092 4276 cmd.exe 128 PID 4276 wrote to memory of 564 4276 cmd.exe 129 PID 4276 wrote to memory of 4560 4276 cmd.exe 130 PID 4276 wrote to memory of 1536 4276 cmd.exe 131 PID 4276 wrote to memory of 2780 4276 cmd.exe 132 PID 4276 wrote to memory of 1480 4276 cmd.exe 133 PID 4276 wrote to memory of 1944 4276 cmd.exe 134 PID 4276 wrote to memory of 3096 4276 cmd.exe 135 PID 4276 wrote to memory of 4892 4276 cmd.exe 136 PID 4276 wrote to memory of 4480 4276 cmd.exe 137 PID 4276 wrote to memory of 216 4276 cmd.exe 138 PID 4276 wrote to memory of 4724 4276 cmd.exe 139 PID 4276 wrote to memory of 4368 4276 cmd.exe 140 PID 4276 wrote to memory of 3876 4276 cmd.exe 141 PID 4276 wrote to memory of 4820 4276 cmd.exe 142 PID 4276 wrote to memory of 2520 4276 cmd.exe 143 PID 4276 wrote to memory of 4216 4276 cmd.exe 144 PID 4276 wrote to memory of 440 4276 cmd.exe 147 PID 4276 wrote to memory of 4152 4276 cmd.exe 148 PID 4276 wrote to memory of 2156 4276 cmd.exe 149 PID 4276 wrote to memory of 208 4276 cmd.exe 150 PID 4276 wrote to memory of 3504 4276 cmd.exe 151 PID 4276 wrote to memory of 984 4276 cmd.exe 152 PID 4276 wrote to memory of 952 4276 cmd.exe 153 PID 4276 wrote to memory of 1664 4276 cmd.exe 154 PID 4276 wrote to memory of 848 4276 cmd.exe 155 PID 4276 wrote to memory of 4272 4276 cmd.exe 156 PID 4276 wrote to memory of 2752 4276 cmd.exe 157 PID 4276 wrote to memory of 3992 4276 cmd.exe 158 PID 4276 wrote to memory of 2360 4276 cmd.exe 159 PID 4276 wrote to memory of 4752 4276 cmd.exe 160 PID 4276 wrote to memory of 1736 4276 cmd.exe 161 PID 4276 wrote to memory of 628 4276 cmd.exe 162 PID 4276 wrote to memory of 2448 4276 cmd.exe 163 PID 4276 wrote to memory of 2380 4276 cmd.exe 164 PID 4276 wrote to memory of 4844 4276 cmd.exe 165 PID 4276 wrote to memory of 2120 4276 cmd.exe 166 PID 4276 wrote to memory of 5028 4276 cmd.exe 167 PID 4276 wrote to memory of 2268 4276 cmd.exe 168 PID 4276 wrote to memory of 3008 4276 cmd.exe 169 PID 4276 wrote to memory of 1052 4276 cmd.exe 170 PID 4276 wrote to memory of 3840 4276 cmd.exe 171 PID 4276 wrote to memory of 4900 4276 cmd.exe 172 PID 4276 wrote to memory of 4052 4276 cmd.exe 173 PID 4276 wrote to memory of 3092 4276 cmd.exe 174 PID 4276 wrote to memory of 1824 4276 cmd.exe 175 PID 4276 wrote to memory of 3328 4276 cmd.exe 176
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\J-A20260727022544.zip1⤵PID:2668
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1184
-
\??\E:\Vat.No.20260727022528.EXE"E:\Vat.No.20260727022528.EXE"1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Windows\SysWOW64\cmd.exe/c C:\Windows\System32\ComputerDefaults.exe2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\SysWOW64\ComputerDefaults.exeC:\Windows\System32\ComputerDefaults.exe3⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\ProgramData\{2F3E7196-76B5-4D66-AF86-E69FB46FAE3E}v39.41.69799.4474\packages\CopilotUpdate.exe"CopilotUpdate.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im cmd.exe5⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1788
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start "" /B cmd /C C:\Users\Admin\AppData\Local\Temp\0BB94DCBFFDA3EB9EF2.BAT5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Windows\SysWOW64\cmd.execmd /C C:\Users\Admin\AppData\Local\Temp\0BB94DCBFFDA3EB9EF2.BAT6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1676
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:4256
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4312
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4836
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:784
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:3564
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2836
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:4824
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:5072
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4920
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:4092
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:564
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4560
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:1536
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2780
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1480
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:1944
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:3096
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4892
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:4480
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:216
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4724
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:4368
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:3876
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4820
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:2520
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4216
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:440
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵PID:4152
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2156
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:208
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:3504
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:984
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:952
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:1664
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:848
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4272
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:2752
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:3992
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2360
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:4752
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1736
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:628
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:2448
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2380
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4844
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:2120
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:5028
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2268
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:3008
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1052
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3840
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:4900
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4052
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3092
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:1824
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:3328
-
-
-
-
-
-
-
C:\ProgramData\{2F3E7196-76B5-4D66-AF86-E69FB46FAE3E}v39.41.69799.4474\packages\CopilotUpdate.exeC:\ProgramData\{2F3E7196-76B5-4D66-AF86-E69FB46FAE3E}v39.41.69799.4474\packages\CopilotUpdate.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4592 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4592 -s 5802⤵
- Program crash
PID:992
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4592 -ip 45921⤵PID:1128
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\{2F3E7196-76B5-4D66-AF86-E69FB46FAE3E}v39.41.69799.4474\packages\CopilotUpdate.exe
- Size 3.5MB
- SHA256 3a0583f7d3f41e1c2c36fa585ad620a518ab6661767f2e9683023745b6f58c4c
- MD5 cae7e1192eb824214833bb1e8ac092b8
- SHA1 dd2bf5cb2a7c29e4a8b7fb405ec2a9e3e9376e81
- SHA512 9fc3a12887dc3c3b82140b3ef591aad68b3407bfec3e7a292dec2417052069c14976e8fcaeea934dc81d58aca85a583979141c4463aa5924fb7c933d648b122d
- SSDEEP 98304:Yi3bpjg3E9+w1Wf/46VK2CvW+gv0AdIsf/M2Xc5ISM5:DV0w2C7qIsfU2Xc5ISM
- TLSH T198F58D20BAC08036D97216324DAA7739A6BDFE301B35A1D752543E7839307D26D396BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\{2F3E7196-76B5-4D66-AF86-E69FB46FAE3E}v39.41.69799.4474\packages\PDFCore8.dll
- Size 5.5MB
- SHA256 d265fcf18b14b98e55aa9fffd6b64b39de84304a1796854e72eef35bc6dca2c6
- MD5 7e41ded03b900c61467b70ca1718fed2
- SHA1 ceb851e0aeb27295b8221a3f5e225c9db0790051
- SHA512 63ca550b570606a2337d24a57baf9069b8cf73c9ef54f353bd177eee04539a3bbd744dd915263739a4077272714e5fdbd8e122724051fa630729b556329b0371
- SSDEEP 98304:0nJkIC4LTSPakN6RaSnZ0qTTJ8OjWrh6Wfa/oSoL4/aC+gsMjLqWaG0T:iJHT4P39fa/oSuFm
- TLSH T12446CF913A40646DE2D7013C4E1DB365D3EE4BA01F3A90CBE2D4E96E29315C2E727E67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\0BB94DCBFFDA3EB9EF2.BAT
- Size 862B
- SHA256 efcace7028808db16af6ea54e029349a4d74e7084b831e8057933fc6f7bcd098
- MD5 896c76ea58b5902b6e56307b7c81425d
- SHA1 ddb2bebfb45337e03030b232bb357c34bcaa261c
- SHA512 68844a5aebe7880aa322c47ca60d2247407bacdc3b3919408b01f40387f9717212730ea2504c689ac3986027e0b896d3b62cbbccd84744225340b5822562f274
- TLSH T13111598F520B286C07F482B778924E464F99D043F73BA1D87000D7446FAA90F95C935C
- MD5 SHA1 SHA512 TLSH