Analysis
- user interaction
yes - max time kernel
599s - max time network
598s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-ja - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-jalocale:ja-jpos:windows11-ltsc_2024-x64systemwindows - submitted
27/07/2026, 09:03
Behavioral task
behavioral1
Sample
J-A20260727022544.zip
Resource
win10v2004-20260513-ja
windows10-2004-x64
18 signatures
600 seconds
Behavioral task
behavioral2
Sample
J-A20260727022544.zip
Resource
win11ltsc2024-20260709-ja
windows11-ltsc_2024-x64
18 signatures
600 seconds
Behavioral task
behavioral3
Sample
PdFcOrE8.dll
Resource
win10v2004-20260513-ja
windows10-2004-x64
3 signatures
600 seconds
Behavioral task
behavioral4
Sample
PdFcOrE8.dll
Resource
win11ltsc2024-20260709-ja
windows11-ltsc_2024-x64
3 signatures
600 seconds
Behavioral task
behavioral5
Sample
Vat.No.20260727022528.exe
Resource
win10v2004-20260513-ja
windows10-2004-x64
18 signatures
600 seconds
Behavioral task
behavioral6
Sample
Vat.No.20260727022528.exe
Resource
win11ltsc2024-20260709-ja
windows11-ltsc_2024-x64
18 signatures
600 seconds
General
- Target J-A20260727022544.zip
- Size 4.4MB
- Sample260727-k1dqhack5x
- SHA256 ee0ef34a4402dea54ec8b4e0557de9605a038a4f2b82380f2978296fd60f9791
- MD5 7c5fe652c8059fa01219d3d24585617a
- SHA1 54d1e6d3ced1cc9fffd64dd7ffa36c4c96bfe27e
- SHA512 39d9497e2c26fd6145d50d359a5999697525c3566b06df1c1ac200c4f701b0c339c296127405cd581d10dcb66f409f78d4b7f66db934e5edd4485a44faa74d0f
- SSDEEP 98304:ccl6iskaJ7RSCMdWj671UtcJwvFqqL/fTwg5KQv+xuJrYjmwo/qc1STeKAC4okL:lqh7IY6ZUysz/7wOKi+8omwGSeDCm
- TLSH T1472633A20442AB8B5B633FA5B1033D6B284BD1F06478FB85E3DBD8C3F69D156116B52C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: valleyrat
- Windows_Trojan_Winos_464b8a2e 5 IoCs
resource yara_rule behavioral2/memory/2920-8-0x0000000004990000-0x00000000049E8000-memory.dmp Windows_Trojan_Winos_464b8a2e behavioral2/memory/2920-9-0x0000000004990000-0x00000000049E8000-memory.dmp Windows_Trojan_Winos_464b8a2e behavioral2/memory/2920-11-0x0000000004990000-0x00000000049E8000-memory.dmp Windows_Trojan_Winos_464b8a2e behavioral2/memory/2920-12-0x0000000004990000-0x00000000049E8000-memory.dmp Windows_Trojan_Winos_464b8a2e behavioral2/memory/2920-13-0x0000000004990000-0x00000000049E8000-memory.dmp Windows_Trojan_Winos_464b8a2e - https://www.esentire.com/blog/winos4-0-online-module-staging-component-used-in-cleversoar-campaign 6 IoCs
resource yara_rule behavioral2/files/0x000d00000001c50d-1.dat WinosStager behavioral2/memory/2920-8-0x0000000004990000-0x00000000049E8000-memory.dmp WinosStager behavioral2/memory/2920-9-0x0000000004990000-0x00000000049E8000-memory.dmp WinosStager behavioral2/memory/2920-11-0x0000000004990000-0x00000000049E8000-memory.dmp WinosStager behavioral2/memory/2920-12-0x0000000004990000-0x00000000049E8000-memory.dmp WinosStager behavioral2/memory/2920-13-0x0000000004990000-0x00000000049E8000-memory.dmp WinosStager - Executes dropped EXE 2 IoCs
pid Process 2920 CopilotUpdate.exe 4756 CopilotUpdate.exe - Loads dropped DLL 2 IoCs
pid Process 2920 CopilotUpdate.exe 4756 CopilotUpdate.exe - Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: CopilotUpdate.exe File opened (read-only) \??\G: CopilotUpdate.exe File opened (read-only) \??\I: CopilotUpdate.exe File opened (read-only) \??\J: CopilotUpdate.exe File opened (read-only) \??\Q: CopilotUpdate.exe File opened (read-only) \??\R: CopilotUpdate.exe File opened (read-only) \??\S: CopilotUpdate.exe File opened (read-only) \??\U: CopilotUpdate.exe File opened (read-only) \??\H: CopilotUpdate.exe File opened (read-only) \??\L: CopilotUpdate.exe File opened (read-only) \??\N: CopilotUpdate.exe File opened (read-only) \??\O: CopilotUpdate.exe File opened (read-only) \??\W: CopilotUpdate.exe File opened (read-only) \??\K: CopilotUpdate.exe File opened (read-only) \??\M: CopilotUpdate.exe File opened (read-only) \??\T: CopilotUpdate.exe File opened (read-only) \??\X: CopilotUpdate.exe File opened (read-only) \??\Y: CopilotUpdate.exe File opened (read-only) \??\Z: CopilotUpdate.exe File opened (read-only) \??\D: ComputerDefaults.exe File opened (read-only) \??\P: CopilotUpdate.exe File opened (read-only) \??\V: CopilotUpdate.exe - Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 api.ipify.org 21 api.ipify.org - Enumerates processes with tasklist 1 TTPs 17 IoCs
pid Process 3660 tasklist.exe 3176 tasklist.exe 3404 tasklist.exe 2904 tasklist.exe 828 tasklist.exe 4812 tasklist.exe 3064 tasklist.exe 2988 tasklist.exe 4996 tasklist.exe 1184 tasklist.exe 5552 tasklist.exe 3380 tasklist.exe 1944 tasklist.exe 5768 tasklist.exe 5792 tasklist.exe 3264 tasklist.exe 2892 tasklist.exe - Executes a command shell one-liner 1 TTPs 3 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3352 cmd.exe 5976 cmd.exe 6036 cmd.exe - Program crash 1 IoCs
pid pid_target Process procid_target 3172 4756 WerFault.exe 111 - System Location Discovery: System Language Discovery 1 TTPs 59 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CopilotUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Vat.No.20260727022528.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CopilotUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ComputerDefaults.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe - Delays execution with timeout.exe 17 IoCs
pid Process 2520 timeout.exe 948 timeout.exe 4644 timeout.exe 1584 timeout.exe 3292 timeout.exe 3056 timeout.exe 4716 timeout.exe 5248 timeout.exe 2136 timeout.exe 1464 timeout.exe 2116 timeout.exe 4808 timeout.exe 5220 timeout.exe 1504 timeout.exe 4072 timeout.exe 2056 timeout.exe 1848 timeout.exe - Kills process with taskkill 1 IoCs
pid Process 5456 taskkill.exe - Modifies registry class 10 IoCs
description ioc Process Key deleted \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\ms-settings\Shell\open Vat.No.20260727022528.EXE Key created \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\ms-settings Vat.No.20260727022528.EXE Key deleted \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\ms-settings\Shell Vat.No.20260727022528.EXE Key deleted \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\ms-settings Vat.No.20260727022528.EXE Key created \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\ms-settings\Shell\open\command Vat.No.20260727022528.EXE Key created \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\ms-settings\Shell Vat.No.20260727022528.EXE Key created \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\ms-settings\Shell\open Vat.No.20260727022528.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/{BA8A9234-65FA-4383-A29F-C3FA2ADF3424}v66.73.83782.4584/packages/CopilotUpdate.exe" Vat.No.20260727022528.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\ms-settings\Shell\open\command\DelegateExecute = "Ā" Vat.No.20260727022528.EXE Key deleted \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\ms-settings\Shell\open\command Vat.No.20260727022528.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2920 CopilotUpdate.exe 2920 CopilotUpdate.exe 2920 CopilotUpdate.exe 2920 CopilotUpdate.exe 2920 CopilotUpdate.exe 2920 CopilotUpdate.exe 2920 CopilotUpdate.exe 2920 CopilotUpdate.exe 2920 CopilotUpdate.exe 2920 CopilotUpdate.exe 2920 CopilotUpdate.exe 2920 CopilotUpdate.exe 2920 CopilotUpdate.exe 2920 CopilotUpdate.exe 2920 CopilotUpdate.exe 2920 CopilotUpdate.exe 2920 CopilotUpdate.exe 2920 CopilotUpdate.exe 2920 CopilotUpdate.exe 2920 CopilotUpdate.exe 2920 CopilotUpdate.exe 2920 CopilotUpdate.exe 2920 CopilotUpdate.exe 2920 CopilotUpdate.exe 2920 CopilotUpdate.exe 2920 CopilotUpdate.exe 2920 CopilotUpdate.exe 2920 CopilotUpdate.exe 2920 CopilotUpdate.exe 2920 CopilotUpdate.exe 2920 CopilotUpdate.exe 2920 CopilotUpdate.exe 2920 CopilotUpdate.exe 2920 CopilotUpdate.exe 2920 CopilotUpdate.exe 2920 CopilotUpdate.exe 2920 CopilotUpdate.exe 2920 CopilotUpdate.exe 2920 CopilotUpdate.exe 2920 CopilotUpdate.exe 2920 CopilotUpdate.exe 2920 CopilotUpdate.exe 2920 CopilotUpdate.exe 2920 CopilotUpdate.exe 2920 CopilotUpdate.exe 2920 CopilotUpdate.exe 2920 CopilotUpdate.exe 2920 CopilotUpdate.exe 2920 CopilotUpdate.exe 2920 CopilotUpdate.exe 2920 CopilotUpdate.exe 2920 CopilotUpdate.exe 2920 CopilotUpdate.exe 2920 CopilotUpdate.exe 2920 CopilotUpdate.exe 2920 CopilotUpdate.exe 2920 CopilotUpdate.exe 2920 CopilotUpdate.exe 2920 CopilotUpdate.exe 2920 CopilotUpdate.exe 2920 CopilotUpdate.exe 2920 CopilotUpdate.exe 2920 CopilotUpdate.exe 2920 CopilotUpdate.exe - Suspicious use of AdjustPrivilegeToken 58 IoCs
description pid Process Token: SeDebugPrivilege 2920 CopilotUpdate.exe Token: SeIncBasePriorityPrivilege 2920 CopilotUpdate.exe Token: SeLoadDriverPrivilege 2920 CopilotUpdate.exe Token: SeTakeOwnershipPrivilege 2920 CopilotUpdate.exe Token: SeTcbPrivilege 2920 CopilotUpdate.exe Token: SeDebugPrivilege 5456 taskkill.exe Token: SeDebugPrivilege 4996 tasklist.exe Token: SeDebugPrivilege 2920 CopilotUpdate.exe Token: SeCreateTokenPrivilege 2920 CopilotUpdate.exe Token: SeAssignPrimaryTokenPrivilege 2920 CopilotUpdate.exe Token: SeLockMemoryPrivilege 2920 CopilotUpdate.exe Token: SeIncreaseQuotaPrivilege 2920 CopilotUpdate.exe Token: SeMachineAccountPrivilege 2920 CopilotUpdate.exe Token: SeTcbPrivilege 2920 CopilotUpdate.exe Token: SeSecurityPrivilege 2920 CopilotUpdate.exe Token: SeTakeOwnershipPrivilege 2920 CopilotUpdate.exe Token: SeLoadDriverPrivilege 2920 CopilotUpdate.exe Token: SeSystemProfilePrivilege 2920 CopilotUpdate.exe Token: SeSystemtimePrivilege 2920 CopilotUpdate.exe Token: SeProfSingleProcessPrivilege 2920 CopilotUpdate.exe Token: SeIncBasePriorityPrivilege 2920 CopilotUpdate.exe Token: SeCreatePagefilePrivilege 2920 CopilotUpdate.exe Token: SeCreatePermanentPrivilege 2920 CopilotUpdate.exe Token: SeBackupPrivilege 2920 CopilotUpdate.exe Token: SeRestorePrivilege 2920 CopilotUpdate.exe Token: SeShutdownPrivilege 2920 CopilotUpdate.exe Token: SeDebugPrivilege 2920 CopilotUpdate.exe Token: SeAuditPrivilege 2920 CopilotUpdate.exe Token: SeSystemEnvironmentPrivilege 2920 CopilotUpdate.exe Token: SeChangeNotifyPrivilege 2920 CopilotUpdate.exe Token: SeRemoteShutdownPrivilege 2920 CopilotUpdate.exe Token: SeUndockPrivilege 2920 CopilotUpdate.exe Token: SeSyncAgentPrivilege 2920 CopilotUpdate.exe Token: SeEnableDelegationPrivilege 2920 CopilotUpdate.exe Token: SeManageVolumePrivilege 2920 CopilotUpdate.exe Token: SeImpersonatePrivilege 2920 CopilotUpdate.exe Token: SeCreateGlobalPrivilege 2920 CopilotUpdate.exe Token: 31 2920 CopilotUpdate.exe Token: 32 2920 CopilotUpdate.exe Token: 33 2920 CopilotUpdate.exe Token: 34 2920 CopilotUpdate.exe Token: 35 2920 CopilotUpdate.exe Token: SeDebugPrivilege 5792 tasklist.exe Token: SeDebugPrivilege 1184 tasklist.exe Token: SeDebugPrivilege 5552 tasklist.exe Token: SeDebugPrivilege 4812 tasklist.exe Token: SeDebugPrivilege 3380 tasklist.exe Token: SeDebugPrivilege 3176 tasklist.exe Token: SeDebugPrivilege 3404 tasklist.exe Token: SeDebugPrivilege 3064 tasklist.exe Token: SeDebugPrivilege 2904 tasklist.exe Token: SeDebugPrivilege 2988 tasklist.exe Token: SeDebugPrivilege 1944 tasklist.exe Token: SeDebugPrivilege 3264 tasklist.exe Token: SeDebugPrivilege 3660 tasklist.exe Token: SeDebugPrivilege 5768 tasklist.exe Token: SeDebugPrivilege 828 tasklist.exe Token: SeDebugPrivilege 2892 tasklist.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4856 Vat.No.20260727022528.EXE 2920 CopilotUpdate.exe 2920 CopilotUpdate.exe 4756 CopilotUpdate.exe - Suspicious use of WriteProcessMemory 57 IoCs
description pid Process procid_target PID 4856 wrote to memory of 3352 4856 Vat.No.20260727022528.EXE 97 PID 3352 wrote to memory of 2536 3352 cmd.exe 99 PID 2536 wrote to memory of 2920 2536 ComputerDefaults.exe 100 PID 2920 wrote to memory of 5456 2920 CopilotUpdate.exe 101 PID 2920 wrote to memory of 5976 2920 CopilotUpdate.exe 104 PID 5976 wrote to memory of 6036 5976 cmd.exe 106 PID 6036 wrote to memory of 4996 6036 cmd.exe 107 PID 6036 wrote to memory of 6028 6036 cmd.exe 108 PID 6036 wrote to memory of 2116 6036 cmd.exe 109 PID 6036 wrote to memory of 5792 6036 cmd.exe 115 PID 6036 wrote to memory of 3592 6036 cmd.exe 116 PID 6036 wrote to memory of 1848 6036 cmd.exe 117 PID 6036 wrote to memory of 1184 6036 cmd.exe 118 PID 6036 wrote to memory of 936 6036 cmd.exe 119 PID 6036 wrote to memory of 2520 6036 cmd.exe 120 PID 6036 wrote to memory of 5552 6036 cmd.exe 121 PID 6036 wrote to memory of 3512 6036 cmd.exe 122 PID 6036 wrote to memory of 4072 6036 cmd.exe 123 PID 6036 wrote to memory of 4812 6036 cmd.exe 124 PID 6036 wrote to memory of 3248 6036 cmd.exe 125 PID 6036 wrote to memory of 4808 6036 cmd.exe 126 PID 6036 wrote to memory of 3380 6036 cmd.exe 127 PID 6036 wrote to memory of 1728 6036 cmd.exe 128 PID 6036 wrote to memory of 948 6036 cmd.exe 129 PID 6036 wrote to memory of 3176 6036 cmd.exe 130 PID 6036 wrote to memory of 2356 6036 cmd.exe 131 PID 6036 wrote to memory of 5220 6036 cmd.exe 132 PID 6036 wrote to memory of 3404 6036 cmd.exe 140 PID 6036 wrote to memory of 3312 6036 cmd.exe 141 PID 6036 wrote to memory of 3292 6036 cmd.exe 142 PID 6036 wrote to memory of 3064 6036 cmd.exe 143 PID 6036 wrote to memory of 2232 6036 cmd.exe 144 PID 6036 wrote to memory of 4644 6036 cmd.exe 145 PID 6036 wrote to memory of 2904 6036 cmd.exe 146 PID 6036 wrote to memory of 5356 6036 cmd.exe 147 PID 6036 wrote to memory of 3056 6036 cmd.exe 148 PID 6036 wrote to memory of 2988 6036 cmd.exe 149 PID 6036 wrote to memory of 1400 6036 cmd.exe 150 PID 6036 wrote to memory of 1584 6036 cmd.exe 151 PID 6036 wrote to memory of 1944 6036 cmd.exe 152 PID 6036 wrote to memory of 4840 6036 cmd.exe 153 PID 6036 wrote to memory of 4716 6036 cmd.exe 154 PID 6036 wrote to memory of 3264 6036 cmd.exe 155 PID 6036 wrote to memory of 2764 6036 cmd.exe 156 PID 6036 wrote to memory of 2056 6036 cmd.exe 157 PID 6036 wrote to memory of 3660 6036 cmd.exe 158 PID 6036 wrote to memory of 4204 6036 cmd.exe 159 PID 6036 wrote to memory of 1464 6036 cmd.exe 160 PID 6036 wrote to memory of 5768 6036 cmd.exe 161 PID 6036 wrote to memory of 3176 6036 cmd.exe 162 PID 6036 wrote to memory of 1504 6036 cmd.exe 163 PID 6036 wrote to memory of 828 6036 cmd.exe 164 PID 6036 wrote to memory of 4084 6036 cmd.exe 165 PID 6036 wrote to memory of 5248 6036 cmd.exe 166 PID 6036 wrote to memory of 2892 6036 cmd.exe 167 PID 6036 wrote to memory of 1872 6036 cmd.exe 168 PID 6036 wrote to memory of 2136 6036 cmd.exe 169
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\J-A20260727022544.zip1⤵PID:4156
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3172
-
\??\D:\Vat.No.20260727022528.EXE"D:\Vat.No.20260727022528.EXE"1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Windows\SysWOW64\cmd.exe/c C:\Windows\System32\ComputerDefaults.exe2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Windows\SysWOW64\ComputerDefaults.exeC:\Windows\System32\ComputerDefaults.exe3⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\ProgramData\{BA8A9234-65FA-4383-A29F-C3FA2ADF3424}v66.73.83782.4584\packages\CopilotUpdate.exe"CopilotUpdate.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im cmd.exe5⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5456
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start "" /B cmd /C C:\Users\Admin\AppData\Local\Temp\0BB94DCBFFDA3EB9EF2.BAT5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5976 -
C:\Windows\SysWOW64\cmd.execmd /C C:\Users\Admin\AppData\Local\Temp\0BB94DCBFFDA3EB9EF2.BAT6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4996
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:6028
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2116
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5792
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:3592
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1848
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1184
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:936
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2520
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5552
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:3512
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4072
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4812
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:3248
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4808
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3380
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:1728
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:948
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3176
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:2356
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:5220
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3404
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:3312
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:3292
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3064
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:2232
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4644
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2904
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:5356
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:3056
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2988
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:1400
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1584
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1944
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:4840
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4716
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3264
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:2764
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2056
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3660
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:4204
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1464
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5768
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:3176
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1504
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:828
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:4084
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:5248
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2892
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:1872
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2136
-
-
-
-
-
-
-
C:\ProgramData\{BA8A9234-65FA-4383-A29F-C3FA2ADF3424}v66.73.83782.4584\packages\CopilotUpdate.exeC:\ProgramData\{BA8A9234-65FA-4383-A29F-C3FA2ADF3424}v66.73.83782.4584\packages\CopilotUpdate.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4756 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4756 -s 6842⤵
- Program crash
PID:3172
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 252 -p 4756 -ip 47561⤵PID:1412
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:5960
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\{BA8A9234-65FA-4383-A29F-C3FA2ADF3424}v66.73.83782.4584\packages\CopilotUpdate.exe
- Size 3.5MB
- SHA256 3a0583f7d3f41e1c2c36fa585ad620a518ab6661767f2e9683023745b6f58c4c
- MD5 cae7e1192eb824214833bb1e8ac092b8
- SHA1 dd2bf5cb2a7c29e4a8b7fb405ec2a9e3e9376e81
- SHA512 9fc3a12887dc3c3b82140b3ef591aad68b3407bfec3e7a292dec2417052069c14976e8fcaeea934dc81d58aca85a583979141c4463aa5924fb7c933d648b122d
- SSDEEP 98304:Yi3bpjg3E9+w1Wf/46VK2CvW+gv0AdIsf/M2Xc5ISM5:DV0w2C7qIsfU2Xc5ISM
- TLSH T198F58D20BAC08036D97216324DAA7739A6BDFE301B35A1D752543E7839307D26D396BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\{BA8A9234-65FA-4383-A29F-C3FA2ADF3424}v66.73.83782.4584\packages\PdFcOrE8.dLl
- Size 5.5MB
- SHA256 d265fcf18b14b98e55aa9fffd6b64b39de84304a1796854e72eef35bc6dca2c6
- MD5 7e41ded03b900c61467b70ca1718fed2
- SHA1 ceb851e0aeb27295b8221a3f5e225c9db0790051
- SHA512 63ca550b570606a2337d24a57baf9069b8cf73c9ef54f353bd177eee04539a3bbd744dd915263739a4077272714e5fdbd8e122724051fa630729b556329b0371
- SSDEEP 98304:0nJkIC4LTSPakN6RaSnZ0qTTJ8OjWrh6Wfa/oSoL4/aC+gsMjLqWaG0T:iJHT4P39fa/oSuFm
- TLSH T12446CF913A40646DE2D7013C4E1DB365D3EE4BA01F3A90CBE2D4E96E29315C2E727E67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\0BB94DCBFFDA3EB9EF2.BAT
- Size 862B
- SHA256 aefd5ea45da7e2526ef42feb9bb7f168be099ceacfcede5161145fca38efc4e6
- MD5 69d97d25f3e7d40011a970767fa2f70e
- SHA1 95bac9832918dcba3a087071775f03469ddd538c
- SHA512 d24401d36f853c19a07402d81a5d047e75d078260a345083386fe461153f58cc9d9251c9cc44358917aed85a55a09cf675875b00b62ff2f40f62577d5f04732c
- TLSH T18211598F924F286C07F482B778925F464FD9D043FB3BA2987000DB45ABAA54F98C935C
- MD5 SHA1 SHA512 TLSH