Analysis
- max time kernel
599s - max time network
599s - platform
windows10-2004_x64 - resource
win10v2004-20260513-ja - resource tags
arch:x64arch:x86image:win10v2004-20260513-jalocale:ja-jpos:windows10-2004-x64systemwindows - submitted
27/07/2026, 09:03
Behavioral task
behavioral1
Sample
J-A20260727022544.zip
Resource
win10v2004-20260513-ja
windows10-2004-x64
18 signatures
600 seconds
Behavioral task
behavioral2
Sample
J-A20260727022544.zip
Resource
win11ltsc2024-20260709-ja
windows11-ltsc_2024-x64
18 signatures
600 seconds
Behavioral task
behavioral3
Sample
PdFcOrE8.dll
Resource
win10v2004-20260513-ja
windows10-2004-x64
3 signatures
600 seconds
Behavioral task
behavioral4
Sample
PdFcOrE8.dll
Resource
win11ltsc2024-20260709-ja
windows11-ltsc_2024-x64
3 signatures
600 seconds
Behavioral task
behavioral5
Sample
Vat.No.20260727022528.exe
Resource
win10v2004-20260513-ja
windows10-2004-x64
18 signatures
600 seconds
Behavioral task
behavioral6
Sample
Vat.No.20260727022528.exe
Resource
win11ltsc2024-20260709-ja
windows11-ltsc_2024-x64
18 signatures
600 seconds
General
- Target Vat.No.20260727022528.exe
- Size 3.5MB
- Sample260727-k1dqhack5x
- SHA256 3a0583f7d3f41e1c2c36fa585ad620a518ab6661767f2e9683023745b6f58c4c
- MD5 cae7e1192eb824214833bb1e8ac092b8
- SHA1 dd2bf5cb2a7c29e4a8b7fb405ec2a9e3e9376e81
- SHA512 9fc3a12887dc3c3b82140b3ef591aad68b3407bfec3e7a292dec2417052069c14976e8fcaeea934dc81d58aca85a583979141c4463aa5924fb7c933d648b122d
- SSDEEP 98304:Yi3bpjg3E9+w1Wf/46VK2CvW+gv0AdIsf/M2Xc5ISM5:DV0w2C7qIsfU2Xc5ISM
- TLSH T198F58D20BAC08036D97216324DAA7739A6BDFE301B35A1D752543E7839307D26D396BF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: valleyrat
- Windows_Trojan_Winos_464b8a2e 5 IoCs
resource yara_rule behavioral5/memory/1764-14-0x0000000003730000-0x0000000003788000-memory.dmp Windows_Trojan_Winos_464b8a2e behavioral5/memory/1764-17-0x0000000003730000-0x0000000003788000-memory.dmp Windows_Trojan_Winos_464b8a2e behavioral5/memory/1764-15-0x0000000003730000-0x0000000003788000-memory.dmp Windows_Trojan_Winos_464b8a2e behavioral5/memory/1764-18-0x0000000003730000-0x0000000003788000-memory.dmp Windows_Trojan_Winos_464b8a2e behavioral5/memory/1764-19-0x0000000003730000-0x0000000003788000-memory.dmp Windows_Trojan_Winos_464b8a2e - https://www.esentire.com/blog/winos4-0-online-module-staging-component-used-in-cleversoar-campaign 6 IoCs
resource yara_rule behavioral5/files/0x0007000000024351-4.dat WinosStager behavioral5/memory/1764-14-0x0000000003730000-0x0000000003788000-memory.dmp WinosStager behavioral5/memory/1764-17-0x0000000003730000-0x0000000003788000-memory.dmp WinosStager behavioral5/memory/1764-15-0x0000000003730000-0x0000000003788000-memory.dmp WinosStager behavioral5/memory/1764-18-0x0000000003730000-0x0000000003788000-memory.dmp WinosStager behavioral5/memory/1764-19-0x0000000003730000-0x0000000003788000-memory.dmp WinosStager - Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: CopilotUpdate.exe File opened (read-only) \??\W: CopilotUpdate.exe File opened (read-only) \??\X: CopilotUpdate.exe File opened (read-only) \??\Y: CopilotUpdate.exe File opened (read-only) \??\Z: CopilotUpdate.exe File opened (read-only) \??\R: CopilotUpdate.exe File opened (read-only) \??\G: CopilotUpdate.exe File opened (read-only) \??\O: CopilotUpdate.exe File opened (read-only) \??\P: CopilotUpdate.exe File opened (read-only) \??\S: CopilotUpdate.exe File opened (read-only) \??\U: CopilotUpdate.exe File opened (read-only) \??\H: CopilotUpdate.exe File opened (read-only) \??\J: CopilotUpdate.exe File opened (read-only) \??\N: CopilotUpdate.exe File opened (read-only) \??\Q: CopilotUpdate.exe File opened (read-only) \??\B: CopilotUpdate.exe File opened (read-only) \??\E: CopilotUpdate.exe File opened (read-only) \??\I: CopilotUpdate.exe File opened (read-only) \??\K: CopilotUpdate.exe File opened (read-only) \??\L: CopilotUpdate.exe File opened (read-only) \??\T: CopilotUpdate.exe File opened (read-only) \??\V: CopilotUpdate.exe - Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 12 api.ipify.org 13 api.ipify.org - Enumerates processes with tasklist 1 TTPs 20 IoCs
pid Process 3156 tasklist.exe 2400 tasklist.exe 3252 tasklist.exe 1808 tasklist.exe 2452 tasklist.exe 2692 tasklist.exe 3056 tasklist.exe 3096 tasklist.exe 2800 tasklist.exe 176 tasklist.exe 5116 tasklist.exe 3368 tasklist.exe 4444 tasklist.exe 420 tasklist.exe 2212 tasklist.exe 4880 tasklist.exe 5100 tasklist.exe 4740 tasklist.exe 3920 tasklist.exe 3152 tasklist.exe - Executes dropped EXE 2 IoCs
pid Process 1764 CopilotUpdate.exe 3220 CopilotUpdate.exe - Loads dropped DLL 2 IoCs
pid Process 1764 CopilotUpdate.exe 3220 CopilotUpdate.exe - Executes a command shell one-liner 1 TTPs 3 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1384 cmd.exe 2840 cmd.exe 3200 cmd.exe - Program crash 1 IoCs
pid pid_target Process procid_target 4660 3220 WerFault.exe 102 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CopilotUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ComputerDefaults.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CopilotUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Vat.No.20260727022528.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe - Delays execution with timeout.exe 20 IoCs
pid Process 1484 timeout.exe 2228 timeout.exe 3292 timeout.exe 4660 timeout.exe 1920 timeout.exe 3224 timeout.exe 2600 timeout.exe 3112 timeout.exe 4248 timeout.exe 1376 timeout.exe 556 timeout.exe 4688 timeout.exe 1288 timeout.exe 2876 timeout.exe 4860 timeout.exe 2484 timeout.exe 2264 timeout.exe 4332 timeout.exe 5012 timeout.exe 2068 timeout.exe - Kills process with taskkill 1 IoCs
pid Process 4696 taskkill.exe - Modifies registry class 10 IoCs
description ioc Process Key deleted \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\ms-settings Vat.No.20260727022528.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\ms-settings\Shell\open\command Vat.No.20260727022528.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/{6BCE6A49-46ED-4577-9E3B-1EC5D9D7E538}v82.26.77849.9393/packages/CopilotUpdate.exe" Vat.No.20260727022528.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\ms-settings\Shell\open\command\DelegateExecute Vat.No.20260727022528.exe Key deleted \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\ms-settings\Shell\open Vat.No.20260727022528.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\ms-settings Vat.No.20260727022528.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\ms-settings\Shell Vat.No.20260727022528.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\ms-settings\Shell\open Vat.No.20260727022528.exe Key deleted \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\ms-settings\Shell\open\command Vat.No.20260727022528.exe Key deleted \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\ms-settings\Shell Vat.No.20260727022528.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1764 CopilotUpdate.exe 1764 CopilotUpdate.exe 1764 CopilotUpdate.exe 1764 CopilotUpdate.exe 1764 CopilotUpdate.exe 1764 CopilotUpdate.exe 1764 CopilotUpdate.exe 1764 CopilotUpdate.exe 1764 CopilotUpdate.exe 1764 CopilotUpdate.exe 1764 CopilotUpdate.exe 1764 CopilotUpdate.exe 1764 CopilotUpdate.exe 1764 CopilotUpdate.exe 1764 CopilotUpdate.exe 1764 CopilotUpdate.exe 1764 CopilotUpdate.exe 1764 CopilotUpdate.exe 1764 CopilotUpdate.exe 1764 CopilotUpdate.exe 1764 CopilotUpdate.exe 1764 CopilotUpdate.exe 1764 CopilotUpdate.exe 1764 CopilotUpdate.exe 1764 CopilotUpdate.exe 1764 CopilotUpdate.exe 1764 CopilotUpdate.exe 1764 CopilotUpdate.exe 1764 CopilotUpdate.exe 1764 CopilotUpdate.exe 1764 CopilotUpdate.exe 1764 CopilotUpdate.exe 1764 CopilotUpdate.exe 1764 CopilotUpdate.exe 1764 CopilotUpdate.exe 1764 CopilotUpdate.exe 1764 CopilotUpdate.exe 1764 CopilotUpdate.exe 1764 CopilotUpdate.exe 1764 CopilotUpdate.exe 1764 CopilotUpdate.exe 1764 CopilotUpdate.exe 1764 CopilotUpdate.exe 1764 CopilotUpdate.exe 1764 CopilotUpdate.exe 1764 CopilotUpdate.exe 1764 CopilotUpdate.exe 1764 CopilotUpdate.exe 1764 CopilotUpdate.exe 1764 CopilotUpdate.exe 1764 CopilotUpdate.exe 1764 CopilotUpdate.exe 1764 CopilotUpdate.exe 1764 CopilotUpdate.exe 1764 CopilotUpdate.exe 1764 CopilotUpdate.exe 1764 CopilotUpdate.exe 1764 CopilotUpdate.exe 1764 CopilotUpdate.exe 1764 CopilotUpdate.exe 1764 CopilotUpdate.exe 1764 CopilotUpdate.exe 1764 CopilotUpdate.exe 1764 CopilotUpdate.exe - Suspicious use of AdjustPrivilegeToken 61 IoCs
description pid Process Token: SeDebugPrivilege 1764 CopilotUpdate.exe Token: SeIncBasePriorityPrivilege 1764 CopilotUpdate.exe Token: SeLoadDriverPrivilege 1764 CopilotUpdate.exe Token: SeTakeOwnershipPrivilege 1764 CopilotUpdate.exe Token: SeTcbPrivilege 1764 CopilotUpdate.exe Token: SeDebugPrivilege 4696 taskkill.exe Token: SeDebugPrivilege 3368 tasklist.exe Token: SeDebugPrivilege 1764 CopilotUpdate.exe Token: SeCreateTokenPrivilege 1764 CopilotUpdate.exe Token: SeAssignPrimaryTokenPrivilege 1764 CopilotUpdate.exe Token: SeLockMemoryPrivilege 1764 CopilotUpdate.exe Token: SeIncreaseQuotaPrivilege 1764 CopilotUpdate.exe Token: SeMachineAccountPrivilege 1764 CopilotUpdate.exe Token: SeTcbPrivilege 1764 CopilotUpdate.exe Token: SeSecurityPrivilege 1764 CopilotUpdate.exe Token: SeTakeOwnershipPrivilege 1764 CopilotUpdate.exe Token: SeLoadDriverPrivilege 1764 CopilotUpdate.exe Token: SeSystemProfilePrivilege 1764 CopilotUpdate.exe Token: SeSystemtimePrivilege 1764 CopilotUpdate.exe Token: SeProfSingleProcessPrivilege 1764 CopilotUpdate.exe Token: SeIncBasePriorityPrivilege 1764 CopilotUpdate.exe Token: SeCreatePagefilePrivilege 1764 CopilotUpdate.exe Token: SeCreatePermanentPrivilege 1764 CopilotUpdate.exe Token: SeBackupPrivilege 1764 CopilotUpdate.exe Token: SeRestorePrivilege 1764 CopilotUpdate.exe Token: SeShutdownPrivilege 1764 CopilotUpdate.exe Token: SeDebugPrivilege 1764 CopilotUpdate.exe Token: SeAuditPrivilege 1764 CopilotUpdate.exe Token: SeSystemEnvironmentPrivilege 1764 CopilotUpdate.exe Token: SeChangeNotifyPrivilege 1764 CopilotUpdate.exe Token: SeRemoteShutdownPrivilege 1764 CopilotUpdate.exe Token: SeUndockPrivilege 1764 CopilotUpdate.exe Token: SeSyncAgentPrivilege 1764 CopilotUpdate.exe Token: SeEnableDelegationPrivilege 1764 CopilotUpdate.exe Token: SeManageVolumePrivilege 1764 CopilotUpdate.exe Token: SeImpersonatePrivilege 1764 CopilotUpdate.exe Token: SeCreateGlobalPrivilege 1764 CopilotUpdate.exe Token: 31 1764 CopilotUpdate.exe Token: 32 1764 CopilotUpdate.exe Token: 33 1764 CopilotUpdate.exe Token: 34 1764 CopilotUpdate.exe Token: 35 1764 CopilotUpdate.exe Token: SeDebugPrivilege 5100 tasklist.exe Token: SeDebugPrivilege 3056 tasklist.exe Token: SeDebugPrivilege 3156 tasklist.exe Token: SeDebugPrivilege 4740 tasklist.exe Token: SeDebugPrivilege 4444 tasklist.exe Token: SeDebugPrivilege 2400 tasklist.exe Token: SeDebugPrivilege 3096 tasklist.exe Token: SeDebugPrivilege 3252 tasklist.exe Token: SeDebugPrivilege 2800 tasklist.exe Token: SeDebugPrivilege 176 tasklist.exe Token: SeDebugPrivilege 420 tasklist.exe Token: SeDebugPrivilege 3920 tasklist.exe Token: SeDebugPrivilege 1808 tasklist.exe Token: SeDebugPrivilege 2212 tasklist.exe Token: SeDebugPrivilege 2452 tasklist.exe Token: SeDebugPrivilege 3152 tasklist.exe Token: SeDebugPrivilege 4880 tasklist.exe Token: SeDebugPrivilege 2692 tasklist.exe Token: SeDebugPrivilege 5116 tasklist.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1264 Vat.No.20260727022528.exe 1764 CopilotUpdate.exe 1764 CopilotUpdate.exe 3220 CopilotUpdate.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1264 wrote to memory of 1384 1264 Vat.No.20260727022528.exe 85 PID 1384 wrote to memory of 3284 1384 cmd.exe 87 PID 3284 wrote to memory of 1764 3284 ComputerDefaults.exe 88 PID 1764 wrote to memory of 4696 1764 CopilotUpdate.exe 89 PID 1764 wrote to memory of 2840 1764 CopilotUpdate.exe 94 PID 2840 wrote to memory of 3200 2840 cmd.exe 96 PID 3200 wrote to memory of 3368 3200 cmd.exe 97 PID 3200 wrote to memory of 2244 3200 cmd.exe 98 PID 3200 wrote to memory of 4688 3200 cmd.exe 100 PID 3200 wrote to memory of 5100 3200 cmd.exe 108 PID 3200 wrote to memory of 1080 3200 cmd.exe 109 PID 3200 wrote to memory of 2600 3200 cmd.exe 110 PID 3200 wrote to memory of 3056 3200 cmd.exe 118 PID 3200 wrote to memory of 1332 3200 cmd.exe 119 PID 3200 wrote to memory of 4860 3200 cmd.exe 120 PID 3200 wrote to memory of 3156 3200 cmd.exe 121 PID 3200 wrote to memory of 1832 3200 cmd.exe 122 PID 3200 wrote to memory of 2228 3200 cmd.exe 123 PID 3200 wrote to memory of 4740 3200 cmd.exe 124 PID 3200 wrote to memory of 4248 3200 cmd.exe 125 PID 3200 wrote to memory of 3292 3200 cmd.exe 126 PID 3200 wrote to memory of 4444 3200 cmd.exe 127 PID 3200 wrote to memory of 3368 3200 cmd.exe 128 PID 3200 wrote to memory of 2484 3200 cmd.exe 129 PID 3200 wrote to memory of 2400 3200 cmd.exe 130 PID 3200 wrote to memory of 4440 3200 cmd.exe 131 PID 3200 wrote to memory of 4660 3200 cmd.exe 132 PID 3200 wrote to memory of 3096 3200 cmd.exe 133 PID 3200 wrote to memory of 4904 3200 cmd.exe 134 PID 3200 wrote to memory of 3112 3200 cmd.exe 135 PID 3200 wrote to memory of 3252 3200 cmd.exe 136 PID 3200 wrote to memory of 1404 3200 cmd.exe 137 PID 3200 wrote to memory of 2264 3200 cmd.exe 138 PID 3200 wrote to memory of 2800 3200 cmd.exe 139 PID 3200 wrote to memory of 1520 3200 cmd.exe 140 PID 3200 wrote to memory of 1288 3200 cmd.exe 141 PID 3200 wrote to memory of 176 3200 cmd.exe 142 PID 3200 wrote to memory of 4392 3200 cmd.exe 143 PID 3200 wrote to memory of 4332 3200 cmd.exe 144 PID 3200 wrote to memory of 420 3200 cmd.exe 145 PID 3200 wrote to memory of 3728 3200 cmd.exe 146 PID 3200 wrote to memory of 1920 3200 cmd.exe 147 PID 3200 wrote to memory of 3920 3200 cmd.exe 148 PID 3200 wrote to memory of 2324 3200 cmd.exe 149 PID 3200 wrote to memory of 2876 3200 cmd.exe 150 PID 3200 wrote to memory of 1808 3200 cmd.exe 151 PID 3200 wrote to memory of 2384 3200 cmd.exe 152 PID 3200 wrote to memory of 5012 3200 cmd.exe 153 PID 3200 wrote to memory of 2212 3200 cmd.exe 154 PID 3200 wrote to memory of 4092 3200 cmd.exe 155 PID 3200 wrote to memory of 4248 3200 cmd.exe 156 PID 3200 wrote to memory of 2452 3200 cmd.exe 157 PID 3200 wrote to memory of 1112 3200 cmd.exe 158 PID 3200 wrote to memory of 2068 3200 cmd.exe 159 PID 3200 wrote to memory of 3152 3200 cmd.exe 160 PID 3200 wrote to memory of 2084 3200 cmd.exe 161 PID 3200 wrote to memory of 1484 3200 cmd.exe 162 PID 3200 wrote to memory of 4880 3200 cmd.exe 163 PID 3200 wrote to memory of 2524 3200 cmd.exe 164 PID 3200 wrote to memory of 3224 3200 cmd.exe 165 PID 3200 wrote to memory of 2692 3200 cmd.exe 166 PID 3200 wrote to memory of 3292 3200 cmd.exe 167 PID 3200 wrote to memory of 1376 3200 cmd.exe 168 PID 3200 wrote to memory of 5116 3200 cmd.exe 169
Processes
-
C:\Users\Admin\AppData\Local\Temp\Vat.No.20260727022528.exe"C:\Users\Admin\AppData\Local\Temp\Vat.No.20260727022528.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Windows\SysWOW64\cmd.exe/c C:\Windows\System32\ComputerDefaults.exe2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Windows\SysWOW64\ComputerDefaults.exeC:\Windows\System32\ComputerDefaults.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\ProgramData\{6BCE6A49-46ED-4577-9E3B-1EC5D9D7E538}v82.26.77849.9393\packages\CopilotUpdate.exe"CopilotUpdate.exe"4⤵
- Enumerates connected drives
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im cmd.exe5⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4696
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start "" /B cmd /C C:\Users\Admin\AppData\Local\Temp\0BB94DCBFFDA3EB9EF2.BAT5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Windows\SysWOW64\cmd.execmd /C C:\Users\Admin\AppData\Local\Temp\0BB94DCBFFDA3EB9EF2.BAT6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3368
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:2244
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4688
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5100
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:1080
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2600
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3056
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:1332
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4860
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3156
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:1832
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2228
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4740
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:4248
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:3292
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4444
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:3368
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2484
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2400
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:4440
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4660
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3096
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:4904
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:3112
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3252
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:1404
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2264
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2800
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:1520
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1288
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:176
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:4392
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4332
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:420
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵PID:3728
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1920
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3920
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:2324
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2876
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1808
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:2384
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:5012
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2212
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:4092
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4248
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2452
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:1112
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2068
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3152
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:2084
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1484
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4880
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:2524
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:3224
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2692
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:3292
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1376
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5116
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵PID:1720
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:556
-
-
-
-
-
-
-
C:\ProgramData\{6BCE6A49-46ED-4577-9E3B-1EC5D9D7E538}v82.26.77849.9393\packages\CopilotUpdate.exeC:\ProgramData\{6BCE6A49-46ED-4577-9E3B-1EC5D9D7E538}v82.26.77849.9393\packages\CopilotUpdate.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3220 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3220 -s 5802⤵
- Program crash
PID:4660
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3220 -ip 32201⤵PID:3052
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\{6BCE6A49-46ED-4577-9E3B-1EC5D9D7E538}v82.26.77849.9393\packages\CopilotUpdate.exe
- Size 3.5MB
- SHA256 3a0583f7d3f41e1c2c36fa585ad620a518ab6661767f2e9683023745b6f58c4c
- MD5 cae7e1192eb824214833bb1e8ac092b8
- SHA1 dd2bf5cb2a7c29e4a8b7fb405ec2a9e3e9376e81
- SHA512 9fc3a12887dc3c3b82140b3ef591aad68b3407bfec3e7a292dec2417052069c14976e8fcaeea934dc81d58aca85a583979141c4463aa5924fb7c933d648b122d
- SSDEEP 98304:Yi3bpjg3E9+w1Wf/46VK2CvW+gv0AdIsf/M2Xc5ISM5:DV0w2C7qIsfU2Xc5ISM
- TLSH T198F58D20BAC08036D97216324DAA7739A6BDFE301B35A1D752543E7839307D26D396BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\{6BCE6A49-46ED-4577-9E3B-1EC5D9D7E538}v82.26.77849.9393\packages\PDFCore8.dll
- Size 5.5MB
- SHA256 d265fcf18b14b98e55aa9fffd6b64b39de84304a1796854e72eef35bc6dca2c6
- MD5 7e41ded03b900c61467b70ca1718fed2
- SHA1 ceb851e0aeb27295b8221a3f5e225c9db0790051
- SHA512 63ca550b570606a2337d24a57baf9069b8cf73c9ef54f353bd177eee04539a3bbd744dd915263739a4077272714e5fdbd8e122724051fa630729b556329b0371
- SSDEEP 98304:0nJkIC4LTSPakN6RaSnZ0qTTJ8OjWrh6Wfa/oSoL4/aC+gsMjLqWaG0T:iJHT4P39fa/oSuFm
- TLSH T12446CF913A40646DE2D7013C4E1DB365D3EE4BA01F3A90CBE2D4E96E29315C2E727E67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\0BB94DCBFFDA3EB9EF2.BAT
- Size 862B
- SHA256 ca42528d696ee2d8acf15c1721e916759aa0da3eed433957b2c374f131d76dae
- MD5 c0a2178e1e24f15f493d900ac5198e7f
- SHA1 df0cccd8b0124cc2c4fcddbd4a3fef91f6515eee
- SHA512 4798390d1ec5743334eab76d277333c1368a9e1e2963719bbc3a61d84ff93b225c3208ffd296b5a1c51fd175935cca483f7cb50a1f801ad429f6ece52e0b3cf6
- TLSH T14D11248F520B286C07F482B778814E465FD9D447F73BA1A87000D7046FAA94F95DA26C
- MD5 SHA1 SHA512 TLSH