Analysis
- max time kernel
600s - max time network
601s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-ja - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-jalocale:ja-jpos:windows11-ltsc_2024-x64systemwindows - submitted
27/07/2026, 09:03
Behavioral task
behavioral1
Sample
J-A20260727022544.zip
Resource
win10v2004-20260513-ja
windows10-2004-x64
18 signatures
600 seconds
Behavioral task
behavioral2
Sample
J-A20260727022544.zip
Resource
win11ltsc2024-20260709-ja
windows11-ltsc_2024-x64
18 signatures
600 seconds
Behavioral task
behavioral3
Sample
PdFcOrE8.dll
Resource
win10v2004-20260513-ja
windows10-2004-x64
3 signatures
600 seconds
Behavioral task
behavioral4
Sample
PdFcOrE8.dll
Resource
win11ltsc2024-20260709-ja
windows11-ltsc_2024-x64
3 signatures
600 seconds
Behavioral task
behavioral5
Sample
Vat.No.20260727022528.exe
Resource
win10v2004-20260513-ja
windows10-2004-x64
18 signatures
600 seconds
Behavioral task
behavioral6
Sample
Vat.No.20260727022528.exe
Resource
win11ltsc2024-20260709-ja
windows11-ltsc_2024-x64
18 signatures
600 seconds
General
- Target Vat.No.20260727022528.exe
- Size 3.5MB
- Sample260727-k1dqhack5x
- SHA256 3a0583f7d3f41e1c2c36fa585ad620a518ab6661767f2e9683023745b6f58c4c
- MD5 cae7e1192eb824214833bb1e8ac092b8
- SHA1 dd2bf5cb2a7c29e4a8b7fb405ec2a9e3e9376e81
- SHA512 9fc3a12887dc3c3b82140b3ef591aad68b3407bfec3e7a292dec2417052069c14976e8fcaeea934dc81d58aca85a583979141c4463aa5924fb7c933d648b122d
- SSDEEP 98304:Yi3bpjg3E9+w1Wf/46VK2CvW+gv0AdIsf/M2Xc5ISM5:DV0w2C7qIsfU2Xc5ISM
- TLSH T198F58D20BAC08036D97216324DAA7739A6BDFE301B35A1D752543E7839307D26D396BF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: valleyrat
- Windows_Trojan_Winos_464b8a2e 5 IoCs
resource yara_rule behavioral6/memory/4280-8-0x0000000004EC0000-0x0000000004F18000-memory.dmp Windows_Trojan_Winos_464b8a2e behavioral6/memory/4280-9-0x0000000004EC0000-0x0000000004F18000-memory.dmp Windows_Trojan_Winos_464b8a2e behavioral6/memory/4280-11-0x0000000004EC0000-0x0000000004F18000-memory.dmp Windows_Trojan_Winos_464b8a2e behavioral6/memory/4280-12-0x0000000004EC0000-0x0000000004F18000-memory.dmp Windows_Trojan_Winos_464b8a2e behavioral6/memory/4280-13-0x0000000004EC0000-0x0000000004F18000-memory.dmp Windows_Trojan_Winos_464b8a2e - https://www.esentire.com/blog/winos4-0-online-module-staging-component-used-in-cleversoar-campaign 6 IoCs
resource yara_rule behavioral6/files/0x000d00000001c51d-1.dat WinosStager behavioral6/memory/4280-8-0x0000000004EC0000-0x0000000004F18000-memory.dmp WinosStager behavioral6/memory/4280-9-0x0000000004EC0000-0x0000000004F18000-memory.dmp WinosStager behavioral6/memory/4280-11-0x0000000004EC0000-0x0000000004F18000-memory.dmp WinosStager behavioral6/memory/4280-12-0x0000000004EC0000-0x0000000004F18000-memory.dmp WinosStager behavioral6/memory/4280-13-0x0000000004EC0000-0x0000000004F18000-memory.dmp WinosStager - Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: CopilotUpdate.exe File opened (read-only) \??\H: CopilotUpdate.exe File opened (read-only) \??\J: CopilotUpdate.exe File opened (read-only) \??\K: CopilotUpdate.exe File opened (read-only) \??\L: CopilotUpdate.exe File opened (read-only) \??\N: CopilotUpdate.exe File opened (read-only) \??\P: CopilotUpdate.exe File opened (read-only) \??\S: CopilotUpdate.exe File opened (read-only) \??\B: CopilotUpdate.exe File opened (read-only) \??\G: CopilotUpdate.exe File opened (read-only) \??\Q: CopilotUpdate.exe File opened (read-only) \??\V: CopilotUpdate.exe File opened (read-only) \??\X: CopilotUpdate.exe File opened (read-only) \??\Z: CopilotUpdate.exe File opened (read-only) \??\O: CopilotUpdate.exe File opened (read-only) \??\R: CopilotUpdate.exe File opened (read-only) \??\T: CopilotUpdate.exe File opened (read-only) \??\U: CopilotUpdate.exe File opened (read-only) \??\Y: CopilotUpdate.exe File opened (read-only) \??\I: CopilotUpdate.exe File opened (read-only) \??\M: CopilotUpdate.exe File opened (read-only) \??\W: CopilotUpdate.exe - Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 api.ipify.org 10 api.ipify.org - Enumerates processes with tasklist 1 TTPs 20 IoCs
pid Process 5168 tasklist.exe 2288 tasklist.exe 5020 tasklist.exe 1376 tasklist.exe 5344 tasklist.exe 5232 tasklist.exe 1000 tasklist.exe 268 tasklist.exe 2436 tasklist.exe 1612 tasklist.exe 4660 tasklist.exe 3264 tasklist.exe 1600 tasklist.exe 1296 tasklist.exe 2408 tasklist.exe 2712 tasklist.exe 5100 tasklist.exe 4000 tasklist.exe 5396 tasklist.exe 1128 tasklist.exe - Executes dropped EXE 2 IoCs
pid Process 4280 CopilotUpdate.exe 1836 CopilotUpdate.exe - Loads dropped DLL 2 IoCs
pid Process 4280 CopilotUpdate.exe 1836 CopilotUpdate.exe - Executes a command shell one-liner 1 TTPs 3 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 52 cmd.exe 4288 cmd.exe 2528 cmd.exe - Program crash 1 IoCs
pid pid_target Process procid_target 2240 1836 WerFault.exe 104 - System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Vat.No.20260727022528.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ComputerDefaults.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CopilotUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language find.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CopilotUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe - Delays execution with timeout.exe 20 IoCs
pid Process 5416 timeout.exe 2872 timeout.exe 4756 timeout.exe 1812 timeout.exe 5208 timeout.exe 5948 timeout.exe 1128 timeout.exe 3732 timeout.exe 5028 timeout.exe 1312 timeout.exe 1236 timeout.exe 5748 timeout.exe 1884 timeout.exe 4192 timeout.exe 2756 timeout.exe 1992 timeout.exe 3144 timeout.exe 2480 timeout.exe 5220 timeout.exe 5704 timeout.exe - Kills process with taskkill 1 IoCs
pid Process 2856 taskkill.exe - Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\ms-settings\Shell\open Vat.No.20260727022528.exe Set value (str) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\ms-settings\Shell\open\command\ = "../../ProgramData/{63E707FC-8212-4167-AC3C-C1A5A74C59C4}v84.84.95846.3541/packages/CopilotUpdate.exe" Vat.No.20260727022528.exe Key deleted \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\ms-settings\Shell\open Vat.No.20260727022528.exe Set value (str) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\ms-settings\Shell\open\command\DelegateExecute = "Ā" Vat.No.20260727022528.exe Key deleted \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\ms-settings\Shell\open\command Vat.No.20260727022528.exe Key deleted \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\ms-settings\Shell Vat.No.20260727022528.exe Key deleted \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\ms-settings Vat.No.20260727022528.exe Key created \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\ms-settings\Shell\open\command Vat.No.20260727022528.exe Key created \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\ms-settings Vat.No.20260727022528.exe Key created \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\ms-settings\Shell Vat.No.20260727022528.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4280 CopilotUpdate.exe 4280 CopilotUpdate.exe 4280 CopilotUpdate.exe 4280 CopilotUpdate.exe 4280 CopilotUpdate.exe 4280 CopilotUpdate.exe 4280 CopilotUpdate.exe 4280 CopilotUpdate.exe 4280 CopilotUpdate.exe 4280 CopilotUpdate.exe 4280 CopilotUpdate.exe 4280 CopilotUpdate.exe 4280 CopilotUpdate.exe 4280 CopilotUpdate.exe 4280 CopilotUpdate.exe 4280 CopilotUpdate.exe 4280 CopilotUpdate.exe 4280 CopilotUpdate.exe 4280 CopilotUpdate.exe 4280 CopilotUpdate.exe 4280 CopilotUpdate.exe 4280 CopilotUpdate.exe 4280 CopilotUpdate.exe 4280 CopilotUpdate.exe 4280 CopilotUpdate.exe 4280 CopilotUpdate.exe 4280 CopilotUpdate.exe 4280 CopilotUpdate.exe 4280 CopilotUpdate.exe 4280 CopilotUpdate.exe 4280 CopilotUpdate.exe 4280 CopilotUpdate.exe 4280 CopilotUpdate.exe 4280 CopilotUpdate.exe 4280 CopilotUpdate.exe 4280 CopilotUpdate.exe 4280 CopilotUpdate.exe 4280 CopilotUpdate.exe 4280 CopilotUpdate.exe 4280 CopilotUpdate.exe 4280 CopilotUpdate.exe 4280 CopilotUpdate.exe 4280 CopilotUpdate.exe 4280 CopilotUpdate.exe 4280 CopilotUpdate.exe 4280 CopilotUpdate.exe 4280 CopilotUpdate.exe 4280 CopilotUpdate.exe 4280 CopilotUpdate.exe 4280 CopilotUpdate.exe 4280 CopilotUpdate.exe 4280 CopilotUpdate.exe 4280 CopilotUpdate.exe 4280 CopilotUpdate.exe 4280 CopilotUpdate.exe 4280 CopilotUpdate.exe 4280 CopilotUpdate.exe 4280 CopilotUpdate.exe 4280 CopilotUpdate.exe 4280 CopilotUpdate.exe 4280 CopilotUpdate.exe 4280 CopilotUpdate.exe 4280 CopilotUpdate.exe 4280 CopilotUpdate.exe - Suspicious use of AdjustPrivilegeToken 61 IoCs
description pid Process Token: SeDebugPrivilege 4280 CopilotUpdate.exe Token: SeIncBasePriorityPrivilege 4280 CopilotUpdate.exe Token: SeLoadDriverPrivilege 4280 CopilotUpdate.exe Token: SeTakeOwnershipPrivilege 4280 CopilotUpdate.exe Token: SeTcbPrivilege 4280 CopilotUpdate.exe Token: SeDebugPrivilege 2856 taskkill.exe Token: SeDebugPrivilege 268 tasklist.exe Token: SeDebugPrivilege 4280 CopilotUpdate.exe Token: SeCreateTokenPrivilege 4280 CopilotUpdate.exe Token: SeAssignPrimaryTokenPrivilege 4280 CopilotUpdate.exe Token: SeLockMemoryPrivilege 4280 CopilotUpdate.exe Token: SeIncreaseQuotaPrivilege 4280 CopilotUpdate.exe Token: SeMachineAccountPrivilege 4280 CopilotUpdate.exe Token: SeTcbPrivilege 4280 CopilotUpdate.exe Token: SeSecurityPrivilege 4280 CopilotUpdate.exe Token: SeTakeOwnershipPrivilege 4280 CopilotUpdate.exe Token: SeLoadDriverPrivilege 4280 CopilotUpdate.exe Token: SeSystemProfilePrivilege 4280 CopilotUpdate.exe Token: SeSystemtimePrivilege 4280 CopilotUpdate.exe Token: SeProfSingleProcessPrivilege 4280 CopilotUpdate.exe Token: SeIncBasePriorityPrivilege 4280 CopilotUpdate.exe Token: SeCreatePagefilePrivilege 4280 CopilotUpdate.exe Token: SeCreatePermanentPrivilege 4280 CopilotUpdate.exe Token: SeBackupPrivilege 4280 CopilotUpdate.exe Token: SeRestorePrivilege 4280 CopilotUpdate.exe Token: SeShutdownPrivilege 4280 CopilotUpdate.exe Token: SeDebugPrivilege 4280 CopilotUpdate.exe Token: SeAuditPrivilege 4280 CopilotUpdate.exe Token: SeSystemEnvironmentPrivilege 4280 CopilotUpdate.exe Token: SeChangeNotifyPrivilege 4280 CopilotUpdate.exe Token: SeRemoteShutdownPrivilege 4280 CopilotUpdate.exe Token: SeUndockPrivilege 4280 CopilotUpdate.exe Token: SeSyncAgentPrivilege 4280 CopilotUpdate.exe Token: SeEnableDelegationPrivilege 4280 CopilotUpdate.exe Token: SeManageVolumePrivilege 4280 CopilotUpdate.exe Token: SeImpersonatePrivilege 4280 CopilotUpdate.exe Token: SeCreateGlobalPrivilege 4280 CopilotUpdate.exe Token: 31 4280 CopilotUpdate.exe Token: 32 4280 CopilotUpdate.exe Token: 33 4280 CopilotUpdate.exe Token: 34 4280 CopilotUpdate.exe Token: 35 4280 CopilotUpdate.exe Token: SeDebugPrivilege 2436 tasklist.exe Token: SeDebugPrivilege 5100 tasklist.exe Token: SeDebugPrivilege 5168 tasklist.exe Token: SeDebugPrivilege 1612 tasklist.exe Token: SeDebugPrivilege 2288 tasklist.exe Token: SeDebugPrivilege 2408 tasklist.exe Token: SeDebugPrivilege 4660 tasklist.exe Token: SeDebugPrivilege 3264 tasklist.exe Token: SeDebugPrivilege 5020 tasklist.exe Token: SeDebugPrivilege 1376 tasklist.exe Token: SeDebugPrivilege 1600 tasklist.exe Token: SeDebugPrivilege 1296 tasklist.exe Token: SeDebugPrivilege 5344 tasklist.exe Token: SeDebugPrivilege 4000 tasklist.exe Token: SeDebugPrivilege 5232 tasklist.exe Token: SeDebugPrivilege 5396 tasklist.exe Token: SeDebugPrivilege 1128 tasklist.exe Token: SeDebugPrivilege 1000 tasklist.exe Token: SeDebugPrivilege 2712 tasklist.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4748 Vat.No.20260727022528.exe 4280 CopilotUpdate.exe 4280 CopilotUpdate.exe 1836 CopilotUpdate.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4748 wrote to memory of 52 4748 Vat.No.20260727022528.exe 90 PID 52 wrote to memory of 1624 52 cmd.exe 92 PID 1624 wrote to memory of 4280 1624 ComputerDefaults.exe 93 PID 4280 wrote to memory of 2856 4280 CopilotUpdate.exe 94 PID 4280 wrote to memory of 4288 4280 CopilotUpdate.exe 97 PID 4288 wrote to memory of 2528 4288 cmd.exe 99 PID 2528 wrote to memory of 268 2528 cmd.exe 100 PID 2528 wrote to memory of 1688 2528 cmd.exe 101 PID 2528 wrote to memory of 5748 2528 cmd.exe 102 PID 2528 wrote to memory of 2436 2528 cmd.exe 109 PID 2528 wrote to memory of 3612 2528 cmd.exe 110 PID 2528 wrote to memory of 1884 2528 cmd.exe 111 PID 2528 wrote to memory of 5100 2528 cmd.exe 112 PID 2528 wrote to memory of 3904 2528 cmd.exe 113 PID 2528 wrote to memory of 4192 2528 cmd.exe 114 PID 2528 wrote to memory of 5168 2528 cmd.exe 115 PID 2528 wrote to memory of 5612 2528 cmd.exe 116 PID 2528 wrote to memory of 1812 2528 cmd.exe 117 PID 2528 wrote to memory of 1612 2528 cmd.exe 118 PID 2528 wrote to memory of 2016 2528 cmd.exe 119 PID 2528 wrote to memory of 2756 2528 cmd.exe 120 PID 2528 wrote to memory of 2288 2528 cmd.exe 121 PID 2528 wrote to memory of 2740 2528 cmd.exe 122 PID 2528 wrote to memory of 5208 2528 cmd.exe 123 PID 2528 wrote to memory of 2408 2528 cmd.exe 124 PID 2528 wrote to memory of 3140 2528 cmd.exe 125 PID 2528 wrote to memory of 5704 2528 cmd.exe 126 PID 2528 wrote to memory of 4660 2528 cmd.exe 127 PID 2528 wrote to memory of 5372 2528 cmd.exe 128 PID 2528 wrote to memory of 5948 2528 cmd.exe 129 PID 2528 wrote to memory of 3264 2528 cmd.exe 130 PID 2528 wrote to memory of 5692 2528 cmd.exe 131 PID 2528 wrote to memory of 1128 2528 cmd.exe 132 PID 2528 wrote to memory of 5020 2528 cmd.exe 133 PID 2528 wrote to memory of 5504 2528 cmd.exe 134 PID 2528 wrote to memory of 3732 2528 cmd.exe 135 PID 2528 wrote to memory of 1376 2528 cmd.exe 142 PID 2528 wrote to memory of 4688 2528 cmd.exe 143 PID 2528 wrote to memory of 5028 2528 cmd.exe 144 PID 2528 wrote to memory of 1600 2528 cmd.exe 146 PID 2528 wrote to memory of 1480 2528 cmd.exe 147 PID 2528 wrote to memory of 1992 2528 cmd.exe 148 PID 2528 wrote to memory of 1296 2528 cmd.exe 149 PID 2528 wrote to memory of 1152 2528 cmd.exe 150 PID 2528 wrote to memory of 3144 2528 cmd.exe 151 PID 2528 wrote to memory of 5344 2528 cmd.exe 152 PID 2528 wrote to memory of 2532 2528 cmd.exe 153 PID 2528 wrote to memory of 1312 2528 cmd.exe 154 PID 2528 wrote to memory of 4000 2528 cmd.exe 155 PID 2528 wrote to memory of 5176 2528 cmd.exe 156 PID 2528 wrote to memory of 2480 2528 cmd.exe 157 PID 2528 wrote to memory of 5232 2528 cmd.exe 158 PID 2528 wrote to memory of 856 2528 cmd.exe 159 PID 2528 wrote to memory of 2872 2528 cmd.exe 160 PID 2528 wrote to memory of 5396 2528 cmd.exe 161 PID 2528 wrote to memory of 936 2528 cmd.exe 162 PID 2528 wrote to memory of 1236 2528 cmd.exe 163 PID 2528 wrote to memory of 1128 2528 cmd.exe 164 PID 2528 wrote to memory of 4576 2528 cmd.exe 165 PID 2528 wrote to memory of 5220 2528 cmd.exe 166 PID 2528 wrote to memory of 1000 2528 cmd.exe 167 PID 2528 wrote to memory of 2208 2528 cmd.exe 168 PID 2528 wrote to memory of 4756 2528 cmd.exe 169 PID 2528 wrote to memory of 2712 2528 cmd.exe 170
Processes
-
C:\Users\Admin\AppData\Local\Temp\Vat.No.20260727022528.exe"C:\Users\Admin\AppData\Local\Temp\Vat.No.20260727022528.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Windows\SysWOW64\cmd.exe/c C:\Windows\System32\ComputerDefaults.exe2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:52 -
C:\Windows\SysWOW64\ComputerDefaults.exeC:\Windows\System32\ComputerDefaults.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\ProgramData\{63E707FC-8212-4167-AC3C-C1A5A74C59C4}v84.84.95846.3541\packages\CopilotUpdate.exe"CopilotUpdate.exe"4⤵
- Enumerates connected drives
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im cmd.exe5⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2856
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start "" /B cmd /C C:\Users\Admin\AppData\Local\Temp\0BB94DCBFFDA3EB9EF2.BAT5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Windows\SysWOW64\cmd.execmd /C C:\Users\Admin\AppData\Local\Temp\0BB94DCBFFDA3EB9EF2.BAT6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:268
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:1688
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:5748
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2436
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:3612
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1884
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5100
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:3904
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4192
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5168
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:5612
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1812
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1612
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:2016
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2756
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2288
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:2740
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- Delays execution with timeout.exe
PID:5208
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2408
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:3140
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:5704
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4660
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:5372
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:5948
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3264
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:5692
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1128
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5020
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:5504
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:3732
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1376
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:4688
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:5028
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1600
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵PID:1480
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- Delays execution with timeout.exe
PID:1992
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1296
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:1152
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:3144
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:5344
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:2532
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1312
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4000
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:5176
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2480
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5232
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:856
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2872
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5396
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:936
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:1236
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1128
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:4576
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:5220
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1000
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:2208
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4756
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "IMAGENAME eq CopilotUpdate.exe"7⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2712
-
-
C:\Windows\SysWOW64\find.exefind /I "CopilotUpdate.exe"7⤵
- System Location Discovery: System Language Discovery
PID:464
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 30 /nobreak7⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:5416
-
-
-
-
-
-
-
C:\ProgramData\{63E707FC-8212-4167-AC3C-C1A5A74C59C4}v84.84.95846.3541\packages\CopilotUpdate.exeC:\ProgramData\{63E707FC-8212-4167-AC3C-C1A5A74C59C4}v84.84.95846.3541\packages\CopilotUpdate.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1836 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1836 -s 7602⤵
- Program crash
PID:2240
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 228 -p 1836 -ip 18361⤵PID:3808
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:1280
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\{63E707FC-8212-4167-AC3C-C1A5A74C59C4}v84.84.95846.3541\packages\CopilotUpdate.exe
- Size 3.5MB
- SHA256 3a0583f7d3f41e1c2c36fa585ad620a518ab6661767f2e9683023745b6f58c4c
- MD5 cae7e1192eb824214833bb1e8ac092b8
- SHA1 dd2bf5cb2a7c29e4a8b7fb405ec2a9e3e9376e81
- SHA512 9fc3a12887dc3c3b82140b3ef591aad68b3407bfec3e7a292dec2417052069c14976e8fcaeea934dc81d58aca85a583979141c4463aa5924fb7c933d648b122d
- SSDEEP 98304:Yi3bpjg3E9+w1Wf/46VK2CvW+gv0AdIsf/M2Xc5ISM5:DV0w2C7qIsfU2Xc5ISM
- TLSH T198F58D20BAC08036D97216324DAA7739A6BDFE301B35A1D752543E7839307D26D396BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\{63E707FC-8212-4167-AC3C-C1A5A74C59C4}v84.84.95846.3541\packages\PdFcOrE8.dLl
- Size 5.5MB
- SHA256 d265fcf18b14b98e55aa9fffd6b64b39de84304a1796854e72eef35bc6dca2c6
- MD5 7e41ded03b900c61467b70ca1718fed2
- SHA1 ceb851e0aeb27295b8221a3f5e225c9db0790051
- SHA512 63ca550b570606a2337d24a57baf9069b8cf73c9ef54f353bd177eee04539a3bbd744dd915263739a4077272714e5fdbd8e122724051fa630729b556329b0371
- SSDEEP 98304:0nJkIC4LTSPakN6RaSnZ0qTTJ8OjWrh6Wfa/oSoL4/aC+gsMjLqWaG0T:iJHT4P39fa/oSuFm
- TLSH T12446CF913A40646DE2D7013C4E1DB365D3EE4BA01F3A90CBE2D4E96E29315C2E727E67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\0BB94DCBFFDA3EB9EF2.BAT
- Size 862B
- SHA256 6f2cdbd97ad3987548d74b6379f3c409a18b23ea12929d20d3a872ad34938dd5
- MD5 2d4f364a6d5381655dc990b551ceef1d
- SHA1 5febf075003574fb6ef34f90b0ae3bf8581e2646
- SHA512 71fd7d197be8ba31b6093a3becfc81bdc54bbf4776294cc1b3b74e05bc256ec92cb56d356e415be5c13b05a1211c0cdbf7da269b080935b18362d943e25ae6e8
- TLSH T16611248F520B286C0BF482B778414E460B99C447FB3BA1987000DB046B9A54F94DA36D
- MD5 SHA1 SHA512 TLSH