Analysis
- user interaction
yes - max time kernel
900s - max time network
528s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 17:13
Behavioral task
behavioral1
Sample
24122024/Defender_Settings.vbs
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
18 signatures
900 seconds
Behavioral task
behavioral2
Sample
24122024/dControl.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
33 signatures
900 seconds
General
- Target 24122024/dControl.exe
- Size 447KB
- Sample260730-vrddgswxey
- SHA256 1ef6c1a4dfdc39b63bfe650ca81ab89510de6c0d3d7c608ac5be80033e559326
- MD5 58008524a6473bdf86c1040a9a9e39c3
- SHA1 cb704d2e8df80fd3500a5b817966dc262d80ddb8
- SHA512 8cf492584303523bf6cdfeb6b1b779ee44471c91e759ce32fd4849547b6245d4ed86af5b38d1c6979729a77f312ba91c48207a332ae1589a6e25de67ffb96c31
- SSDEEP 6144:Vzv+kSn74iCmfianQGDM3OXTWRDy9GYQDUmJFXIXHrsUBnBTF8JJCYrYNsQJzfgu:Vzcn7EanlQiWtYhmJFSwUBLcQZfgiD
- TLSH T1EBA42292D5045CD2D5174339DF7B7FF38EB6ADEE29180A8344B8387B3C3A9922158A53
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" dControl.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "1" MsMpEng.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" dControl.exe - Modifies firewall policy service 3 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DynamicKeywords\Addresses\AutoResolve MsMpEng.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DynamicKeywords\Addresses\AutoResolve MsMpEng.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\Mdm\DynamicKeywords\Addresses\AutoResolve MsMpEng.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DynamicKeywords\Addresses\AutoResolve MsMpEng.exe - Modifies security service 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "2" dControl.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4" dControl.exe - Windows security bypass 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\IpAddresses MsMpEng.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\TemporaryPaths MsMpEng.exe - Downloads MZ/PE file 1 IoCs
flow pid Process 13 2724 MpCmdRun.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpcmdrun.exe\Debugger = "C:\\Windows\\System32\\systray.exe" dControl.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpcmdrun.exe dControl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpcmdrun.exe dControl.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Loads dropped DLL 1 IoCs
pid Process 2776 MsMpEng.exe - Windows security modification 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection dControl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" dControl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features dControl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0" dControl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\DisableAntiSpyware = "1" dControl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\DisableAntiVirus = "1" dControl.exe -
pid Process 2328 powershell.exe 5780 powershell.exe -
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpcmdrun.exe dControl.exe - Modifies Security services 2 TTPs 6 IoCs
Modifies the startup behavior of a security service.
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdFilter\Start = "4" dControl.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisDrv\Start = "4" dControl.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisSvc\Start = "4" dControl.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdFilter\Start = "0" dControl.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisDrv\Start = "3" dControl.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisSvc\Start = "3" dControl.exe - AutoIT Executable 8 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/4704-19-0x0000000000400000-0x00000000004CD000-memory.dmp autoit_exe behavioral2/memory/4248-37-0x0000000000400000-0x00000000004CD000-memory.dmp autoit_exe behavioral2/memory/2664-75-0x0000000000400000-0x00000000004CD000-memory.dmp autoit_exe behavioral2/memory/700-110-0x0000000000400000-0x00000000004CD000-memory.dmp autoit_exe behavioral2/memory/1604-113-0x0000000000400000-0x00000000004CD000-memory.dmp autoit_exe behavioral2/memory/2664-111-0x0000000000400000-0x00000000004CD000-memory.dmp autoit_exe behavioral2/memory/5408-706-0x0000000000400000-0x00000000004CD000-memory.dmp autoit_exe behavioral2/memory/3348-708-0x0000000000400000-0x00000000004CD000-memory.dmp autoit_exe - Drops file in System32 directory 7 IoCs
description ioc Process File opened for modification C:\WINDOWS\SYSTEM32\WINBIODATABASE\51F39552-1075-4199-B513-0C10EA185DB0.DAT svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol dControl.exe File opened for modification C:\Windows\System32\GroupPolicy\gpt.ini dControl.exe File opened for modification C:\Windows\System32\GroupPolicy\Machine\Registry.pol dControl.exe File opened for modification C:\Windows\system32\LogFiles\WMI\FaceTelManually.etl svchost.exe -
resource yara_rule behavioral2/memory/4704-0-0x0000000000400000-0x00000000004CD000-memory.dmp upx behavioral2/memory/4704-19-0x0000000000400000-0x00000000004CD000-memory.dmp upx behavioral2/memory/4248-37-0x0000000000400000-0x00000000004CD000-memory.dmp upx behavioral2/memory/2664-75-0x0000000000400000-0x00000000004CD000-memory.dmp upx behavioral2/memory/700-110-0x0000000000400000-0x00000000004CD000-memory.dmp upx behavioral2/memory/1604-113-0x0000000000400000-0x00000000004CD000-memory.dmp upx behavioral2/memory/2664-111-0x0000000000400000-0x00000000004CD000-memory.dmp upx behavioral2/memory/5408-706-0x0000000000400000-0x00000000004CD000-memory.dmp upx behavioral2/memory/3348-708-0x0000000000400000-0x00000000004CD000-memory.dmp upx - Drops file in Windows directory 18 IoCs
description ioc Process File created C:\Windows\SystemTemp\149CF6AE-8E32-1662-A39D-B29B779A884D.man MsMpEng.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_vx2yg0lw.5rm.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_1ot0xtvn.zau.ps1 powershell.exe File created C:\Windows\SystemTemp\45EB7173-4CB9-4EC4-BFF8-4A54359D8366MpCommU\D776EC1A-A4F8-4588-8B64-53BED76FFA49 MpCmdRun.exe File opened for modification C:\Windows\SystemTemp\MpCmdRun.log mpcmdrun.exe File opened for modification C:\Windows\SystemTemp\MpCmdRun.log MpCmdRun.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_qrsnld0u.tcp.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_dtmeokzj.305.psm1 powershell.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_mkbd50qg.cgg.psm1 powershell.exe File opened for modification C:\Windows\SystemTemp\MpCmdRun.log MpCmdRun.exe File opened for modification C:\Windows\SERVIC~1\NETWOR~1\AppData\Local\Temp\MpCmdRun.log MpCmdRun.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_f03uogyu.gk3.ps1 powershell.exe File opened for modification C:\Windows\SystemTemp\tmpDD1.tmp mofcomp.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_xz1v2a31.han.ps1 powershell.exe File created C:\Windows\SystemTemp\45EB7173-4CB9-4EC4-BFF8-4A54359D8366MpCommU\mpam-d00abb31.exe MpCmdRun.exe File created C:\Windows\SystemTemp\__PSScriptPolicyTest_jm4bok13.zz2.ps1 powershell.exe File opened for modification C:\Windows\logs\StorGroupPolicy.log svchost.exe File created C:\Windows\SystemTemp\MpCmdRun-b0-53C9D589-6B66-4F30-9BAB-9A0193B0BAFC.lock MpCmdRun.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dControl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dControl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dControl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dControl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dControl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dControl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dControl.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MsMpEng.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MsMpEng.exe - Kills process with taskkill 1 IoCs
pid Process 4268 taskkill.exe -
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Extension Validation MsMpEng.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Validation\{2781761E-28E0-4109-99FE-B9D127C57AFE} MsMpEng.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\EXTENSION VALIDATION\{2781761E-28E0-4109-99FE-B9D127C57AFE} MsMpEng.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\EXTENSION VALIDATION\{2781761E-28E0-4109-99FE-B9D127C57AFE} MsMpEng.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Extension Validation MsMpEng.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Validation\{2781761E-28E0-4109-99FE-B9D127C57AFE} MsMpEng.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed MsMpEng.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates MsMpEng.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs MsMpEng.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs MsMpEng.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs MsMpEng.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs MsMpEng.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs MsMpEng.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs MsMpEng.exe Key created \REGISTRY\USER\S-1-5-20\Software MpCmdRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA MsMpEng.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs MsMpEng.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates MsMpEng.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Defender\CachedProxyAccessType = "0" MsMpEng.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs MsMpEng.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs MsMpEng.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates MsMpEng.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates MsMpEng.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs MsMpEng.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs MsMpEng.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs MsMpEng.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" MsMpEng.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs MsMpEng.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\IdentityCRL\Immersive\production\Property MpCmdRun.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\IdentityCRL\Immersive MpCmdRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs MsMpEng.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs MsMpEng.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root MsMpEng.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs MsMpEng.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs MsMpEng.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates MsMpEng.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs MsMpEng.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache MpCmdRun.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs MsMpEng.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs MsMpEng.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs MsMpEng.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople MsMpEng.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\IdentityCRL\Immersive\production MpCmdRun.exe Set value (data) \REGISTRY\USER\S-1-5-20\Software\Microsoft\IdentityCRL\Immersive\production\Token\{922DF99B-F4C3-4B57-B70A-AA696443101A}\DeviceTicket = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb0100000043effde0703f604c88f90346436bd9a400000000020000000000106600000001000020000000c6ad596c298e246a3658a6effa798a3b5c4c9252d9c5ddb1599b089680d5d32e000000000e8000000002000020000000fde9b100d92fb19fe07aece30fa5aac29db1fd4ca687be9c331cb8d11342bd9a20060000ff7f1ff3f076212842edcbce712329490b21a8812003ff7a8312fc1367e55b189d44f1ff9e666e90ce3acb5fef6e720af996b03988575fa3c3e63fec96f2c13920e23b9fdbb0586bf80d066e8c01924369b3d8d8a29d6184e030913bc5f8dd73e50423ec4b1b617625584a9a4ae93514a66a3d8f630bc470f892ef4de567e8e9179792b86177ec569b83bf2728d82a1391978d34d9cbea31fe03255cc6fda62521a4c72eabdc470eb7acfb17375990cdeb95248a0568994ac1857ac823d72df65dd3fe4c1cb9b2c06d607c2182c653ff220413918abb3cd60d0fb99c898d0eb14d30a18982296e1ca36b5b9eb4235443d40641e0b1071adff7fdb93d15816e831f53d422134650f0f46f95f926c67cb533919621c87172f6caf0c8b608618613c8354cd99f4199d59a2570246ab2cc21925f84fb5273a86fe7959c407057a21cdc3de0bad1fac5eeae02f1f5265cd02724f7566444ae439adb49fbea24a29f4d29149916e20b264b27a673d8c54bf88b38d522c36e6fa7fee25f4a53ba41dee4693709dc9d86f7896d10f1b66b90b2c79677e0970aea9f48e3bd98688691f737fca84405d4d4348c3b7862739271ce4f432cfa6b0c506b19b902b7c293d46e49725d9e6a6118a42f44f500219c14d5b89d12e5b5f620a44631fdffaf83f6e0a218c5d3e3a5e13801b86643d85594e57b0b9f43278918a5429bd605eabaecb0ebb5999883dc2cb82e1c54aca4a2979b846701d9228324f301564b09562f49761da926a62516c40bc7ee35e400c4c4b548525ec06d52dc1bf0f2e12603720526aa16592adefaa2487eb26fb3a0fa5deed1cf56707a013fbe31e87f6d533c842f7e7d4f07e589a969896f367eaa75f2640fcf7f8c6ce1151fb8a60103d17c19e2a1bb18d5f0a0af91d12da456345f1c6967010c3355596ea640f25f6a27ecfafce995c03b867c7671db24d706dcb7e882ab9b82fd1489c49e0d6138cd987b10890444216dc24f9b1962713dc8e6c9886ed6324e2dc22402a24bd761469b3e12ec73bda97e6f1b32a9e4c0408b5e8c06120a765ce759cedbb51551b65461a6d0beb443ea071a895deed63dde619034fde20b5c25bacc60e12c091c38f873a5083aa8d7b690e4fc92a27fc66f07773aa6b44d622a683ee67a2be60298e01b316f9eb92991e23835ec661b82ef1a84348390b99ff4ad8ac3870196215aa328647ae7aa88edbb4d46b9eb871cce87f2469e0f09d4fd05560c2a25ae382197009bfc6f8bfde138e5e97c5ee98bfd123139f7679fcc411c7effac94020629b409c694d941ccfa8accc8c7f45d24e236a7fc37d67e428e4eb357122b00075c313be8d2848ecc4faf75a8e6fd747991b0c34deb9fced92c1fd8e52757e81e295c1fe74ed34fdc4099eb415a394ca5ebba9accd795a926ce9debc9bd1f0a19dc0d256f305b60a1f55d2a2b9065516095f4ddd7fc6a4d0968734db6f3cea52d1cb107d5de91fbe393aa6f8533921d6d432359342732cf420dd7b49f53adb1675673f8cd5849646ecec914d70858086ab43d56a6e41cf1ac1333750a25c56d355689a3482a8fa8b633c305351c149b29307ea631bbfde2b58954a4b6d49ad9c66198996aff82195d4e7078c25d98a6a9c22b41f3ddfbffd599f2d420b20044bbe199c07ac0017c9f2c3fd970fdc4320f22f97fde668467e72abffb55389db2008a6c178025aadf54ddf9bb2e458b08e1762a43a5c0613cc157242dd928cae90ef66aba5a0e2da5cf1f4bca866529abe733fbbf406a22f71908595f5ca8e916685ea4d8994af6e5b4b3134f1db336116d5f37298ed890310870e28ed0ff7e67fbd8d3d843c22893fa64df1ceeb3b7e1136bd1318da76b77baf13f3730b9d32d1695df241429f4359d90db3466e489e330fc4fda03b3d003d9d6c9de02f3a21b60dae4f2a69c708a3a4e8738aa779bdf64cdb8e1a22bf04b07c56f3a262b1ed1ec1eecb2fbf07fdf5234b1c06fd50efffa6487110e8c184cf62765983a070c3ef1de274fd4c6661056c063001056f4daf3d368329c42d36048023fcd02d763ec9cf00caa4d1dfd9da500f6b61137ea36ccdd9a9ef289509b6c4c128660724923499a217247bccc34ebe4e3aac42bfae098b245bd46ab49f3c7adf47934291d1f515c6051e40e15b9d41da86485ba79123efd558a19c6fd734ecd75d9866f0c72bd2587a4b46c7b1140000000e99f72de224aa0db20b9808e13c6bb22353932cd2f2d59d9820c16a57554c0fc4cb95e6d2eef3f713e70cd9fa2ba53b564e49d6c4334cfe74214e020c74e1bf3 MpCmdRun.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Defender\LastKnownGoodProxy = "0" MsMpEng.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs MsMpEng.exe - Modifies registry class 23 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49} MsMpEng.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP MsMpEng.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{195B4D07-3DE2-4744-BBF2-D90121AE785B}\InprocServer32\ = "\"%ProgramFiles%\\Windows Defender\\DefenderCSP.dll\"" MsMpEng.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A7C452EF-8E9F-42EB-9F2B-245613CA0DC9}\InprocServer32\ = "\"%ProgramFiles%\\Windows Defender\\ProtectionManagement.dll\"" MsMpEng.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}" MsMpEng.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\Implemented Categories\Disabled - {56FFCC30-D398-11D0-B2AE-00A0C908FA49} MsMpEng.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\InprocServer32\ = "\"%ProgramFiles%\\Windows Defender\\MpOav.dll\"" MsMpEng.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}" MsMpEng.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\Implemented Categories\Disabled - {56FFCC30-D398-11D0-B2AE-00A0C908FA49} MsMpEng.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\EPP MsMpEng.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\IMPLEMENTED CATEGORIES\{56FFCC30-D398-11D0-B2AE-00A0C908FA49} MsMpEng.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\InprocServer32\ = "\"%ProgramFiles%\\Windows Defender\\MpOav.dll\"" MsMpEng.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}" MsMpEng.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}" MsMpEng.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}" MsMpEng.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49} MsMpEng.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\EPP MsMpEng.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\Implemented Categories\{56FFCC30-D398-11D0-B2AE-00A0C908FA49} MsMpEng.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\EPP\ = "{09A47860-11B0-4DA5-AFA5-26D86198A780}" MsMpEng.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4704 dControl.exe 4704 dControl.exe 4704 dControl.exe 4704 dControl.exe 4704 dControl.exe 4704 dControl.exe 4248 dControl.exe 4248 dControl.exe 4248 dControl.exe 4248 dControl.exe 4248 dControl.exe 4248 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 1604 dControl.exe 1604 dControl.exe 700 dControl.exe 700 dControl.exe 1604 dControl.exe 1604 dControl.exe 1604 dControl.exe 1604 dControl.exe 1604 dControl.exe 1604 dControl.exe 1604 dControl.exe 1604 dControl.exe 700 dControl.exe 700 dControl.exe 700 dControl.exe 700 dControl.exe 700 dControl.exe 700 dControl.exe 700 dControl.exe 700 dControl.exe 2664 dControl.exe 2664 dControl.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2664 dControl.exe - Suspicious behavior: LoadsDriver 8 IoCs
pid Process 816 Process not Found 4508 MsMpEng.exe 816 Process not Found 2776 MsMpEng.exe 2776 MsMpEng.exe 2776 MsMpEng.exe 2776 MsMpEng.exe 2776 MsMpEng.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4704 dControl.exe Token: SeAssignPrimaryTokenPrivilege 4704 dControl.exe Token: SeIncreaseQuotaPrivilege 4704 dControl.exe Token: 0 4704 dControl.exe Token: SeDebugPrivilege 4248 dControl.exe Token: SeAssignPrimaryTokenPrivilege 4248 dControl.exe Token: SeIncreaseQuotaPrivilege 4248 dControl.exe Token: SeAssignPrimaryTokenPrivilege 4508 MsMpEng.exe Token: SeIncreaseQuotaPrivilege 4508 MsMpEng.exe Token: SeTcbPrivilege 4508 MsMpEng.exe Token: SeSecurityPrivilege 4508 MsMpEng.exe Token: SeTakeOwnershipPrivilege 4508 MsMpEng.exe Token: SeLoadDriverPrivilege 4508 MsMpEng.exe Token: SeIncBasePriorityPrivilege 4508 MsMpEng.exe Token: SeBackupPrivilege 4508 MsMpEng.exe Token: SeRestorePrivilege 4508 MsMpEng.exe Token: SeShutdownPrivilege 4508 MsMpEng.exe Token: SeDebugPrivilege 4508 MsMpEng.exe Token: SeSystemEnvironmentPrivilege 4508 MsMpEng.exe Token: SeChangeNotifyPrivilege 4508 MsMpEng.exe Token: SeImpersonatePrivilege 4508 MsMpEng.exe Token: SeDebugPrivilege 2664 dControl.exe Token: SeAssignPrimaryTokenPrivilege 2664 dControl.exe Token: SeIncreaseQuotaPrivilege 2664 dControl.exe Token: 0 2664 dControl.exe Token: SeDebugPrivilege 2664 dControl.exe Token: SeAssignPrimaryTokenPrivilege 2664 dControl.exe Token: SeIncreaseQuotaPrivilege 2664 dControl.exe Token: 0 2664 dControl.exe Token: SeSecurityPrivilege 3768 mofcomp.exe Token: SeDebugPrivilege 4268 taskkill.exe Token: SeShutdownPrivilege 2008 svchost.exe Token: SeSecurityPrivilege 3808 wevtutil.exe Token: SeBackupPrivilege 3808 wevtutil.exe Token: SeSecurityPrivilege 6124 wevtutil.exe Token: SeBackupPrivilege 6124 wevtutil.exe Token: SeDebugPrivilege 4508 MsMpEng.exe Token: SeBackupPrivilege 4508 MsMpEng.exe Token: SeRestorePrivilege 4508 MsMpEng.exe Token: SeDebugPrivilege 2328 powershell.exe Token: SeAssignPrimaryTokenPrivilege 2328 powershell.exe Token: SeIncreaseQuotaPrivilege 2328 powershell.exe Token: SeSecurityPrivilege 2328 powershell.exe Token: SeTakeOwnershipPrivilege 2328 powershell.exe Token: SeLoadDriverPrivilege 2328 powershell.exe Token: SeSystemtimePrivilege 2328 powershell.exe Token: SeBackupPrivilege 2328 powershell.exe Token: SeRestorePrivilege 2328 powershell.exe Token: SeShutdownPrivilege 2328 powershell.exe Token: SeSystemEnvironmentPrivilege 2328 powershell.exe Token: SeUndockPrivilege 2328 powershell.exe Token: SeManageVolumePrivilege 2328 powershell.exe Token: SeDebugPrivilege 2664 dControl.exe Token: SeAssignPrimaryTokenPrivilege 2664 dControl.exe Token: SeIncreaseQuotaPrivilege 2664 dControl.exe Token: 0 2664 dControl.exe Token: SeDebugPrivilege 2664 dControl.exe Token: SeAssignPrimaryTokenPrivilege 2664 dControl.exe Token: SeIncreaseQuotaPrivilege 2664 dControl.exe Token: 0 2664 dControl.exe Token: SeAssignPrimaryTokenPrivilege 2776 MsMpEng.exe Token: SeIncreaseQuotaPrivilege 2776 MsMpEng.exe Token: SeTcbPrivilege 2776 MsMpEng.exe Token: SeSecurityPrivilege 2776 MsMpEng.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 5016 SecurityHealthSystray.exe 5016 SecurityHealthSystray.exe 5016 SecurityHealthSystray.exe 5016 SecurityHealthSystray.exe 2664 dControl.exe 5016 SecurityHealthSystray.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 404 SecurityHealthSystray.exe 404 SecurityHealthSystray.exe 404 SecurityHealthSystray.exe 404 SecurityHealthSystray.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 5016 SecurityHealthSystray.exe 5016 SecurityHealthSystray.exe 5016 SecurityHealthSystray.exe 2664 dControl.exe 5016 SecurityHealthSystray.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 404 SecurityHealthSystray.exe 404 SecurityHealthSystray.exe 404 SecurityHealthSystray.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe 404 SecurityHealthSystray.exe 2664 dControl.exe 2664 dControl.exe 2664 dControl.exe - Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 4408 explorer.exe 5940 explorer.exe 6024 SecHealthUI.exe 2856 explorer.exe 1644 explorer.exe - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 2664 wrote to memory of 1604 2664 dControl.exe 99 PID 2664 wrote to memory of 4464 2664 dControl.exe 100 PID 2664 wrote to memory of 700 2664 dControl.exe 102 PID 4508 wrote to memory of 3768 4508 MsMpEng.exe 104 PID 5940 wrote to memory of 5016 5940 explorer.exe 111 PID 4508 wrote to memory of 4268 4508 MsMpEng.exe 114 PID 4508 wrote to memory of 3808 4508 MsMpEng.exe 121 PID 4508 wrote to memory of 6124 4508 MsMpEng.exe 123 PID 2664 wrote to memory of 2328 2664 dControl.exe 125 PID 2664 wrote to memory of 5408 2664 dControl.exe 132 PID 2664 wrote to memory of 4144 2664 dControl.exe 133 PID 2664 wrote to memory of 3348 2664 dControl.exe 137 PID 2856 wrote to memory of 404 2856 explorer.exe 140 PID 2776 wrote to memory of 2596 2776 MsMpEng.exe 141 PID 2776 wrote to memory of 2724 2776 MsMpEng.exe 143 PID 2776 wrote to memory of 5652 2776 MsMpEng.exe 145 PID 2664 wrote to memory of 5780 2664 dControl.exe 147 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\24122024\dControl.exe"C:\Users\Admin\AppData\Local\Temp\24122024\dControl.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\24122024\dControl.exeC:\Users\Admin\AppData\Local\Temp\24122024\dControl.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\24122024\dControl.exe"C:\Users\Admin\AppData\Local\Temp\24122024\dControl.exe" /TI3⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender TamperProtection settings
- Modifies security service
- Event Triggered Execution: Image File Execution Options Injection
- Windows security modification
- Indicator Removal: Clear Persistence
- Modifies Security services
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe4⤵PID:1264
-
-
C:\Users\Admin\AppData\Local\Temp\24122024\dControl.exe"C:\Users\Admin\AppData\Local\Temp\24122024\dControl.exe" /EXP |3404|4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1604
-
-
C:\Program Files\Windows Defender\mpcmdrun.exe"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable4⤵PID:4464
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" windowsdefender://Threatsettings4⤵PID:2288
-
-
C:\Users\Admin\AppData\Local\Temp\24122024\dControl.exe"C:\Users\Admin\AppData\Local\Temp\24122024\dControl.exe" /EXP |3404|1264|4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:700
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 14⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2328
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" C:\Windows\System32\SecurityHealthSystray.exe4⤵PID:1604
-
-
C:\Users\Admin\AppData\Local\Temp\24122024\dControl.exe"C:\Users\Admin\AppData\Local\Temp\24122024\dControl.exe" /EXP |3404|4⤵
- System Location Discovery: System Language Discovery
PID:5408
-
-
C:\Program Files\Windows Defender\mpcmdrun.exe"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable4⤵
- Drops file in Windows directory
PID:4144
-
-
C:\Windows\Explorer.exe"C:\Windows\Explorer.exe" windowsdefender://Threatsettings4⤵PID:2868
-
-
C:\Users\Admin\AppData\Local\Temp\24122024\dControl.exe"C:\Users\Admin\AppData\Local\Temp\24122024\dControl.exe" /EXP |3404|1604|4⤵
- System Location Discovery: System Language Discovery
PID:3348
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoLogo -NoProfile -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring 14⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:5780
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵PID:3504
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
- Drops file in Windows directory
PID:2096
-
C:\Program Files\Windows Defender\MsMpEng.exe"C:\Program Files\Windows Defender\MsMpEng.exe"1⤵
- Modifies Windows Defender TamperProtection settings
- Modifies firewall policy service
- Windows security bypass
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4508 -
C:\Windows\system32\wbem\mofcomp.exeC:\Windows\system32\wbem\mofcomp.exe "C:\Program Files\Windows Defender\ProtectionManagement.mof"2⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3768
-
-
C:\Windows\system32\taskkill.exeC:\Windows\system32\taskkill.exe /f /FI "MODULES eq protectionmanagement.dll" /IM WmiPrvSE.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4268
-
-
C:\Windows\system32\wevtutil.exeC:\Windows\system32\wevtutil.exe uninstall-manifest C:\Windows\SystemTemp\149CF6AE-8E32-1662-A39D-B29B779A884D.man2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3808
-
-
C:\Windows\system32\wevtutil.exeC:\Windows\system32\wevtutil.exe install-manifest C:\Windows\SystemTemp\149CF6AE-8E32-1662-A39D-B29B779A884D.man "/resourceFilePath:C:\ProgramData\Microsoft\Windows Defender\Definition Updates\StableEngineEtwLocation\mpengine_etw.dll" "/messageFilePath:C:\ProgramData\Microsoft\Windows Defender\Definition Updates\StableEngineEtwLocation\mpengine_etw.dll" "/parameterFilePath:C:\ProgramData\Microsoft\Windows Defender\Definition Updates\StableEngineEtwLocation\mpengine_etw.dll"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:6124
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4408
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5940 -
C:\Windows\System32\SecurityHealthSystray.exe"C:\Windows\System32\SecurityHealthSystray.exe"2⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5016
-
-
C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe"C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe" -ServerName:SecHealthUI.AppX8tam42xc7v2czs3s1nt0nkxvfjtepzp9.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:6024
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵PID:2112
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding1⤵PID:5844
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k WbioSvcGroup -s WbioSrvc1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2008
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:1188
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
- Modifies data under HKEY_USERS
PID:3704
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵PID:5088
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵PID:4764
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵PID:2080
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵PID:1596
-
C:\Program Files\Windows Defender\MsMpEng.exe"C:\Program Files\Windows Defender\MsMpEng.exe"1⤵
- Modifies firewall policy service
- Loads dropped DLL
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Program Files\Windows Defender\MpCmdRun.exe"C:\Program Files\Windows Defender\MpCmdRun.exe" SignatureUpdate -ScheduleJob -RestrictPrivileges2⤵
- Drops file in Windows directory
PID:2596
-
-
C:\Program Files\Windows Defender\MpCmdRun.exe"C:\Program Files\Windows Defender\MpCmdRun.exe" SignaturesUpdateService -ScheduleJob -HttpDownload -RestrictPrivileges2⤵
- Downloads MZ/PE file
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2724
-
-
C:\Program Files\Windows Defender\MpCmdRun.exe"C:\Program Files\Windows Defender\MpCmdRun.exe" GetDeviceTicket -AccessKey 37136E02-F4DC-505A-299C-97220EC4D6362⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:5652
-
-
C:\Program Files\Windows Defender\MpCmdRun.exe"C:\Program Files\Windows Defender\MpCmdRun.exe" -DisableService2⤵
- Drops file in Windows directory
PID:6676
-
-
C:\Program Files\Windows Defender\MpCmdRun.exe"C:\Program Files\Windows Defender\MpCmdRun.exe" -DisableService2⤵
- Drops file in Windows directory
PID:6692
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\System32\SecurityHealthSystray.exe"C:\Windows\System32\SecurityHealthSystray.exe"2⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:404
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1644
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵PID:2336
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵PID:4864
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:6124
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵PID:1820
Network
MITRE ATT&CK Enterprise v16
Persistence
Create or Modify System Process
4Windows Service
4Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Privilege Escalation
Create or Modify System Process
4Windows Service
4Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Defense Evasion
Impair Defenses
6Disable or Modify System Firewall
1Disable or Modify Tools
4Indicator Removal
1Clear Persistence
1Modify Registry
8Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{E8E7FF99-348F-4897-BA0E-93AAEAC0DE7C}\mpengine.dll
- Size 18.1MB
- SHA256 78f0315fa9ceff11787fb1b2eaa99150ed7024f8ac826f51ffa0fd7fba3fed86
- MD5 58cc1c4210bfaa213c817fb435538d26
- SHA1 db3dd3dbe26af7d6ad28ce02f29f906d644f5c35
- SHA512 9e62eda56a4b4cabb2c5571ab304f5fefa012226f19800862825c0c9c77106b99fb50073d3476e746199d420888799f7faedd8e6570f063f7cc971fbba70e2f3
- SSDEEP 196608:5zTq0UHMtwgOfPJ1F0xcIW2NF47JECCBbYJBLq6mvaDjo4M:5BtyNPJ1F0ZWw47JEcm
- TLSH T1DD177B1BB3A800D5C1BAD274C6169B17EBB2BC1A173197CB0B6476561F376E08E3B391
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Windows Defender\Scans\History\CacheManager\5D76DC85-0000-0000-0000-D08302000000-0.bin
- Size 312KB
- SHA256 4faa720006e18ff7e8aa2af7d3dd4337f72abab08c9f5689d141e59b3e9cd4d5
- MD5 75d2b859a50a78f241828cff4aea4b1a
- SHA1 592690388dbef508602e6e74a36af4046ebe2451
- SHA512 14155392f9942a69d8235ef019dee27aacd33c1d34d3a97196bcca0c7efd96050e4f833650d38bbd371173a561c8e52f8cdc86f3aa39a58e0ccba79a42c5c736
- SSDEEP 6:FEfKQdifzyQ40CrB/E0oW0Fxo3141/ll12qW16Bis1Vl/l1Et8s8:FEfqz3iE0xYel4PuiVl/vEt8s8
- TLSH T12B64A70FF7368CE8D11A13389E370B00B745D66E22BB1F039E046855AE19300DDB05D9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-60350C52120E3B359D74B31410EE75B5ADE77223.bin
- Size 28.3MB
- SHA256 2bec11d1c407b2caf9ad21e61c4777e3c10e3543b8cfbc2babe2362e31ca3135
- MD5 22e734525386b47a211f8823f3e856b4
- SHA1 ad00cb516611b54d793b8ef6b43c1e23e936d747
- SHA512 01c4588df686399517ba65a9562f714aab75fd7388928e70613f68a4d63473f659b15d2ab648a08b751c5c0c9052d6baad9ad56d71c2468a898408d38dd4b2f9
- SSDEEP 786432:LsAeROvwWNWDYhdKqVvwmPKHOX3vR6gWGqa2aX:gsYW5hEAXya56gIaz
- TLSH T10C5733695AFE00B8E498547257EF664B06A6D1FC887E63D8853602917FFAFE034C9C34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-60350C52120E3B359D74B31410EE75B5ADE77223.bin.01
- Size 1.0MB
- SHA256 19ec3509e9be9fa0621746aad4babcf6d98dc5c61df4ac4821e55063e5506191
- MD5 f11a44eef058680feec6057727be05b3
- SHA1 48d834a9afd5733dbc90c4a27d764f9434c2efb7
- SHA512 cebe2f7d16507244cc4209abc6288418ea69dc1ee35d0b4fd1e6035223a73076aa4060ea0435c37f158fa1969c780242d4a0072e7ded219d11ddfcd642df39c5
- SSDEEP 24576:yUax0McaIWpOKjk8/7Zs+GYmgEfLIs+/BkW0K289s:4J8KjZujbgEfLIs9m28G
- TLSH T1B735336C0A6FFD98D8D00ECCDDC52ACD42B52D8F447A748E8C641458B7F65B6262E84F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-60350C52120E3B359D74B31410EE75B5ADE77223.bin.67
- Size 29.4MB
- SHA256 05667f5a0c11930894eec170e58d95d6f8afb2d06cc2613c815e89f7824a5413
- MD5 ed095223906a51ea2930362daa1701e1
- SHA1 70aa9a9dd28b9122e4f91cb674b0473d5372d289
- SHA512 0e5dd6921234553bc50d201080bb35cb51a87100af4948eba62fe064c1d4953f8704e2af23acda8d8800d20fbad67f0800c822e280f68c14f91d1a39a245da72
- SSDEEP 393216:5zigfGnjtP6J+Hn0fiTfwhUMgCFlIXrLLrbhmxkIVLdhHsxXaiysEA:4gfqjtPNhLk9IjrNm7LdhMxX7ysEA
- TLSH T1C767E00380B0A5DAE2C3B7F2B55EAB100956F033605D5AAC96C54AEA4DFBCD913CD5F2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-60350C52120E3B359D74B31410EE75B5ADE77223.bin.6C
- Size 3.6MB
- SHA256 dd1bc968b9b9f9f4369640f8643e253773c2505b0bce8fda94e4fa5352561820
- MD5 7d17dfd66a2fb7cf1f24e58f9ea3ba8f
- SHA1 840bf240c4c6da1ad7dc95c4525ab898122ef91c
- SHA512 c4b0f771abd25a6df890b1466dc82e0a972ef4af572acd1b0c2aed8a618ae6133caef98428c7d239bd98a46bff0e2b953da854d0d368f7a3862a708aa0c23ee7
- SSDEEP 98304:9sB16TkjMDmSyW4C16MdEcWvnCZXAUW5iio:9sraVqYB16yWvCWUWYT
- TLSH T160066B8A348A2A57E14BF6F890E5777B439AD5038B878F46C5B431F6DD6238C6B31C24
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-60350C52120E3B359D74B31410EE75B5ADE77223.bin.7C
- Size 8.1MB
- SHA256 270a823e5c747bac8b4d7de037b9a2d7f5ecc425785322736df4ab01fc3267ea
- MD5 8a31cde394c0f6e53d942b2c8a415ef2
- SHA1 f7979751a91c3233a28f141a5fdd6e2349bc5057
- SHA512 78bcb30367ffde824f573ebb60d1474df5eea3890b26f4d9c10bf1127ba556b741023207d0418e19e44734d4d4aab77d50c2124899b059aced1ce3c7e65eb7fe
- SSDEEP 49152:69sfQCUCfVxIsCQHukaQGBW56cATi1k1mtYIc+NhLA9QRDuxtjIYKjqNDYGvURbE:69iQguBm6Wk1WDyKGvUq
- TLSH T1AE864A52BB5609B4F06AC3BA94936311C2F27C254AF1B30717CADD891F27394F6A37A1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-60350C52120E3B359D74B31410EE75B5ADE77223.bin.7E
- Size 21.2MB
- SHA256 2b7ffc34e9612ea3c5ef830d7bdd97fa1ecfa5a8d23b42cdeb37548d60a6e2f7
- MD5 23ae149eb7ada82f8f9c8900d05ef339
- SHA1 2a8fb6ac5eba3d6a838efea1b28bbfcdbccc8cae
- SHA512 c1bea83294f92871d2d79e549b4931869b958246140c5c941fa81164d3efe551201addbf5bb90605420fa35df28fcb5a3d535cac55c573293b3eed420193f340
- SSDEEP 393216:XznN7DyT/bHBkJg45DqDkAK7K9ffBu03wtik/D:RkbhkJRRqDoaF3wEkr
- TLSH T18F277D31FAED0B0FF46D39FE875B04FA47BAE889B7419683A7659116D005BDC1C8AC18
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-60350C52120E3B359D74B31410EE75B5ADE77223.bin.80
- Size 12.1MB
- SHA256 5dad43c0178e2ec1233d117a908021fd4378249adc300826995497bd4450d73b
- MD5 ef79e72b7a7f3078eaef415c1d4fb833
- SHA1 e81ef864a7cb55b4ce7af69867c410bbcde1b5f3
- SHA512 a7ea1adce4cc8a0d5a3935149564686f27becd2e5b2704d661403553cc370374b855819513317eff33e438cb9da33080408c714ebe05a7005eb1556dca073bdb
- SSDEEP 196608:A7wABiMelP1qo+FrWK7qM5uKAt14uiqNIWZVV:MsZP1qo+AKeEuEhqNIW3V
- TLSH T17AD62861BB5C5230DBAAFAF9C5CF19BDB5DF40846F1816D05431A8DFED3220D1A0A1AB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-60350C52120E3B359D74B31410EE75B5ADE77223.bin.83
- Size 1.9MB
- SHA256 e7616d6de2933437ff7e1bf89d1a249cab4850239d94d942e0a64ab7284d6803
- MD5 8437f1dda17bd5656e2c7b3cb08c2419
- SHA1 f04f7de5d626d6db42f4cd068dc330fe7a83901b
- SHA512 fa72411ad598b068801e5e358352f02e43ad97da09ee7c658c9bb8d12cf23f7e1295d72644479c83d5647273baf436ac5cf9d21dc8b73b92e29ee2188441f037
- SSDEEP 3072:pgb4gsFg4T4A4QDqJzgdKU8jxKZ3VXEddDkFeOAhOF7I7R9+iDinEEwXliVay4uH:9Vy9Ln8ec3
- TLSH T18495B432EBE87174F1965A315B7EC732C52AF9208B1293CF259DC0490F648D398BE627
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-60350C52120E3B359D74B31410EE75B5ADE77223.bin.87
- Size 1.7MB
- SHA256 dc416b94a6fe416ac3a35e90ef7f0ee4ef8851a528615900b6e52b7c4955c287
- MD5 13b65031aef661a2b7da926d8cee9f0e
- SHA1 35cf13fa2d399daae3cdb971f1aed2edd1648e7e
- SHA512 5994aa9ccdf7417dce992beb032037852a9535a51ad93861c4cbd657b49f9af7e69cbd0c61600962c3273b69c5d6e0b60d03ae7ac08fd5a83e0dccffd2a1ef47
- SSDEEP 24576:usIvYKvmOsxLr9NSZKwZ1AjnfzjWu0trDgtyg0XL1vC3YIC:Snp6ydZMfz9yg0b
- TLSH T12085DF2D76522B79CF1703B4574F2F4243C949BC4738FA56A693A563BC312F32E02A5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-60350C52120E3B359D74B31410EE75B5ADE77223.bin.A0
- Size 16.9MB
- SHA256 e279dc6f8e7c205bd6f2e3cebbfec6fbd41fbc8e45cb79cefc8d035d65c0a9d0
- MD5 4082991948ba0b47f9be580b205f9d37
- SHA1 0903a93e71deabd2030dca7c1be526398162165a
- SHA512 f5feb2440b6860a95061e804458d9d907360b93f1f14a2138a4a4428f500cb2c8b093502422f11ea6aa492a77d58c9141af03d06b3671e6d3fc9c49cf6261832
- SSDEEP 393216:u5BW7ppUnJnON3ccGKLP9bJeeDncHJFm/jZWEuK3ZK6SZHiO6h:uTKpUhwFGKrvpDncHJu0EhiK
- TLSH T1C30733666B3B5814F0F3E37E91BEEED95906E7961A2590B0313E2BDB130E274A053347
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-60350C52120E3B359D74B31410EE75B5ADE77223.bin.DB
- Size 1.1MB
- SHA256 46bf4dd7fba37c8ecf865f6a67bcc83f3cadf97649dafae119d2876e93db3f8f
- MD5 4957c9a2b55a6f41f8e4bad3a9cc41c4
- SHA1 35975abd4040de979f1a1138cf74ac183270ec4a
- SHA512 b763c1da5b1bcebc4da269fb20acfb8d424c7d502beb539f7561d26120fc5f972522196544751895ab489dc5a8222a85aa5968a285886b07e48723c6b4900059
- SSDEEP 24576:dP9DF1Xce5FZru1yP1942eSWzrfgXWlxuLtzc62BgOlPC:dZ5Tqm9RFLf2BVPC
- TLSH T1783533D3AB2D4F49CC910CB343A62E262F7F94FDDF101B489E488A2F4D3557EA6A0459
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Windows Defender\Scans\mpcache-60350C52120E3B359D74B31410EE75B5ADE77223.bin.E6
- Size 67KB
- SHA256 b793a800dfa3f07792752b3f04817316a2c4353beeda19ad239d45f2e13e396d
- MD5 6df860710c97f891263bdb65dc90296e
- SHA1 0cd1e1b8ff0e755f585a6a0bc22fea33ef5d1e2a
- SHA512 92f95750c15578c9ad825966df4cd18adcf92db8bbd4f4e88b46996086357c5912b26fff7d3a9ff95153be85d55c7655991ce316c3d63b39b519bf7151807ff2
- SSDEEP 96:8y2WNPRkbSlPUWj80bXl3Eo0Xn5/IBoUZtof9JZ4Gl3+WJ:PPRkbSVTw0bXl3B0X5gfZ2Zf+0
- TLSH T17C63F720AF65BDA2CB3CBB30B8467E02D9B3514E46F107845B5BCC38558C51F26B6A2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Windows Defender\Support\MPDetection-20260730-181319.log
- Size 344B
- SHA256 960b8388bea4a2e38dc62e10d23ecd9b3224a24150d1995fb815e697da03e6a0
- MD5 20725e5511ee436a434cc576cf6cb14c
- SHA1 5391fc30731d7bc2b1355e29ff9bdd4f7361a301
- SHA512 e874dd59f40a1e4505e93aa6e2fd592fa2b800dddcf3ede4d4eb3e20c22d417a0dd80de6773e592f51c9c879b75d7737679608a7170d756bad69b0e7f0b6ad6f
- TLSH T1FDE08C284AF90E13A0B4EA828BF11123AA62788B6434ED0C02E01B880522C92F4E0F5B
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Microsoft\Windows Defender\Support\MPDeviceControl-20260730-181319.log
- Size 2B
- SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
- MD5 f3b25701fe362ec84616a93a45ce9998
- SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
- SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
- MD5 SHA1 SHA512
- Path C:\ProgramData\Microsoft\Windows Defender\Support\MPDeviceControl-20260730-181319.log
- Size 3KB
- SHA256 fb59ff758a5cc500a6637b40e5c30211e2106a5c4e35d3558d2f8490e877834f
- MD5 476b0728659ec9f621310c60fb8d015e
- SHA1 450497f3ffc3cc6fef041888a44a26355771f8ca
- SHA512 8560e6637df56647fcc7ba21e226494b1c52a0ce02b15b8b9b05f445f6194b163d1706e69faf18ee8a637803062372a55a4bfad85d6a9f556dfdab5df6e81546
- TLSH T19D61941923F82E09F8B54B92FFB798532932BDE65934DE1C21B5439D0271C58E9A0B37
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Microsoft\Windows Defender\Support\MPLog-20260730-181319.log
- Size 39KB
- SHA256 0f58ff9b3ce021bc9a9559c3288fb57e56a2699748e9ae8c93ee485b9b35dc47
- MD5 9f44ab6c62735a68b854a5239ff012d1
- SHA1 b88af330fe435c785f9de029bbda4402150f61fd
- SHA512 fd47ca6d92db9631c4ec73a86b3bd50311c7df354e9d7f17b29a09777632e37ee94c696ee42d8e8e098f7fce727293522b1e9dbc3e9e4f46b1b677d9861d3c5d
- SSDEEP 384:2d+F+jYYENDRdRiWdOLpOW0O7xOUtBIC29fx/G5n51xrDGBMWDu0UUvDuJ:R+jYyWdOLpOW0O7xOUtBIp/G55X/
- TLSH T13D03C71697F90908F1B3AF166AF290635A737DD66938DE0D02D4034E09BAE54E8B0F77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\4k7z0f4v.tmp
- Size 37KB
- SHA256 a3d7de3d70c7673e8af7275eede44c1596156b6503a9614c47bad2c8e5fa3f79
- MD5 3bc9acd9c4b8384fb7ce6c08db87df6d
- SHA1 936c93e3a01d5ae30d05711a97bbf3dfa5e0921f
- SHA512 f8508376d9fb001bce10a8cc56da5c67b31ff220afd01fb57e736e961f3a563731e84d6a6c046123e1a5c16d31f39d9b07528b64a8f432eac7baa433e1d23375
- SSDEEP 3::
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\GroupPolicy\Machine\Registry.pol
- Size 160B
- SHA256 6509c7fc4fa70391399831bbc3d66206d3f6f8f2bb20ffcac4e04844861d733a
- MD5 58f8eb09a822c09fc11f5a42baae36f1
- SHA1 9e7063eeee62c8588e0020bef3a116e9379966aa
- SHA512 53806780934bd86bb032ee4a515dfc0e8464a5ecc5f4c8c593304fcd969c1058d443bdec54e7ae21469adb942b16693cc9eaf997217adc69d3618ab0ec99dc1e
- TLSH T1F0C0480007F82714FAFF4E351A732948683A782AAA00D88C0168494D8876E34CB2332B
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\GroupPolicy\Machine\Registry.pol
- Size 8B
- SHA256 5bb1f21f806938a043563024b13b33d74a2b95b767c5f81bde8456e9d0413a89
- MD5 8e1b08222f20e45a3e8db04c569f9cb7
- SHA1 a6ac68fbadf96faba3af7000a7514790157f930f
- SHA512 414d30dec0fce6b4e3ab52c50f064262e0df00cf9dbbeacca271a0991555371a37cfffdd0486c07a9096838942a69cdbefea4a4399ef2848139678daff589c31
- MD5 SHA1 SHA512
- Path C:\Windows\System32\GroupPolicy\gpt.ini
- Size 233B
- SHA256 1c59482111e657ef5190e22de6c047609a67e46e28d67fd70829882fd8087a9c
- MD5 cd4326a6fd01cd3ca77cfd8d0f53821b
- SHA1 a1030414d1f8e5d5a6e89d5a309921b8920856f9
- SHA512 29ce5532fb3adf55caa011e53736507fbf241afee9d3ca516a1d9bffec6e5cb2f87c4cd73e4da8c33b8706f96ba3b31f13ce229746110d5bd248839f67ec6d67
- TLSH T1F4D0955244C01530C01D9103C0FD113C865D1908D1E048FFC2B7D15E11A3526FC3DF11
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\149CF6AE-8E32-1662-A39D-B29B779A884D.man
- Size 74KB
- SHA256 1114198d6d76348ef6a7b6ae528c77e06f51369802af24ba9ad5f56fc73cb63d
- MD5 f2cc8125493496245b6ec1297ac2a502
- SHA1 0424a8430eda346ad6e627e7fd41710e28b541da
- SHA512 77aadcada3ca13f4a420565e0c41695cbebc8b0132f4f1ff33b3c090c5234ae143ef7f56cba8be8b946ccad88407a2fc3dc84df8493066346c83adfa622daa98
- SSDEEP 384:gdejk8/WmmU3LHzdphANk2s5p5BIyJDHEhJjNQrAUOmpd5+ofhyIyG42VtclEltK:g8kXmmMu6S3KNi
- TLSH T1A473E390F458ACE14D08376B59FC9904153EFEBA47E820AB7CE4A977A75B70437B0B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\MpCmdRun.log
- Size 3KB
- SHA256 c1c102401e0d472bf380527c35013d5fa1387ac009551e8e40d0cb219f66d337
- MD5 af4398c626ebcb198e74d696c96d0612
- SHA1 80cc3c3cb5f4d65dc1edf25d15e29fb7d5e25da0
- SHA512 bcdb23b35d9e90f287751cc3c26b247a06c1a583443f362defc1e039ba6f609e23d4a88134eb82cbea37dc57aa8def54cb9a6e77a199e65f2cd695b700f4591f
- TLSH T146616D1221ED0E05B2B26BA26AF3C122DA377CD795389F0E1780925A04EDE44DD19FB7
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SystemTemp\MpCmdRun.log
- Size 4KB
- SHA256 2225d6fa8e7052845dec95bdba7e5748385cd780015bda85d590dd796f4d2f9b
- MD5 0b99b2122f2d0fd6aa76950e9dcc06c8
- SHA1 3f65565059eaa72cede04b1b8b6752857ef0292e
- SHA512 4281d965bdf340cd834d045f6d81456ebe5caf3f886613a1728afc707ee3e175d232f96027b81842f4a1687ff5ed19f38c21d454c950c2e3c0eb7cdb09028b14
- SSDEEP 96:TE++AkdLyCplw+AiGMp3rBlw+AiGMp3rV:TJ+bz++K2bB++K2bV
- TLSH T1DDA18E1222ED0E04B5B26BA25AF3C122DA377CD795389F0D1780925E04EDA44DD19FB7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\__PSScriptPolicyTest_f03uogyu.gk3.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Temp\autEC4F.tmp
- Size 14KB
- SHA256 8f5bbcc572bc62feb13a669f856d21886a61888fd6288afd066272a27ea79bb3
- MD5 9d5a0ef18cc4bb492930582064c5330f
- SHA1 2ec4168fd3c5ea9f2b0ab6acd676a5b4a95848c8
- SHA512 1dc3387790b051c3291692607312819f0967848961bc075799b5a2353efadd65f54db54ddf47c296bb6a9f48e94ec83086a4f8bf7200c64329a73fc7ec4340a4
- SSDEEP 384:Lc+oi65hxQuuaeawNT9vyk+8fYkjeXGsuojMExHixvLiH:Lvqxpkaw9oD0Jje2sZPxCxvGH
- TLSH T1A162BE8D3D193109F2A2A4D14B7197A06E1FCBD0794C67285F90C9366E72FB1B2E3227
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\autEC50.tmp
- Size 12KB
- SHA256 5ea3b26c6b1b71edaef17ce365d50be963ae9f4cb79b39ec723fe6e9e4054366
- MD5 efe44d9f6e4426a05e39f99ad407d3e7
- SHA1 637c531222ee6a56780a7fdcd2b5078467b6e036
- SHA512 8014b60cef62ff5c94bf6338ee3385962cfc62aaa6c101a607c592ba00aea2d860f52e5f52be2a2a3b35310f135548e8d0b00211bfcf32d6b71198f5d3046b63
- SSDEEP 384:cIbUPrMe4JQrf/GvefQ9Ruiwwyeq62BYZ:l+getDi9Cq2yZ
- TLSH T1EC42D1506C29AD2E63768D9D93A9E701ADB107D11140CD52B24337FA9E4A8CAF349C3D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Temp\autEC61.tmp
- Size 7KB
- SHA256 9874ab363b07dcc7e9cd6022a380a64102c1814343642295239a9f120cb941c5
- MD5 ecffd3e81c5f2e3c62bcdc122442b5f2
- SHA1 d41567acbbb0107361c6ee1715fe41b416663f40
- SHA512 7f84899b77e3e2c0a35fb4973f4cd57f170f7a22f862b08f01938cf7537c8af7c442ef2ae6e561739023f6c9928f93a59b50d463af6373ed344f68260bc47c76
- SSDEEP 192:IsyIiAhPheSUbYWJ/sktA3qM9snQWjljZ1hkDjuQ0C1yW:IBXAhPheSaYCEGAHaQWdmxrkW
- TLSH T1FDF1AE1C4A7099792F10A6273A9BD71921FF8EE74397E0A39450A79AF0E2389C648F44
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 58245b535bb164e85943800b4154e0128260c1a510da112294f1c53edfbfbf07
- MD5 47ad9cc420da0514ba1b00c8644623c3
- SHA1 ae21313963068b048e67ea7211e2e3b62269795b
- SHA512 9aedb22199721ad446e49421651fbdb3e1799bac3d3fae2e8f09644b650ad99fa60b1055e7f5b210d51e587ee1f71ee50c95ba81700a59efeec033da62e9627f
- TLSH T16F216833B3DD8614C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
- MD5 SHA1 SHA512 TLSH