Overview

overview

8

Static

static

3

AtlasSecureSystem.exe

windows10-2004-x64

1

AtlasSecureSystem.exe

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    151s
  • max time network
    137s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    04/08/2026, 05:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    AtlasSecureSystem.exe
  • Size 10.5MB
  • Sample260804-gl9b3sscrg
  • SHA256 39a57bfead642d08f67dfb547bda6de1ce1180200da10f88e7f96ab8cdddba61
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutionexploit

Malware Config

Signatures

  • Possible privilege escalation attempt 22 IoCs
    exploit
  • Modifies file permissions 1 TTPs 22 IoCs
    discovery
  • Command and Scripting Interpreter: PowerShell 1 TTPs 14 IoCs

    Using powershell.exe command.

    execution
  • Drops desktop.ini file(s) 6 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 44 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 41 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\AtlasSecureSystem.exe
    "C:\Users\Admin\AppData\Local\Temp\AtlasSecureSystem.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2352
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command " $acl = Get-Acl 'C:\System Volume Information' $acl.SetAccessRuleProtection($false, $false) $adminRule = New-Object System.Security.AccessControl.FileSystemAccessRule( 'BUILTIN\Administrators', 'FullControl', 'ContainerInherit,ObjectInherit', 'None', 'Allow' ) $acl.SetAccessRule($adminRule) Set-Acl -Path 'C:\System Volume Information' -AclObject $acl takeown /f 'C:\System Volume Information' /a /r /d y 2>&1 | Out-Null icacls 'C:\System Volume Information' /grant:r Administrators:F /t /q 2>&1 | Out-Null "
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4540
      • C:\Windows\system32\takeown.exe
        "C:\Windows\system32\takeown.exe" /f "C:\System Volume Information" /a /r /d y
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        • Suspicious use of AdjustPrivilegeToken
        PID:2548
      • C:\Windows\system32\icacls.exe
        "C:\Windows\system32\icacls.exe" "C:\System Volume Information" /grant:r Administrators:F /t /q
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:5380
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' if (!(Test-Path 'C:\System Volume Information\default')) { New-Item -Path 'C:\System Volume Information\default' -ItemType Directory -Force | Out-Null } $acl = Get-Acl 'C:\System Volume Information\default' $acl.SetAccessRuleProtection($false, $true) $adminRule = New-Object System.Security.AccessControl.FileSystemAccessRule( 'BUILTIN\Administrators', 'FullControl', 'ContainerInherit,ObjectInherit', 'None', 'Allow' ) $acl.SetAccessRule($adminRule) Set-Acl -Path 'C:\System Volume Information\default' -AclObject $acl takeown /f 'C:\System Volume Information\default' /a /r /d y 2>&1 | Out-Null icacls 'C:\System Volume Information\default' /grant:r Administrators:F /t /q 2>&1 | Out-Null attrib +s 'C:\System Volume Information\default' "
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2424
      • C:\Windows\system32\takeown.exe
        "C:\Windows\system32\takeown.exe" /f "C:\System Volume Information\default" /a /r /d y
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:2336
      • C:\Windows\system32\icacls.exe
        "C:\Windows\system32\icacls.exe" "C:\System Volume Information\default" /grant:r Administrators:F /t /q
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:1268
      • C:\Windows\system32\attrib.exe
        "C:\Windows\system32\attrib.exe" +s "C:\System Volume Information\default"
        3⤵
        • Views/modifies file attributes
        PID:1972
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference = 'Stop' if (!(Test-Path 'C:\System Volume Information\default\nil')) { New-Item -Path 'C:\System Volume Information\default\nil' -ItemType Directory -Force | Out-Null } $acl = Get-Acl 'C:\System Volume Information\default\nil' $acl.SetAccessRuleProtection($false, $true) $adminRule = New-Object System.Security.AccessControl.FileSystemAccessRule( 'BUILTIN\Administrators', 'FullControl', 'ContainerInherit,ObjectInherit', 'None', 'Allow' ) $acl.SetAccessRule($adminRule) Set-Acl -Path 'C:\System Volume Information\default\nil' -AclObject $acl takeown /f 'C:\System Volume Information\default\nil' /a /r /d y 2>&1 | Out-Null icacls 'C:\System Volume Information\default\nil' /grant:r Administrators:F /t /q 2>&1 | Out-Null "
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:6620
      • C:\Windows\system32\takeown.exe
        "C:\Windows\system32\takeown.exe" /f "C:\System Volume Information\default\nil" /a /r /d y
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:2796
      • C:\Windows\system32\icacls.exe
        "C:\Windows\system32\icacls.exe" "C:\System Volume Information\default\nil" /grant:r Administrators:F /t /q
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:4572
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command " try { takeown /f 'C:\System Volume Information' /a | Out-Null } catch {} try { icacls 'C:\System Volume Information' /grant Administrators:F /q | Out-Null } catch {} if (Test-Path 'C:\System Volume Information\default') { try { takeown /f 'C:\System Volume Information\default' /a /r /d y | Out-Null } catch {} try { icacls 'C:\System Volume Information\default' /grant Administrators:F /t /q | Out-Null } catch {} } if (Test-Path 'C:\System Volume Information\default\nil') { try { takeown /f 'C:\System Volume Information\default\nil' /a /r /d y | Out-Null } catch {} try { icacls 'C:\System Volume Information\default\nil' /grant Administrators:F /t /q | Out-Null } catch {} }"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3972
      • C:\Windows\system32\takeown.exe
        "C:\Windows\system32\takeown.exe" /f "C:\System Volume Information" /a
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:2392
      • C:\Windows\system32\icacls.exe
        "C:\Windows\system32\icacls.exe" "C:\System Volume Information" /grant Administrators:F /q
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:3256
      • C:\Windows\system32\takeown.exe
        "C:\Windows\system32\takeown.exe" /f "C:\System Volume Information\default" /a /r /d y
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:1604
      • C:\Windows\system32\icacls.exe
        "C:\Windows\system32\icacls.exe" "C:\System Volume Information\default" /grant Administrators:F /t /q
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:5612
      • C:\Windows\system32\takeown.exe
        "C:\Windows\system32\takeown.exe" /f "C:\System Volume Information\default\nil" /a /r /d y
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:7072
      • C:\Windows\system32\icacls.exe
        "C:\Windows\system32\icacls.exe" "C:\System Volume Information\default\nil" /grant Administrators:F /t /q
        3⤵
        • Possible privilege escalation attempt
        • Modifies file permissions
        PID:2052
    • C:\Windows\SYSTEM32\diskpart.exe
      "diskpart.exe" /s "C:\Users\Admin\AppData\Local\Temp\dp_init.txt"
      2⤵
        PID:4828
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command " $path = 'C:\System Volume Information\default\desktop.ini' $acl = Get-Acl $path $acl.SetAccessRuleProtection($true, $false) $denyRule = New-Object System.Security.AccessControl.FileSystemAccessRule( 'Everyone', 'Delete,DeleteSubdirectoriesAndFiles', 'None', 'None', 'Deny') $acl.AddAccessRule($denyRule) $adminRule = New-Object System.Security.AccessControl.FileSystemAccessRule( 'BUILTIN\Administrators', 'FullControl', 'None', 'None', 'Allow') $acl.AddAccessRule($adminRule) $systemRule = New-Object System.Security.AccessControl.FileSystemAccessRule( 'NT AUTHORITY\SYSTEM', 'FullControl', 'None', 'None', 'Allow') $acl.AddAccessRule($systemRule) $readRule = New-Object System.Security.AccessControl.FileSystemAccessRule( 'Everyone', 'Read', 'None', 'None', 'Allow') $acl.AddAccessRule($readRule) Set-Acl -Path $path -AclObject $acl "
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:2556
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command " $path = 'C:\System Volume Information\desktop.ini' $acl = Get-Acl $path $acl.SetAccessRuleProtection($true, $false) $denyRule = New-Object System.Security.AccessControl.FileSystemAccessRule( 'Everyone', 'Delete,DeleteSubdirectoriesAndFiles', 'None', 'None', 'Deny') $acl.AddAccessRule($denyRule) $adminRule = New-Object System.Security.AccessControl.FileSystemAccessRule( 'BUILTIN\Administrators', 'FullControl', 'None', 'None', 'Allow') $acl.AddAccessRule($adminRule) $systemRule = New-Object System.Security.AccessControl.FileSystemAccessRule( 'NT AUTHORITY\SYSTEM', 'FullControl', 'None', 'None', 'Allow') $acl.AddAccessRule($systemRule) $readRule = New-Object System.Security.AccessControl.FileSystemAccessRule( 'Everyone', 'Read', 'None', 'None', 'Allow') $acl.AddAccessRule($readRule) Set-Acl -Path $path -AclObject $acl "
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:4372
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command " $path = 'C:\System Volume Information\default\desktop.ini' $acl = Get-Acl $path $acl.SetAccessRuleProtection($true, $false) $denyRule = New-Object System.Security.AccessControl.FileSystemAccessRule( 'Everyone', 'Delete,DeleteSubdirectoriesAndFiles', 'None', 'None', 'Deny') $acl.AddAccessRule($denyRule) $adminRule = New-Object System.Security.AccessControl.FileSystemAccessRule( 'BUILTIN\Administrators', 'FullControl', 'None', 'None', 'Allow') $acl.AddAccessRule($adminRule) $systemRule = New-Object System.Security.AccessControl.FileSystemAccessRule( 'NT AUTHORITY\SYSTEM', 'FullControl', 'None', 'None', 'Allow') $acl.AddAccessRule($systemRule) $readRule = New-Object System.Security.AccessControl.FileSystemAccessRule( 'Everyone', 'Read', 'None', 'None', 'Allow') $acl.AddAccessRule($readRule) Set-Acl -Path $path -AclObject $acl "
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:3292
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command " $path = 'C:\System Volume Information\desktop.ini' $acl = Get-Acl $path $acl.SetAccessRuleProtection($true, $false) $denyRule = New-Object System.Security.AccessControl.FileSystemAccessRule( 'Everyone', 'Delete,DeleteSubdirectoriesAndFiles', 'None', 'None', 'Deny') $acl.AddAccessRule($denyRule) $adminRule = New-Object System.Security.AccessControl.FileSystemAccessRule( 'BUILTIN\Administrators', 'FullControl', 'None', 'None', 'Allow') $acl.AddAccessRule($adminRule) $systemRule = New-Object System.Security.AccessControl.FileSystemAccessRule( 'NT AUTHORITY\SYSTEM', 'FullControl', 'None', 'None', 'Allow') $acl.AddAccessRule($systemRule) $readRule = New-Object System.Security.AccessControl.FileSystemAccessRule( 'Everyone', 'Read', 'None', 'None', 'Allow') $acl.AddAccessRule($readRule) Set-Acl -Path $path -AclObject $acl "
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious use of AdjustPrivilegeToken
        PID:556
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /7
      1⤵
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:3380
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:3172
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k GPSvcGroup
        1⤵
          PID:6384
        • C:\Windows\System32\vdsldr.exe
          C:\Windows\System32\vdsldr.exe -Embedding
          1⤵
            PID:6800
          • C:\Windows\System32\vds.exe
            C:\Windows\System32\vds.exe
            1⤵
            • Drops file in Windows directory
            • Checks SCSI registry key(s)
            • Suspicious use of AdjustPrivilegeToken
            PID:520
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
            1⤵
            • Drops file in Windows directory
            PID:4364
          • C:\Windows\System32\rundll32.exe
            C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {995C996E-D918-4a8c-A302-45719A6F4EA7} -Embedding
            1⤵
              PID:936
            • C:\Users\Admin\AppData\Local\Temp\AtlasSecureSystem.exe
              "C:\Users\Admin\AppData\Local\Temp\AtlasSecureSystem.exe"
              1⤵
              • Drops desktop.ini file(s)
              • Enumerates connected drives
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1988
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command " $acl = Get-Acl 'C:\System Volume Information' $acl.SetAccessRuleProtection($false, $false) $adminRule = New-Object System.Security.AccessControl.FileSystemAccessRule( 'BUILTIN\Administrators', 'FullControl', 'ContainerInherit,ObjectInherit', 'None', 'Allow' ) $acl.SetAccessRule($adminRule) Set-Acl -Path 'C:\System Volume Information' -AclObject $acl takeown /f 'C:\System Volume Information' /a /r /d y 2>&1 | Out-Null icacls 'C:\System Volume Information' /grant:r Administrators:F /t /q 2>&1 | Out-Null "
                2⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:1328
                • C:\Windows\system32\takeown.exe
                  "C:\Windows\system32\takeown.exe" /f "C:\System Volume Information" /a /r /d y
                  3⤵
                  • Possible privilege escalation attempt
                  • Modifies file permissions
                  • Suspicious use of AdjustPrivilegeToken
                  PID:6596
                • C:\Windows\system32\icacls.exe
                  "C:\Windows\system32\icacls.exe" "C:\System Volume Information" /grant:r Administrators:F /t /q
                  3⤵
                  • Possible privilege escalation attempt
                  • Modifies file permissions
                  PID:5092
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command " try { takeown /f 'C:\System Volume Information' /a | Out-Null } catch {} try { icacls 'C:\System Volume Information' /grant Administrators:F /q | Out-Null } catch {} if (Test-Path 'C:\System Volume Information\default') { try { takeown /f 'C:\System Volume Information\default' /a /r /d y | Out-Null } catch {} try { icacls 'C:\System Volume Information\default' /grant Administrators:F /t /q | Out-Null } catch {} } if (Test-Path 'C:\System Volume Information\default\nil') { try { takeown /f 'C:\System Volume Information\default\nil' /a /r /d y | Out-Null } catch {} try { icacls 'C:\System Volume Information\default\nil' /grant Administrators:F /t /q | Out-Null } catch {} }"
                2⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:4136
                • C:\Windows\system32\takeown.exe
                  "C:\Windows\system32\takeown.exe" /f "C:\System Volume Information" /a
                  3⤵
                  • Possible privilege escalation attempt
                  • Modifies file permissions
                  PID:6388
                • C:\Windows\system32\icacls.exe
                  "C:\Windows\system32\icacls.exe" "C:\System Volume Information" /grant Administrators:F /q
                  3⤵
                  • Possible privilege escalation attempt
                  • Modifies file permissions
                  PID:3504
                • C:\Windows\system32\takeown.exe
                  "C:\Windows\system32\takeown.exe" /f "C:\System Volume Information\default" /a /r /d y
                  3⤵
                  • Possible privilege escalation attempt
                  • Modifies file permissions
                  PID:1300
                • C:\Windows\system32\icacls.exe
                  "C:\Windows\system32\icacls.exe" "C:\System Volume Information\default" /grant Administrators:F /t /q
                  3⤵
                  • Possible privilege escalation attempt
                  • Modifies file permissions
                  PID:2332
                • C:\Windows\system32\takeown.exe
                  "C:\Windows\system32\takeown.exe" /f "C:\System Volume Information\default\nil" /a /r /d y
                  3⤵
                  • Possible privilege escalation attempt
                  • Modifies file permissions
                  PID:5304
                • C:\Windows\system32\icacls.exe
                  "C:\Windows\system32\icacls.exe" "C:\System Volume Information\default\nil" /grant Administrators:F /t /q
                  3⤵
                  • Possible privilege escalation attempt
                  • Modifies file permissions
                  PID:1472
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "takeown /f 'C:\System Volume Information\default\nil\Core.atlas' /a; icacls 'C:\System Volume Information\default\nil\Core.atlas' /grant Administrators:F /q"
                2⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:2580
                • C:\Windows\system32\takeown.exe
                  "C:\Windows\system32\takeown.exe" /f "C:\System Volume Information\default\nil\Core.atlas" /a
                  3⤵
                  • Possible privilege escalation attempt
                  • Modifies file permissions
                  PID:4004
                • C:\Windows\system32\icacls.exe
                  "C:\Windows\system32\icacls.exe" "C:\System Volume Information\default\nil\Core.atlas" /grant Administrators:F /q
                  3⤵
                  • Possible privilege escalation attempt
                  • Modifies file permissions
                  PID:2004
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "diskpart.exe /s "C:\Users\Admin\AppData\Local\Temp\assign_letter.txt""
                2⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:6972
                • C:\Windows\system32\diskpart.exe
                  "C:\Windows\system32\diskpart.exe" /s C:\Users\Admin\AppData\Local\Temp\assign_letter.txt
                  3⤵
                    PID:5172
                • C:\Windows\SYSTEM32\diskpart.exe
                  "diskpart.exe" /s "C:\Users\Admin\AppData\Local\Temp\final_assign.txt"
                  2⤵
                    PID:3496
                  • C:\Users\Admin\AppData\Local\Temp\AtlasSecureSystem.exe
                    "C:\Users\Admin\AppData\Local\Temp\AtlasSecureSystem.exe" --sentinel 1988 "C:\System Volume Information\default\nil\Core.atlas"
                    2⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3108
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command " $path = 'C:\System Volume Information\default\desktop.ini' $acl = Get-Acl $path $acl.SetAccessRuleProtection($true, $false) $denyRule = New-Object System.Security.AccessControl.FileSystemAccessRule( 'Everyone', 'Delete,DeleteSubdirectoriesAndFiles', 'None', 'None', 'Deny') $acl.AddAccessRule($denyRule) $adminRule = New-Object System.Security.AccessControl.FileSystemAccessRule( 'BUILTIN\Administrators', 'FullControl', 'None', 'None', 'Allow') $acl.AddAccessRule($adminRule) $systemRule = New-Object System.Security.AccessControl.FileSystemAccessRule( 'NT AUTHORITY\SYSTEM', 'FullControl', 'None', 'None', 'Allow') $acl.AddAccessRule($systemRule) $readRule = New-Object System.Security.AccessControl.FileSystemAccessRule( 'Everyone', 'Read', 'None', 'None', 'Allow') $acl.AddAccessRule($readRule) Set-Acl -Path $path -AclObject $acl "
                    2⤵
                    • Command and Scripting Interpreter: PowerShell
                    • Suspicious use of AdjustPrivilegeToken
                    PID:6236
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command " $path = 'C:\System Volume Information\desktop.ini' $acl = Get-Acl $path $acl.SetAccessRuleProtection($true, $false) $denyRule = New-Object System.Security.AccessControl.FileSystemAccessRule( 'Everyone', 'Delete,DeleteSubdirectoriesAndFiles', 'None', 'None', 'Deny') $acl.AddAccessRule($denyRule) $adminRule = New-Object System.Security.AccessControl.FileSystemAccessRule( 'BUILTIN\Administrators', 'FullControl', 'None', 'None', 'Allow') $acl.AddAccessRule($adminRule) $systemRule = New-Object System.Security.AccessControl.FileSystemAccessRule( 'NT AUTHORITY\SYSTEM', 'FullControl', 'None', 'None', 'Allow') $acl.AddAccessRule($systemRule) $readRule = New-Object System.Security.AccessControl.FileSystemAccessRule( 'Everyone', 'Read', 'None', 'None', 'Allow') $acl.AddAccessRule($readRule) Set-Acl -Path $path -AclObject $acl "
                    2⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:2664
                • C:\Windows\System32\svchost.exe
                  C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
                  1⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:7112
                • C:\Windows\System32\BdeUISrv.exe
                  C:\Windows\System32\BdeUISrv.exe -Embedding
                  1⤵
                    PID:5316
                  • C:\Windows\System32\vdsldr.exe
                    C:\Windows\System32\vdsldr.exe -Embedding
                    1⤵
                      PID:4300
                    • C:\Windows\System32\vds.exe
                      C:\Windows\System32\vds.exe
                      1⤵
                      • Checks SCSI registry key(s)
                      PID:4256
                    • C:\Windows\System32\vds.exe
                      C:\Windows\System32\vds.exe
                      1⤵
                      • Enumerates connected drives
                      • Checks SCSI registry key(s)
                      PID:5096

                    Network

                          MITRE ATT&CK Enterprise v16

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          desktop.ini
                          • Path C:\System Volume Information\default\desktop.ini
                          • Size 65B
                          • SHA256 9e0bce659081c4a89060d5849af63752a19a7ec88875002a6125ae9e8411c17f
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          UsnClass.dat
                          • Path C:\System Volume Information\default\nil\UsnClass.dat
                          • Size 648KB
                          • SHA256 f5a297907ed76553c23e3fa9c0c876ddf802c8652cb4ec519598aabb9b0305c2
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          UsnClass.dat
                          • Path C:\System Volume Information\default\nil\UsnClass.dat
                          • Size 1.5MB
                          • SHA256 8b1fb2e647b5fd5170f7b50c9f37f7081f702928d9f1083fa2a76ae807a0dfe4
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          UsnClass.dat
                          • Path C:\System Volume Information\default\nil\UsnClass.dat
                          • Size 1.6MB
                          • SHA256 66db59bf7a806e06982eab9f6e1388e2d53ed5fcff62561176aa51321aed42a8
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          catalog.edb
                          • Path C:\System Volume Information\default\nil\catalog.edb
                          • Size 728KB
                          • SHA256 f6f1e2cef5a53ab1ef9d473f417d6345402516c2ae8d96087d6597f2dbf070ee
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          catalog.edb
                          • Path C:\System Volume Information\default\nil\catalog.edb
                          • Size 1.4MB
                          • SHA256 2efd286520cb5a3e8cd0f179e94cddd1a3e24ca8dccbccdfd05beac918559a9b
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          catalog.edb
                          • Path C:\System Volume Information\default\nil\catalog.edb
                          • Size 1.4MB
                          • SHA256 dc064ba43bce520abc5d97162975a32d62bf3f9cc5e16cc146ed1bf833a1107b
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          edbtmp.log
                          • Path C:\System Volume Information\default\nil\edbtmp.log
                          • Size 562KB
                          • SHA256 9d2c5eb6bbab65c3c0350914c4fb07a89e2ba13bf36cd9da4a9c91f8dfdae35b
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          edbtmp.log
                          • Path C:\System Volume Information\default\nil\edbtmp.log
                          • Size 1.0MB
                          • SHA256 ddeb7bc966f374331e4f8db80b3ae9057414b2c543bd70909431e7d02f05fe04
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          edbtmp.log
                          • Path C:\System Volume Information\default\nil\edbtmp.log
                          • Size 1.4MB
                          • SHA256 bee55075981379d2d62f848ff5b617aded3768e75ab2369e54699782c3d11c29
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          integrity.cfg
                          • Path C:\System Volume Information\default\nil\integrity.cfg
                          • Size 566B
                          • SHA256 b7c85ce514e0e13f3ed5fccf384f8785bb651f5aed1e7ffc798d015165c7ee29
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          integrity.cfg
                          • Path C:\System Volume Information\default\nil\integrity.cfg
                          • Size 870B
                          • SHA256 02fda373c396f335ef48c693ccb38693724469df48389b6614cf9254ed083e13
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          mft_fragment.dat
                          • Path C:\System Volume Information\default\nil\mft_fragment.dat
                          • Size 1.4MB
                          • SHA256 a573948db242e36a4218489e3e5ec2708332c9dfe0909b354e4e646a6aff886e
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          mft_fragment.dat
                          • Path C:\System Volume Information\default\nil\mft_fragment.dat
                          • Size 2.0MB
                          • SHA256 5da19a182dbb4aff1ef6a6a40c61aacf73b08449c1fb2bcca9d4a0f68e4e8116
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          mft_fragment.dat
                          • Path C:\System Volume Information\default\nil\mft_fragment.dat
                          • Size 540KB
                          • SHA256 c578ba3ce4cdd9bc7b8d6cd9d58413effebe6d0a90f6aafa1b88da75ed89167b
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          ntfs_log.tmp
                          • Path C:\System Volume Information\default\nil\ntfs_log.tmp
                          • Size 867KB
                          • SHA256 2f0d30f82660b5a2fc4e1342b345557d379c410d2348cf38f22f7fd634c6a555
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          ntfs_log.tmp
                          • Path C:\System Volume Information\default\nil\ntfs_log.tmp
                          • Size 540KB
                          • SHA256 5c058441327ca5de8fe23c8f27b99d936efb834473c6fc9bff6da57698c91070
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          ntfs_log.tmp
                          • Path C:\System Volume Information\default\nil\ntfs_log.tmp
                          • Size 1.9MB
                          • SHA256 88bf6b8345c695b695438683aa53d249aa0a0084095dd585886c0e403d3396dc
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          syscache.edb
                          • Path C:\System Volume Information\default\nil\syscache.edb
                          • Size 1.2MB
                          • SHA256 9f1f4ddfcaf72c9c025b2f2ec72135b0633de69a3b1c661fc0db7ae987831680
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          syscache.edb
                          • Path C:\System Volume Information\default\nil\syscache.edb
                          • Size 1.3MB
                          • SHA256 c99c483865bbd21db72f0ca3ecfd661c7d692631fc2959b4bfce5fe0b1c480ed
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          syscache.edb
                          • Path C:\System Volume Information\default\nil\syscache.edb
                          • Size 1.2MB
                          • SHA256 09231e7e2848293f93b049802a404b1a6fef5c10d4aed5c36c6f811cae212f85
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          tmp.edb
                          • Path C:\System Volume Information\default\nil\tmp.edb
                          • Size 1.5MB
                          • SHA256 48cbd3624982f60dcf9c8aabe2a1f56f95f9d6a025e3103c8e90bb9e56000a5a
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          tmp.edb
                          • Path C:\System Volume Information\default\nil\tmp.edb
                          • Size 1.5MB
                          • SHA256 fba34a7830143b8afb17a7bf02f7f69301818d860b5944dac32c134a0d6b9a0b
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          tmp.edb
                          • Path C:\System Volume Information\default\nil\tmp.edb
                          • Size 1.6MB
                          • SHA256 58dc89368b70735d67d6dff81e20d494da7883758a15139c66083a39ca02b507
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          vss_cache.bin
                          • Path C:\System Volume Information\default\nil\vss_cache.bin
                          • Size 354KB
                          • SHA256 8b73d639c4ab1ce711356267f9312895f1c8a2d8c0f609af2864eff147e21224
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          vss_cache.bin
                          • Path C:\System Volume Information\default\nil\vss_cache.bin
                          • Size 1.8MB
                          • SHA256 c254298c80344c26e6290381293782e1371b977ad6b71b22dba860885f6dd72a
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          vss_cache.bin
                          • Path C:\System Volume Information\default\nil\vss_cache.bin
                          • Size 257KB
                          • SHA256 0d00ec8c3924574188709d5ff5f406d2c8a4c0fa6ae7a14cf07074aab1c749b1
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          desktop.ini
                          • Path C:\System Volume Information\desktop.ini
                          • Size 96B
                          • SHA256 b65342418c0c17897f13ed628c6ba79112730727feca7e3f28f54989352a4196
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 1KB
                          • SHA256 c98a886ab7a7fb21fa31b56ea6cdea8edb4dfe7e9783c35c9f98fb23065195c9
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 1KB
                          • SHA256 0f08005537e40628f93f248570c6fa1793a89fa85ddbde20815573ac35526119
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 1KB
                          • SHA256 861b76770359b2b94e7754d4c8388de565441a25158836fefc4a5adf0f7b6c97
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 1KB
                          • SHA256 d1b8dd62973ee2d67049b0a0a90d2d8cdff4a84287de410138ebc606ae91fd45
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 1KB
                          • SHA256 2fc57068f9914b6e4e7f83fea8c076ef8b3cc50daa566819a1480a13c3ba5dce
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 1KB
                          • SHA256 c4bf53238a571970196573f50fa24b14edc0137cad7791b5c5314fb1769c60d4
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 1KB
                          • SHA256 4aa75f9e3807d0107b5400963686adbc6abcfde431eac9dc2f7e1bc6b4eeee9e
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 64B
                          • SHA256 d92d529483d3340105c18086873cfbbc79ba2585fadb31c73c908545abc1f97c
                          • MD5 SHA1 SHA512
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 1KB
                          • SHA256 abb8ad6ba85bf0c8b4d3cba5c4b3bc0cf2c22df259c700da68623dbe59113dfd
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 64B
                          • SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
                          • MD5 SHA1 SHA512
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 1KB
                          • SHA256 ff98d17dbdb68ee8502c9acc527abb133b6dc62942681e75cdf05e00269f33fb
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 1KB
                          • SHA256 3266629feb6a0e9d780b6ff2ce315508f88e2dc0f7ccf4ffbcd6dcd7bd735e68
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 1KB
                          • SHA256 dbe6838db92a35afeb40869e37ec8b5f0acaab3fb07f428092a3b1dbbe56b715
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          __PSScriptPolicyTest_bandp3wc.aw5.ps1
                          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bandp3wc.aw5.ps1
                          • Size 60B
                          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          assign_letter.txt
                          • Path C:\Users\Admin\AppData\Local\Temp\assign_letter.txt
                          • Size 85B
                          • SHA256 38d79e20a8d13b6208af245dd1ea81dc50c7ba11dc978ed593e31d811347d42c
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          dp_init.txt
                          • Path C:\Users\Admin\AppData\Local\Temp\dp_init.txt
                          • Size 187B
                          • SHA256 12e1eb278e2f5dd80ed1fdd257f1b7d4d001b1b9010fc08c50f5e53bcc77b151
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          final_assign.txt
                          • Path C:\Users\Admin\AppData\Local\Temp\final_assign.txt
                          • Size 105B
                          • SHA256 e4e7975f08ecbcd936933d8ec668aef9f78fb2ca77e8d230da50f300c1cd1be8
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          memory/1328-272-0x000001A0DC450000-0x000001A0DC502000-memory.dmp
                          Download

                          memory/2424-40-0x000001A0D34F0000-0x000001A0D35A2000-memory.dmp
                          Download

                          memory/2556-151-0x000002CD7ADF0000-0x000002CD7AEA2000-memory.dmp
                          Download

                          memory/2664-430-0x000002C77E4F0000-0x000002C77E5A2000-memory.dmp
                          Download

                          memory/3292-257-0x000002D4BE900000-0x000002D4BE9B2000-memory.dmp
                          Download

                          memory/3380-10-0x0000021695790000-0x0000021695791000-memory.dmp
                          Download

                          memory/3380-2-0x0000021695790000-0x0000021695791000-memory.dmp
                          Download

                          memory/3380-0-0x0000021695790000-0x0000021695791000-memory.dmp
                          Download

                          memory/3380-8-0x0000021695790000-0x0000021695791000-memory.dmp
                          Download

                          memory/3380-6-0x0000021695790000-0x0000021695791000-memory.dmp
                          Download

                          memory/3380-7-0x0000021695790000-0x0000021695791000-memory.dmp
                          Download

                          memory/3380-9-0x0000021695790000-0x0000021695791000-memory.dmp
                          Download

                          memory/3380-11-0x0000021695790000-0x0000021695791000-memory.dmp
                          Download

                          memory/4540-33-0x0000013EC5810000-0x0000013EC582E000-memory.dmp
                          Download

                          memory/4540-27-0x0000013EC5600000-0x0000013EC5622000-memory.dmp
                          Download

                          memory/4540-30-0x0000013EC57D0000-0x0000013EC57EE000-memory.dmp
                          Download

                          memory/4540-31-0x0000013EC5A90000-0x0000013EC5B42000-memory.dmp
                          Download

                          memory/4540-32-0x0000013EC57C0000-0x0000013EC57CA000-memory.dmp
                          Download

                          memory/6236-423-0x0000014574820000-0x00000145748D2000-memory.dmp
                          Download