Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
04/08/2026, 06:32
General
- Target 2026-08-04_8414edaa0a5042e3b54909fab4673b6c_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
- Size 419KB
- Sample260804-hat9fsed89
- SHA256 f96b37a086bf032b832288aad7f820be00063a087e0423eb55a9986559d6c61e
Score
10/10
Malware Config
Signatures
- Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Detects Sheetrat Payload 2 IoCs
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 2 IoCs
- Modifies Windows Defender TamperProtection settings 3 TTPs 2 IoCs
- UAC bypass 3 TTPs 8 IoCs
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 2 IoCs
- Detects executables (downlaoders) containing URLs to raw contents of a paste 2 IoCs
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen 2 IoCs
- Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 28 IoCs
Run Powershell and hide display window.
- Drops file in Drivers directory 26 IoCs
- Modifies Windows Firewall 2 TTPs 2 IoCs
- Possible privilege escalation attempt 46 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Creates new service(s) 2 TTPs
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 8 IoCs
- Modifies file permissions 1 TTPs 46 IoCs
- Registers new Windows logon scripts automatically executed at logon. 1 TTPs 2 IoCs
- Stops running service(s) 4 TTPs
- Windows security modification 2 TTPs 2 IoCs
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Enumerates connected drives 3 TTPs 51 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory 2 IoCs
- Drops file in Windows directory 4 IoCs
- Launches sc.exe 8 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Executes a command shell one-liner 1 TTPs 14 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Modifies data under HKEY_USERS 3 IoCs
- Modifies registry class 2 IoCs
- Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 22 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 59 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 12 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_8414edaa0a5042e3b54909fab4673b6c_amadey_cobalt-strike_darkgate_glassworm_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_8414edaa0a5042e3b54909fab4673b6c_amadey_cobalt-strike_darkgate_glassworm_icedid.exe"1⤵
- Modifies WinLogon for persistence
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender TamperProtection settings
- UAC bypass
- Drops file in Drivers directory
- Checks computer location settings
- Registers new Windows logon scripts automatically executed at logon.
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\2026-08-04_8414edaa0a5042e3b54909fab4673b6c_amadey_cobalt-strike_darkgate_glassworm_icedid.exe" enable=yes & exit2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\2026-08-04_8414edaa0a5042e3b54909fab4673b6c_amadey_cobalt-strike_darkgate_glassworm_icedid.exe" enable=yes3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /S2⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete "WindowsUpdaterDefenderMicrosoft"2⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-08-04_8414edaa0a5042e3b54909fab4673b6c_amadey_cobalt-strike_darkgate_glassworm_icedid.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"2⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" start "WindowsUpdaterDefenderMicrosoft"2⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /D2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /S2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "User_Feed_Synchronization-e780ec86-ebfa-4643-befb-9aac61715f7c" /F2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "User_Feed_Synchronization-e780ec86-ebfa-4643-befb-9aac61715f7c" /XML "C:\Users\Admin\AppData\Local\Temp\2526cd21-3025-4efb-b5ea-abf7af459e8c.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Updater.exe' -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "FamilySafetyMonitor_a7e9f792" /F2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "FamilySafetyMonitor_a7e9f792" /XML "C:\Users\Admin\AppData\Local\Temp\f70bf163-051f-4544-b0b3-62395bad2f28.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\exploler.exe' -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "User_Feed_Synchronization-67a1eb13-ed0c-4665-bbcf-c92fc2f5e350" /F2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /S2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "User_Feed_Synchronization-67a1eb13-ed0c-4665-bbcf-c92fc2f5e350" /XML "C:\Users\Admin\AppData\Local\Temp\8cc6836a-0a98-416d-9464-76b9efbcf575.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows' -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "SystemSoundsService_2d649183" /F2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming' -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "SystemSoundsService_2d649183" /XML "C:\Users\Admin\AppData\Local\Temp\0c9d38a7-1102-4784-9726-47df40e8df66.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\' -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_a06f7b40" /F2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_a06f7b40" /XML "C:\Users\Admin\AppData\Local\Temp\7b7eb0b4-ee16-4a6b-bd21-5f8fce59fec0.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'Updater.exe' -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /S2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "DropboxUpdateTaskMachineCore_259a70d3" /F2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'exploler.exe' -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "DropboxUpdateTaskMachineCore_259a70d3" /XML "C:\Users\Admin\AppData\Local\Temp\3921c426-c2a6-4b63-bb55-5614ad97e68a.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 6 /tn "MicrosoftEdgeUpdate" /tr "C:\Users\Admin\AppData\Roaming\Updater.exe" /RL HIGHEST & exit2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 6 /tn "MicrosoftEdgeUpdate" /tr "C:\Users\Admin\AppData\Roaming\Updater.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc" start TrustedInstaller2⤵
- Launches sc.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows\exploler.exe' -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Updater.exe' -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /S2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Windows' -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\net.exe"net" stop WinDefend2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop WinDefend3⤵
-
-
-
C:\Windows\SYSTEM32\net.exe"net" start WinDefend2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start WinDefend3⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming' -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /S2⤵
-
-
C:\Windows\SYSTEM32\bcdedit.exe"bcdedit" /set testsigning on2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\SYSTEM32\bcdedit.exe"bcdedit" /set nointegritychecks on2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\null.sys" /grant administrators:F /t /c2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\takeown.exe"takeown" /f "C:\Windows\system32\drivers\null.sys" /a2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\null.sys" /grant administrators:F2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\beep.sys" /grant administrators:F /t /c2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\takeown.exe"takeown" /f "C:\Windows\system32\drivers\beep.sys" /a2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\beep.sys" /grant administrators:F2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\rasl2tp.sys" /grant administrators:F /t /c2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\takeown.exe"takeown" /f "C:\Windows\system32\drivers\rasl2tp.sys" /a2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\rasl2tp.sys" /grant administrators:F2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\' -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\raspppoe.sys" /grant administrators:F /t /c2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" L: /S2⤵
-
-
C:\Windows\SYSTEM32\takeown.exe"takeown" /f "C:\Windows\system32\drivers\raspppoe.sys" /a2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\raspppoe.sys" /grant administrators:F2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\raspptp.sys" /grant administrators:F /t /c2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\takeown.exe"takeown" /f "C:\Windows\system32\drivers\raspptp.sys" /a2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\raspptp.sys" /grant administrators:F2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\modem.sys" /grant administrators:F /t /c2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\takeown.exe"takeown" /f "C:\Windows\system32\drivers\modem.sys" /a2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\modem.sys" /grant administrators:F2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\parport.sys" /grant administrators:F /t /c2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\serenum.sys" /grant administrators:F /t /c2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\serial.sys" /grant administrators:F /t /c2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" L: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" M: /S2⤵
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\usbprint.sys" /grant administrators:F /t /c2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'exploler.exe' -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'Updater.exe' -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" M: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" N: /S2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" netsh advfirewall firewall add rule name="WindowsControl" dir=in action=allow program="C:\Windows\exploler.exe" enable=yes & exit2⤵
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c schtasks /delete /F /TN "OneDriveStandalone Task" & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /delete /F /TN "OneDriveStandalone Task"3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc onlogon /tn "OneDriveStandalone Task" /tr "C:\Windows\exploler.exe" & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /tn "OneDriveStandalone Task" /tr "C:\Windows\exploler.exe"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c schtasks /create /f /tn "OneDriveStandalone Task_OnLock" /tr "C:\Windows\exploler.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /tn "OneDriveStandalone Task_OnLock" /tr "C:\Windows\exploler.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c schtasks /create /f /tn "OneDriveStandalone Task_OnUnlock" /tr "C:\Windows\exploler.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /tn "OneDriveStandalone Task_OnUnlock" /tr "C:\Windows\exploler.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c schtasks /create /f /tn "OneDriveStandalone Task_OnIdle" /tr "C:\Windows\exploler.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance" & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /tn "OneDriveStandalone Task_OnIdle" /tr "C:\Windows\exploler.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c schtasks /create /f /tn "OneDriveStandalone Task_Evt4624" /tr "C:\Windows\exploler.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance" & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /tn "OneDriveStandalone Task_Evt4624" /tr "C:\Windows\exploler.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\exploler.exe"C:\Windows\exploler.exe"2⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender TamperProtection settings
- UAC bypass
- Drops file in Drivers directory
- Executes dropped EXE
- Registers new Windows logon scripts automatically executed at logon.
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\exploler.exe" enable=yes & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\exploler.exe" enable=yes4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /S3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete "WindowsUpdaterDefenderMicrosoft"3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\exploler.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" start "WindowsUpdaterDefenderMicrosoft"3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /S3⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "Consolidator_3a114cad" /F3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc" start TrustedInstaller3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c schtasks /delete /F /TN "OneDriveStandalone Task" & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /delete /F /TN "OneDriveStandalone Task"4⤵
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "Consolidator_3a114cad" /XML "C:\Users\Admin\AppData\Local\Temp\4f3a883a-2458-475c-8634-2468977d5341.xml" /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c schtasks /create /f /tn "OneDriveStandalone Task_OnLock" /tr "C:\Windows\exploler.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /tn "OneDriveStandalone Task_OnLock" /tr "C:\Windows\exploler.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c schtasks /create /f /tn "OneDriveStandalone Task_OnUnlock" /tr "C:\Windows\exploler.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /tn "OneDriveStandalone Task_OnUnlock" /tr "C:\Windows\exploler.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c schtasks /create /f /tn "OneDriveStandalone Task_OnIdle" /tr "C:\Windows\exploler.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance" & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /tn "OneDriveStandalone Task_OnIdle" /tr "C:\Windows\exploler.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c schtasks /create /f /tn "OneDriveStandalone Task_Evt4624" /tr "C:\Windows\exploler.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance" & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /tn "OneDriveStandalone Task_Evt4624" /tr "C:\Windows\exploler.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_3c58cd44" /F3⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_3c58cd44" /XML "C:\Users\Admin\AppData\Local\Temp\01d02c34-7a3f-4035-94a1-8492fd84cdd9.xml" /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /S3⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_5966be41" /F3⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_5966be41" /XML "C:\Users\Admin\AppData\Local\Temp\64faa725-b840-41f7-a2dd-4af575c2d1ae.xml" /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\net.exe"net" stop WinDefend3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop WinDefend4⤵
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_a8abbf35" /F3⤵
-
-
C:\Windows\SYSTEM32\net.exe"net" start WinDefend3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start WinDefend4⤵
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_a8abbf35" /XML "C:\Users\Admin\AppData\Local\Temp\aee849bc-fa0e-4190-b271-045cdd465f47.xml" /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "Intel PTT EK Recertification_67c01c5e" /F3⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "Intel PTT EK Recertification_67c01c5e" /XML "C:\Users\Admin\AppData\Local\Temp\c3f88893-7af4-4e8b-aeae-eb6ed42a1d3e.xml" /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /D3⤵
- Enumerates connected drives
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /S3⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_af5ce599" /F3⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_af5ce599" /XML "C:\Users\Admin\AppData\Local\Temp\bc24aa78-5208-4805-a960-f49e2a8ebaea.xml" /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\bcdedit.exe"bcdedit" /set testsigning on3⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\SYSTEM32\bcdedit.exe"bcdedit" /set nointegritychecks on3⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\null.sys" /grant administrators:F /t /c3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\takeown.exe"takeown" /f "C:\Windows\system32\drivers\null.sys" /a3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\null.sys" /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\beep.sys" /grant administrators:F /t /c3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\takeown.exe"takeown" /f "C:\Windows\system32\drivers\beep.sys" /a3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\beep.sys" /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\rasl2tp.sys" /grant administrators:F /t /c3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\takeown.exe"takeown" /f "C:\Windows\system32\drivers\rasl2tp.sys" /a3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\rasl2tp.sys" /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\raspppoe.sys" /grant administrators:F /t /c3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\takeown.exe"takeown" /f "C:\Windows\system32\drivers\raspppoe.sys" /a3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\raspppoe.sys" /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\raspptp.sys" /grant administrators:F /t /c3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\takeown.exe"takeown" /f "C:\Windows\system32\drivers\raspptp.sys" /a3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\raspptp.sys" /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\modem.sys" /grant administrators:F /t /c3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\takeown.exe"takeown" /f "C:\Windows\system32\drivers\modem.sys" /a3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\modem.sys" /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\parport.sys" /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\parport.sys.bak" /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\parport.sys" /grant administrators:F /t /c3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /S3⤵
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\usbprint.sys" /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\usbprint.sys.bak" /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\usbprint.sys" /grant administrators:F /t /c3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" L: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" L: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" M: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" M: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" N: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" N: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" O: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" O: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" P: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" P: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Q: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Q: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" R: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" R: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" S: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" S: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" T: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" T: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" U: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" U: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" V: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" V: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" W: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" W: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" X: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" X: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Y: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Y: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" L: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" L: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" M: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" M: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" N: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" N: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" O: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" O: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" P: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" P: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Q: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Q: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" R: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" R: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" S: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" S: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" T: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" T: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" U: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" U: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" V: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" V: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" W: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" W: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" X: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" X: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Y: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Y: /D3⤵
- Enumerates connected drives
-
-
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_8414edaa0a5042e3b54909fab4673b6c_amadey_cobalt-strike_darkgate_glassworm_icedid.exeC:\Users\Admin\AppData\Local\Temp\2026-08-04_8414edaa0a5042e3b54909fab4673b6c_amadey_cobalt-strike_darkgate_glassworm_icedid.exe1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\exploler.exeC:\Windows\exploler.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\exploler.exeC:\Windows\exploler.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Create or Modify System Process
5Windows Service
5Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Create or Modify System Process
5Windows Service
5Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1File and Directory Permissions Modification
2Windows File and Directory Permissions Modification
1Impair Defenses
6Disable or Modify System Firewall
1Disable or Modify Tools
4Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
01d02c34-7a3f-4035-94a1-8492fd84cdd9.xml
0c9d38a7-1102-4784-9726-47df40e8df66.xml
2526cd21-3025-4efb-b5ea-abf7af459e8c.xml
3921c426-c2a6-4b63-bb55-5614ad97e68a.xml
4f3a883a-2458-475c-8634-2468977d5341.xml
64faa725-b840-41f7-a2dd-4af575c2d1ae.xml
7b7eb0b4-ee16-4a6b-bd21-5f8fce59fec0.xml
81896405196a4e1bb9fc9524e184d1a5.dll
8cc6836a-0a98-416d-9464-76b9efbcf575.xml
__PSScriptPolicyTest_gcn0o3zw.vil.ps1
aee849bc-fa0e-4190-b271-045cdd465f47.xml
bc24aa78-5208-4805-a960-f49e2a8ebaea.xml
c3f88893-7af4-4e8b-aeae-eb6ed42a1d3e.xml
f70bf163-051f-4544-b0b3-62395bad2f28.xml
Updater.exe
driver_infector.log
driver_infector.log
driver_infector.log
parport.sys
serenum.sys
serial.sys
usbprint.sys
memory/408-0-0x000001E57DE40000-0x000001E57DEAE000-memory.dmp
memory/408-1-0x000001E57FB40000-0x000001E57FB50000-memory.dmp
memory/408-165-0x000001E57FB40000-0x000001E57FB50000-memory.dmp
memory/408-2-0x00007FF837070000-0x00007FF837265000-memory.dmp
memory/408-3-0x00007FF836DB0000-0x00007FF836E6E000-memory.dmp
memory/408-4-0x00007FF834AF0000-0x00007FF834DB9000-memory.dmp
memory/736-699-0x00007FF7F70F0000-0x00007FF7F7100000-memory.dmp
memory/756-224-0x00007FF7F70F0000-0x00007FF7F7100000-memory.dmp
memory/1196-86-0x00007FF7F70F0000-0x00007FF7F7100000-memory.dmp
memory/1748-711-0x00007FF7F70F0000-0x00007FF7F7100000-memory.dmp
memory/1812-703-0x00007FF7F70F0000-0x00007FF7F7100000-memory.dmp
memory/2204-707-0x00007FF7F70F0000-0x00007FF7F7100000-memory.dmp
memory/3284-190-0x0000000000F10000-0x0000000000F11000-memory.dmp
memory/3284-8-0x00007FF7F70F0000-0x00007FF7F7100000-memory.dmp
memory/3284-437-0x00000000030C0000-0x00000000030C1000-memory.dmp
memory/3540-42-0x000001B1102C0000-0x000001B1102E2000-memory.dmp
memory/3540-59-0x000001B128A30000-0x000001B128C4C000-memory.dmp
memory/4832-695-0x00007FF7F70F0000-0x00007FF7F7100000-memory.dmp
memory/4940-441-0x00007FF834AF0000-0x00007FF834DB9000-memory.dmp
memory/4940-440-0x00007FF836DB0000-0x00007FF836E6E000-memory.dmp
memory/4940-439-0x00007FF837070000-0x00007FF837265000-memory.dmp