Analysis
- user interaction
yes - max time kernel
150s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
04/08/2026, 10:36
General
- Target x479xdoy1zzw27g5 (1).exe
- Size 375KB
- Sample260804-mnn2tahf64
- SHA256 55b251d15b2e00c05b8bc2c52ccaedecb3819879a39b4ec9d2105ddd3b805ac1
Malware Config
Signatures
- Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Detects Sheetrat Payload 4 IoCs
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 2 IoCs
- Modifies Windows Defender TamperProtection settings 3 TTPs 2 IoCs
- Modifies security service 2 TTPs 1 IoCs
- UAC bypass 3 TTPs 8 IoCs
- Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 36 IoCs
- Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs
Clear Windows Event Logs to hide the activity of an intrusion.
- Loads dropped DLL 64 IoCs
- Stops running service(s) 4 TTPs
- Windows security modification 2 TTPs 5 IoCs
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Enumerates connected drives 3 TTPs 56 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in System32 directory 20 IoCs
- Drops file in Program Files directory 1 IoCs
- Drops file in Windows directory 2 IoCs
- Launches sc.exe 6 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Checks SCSI registry key(s) 3 TTPs 18 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 13 IoCs
Processor information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 1 IoCs
- Enumerates system info in registry 2 TTPs 3 IoCs
- Kills process with taskkill 1 IoCs
- Modifies data under HKEY_USERS 52 IoCs
- Modifies registry class 26 IoCs
- NTFS ADS 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 44 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 6 IoCs
- Suspicious use of UnmapMainImage 17 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 12 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\x479xdoy1zzw27g5 (1).exe"C:\Users\Admin\AppData\Local\Temp\x479xdoy1zzw27g5 (1).exe"2⤵
- Modifies WinLogon for persistence
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender TamperProtection settings
- Modifies security service
- UAC bypass
- Checks computer location settings
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SYSTEM32\sc.exe"sc" stop WinDefend3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc" config WinDefend start= demand3⤵
- Launches sc.exe
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /S3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol E: /S4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /D3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol E: /D4⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /S3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol F: /S4⤵
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" netsh advfirewall firewall add rule name="WindowsControl" dir=in action=allow program="C:\Windows\xdwdDefeneder.exe" enable=yes & exit3⤵
- Loads dropped DLL
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c schtasks /delete /F /TN "12" & exit3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /delete /F /TN "12"4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc onlogon /tn "12" /tr "C:\Windows\xdwdDefeneder.exe" & exit3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /tn "12" /tr "C:\Windows\xdwdDefeneder.exe"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc" stop WinDefend3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc" config WinDefend start= demand3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /D3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol F: /D4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /S3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol G: /S4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc" stop WinDefend3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc" config WinDefend start= demand3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /D3⤵
- Loads dropped DLL
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol G: /D4⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /S3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol H: /S4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /D3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol H: /D4⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol I: /S3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol I: /S4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol I: /D3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol I: /D4⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol J: /S3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol J: /S4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol J: /D3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol J: /D4⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol K: /S3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol K: /S4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol K: /D3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol K: /D4⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol L: /S3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol L: /S4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol L: /D3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol L: /D4⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol M: /S3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol M: /S4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol M: /D3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol M: /D4⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol N: /S3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol N: /S4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol N: /D3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol N: /D4⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol O: /S3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol O: /S4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol O: /D3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol O: /D4⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol P: /S3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol P: /S4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol P: /D3⤵
-
C:\Windows\system32\mountvol.exemountvol P: /D4⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Q: /S3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol Q: /S4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Q: /D3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol Q: /D4⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol R: /S3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol R: /S4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol R: /D3⤵
- Loads dropped DLL
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol R: /D4⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol S: /S3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol S: /S4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol S: /D3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol S: /D4⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol T: /S3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol T: /S4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol T: /D3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol T: /D4⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol U: /S3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol U: /S4⤵
-
-
-
C:\Windows\xdwdDefeneder.exe"C:\Windows\xdwdDefeneder.exe"3⤵
- Executes dropped EXE
-
-
-
C:\Windows\xdwdDefeneder.exeC:\Windows\xdwdDefeneder.exe1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender TamperProtection settings
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\CMD.exe"CMD" /c schtasks /delete /F /TN "12" & exit2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /delete /F /TN "12"3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 30 /tn "msegde" /tr "C:\Program Files\xdwdDefeneder" /RL HIGHEST & exit2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 30 /tn "msegde" /tr "C:\Program Files\xdwdDefeneder" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol E: /S2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol E: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol E: /D2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol E: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol F: /S2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol F: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol F: /D2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol F: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol G: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol G: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol G: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol G: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol H: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol H: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol H: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol H: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol I: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol I: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol I: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol I: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol J: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol J: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol J: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol J: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol K: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol K: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol K: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol K: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol L: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol L: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol L: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol L: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol M: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol M: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol M: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol M: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol N: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol N: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol N: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol N: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol O: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol O: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol O: /D2⤵
- Loads dropped DLL
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol O: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol P: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol P: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol P: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol P: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol Q: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol Q: /S3⤵
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c schtasks /delete /F /TN "12" & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /delete /F /TN "12"3⤵
-
-
-
C:\Windows\system32\CMD.exe"CMD" /c schtasks /delete /F /TN "msegde" & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /delete /F /TN "msegde"3⤵
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp9749.tmp.bat"2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /end /TN "12"3⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /delete /F /TN "12"3⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /end /TN "msegde"3⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /delete /F /TN "msegde"3⤵
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im "xdwdDefeneder.exe"3⤵
- Kills process with taskkill
-
-
C:\Windows\system32\timeout.exetimeout 103⤵
- Delays execution with timeout.exe
-
-
C:\Windows\system32\schtasks.exeschtasks /end /TN "12"3⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /delete /F /TN "12"3⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /end /TN "msegde"3⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /delete /F /TN "msegde"3⤵
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit /t REG_SZ /d "C:\\Windows\\System32\\userinit.exe," /f3⤵
- Modifies WinLogon for persistence
-
-
C:\Windows\system32\reg.exereg delete "HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit /f3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol Q: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol Q: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol R: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol R: /S3⤵
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
- Loads dropped DLL
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\servicing\TrustedInstaller.exeC:\Windows\servicing\TrustedInstaller.exe1⤵
- Loads dropped DLL
-
C:\Windows\System32\mousocoreworker.exeC:\Windows\System32\mousocoreworker.exe -Embedding1⤵
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\system32\UsoClient.exeC:\Windows\system32\usoclient.exe1⤵
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
5Windows Service
5Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
5Windows Service
5Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
5Disable or Modify Tools
4Indicator Removal
1Clear Windows Event Logs
1Modify Registry
8Pre-OS Boot
1Bootkit
1Replay Monitor
Loading Replay Monitor...
Downloads
12.exe
config.json
IDX_CONTENT_TASKBARHEADLINES.json
509f37d6-2bea-4f41-927c-f6a8ccf0ca33.dll
Schedule Wake To Work
Schedule Wake To Work
Schedule Work
memory/396-173-0x00007FFE1C2F0000-0x00007FFE1C300000-memory.dmp
memory/616-13-0x00007FFE1C2F0000-0x00007FFE1C300000-memory.dmp
memory/668-70-0x00007FFE1C2F0000-0x00007FFE1C300000-memory.dmp
memory/696-139-0x00007FFE1C2F0000-0x00007FFE1C300000-memory.dmp
memory/764-48-0x00007FFE1C2F0000-0x00007FFE1C300000-memory.dmp
memory/792-152-0x00007FFE1C2F0000-0x00007FFE1C300000-memory.dmp
memory/968-1571-0x00000259B0C90000-0x00000259B0CF2000-memory.dmp
memory/1004-174-0x00007FFE1C2F0000-0x00007FFE1C300000-memory.dmp
memory/1084-100-0x00007FFE1C2F0000-0x00007FFE1C300000-memory.dmp
memory/1096-147-0x00007FFE1C2F0000-0x00007FFE1C300000-memory.dmp
memory/1236-166-0x00007FFE1C2F0000-0x00007FFE1C300000-memory.dmp
memory/1268-106-0x00007FFE1C2F0000-0x00007FFE1C300000-memory.dmp
memory/1320-60-0x00007FFE1C2F0000-0x00007FFE1C300000-memory.dmp
memory/1576-163-0x00007FFE1C2F0000-0x00007FFE1C300000-memory.dmp
memory/1584-172-0x00007FFE1C2F0000-0x00007FFE1C300000-memory.dmp
memory/1596-169-0x00007FFE1C2F0000-0x00007FFE1C300000-memory.dmp
memory/1808-141-0x00007FFE1C2F0000-0x00007FFE1C300000-memory.dmp
memory/1888-88-0x00007FFE1C2F0000-0x00007FFE1C300000-memory.dmp
memory/1928-58-0x00007FFE1C2F0000-0x00007FFE1C300000-memory.dmp
memory/2040-123-0x00007FFE1C2F0000-0x00007FFE1C300000-memory.dmp
memory/2160-18-0x00007FFE1C2F0000-0x00007FFE1C300000-memory.dmp
memory/2168-112-0x00007FFE1C2F0000-0x00007FFE1C300000-memory.dmp
memory/2272-171-0x00007FFE1C2F0000-0x00007FFE1C300000-memory.dmp
memory/2296-198-0x00000263F85E0000-0x00000263F85E1000-memory.dmp
memory/2616-127-0x00007FFE1C2F0000-0x00007FFE1C300000-memory.dmp
memory/2648-103-0x00007FFE1C2F0000-0x00007FFE1C300000-memory.dmp
memory/2792-145-0x00007FFE1C2F0000-0x00007FFE1C300000-memory.dmp
memory/2812-131-0x00007FFE1C2F0000-0x00007FFE1C300000-memory.dmp
memory/2820-126-0x00007FFE1C2F0000-0x00007FFE1C300000-memory.dmp
memory/2864-96-0x00007FFE1C2F0000-0x00007FFE1C300000-memory.dmp
memory/2912-56-0x00007FFE1C2F0000-0x00007FFE1C300000-memory.dmp
memory/3244-9-0x00007FFE1C2F0000-0x00007FFE1C300000-memory.dmp
memory/3244-181-0x00000000012F0000-0x00000000012F1000-memory.dmp
memory/3396-134-0x00007FFE1C2F0000-0x00007FFE1C300000-memory.dmp
memory/3744-175-0x00007FFE1C2F0000-0x00007FFE1C300000-memory.dmp
memory/3940-121-0x00007FFE1C2F0000-0x00007FFE1C300000-memory.dmp
memory/4268-194-0x0000021BA2590000-0x0000021BA25BB000-memory.dmp
memory/4268-195-0x00007FFE1C2F0000-0x00007FFE1C300000-memory.dmp
memory/4268-185-0x0000021BA2590000-0x0000021BA25BB000-memory.dmp
memory/4268-197-0x0000021BA2370000-0x0000021BA23D2000-memory.dmp
memory/4268-193-0x0000021BA2590000-0x0000021BA25BB000-memory.dmp
memory/4268-183-0x0000021BA2450000-0x0000021BA2475000-memory.dmp
memory/4268-192-0x0000021BA2590000-0x0000021BA25BB000-memory.dmp
memory/4268-190-0x0000021BA2590000-0x0000021BA25BB000-memory.dmp
memory/4268-184-0x0000021BA2590000-0x0000021BA25BB000-memory.dmp
memory/4268-191-0x0000021BA2590000-0x0000021BA25BB000-memory.dmp
memory/4700-225-0x00000172E9170000-0x00000172E9180000-memory.dmp
memory/4700-222-0x00000172E9170000-0x00000172E9180000-memory.dmp
memory/4700-216-0x00000172E73F0000-0x00000172E741B000-memory.dmp
memory/4700-215-0x00000172E73F0000-0x00000172E741B000-memory.dmp
memory/4700-214-0x00000172E73F0000-0x00000172E741B000-memory.dmp
memory/4700-213-0x00000172E73F0000-0x00000172E741B000-memory.dmp
memory/4700-208-0x00000172E73F0000-0x00000172E741B000-memory.dmp
memory/4700-220-0x00000172E9170000-0x00000172E9180000-memory.dmp
memory/4700-221-0x00000172E9170000-0x00000172E9180000-memory.dmp
memory/4700-218-0x00007FFE1C2F0000-0x00007FFE1C300000-memory.dmp
memory/4700-226-0x00000172E9170000-0x00000172E9180000-memory.dmp
memory/4700-217-0x00000172E73F0000-0x00000172E741B000-memory.dmp
memory/4700-238-0x00000172E9170000-0x00000172E9180000-memory.dmp
memory/4700-224-0x00000172E9170000-0x00000172E9180000-memory.dmp
memory/4700-223-0x00000172E9170000-0x00000172E9180000-memory.dmp
memory/4736-0-0x00000281CB130000-0x00000281CB192000-memory.dmp
memory/4736-476-0x00000281CCE80000-0x00000281CCE90000-memory.dmp
memory/4736-4-0x00007FFE59990000-0x00007FFE59C59000-memory.dmp
memory/4736-3-0x00007FFE5BDC0000-0x00007FFE5BE7E000-memory.dmp
memory/4736-2-0x00007FFE5C270000-0x00007FFE5C465000-memory.dmp
memory/4736-1-0x00000281CCE80000-0x00000281CCE90000-memory.dmp
memory/4872-119-0x00007FFE1C2F0000-0x00007FFE1C300000-memory.dmp
memory/5644-109-0x00007FFE1C2F0000-0x00007FFE1C300000-memory.dmp