Analysis
- user interaction
yes - max time kernel
110s - max time network
114s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
05/08/2026, 14:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
YT3VM.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
41 signatures
150 seconds
Behavioral task
behavioral2
Sample
YT3VM.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
43 signatures
150 seconds
Errors
Reason
Machine shutdown
General
- Target YT3VM.exe
- Size 586KB
- Sample260805-rfwtxahn2z
- SHA256 afee76a441618314d4f0701ac50f4c750c9b76e8aa77b28c3602850f97a00b5b
- MD5 46ae960d90f0ea2bfa6f10b44489b66b
- SHA1 862bfd947cd55788ae437ca432af8a63ef18602d
- SHA512 78f272db2212a8544584e0a3f5c40409cdb98dae6b268a4ca3085aa7028ec54894138b9876afb039dbc688efcb65e5221274efc2e60862628a7f3b841d247e13
- SSDEEP 12288:s1pmKYcSV5K2FeVZLv4V4zjrbn/DvUNtq7rneKTQ0gJWdRU938Q:GYkeeMGzj/Dvf7auK2U938Q
- TLSH T17DD4C042F7D40521E6FE0E3D8CB35E10C6B0F49EEE22C39D17DAB96465B37448660BA6
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, C:\\Windows\\files\\bootup.exe" YT3VM.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" bootup.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" bootup.exe - UAC bypass 3 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" YT3VM.exe - Renames multiple (153) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts bootup.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 9 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procmon.exe\Debugger bootup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procmon.exe\DisableExceptionChainValidation = "1" bootup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe bootup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe bootup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe\Debugger bootup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe\DisableExceptionChainValidation = "1" bootup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger bootup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\DisableExceptionChainValidation = "1" bootup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procmon.exe bootup.exe - Modifies Windows Firewall 2 TTPs 2 IoCs
pid Process 4044 netsh.exe 4644 netsh.exe - Outbound SSH connection to private host 3 TTPs 1 IoCs
SSH is used for remote access. Internal traffic may indicate local host discovery or lateral movement.
description flow ioc pid Process SSH destination 21 10.127.0.1:22 4740 bootup.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation bootup.exe - Creates a file in the Startup directory 1 TTPs 5 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemCheck.exe bootup.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.exe bootup.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityService.exe bootup.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemSettings.exe bootup.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SystemSettings.exe bootup.exe - Creates new service(s) 2 TTPs
- Executes dropped EXE 1 IoCs
pid Process 4740 bootup.exe - Outbound SSH connection to public host 2 TTPs 12 IoCs
SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.
description flow ioc pid Process SSH destination 2465 144.141.135.143:22 4740 bootup.exe SSH destination 3093 101.163.12.147:22 4740 bootup.exe SSH destination 4426 70.3.220.196:22 4740 bootup.exe SSH destination 4454 142.27.140.183:22 4740 bootup.exe SSH destination 4477 117.39.62.83:22 4740 bootup.exe SSH destination 3860 214.40.132.151:22 4740 bootup.exe SSH destination 4227 8.240.169.238:22 4740 bootup.exe SSH destination 4820 100.171.38.106:22 4740 bootup.exe SSH destination 5094 58.237.27.114:22 4740 bootup.exe SSH destination 5170 43.88.134.133:22 4740 bootup.exe SSH destination 26 13.236.145.151:22 4740 bootup.exe SSH destination 2300 43.139.1.247:22 4740 bootup.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Windows security modification 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features bootup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" bootup.exe - Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SystemCheck = "C:\\Windows\\files\\bootup.exe" bootup.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\CriticalUpdate = "C:\\Windows\\files\\bootup.exe" bootup.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Windows\\files\\bootup.exe" bootup.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemCheck = "C:\\Windows\\files\\bootup.exe" bootup.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SecurityUpdate = "C:\\Windows\\files\\bootup.exe" bootup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Windows\\files\\bootup.exe" bootup.exe - Checks whether UAC is enabled 1 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA YT3VM.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" YT3VM.exe - Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Drops desktop.ini file(s) 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\stolen\desktop.ini bootup.exe File opened for modification C:\Users\Admin\AppData\Roaming\stolen\desktop.ini bootup.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger bootup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procmon.exe\Debugger bootup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe\Debugger bootup.exe - Looks up external IP address via web service 1 TTPs 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 39 api.ipify.org 42 api.ipify.org 48 api.ipify.org - Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 bootup.exe - Drops file in System32 directory 6 IoCs
description ioc Process File created C:\Windows\SysWOW64\csrss.exe bootup.exe File opened for modification C:\Windows\SysWOW64\csrss.exe bootup.exe File created C:\Windows\SysWOW64\svchost.exe bootup.exe File created C:\Windows\SysWOW64\dllhost.exe bootup.exe File created C:\Windows\SysWOW64\lsass.exe bootup.exe File opened for modification C:\Windows\SysWOW64\lsass.exe bootup.exe - Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files\svchost.exe bootup.exe File opened for modification C:\Program Files\svchost.exe bootup.exe File created C:\Program Files (x86)\svchost.exe bootup.exe File opened for modification C:\Program Files (x86)\svchost.exe bootup.exe - Drops file in Windows directory 6 IoCs
description ioc Process File created C:\Windows\files\stage.txt YT3VM.exe File created C:\Windows\svchost.exe bootup.exe File opened for modification C:\Windows\svchost.exe bootup.exe File opened for modification C:\Windows\files\stage.txt bootup.exe File created C:\Windows\files\bootup.exe YT3VM.exe File opened for modification C:\Windows\files\bootup.exe YT3VM.exe - Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 828 sc.exe 4028 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe - System Location Discovery: System Language Discovery 1 TTPs 19 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ipconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ipconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language YT3VM.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ipconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ipconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language sc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ipconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ipconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language shutdown.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bootup.exe - System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs
Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.
pid Process 4756 netsh.exe 2548 netsh.exe - Gathers network information 2 TTPs 6 IoCs
Uses commandline utility to view network configuration.
pid Process 1184 ipconfig.exe 1056 ipconfig.exe 2520 ipconfig.exe 1576 ipconfig.exe 1956 ipconfig.exe 5052 ipconfig.exe - Modifies data under HKEY_USERS 15 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "201" LogonUI.exe - Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2768 schtasks.exe 1080 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4740 bootup.exe 4740 bootup.exe 4740 bootup.exe 4740 bootup.exe 4740 bootup.exe 4740 bootup.exe 4740 bootup.exe 4740 bootup.exe 4740 bootup.exe 4740 bootup.exe 4740 bootup.exe 4740 bootup.exe 4740 bootup.exe 4740 bootup.exe 4740 bootup.exe 4740 bootup.exe 4740 bootup.exe 4740 bootup.exe 4740 bootup.exe 4740 bootup.exe 4740 bootup.exe 4740 bootup.exe 4740 bootup.exe 4740 bootup.exe 4740 bootup.exe 4740 bootup.exe 4740 bootup.exe 4740 bootup.exe 4740 bootup.exe 4740 bootup.exe 4740 bootup.exe 4740 bootup.exe 4740 bootup.exe 4740 bootup.exe 4740 bootup.exe 4740 bootup.exe 4740 bootup.exe 4740 bootup.exe 4740 bootup.exe 4740 bootup.exe 4740 bootup.exe 4740 bootup.exe 4740 bootup.exe 4740 bootup.exe 4740 bootup.exe 4740 bootup.exe 4740 bootup.exe 4740 bootup.exe 4740 bootup.exe 4740 bootup.exe 4740 bootup.exe 4740 bootup.exe 4740 bootup.exe 4740 bootup.exe 4740 bootup.exe 4740 bootup.exe 4740 bootup.exe 4740 bootup.exe 4740 bootup.exe 4740 bootup.exe 4740 bootup.exe 4740 bootup.exe 4740 bootup.exe 4740 bootup.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4740 bootup.exe Token: SeIncreaseQuotaPrivilege 4740 bootup.exe Token: SeSecurityPrivilege 4740 bootup.exe Token: SeTakeOwnershipPrivilege 4740 bootup.exe Token: SeLoadDriverPrivilege 4740 bootup.exe Token: SeSystemProfilePrivilege 4740 bootup.exe Token: SeSystemtimePrivilege 4740 bootup.exe Token: SeProfSingleProcessPrivilege 4740 bootup.exe Token: SeIncBasePriorityPrivilege 4740 bootup.exe Token: SeCreatePagefilePrivilege 4740 bootup.exe Token: SeBackupPrivilege 4740 bootup.exe Token: SeRestorePrivilege 4740 bootup.exe Token: SeShutdownPrivilege 4740 bootup.exe Token: SeDebugPrivilege 4740 bootup.exe Token: SeSystemEnvironmentPrivilege 4740 bootup.exe Token: SeRemoteShutdownPrivilege 4740 bootup.exe Token: SeUndockPrivilege 4740 bootup.exe Token: SeManageVolumePrivilege 4740 bootup.exe Token: 33 4740 bootup.exe Token: 34 4740 bootup.exe Token: 35 4740 bootup.exe Token: 36 4740 bootup.exe Token: SeIncreaseQuotaPrivilege 4740 bootup.exe Token: SeSecurityPrivilege 4740 bootup.exe Token: SeTakeOwnershipPrivilege 4740 bootup.exe Token: SeLoadDriverPrivilege 4740 bootup.exe Token: SeSystemProfilePrivilege 4740 bootup.exe Token: SeSystemtimePrivilege 4740 bootup.exe Token: SeProfSingleProcessPrivilege 4740 bootup.exe Token: SeIncBasePriorityPrivilege 4740 bootup.exe Token: SeCreatePagefilePrivilege 4740 bootup.exe Token: SeBackupPrivilege 4740 bootup.exe Token: SeRestorePrivilege 4740 bootup.exe Token: SeShutdownPrivilege 4740 bootup.exe Token: SeDebugPrivilege 4740 bootup.exe Token: SeSystemEnvironmentPrivilege 4740 bootup.exe Token: SeRemoteShutdownPrivilege 4740 bootup.exe Token: SeUndockPrivilege 4740 bootup.exe Token: SeManageVolumePrivilege 4740 bootup.exe Token: 33 4740 bootup.exe Token: 34 4740 bootup.exe Token: 35 4740 bootup.exe Token: 36 4740 bootup.exe Token: SeIncreaseQuotaPrivilege 4740 bootup.exe Token: SeSecurityPrivilege 4740 bootup.exe Token: SeTakeOwnershipPrivilege 4740 bootup.exe Token: SeLoadDriverPrivilege 4740 bootup.exe Token: SeSystemProfilePrivilege 4740 bootup.exe Token: SeSystemtimePrivilege 4740 bootup.exe Token: SeProfSingleProcessPrivilege 4740 bootup.exe Token: SeIncBasePriorityPrivilege 4740 bootup.exe Token: SeCreatePagefilePrivilege 4740 bootup.exe Token: SeBackupPrivilege 4740 bootup.exe Token: SeRestorePrivilege 4740 bootup.exe Token: SeShutdownPrivilege 4740 bootup.exe Token: SeDebugPrivilege 4740 bootup.exe Token: SeSystemEnvironmentPrivilege 4740 bootup.exe Token: SeRemoteShutdownPrivilege 4740 bootup.exe Token: SeUndockPrivilege 4740 bootup.exe Token: SeManageVolumePrivilege 4740 bootup.exe Token: 33 4740 bootup.exe Token: 34 4740 bootup.exe Token: 35 4740 bootup.exe Token: 36 4740 bootup.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4596 LogonUI.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1352 wrote to memory of 4740 1352 YT3VM.exe 86 PID 4740 wrote to memory of 1184 4740 bootup.exe 87 PID 4740 wrote to memory of 1056 4740 bootup.exe 89 PID 4740 wrote to memory of 2520 4740 bootup.exe 91 PID 4740 wrote to memory of 4756 4740 bootup.exe 93 PID 4740 wrote to memory of 3136 4740 bootup.exe 56 PID 4740 wrote to memory of 1768 4740 bootup.exe 30 PID 4740 wrote to memory of 1176 4740 bootup.exe 20 PID 4740 wrote to memory of 2160 4740 bootup.exe 38 PID 4740 wrote to memory of 1368 4740 bootup.exe 24 PID 4740 wrote to memory of 2540 4740 bootup.exe 47 PID 4740 wrote to memory of 1160 4740 bootup.exe 19 PID 4740 wrote to memory of 2528 4740 bootup.exe 46 PID 4740 wrote to memory of 1936 4740 bootup.exe 33 PID 4740 wrote to memory of 948 4740 bootup.exe 15 PID 4740 wrote to memory of 1340 4740 bootup.exe 68 PID 4740 wrote to memory of 3108 4740 bootup.exe 55 PID 4740 wrote to memory of 2512 4740 bootup.exe 45 PID 4740 wrote to memory of 932 4740 bootup.exe 12 PID 4740 wrote to memory of 1916 4740 bootup.exe 32 PID 4740 wrote to memory of 2308 4740 bootup.exe 41 PID 4740 wrote to memory of 1716 4740 bootup.exe 29 PID 4740 wrote to memory of 1124 4740 bootup.exe 18 PID 4740 wrote to memory of 1516 4740 bootup.exe 27 PID 4740 wrote to memory of 3288 4740 bootup.exe 57 PID 4740 wrote to memory of 1456 4740 bootup.exe 25 PID 4740 wrote to memory of 2584 4740 bootup.exe 69 PID 4740 wrote to memory of 2100 4740 bootup.exe 37 PID 4740 wrote to memory of 1112 4740 bootup.exe 17 PID 4740 wrote to memory of 1308 4740 bootup.exe 23 PID 4740 wrote to memory of 1700 4740 bootup.exe 28 PID 4740 wrote to memory of 2088 4740 bootup.exe 36 PID 4740 wrote to memory of 1492 4740 bootup.exe 26 PID 4740 wrote to memory of 2080 4740 bootup.exe 35 PID 4740 wrote to memory of 2548 4740 bootup.exe 97 PID 4740 wrote to memory of 2468 4740 bootup.exe 44 PID 4740 wrote to memory of 1948 4740 bootup.exe 70 PID 4740 wrote to memory of 1872 4740 bootup.exe 31 PID 4740 wrote to memory of 1300 4740 bootup.exe 22 PID 4740 wrote to memory of 2264 4740 bootup.exe 40 PID 4740 wrote to memory of 2448 4740 bootup.exe 43 PID 4740 wrote to memory of 1260 4740 bootup.exe 76 PID 4740 wrote to memory of 2832 4740 bootup.exe 50 PID 4740 wrote to memory of 2424 4740 bootup.exe 42 PID 4740 wrote to memory of 1044 4740 bootup.exe 16 PID 4740 wrote to memory of 3012 4740 bootup.exe 52 PID 4740 wrote to memory of 2016 4740 bootup.exe 34 PID 4740 wrote to memory of 1028 4740 bootup.exe 54 PID 4740 wrote to memory of 2596 4740 bootup.exe 48 PID 4740 wrote to memory of 548 4740 bootup.exe 77 PID 4740 wrote to memory of 792 4740 bootup.exe 10 PID 4740 wrote to memory of 1996 4740 bootup.exe 74 PID 4740 wrote to memory of 1008 4740 bootup.exe 13 PID 4740 wrote to memory of 1228 4740 bootup.exe 21 PID 4740 wrote to memory of 612 4740 bootup.exe 5 PID 4740 wrote to memory of 668 4740 bootup.exe 7 PID 4740 wrote to memory of 524 4740 bootup.exe 14 PID 4740 wrote to memory of 1576 4740 bootup.exe 99 PID 4740 wrote to memory of 828 4740 bootup.exe 101 PID 4740 wrote to memory of 4028 4740 bootup.exe 103 PID 4740 wrote to memory of 2768 4740 bootup.exe 106 PID 4740 wrote to memory of 4044 4740 bootup.exe 108 PID 4740 wrote to memory of 1724 4740 bootup.exe 110 PID 4740 wrote to memory of 1080 4740 bootup.exe 112 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" YT3VM.exe
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:612
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵PID:524
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa38e5055 /state1:0x41c64e6d2⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4596
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:668
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p1⤵PID:792
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS -p1⤵PID:932
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵PID:1008
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵PID:948
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵PID:1044
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵PID:1112
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵PID:1124
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p1⤵PID:1160
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵PID:1176
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵PID:1228
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵PID:1300
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService1⤵PID:1308
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵PID:1368
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵PID:1456
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵PID:1492
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵PID:1516
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵PID:1700
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵PID:1716
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵PID:1768
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵PID:1872
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵PID:1916
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵PID:1936
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:2016
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:2080
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵PID:2088
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵PID:2100
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵PID:2160
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p1⤵PID:2264
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵PID:2308
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵PID:2424
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵PID:2448
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵PID:2468
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵PID:2512
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵PID:2528
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵PID:2540
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵PID:2596
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵PID:2832
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:3012
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker1⤵PID:1028
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵PID:3108
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3136
-
C:\Users\Admin\AppData\Local\Temp\YT3VM.exe"C:\Users\Admin\AppData\Local\Temp\YT3VM.exe"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1352 -
C:\Windows\files\bootup.exe"C:\Windows\files\bootup.exe"3⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender TamperProtection settings
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Outbound SSH connection to private host
- Checks computer location settings
- Creates a file in the Startup directory
- Executes dropped EXE
- Outbound SSH connection to public host
- Windows security modification
- Adds Run key to start application
- Drops desktop.ini file(s)
- Indicator Removal: Clear Persistence
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Windows\SysWOW64\ipconfig.exe"ipconfig" /all4⤵
- System Location Discovery: System Language Discovery
- Gathers network information
PID:1184
-
-
C:\Windows\SysWOW64\ipconfig.exe"ipconfig" /all4⤵
- System Location Discovery: System Language Discovery
- Gathers network information
PID:1056
-
-
C:\Windows\SysWOW64\ipconfig.exe"ipconfig" /all4⤵
- System Location Discovery: System Language Discovery
- Gathers network information
PID:2520
-
-
C:\Windows\SysWOW64\netsh.exe"netsh" wlan show profiles4⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Wi-Fi Discovery
PID:4756
-
-
C:\Windows\SysWOW64\netsh.exe"netsh" wlan show profiles4⤵
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Wi-Fi Discovery
PID:2548
-
-
C:\Windows\SysWOW64\ipconfig.exe"ipconfig" /all4⤵
- System Location Discovery: System Language Discovery
- Gathers network information
PID:1576
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create "WindowsSecurity" binPath= "C:\Windows\files\bootup.exe" start= auto4⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:828
-
-
C:\Windows\SysWOW64\sc.exe"C:\Windows\System32\sc.exe" create "SystemUpdate" binPath= "C:\Windows\files\bootup.exe" start= auto4⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
PID:4028
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "Microsoft\Windows\Update\8a1b05a8-95b4-491e-a16c-9c7d164303ae" /tr "C:\Windows\files\bootup.exe" /sc onlogon /ru System /f4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2768
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="WindowsUpdate" dir=out action=allow protocol=TCP4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:4044
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop sysmon /y4⤵
- System Location Discovery: System Language Discovery
PID:1724 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop sysmon /y5⤵
- System Location Discovery: System Language Discovery
PID:2772
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "Microsoft\Windows\Update\a5c79b69-370e-45c0-abda-d3c80d5b2503" /tr "C:\Windows\files\bootup.exe" /sc onlogon /ru System /f4⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1080
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="WindowsUpdate" dir=out action=allow protocol=TCP4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:4644
-
-
C:\Windows\SysWOW64\ipconfig.exe"ipconfig" /all4⤵
- System Location Discovery: System Language Discovery
- Gathers network information
PID:1956
-
-
C:\Windows\SysWOW64\ipconfig.exe"ipconfig" /all4⤵
- System Location Discovery: System Language Discovery
- Gathers network information
PID:5052
-
-
C:\Windows\SysWOW64\shutdown.exe"shutdown" /r /f /t 04⤵
- System Location Discovery: System Language Discovery
PID:3216
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3288
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵PID:1340
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵PID:2584
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵PID:1948
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵PID:1996
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s camsvc1⤵PID:1260
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵PID:548
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵PID:808
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵PID:4280
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵PID:3964
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Create or Modify System Process
4Windows Service
4Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Create or Modify System Process
4Windows Service
4Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
5Disable or Modify System Firewall
1Disable or Modify Tools
4Indicator Removal
1Clear Persistence
1Modify Registry
7Pre-OS Boot
1Bootkit
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Network Service Discovery
3Query Registry
1System Information Discovery
4System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
2Internet Connection Discovery
1Wi-Fi Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\stolen\desktop.ini
- Size 504B
- SHA256 b287b639f6edd612f414caf000c12ba0555adb3a2643230cbdd5af4053284978
- MD5 50a956778107a4272aae83c86ece77cb
- SHA1 10bce7ea45077c0baab055e0602eef787dba735e
- SHA512 d1df6bdc871cacbc776ac8152a76e331d2f1d905a50d9d358c7bf9ed7c5cbb510c9d52d6958b071e5bcba7c5117fc8f9729fe51724e82cc45f6b7b5afe5ed51a
- TLSH T1EAF01209A6F956105271DF27FCB8D0119BB1B8212C1BCF9E97C491CA18D5A18F637B53
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\stolen\desktop.ini
- Size 504B
- SHA256 8301e344371b0753d547b429c5fe513908b1c9813144f08549563ac7f4d7da68
- MD5 06e8f7e6ddd666dbd323f7d9210f91ae
- SHA1 883ae527ee83ed9346cd82c33dfc0eb97298dc14
- SHA512 f7646f8dcd37019623d5540ad8e41cb285bcc04666391258dbf4c42873c4de46977a4939b091404d8d86f367cc31e36338757a776a632c7b5bf1c6f28e59ad98
- TLSH T155F05E19A2F9521052719F27FCB8D0018BB1BC212C1B8F9E86C4918A18D5A18F633B53
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\drivers\etc\hosts
- Size 1KB
- SHA256 cd0dd57baed19beb8db16c670763e8c93442bdde9627bd1d24ba201dab7cf7e7
- MD5 139c8d44180bd0296daacfb0fe68e9e3
- SHA1 e476ce9c67252b2e57609ba4d03396c406ef9fc0
- SHA512 dfd154d7dfdf56bf8472ed52d6c0841cf49dc21911971e1ffabe73321a9b77e9e22b1f2cc80a8f2ecf9325194322e7374d7a2a132bba352627ff5fdd6c659e76
- TLSH T1DF313115464590DE277200A9441EF05EF21F81FB0927E8CC3ACD540E7BA276CAB232F5
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\files\bootup.exe
- Size 586KB
- SHA256 afee76a441618314d4f0701ac50f4c750c9b76e8aa77b28c3602850f97a00b5b
- MD5 46ae960d90f0ea2bfa6f10b44489b66b
- SHA1 862bfd947cd55788ae437ca432af8a63ef18602d
- SHA512 78f272db2212a8544584e0a3f5c40409cdb98dae6b268a4ca3085aa7028ec54894138b9876afb039dbc688efcb65e5221274efc2e60862628a7f3b841d247e13
- SSDEEP 12288:s1pmKYcSV5K2FeVZLv4V4zjrbn/DvUNtq7rneKTQ0gJWdRU938Q:GYkeeMGzj/Dvf7auK2U938Q
- TLSH T17DD4C042F7D40521E6FE0E3D8CB35E10C6B0F49EEE22C39D17DAB96465B37448660BA6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\files\stage.txt
- Size 1B
- SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
- MD5 c4ca4238a0b923820dcc509a6f75849b
- SHA1 356a192b7913b04c54574d18c28d46e6395428ab
- SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
- MD5 SHA1 SHA512