Analysis
- max time kernel
105s - max time network
28s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 09:43
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
32 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
34 signatures
150 seconds
General
- Target 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe
- Size 1.3MB
- Sample260810-lp951az1dv
- SHA256 8293f194ce18f3222e0d13d80ff9f822b90cbe30d44182f325b0f6323b4ff6a0
- MD5 b74a5c1d23fbeee5ee7413d9fece9326
- SHA1 f13622e4e3de5f8d1fc37b33a26a7239c717c93e
- SHA512 49466281e09ba2a3a042dc9a44cabcfdeb2f9c24d92a2c3abc1a0b450297e8201b696ca048d8e6cca824aeeea774376a564b18ec783ea5d426ed9bf80cd672a9
- SSDEEP 24576:7JeofAq/jp98z3kitgVIAPeOeOe7OxmOocRLfzyFyT96I:9eofAaWk0KIAPeOeOe7OxmHcR1t
- TLSH T13655F11372E0B0F1E96665F41F5B9379A7B57C30123AAE0BA3D47E176631490AB36323
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
-
http://www.klkjwre9fqwieluoi.info/
-
http://kukutrustnet777888.info/
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe rundll.exe" 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe - Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe - UAC bypass 3 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe - Windows security bypass 2 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe - Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 42 IoCs
resource yara_rule behavioral2/memory/1564-1-0x00000000033B0000-0x000000000443E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1564-11-0x00000000033B0000-0x000000000443E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1564-12-0x00000000033B0000-0x000000000443E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1564-4-0x00000000033B0000-0x000000000443E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1564-3-0x00000000033B0000-0x000000000443E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1564-15-0x00000000033B0000-0x000000000443E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1564-18-0x00000000033B0000-0x000000000443E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1564-16-0x00000000033B0000-0x000000000443E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1564-17-0x00000000033B0000-0x000000000443E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1564-13-0x00000000033B0000-0x000000000443E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1564-29-0x00000000033B0000-0x000000000443E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1564-32-0x00000000033B0000-0x000000000443E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1564-39-0x00000000033B0000-0x000000000443E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1564-40-0x00000000033B0000-0x000000000443E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1564-45-0x00000000033B0000-0x000000000443E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1564-47-0x00000000033B0000-0x000000000443E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1564-50-0x00000000033B0000-0x000000000443E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1564-52-0x00000000033B0000-0x000000000443E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1564-53-0x00000000033B0000-0x000000000443E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1564-54-0x00000000033B0000-0x000000000443E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1564-57-0x00000000033B0000-0x000000000443E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1564-58-0x00000000033B0000-0x000000000443E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1564-60-0x00000000033B0000-0x000000000443E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1564-61-0x00000000033B0000-0x000000000443E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1564-68-0x00000000033B0000-0x000000000443E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1564-69-0x00000000033B0000-0x000000000443E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1564-70-0x00000000033B0000-0x000000000443E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1564-72-0x00000000033B0000-0x000000000443E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1564-73-0x00000000033B0000-0x000000000443E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1564-74-0x00000000033B0000-0x000000000443E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1564-77-0x00000000033B0000-0x000000000443E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1564-80-0x00000000033B0000-0x000000000443E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1564-81-0x00000000033B0000-0x000000000443E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1564-82-0x00000000033B0000-0x000000000443E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1564-84-0x00000000033B0000-0x000000000443E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1564-83-0x00000000033B0000-0x000000000443E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1564-87-0x00000000033B0000-0x000000000443E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1564-89-0x00000000033B0000-0x000000000443E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1564-91-0x00000000033B0000-0x000000000443E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/files/0x000500000001b853-96.dat INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1564-101-0x00000000033B0000-0x000000000443E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1564-103-0x00000000033B0000-0x000000000443E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine - UPX dump on OEP (original entry point) 44 IoCs
resource yara_rule behavioral2/memory/1564-1-0x00000000033B0000-0x000000000443E000-memory.dmp UPX behavioral2/memory/1564-11-0x00000000033B0000-0x000000000443E000-memory.dmp UPX behavioral2/memory/1564-12-0x00000000033B0000-0x000000000443E000-memory.dmp UPX behavioral2/memory/1564-4-0x00000000033B0000-0x000000000443E000-memory.dmp UPX behavioral2/memory/1564-3-0x00000000033B0000-0x000000000443E000-memory.dmp UPX behavioral2/memory/1564-15-0x00000000033B0000-0x000000000443E000-memory.dmp UPX behavioral2/memory/1564-18-0x00000000033B0000-0x000000000443E000-memory.dmp UPX behavioral2/memory/1564-24-0x0000000000400000-0x00000000004B4000-memory.dmp UPX behavioral2/memory/1564-16-0x00000000033B0000-0x000000000443E000-memory.dmp UPX behavioral2/memory/1564-17-0x00000000033B0000-0x000000000443E000-memory.dmp UPX behavioral2/memory/1564-13-0x00000000033B0000-0x000000000443E000-memory.dmp UPX behavioral2/memory/1564-29-0x00000000033B0000-0x000000000443E000-memory.dmp UPX behavioral2/memory/1564-32-0x00000000033B0000-0x000000000443E000-memory.dmp UPX behavioral2/memory/1564-39-0x00000000033B0000-0x000000000443E000-memory.dmp UPX behavioral2/memory/1564-40-0x00000000033B0000-0x000000000443E000-memory.dmp UPX behavioral2/memory/1564-45-0x00000000033B0000-0x000000000443E000-memory.dmp UPX behavioral2/memory/1564-47-0x00000000033B0000-0x000000000443E000-memory.dmp UPX behavioral2/memory/1564-50-0x00000000033B0000-0x000000000443E000-memory.dmp UPX behavioral2/memory/1564-51-0x0000000000400000-0x00000000004B4000-memory.dmp UPX behavioral2/memory/1564-52-0x00000000033B0000-0x000000000443E000-memory.dmp UPX behavioral2/memory/1564-53-0x00000000033B0000-0x000000000443E000-memory.dmp UPX behavioral2/memory/1564-54-0x00000000033B0000-0x000000000443E000-memory.dmp UPX behavioral2/memory/1564-57-0x00000000033B0000-0x000000000443E000-memory.dmp UPX behavioral2/memory/1564-58-0x00000000033B0000-0x000000000443E000-memory.dmp UPX behavioral2/memory/1564-60-0x00000000033B0000-0x000000000443E000-memory.dmp UPX behavioral2/memory/1564-61-0x00000000033B0000-0x000000000443E000-memory.dmp UPX behavioral2/memory/1564-68-0x00000000033B0000-0x000000000443E000-memory.dmp UPX behavioral2/memory/1564-69-0x00000000033B0000-0x000000000443E000-memory.dmp UPX behavioral2/memory/1564-70-0x00000000033B0000-0x000000000443E000-memory.dmp UPX behavioral2/memory/1564-72-0x00000000033B0000-0x000000000443E000-memory.dmp UPX behavioral2/memory/1564-73-0x00000000033B0000-0x000000000443E000-memory.dmp UPX behavioral2/memory/1564-74-0x00000000033B0000-0x000000000443E000-memory.dmp UPX behavioral2/memory/1564-77-0x00000000033B0000-0x000000000443E000-memory.dmp UPX behavioral2/memory/1564-80-0x00000000033B0000-0x000000000443E000-memory.dmp UPX behavioral2/memory/1564-81-0x00000000033B0000-0x000000000443E000-memory.dmp UPX behavioral2/memory/1564-82-0x00000000033B0000-0x000000000443E000-memory.dmp UPX behavioral2/memory/1564-84-0x00000000033B0000-0x000000000443E000-memory.dmp UPX behavioral2/memory/1564-83-0x00000000033B0000-0x000000000443E000-memory.dmp UPX behavioral2/memory/1564-87-0x00000000033B0000-0x000000000443E000-memory.dmp UPX behavioral2/memory/1564-89-0x00000000033B0000-0x000000000443E000-memory.dmp UPX behavioral2/memory/1564-91-0x00000000033B0000-0x000000000443E000-memory.dmp UPX behavioral2/memory/1564-101-0x00000000033B0000-0x000000000443E000-memory.dmp UPX behavioral2/memory/1564-103-0x00000000033B0000-0x000000000443E000-memory.dmp UPX behavioral2/memory/1564-107-0x0000000000400000-0x00000000004B4000-memory.dmp UPX - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Policies\system\DisableRegistryTools = "1" 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe - Disables Task Manager via registry modification
- Windows security modification 2 TTPs 7 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Yahoo Messengger = "C:\\Windows\\system32\\regsvr.exe" 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe - Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe - Drops desktop.ini file(s) 3 IoCs
description ioc Process File opened for modification C:\Users\Admin\Pictures\desktop.ini explorer.exe File opened for modification C:\Users\Public\desktop.ini explorer.exe File opened for modification C:\Users\Public\Pictures\desktop.ini explorer.exe - Enumerates connected drives 3 TTPs 44 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe File opened (read-only) \??\L: 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe File opened (read-only) \??\l: 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe File opened (read-only) \??\U: 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe File opened (read-only) \??\V: 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe File opened (read-only) \??\O: 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe File opened (read-only) \??\Q: 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe File opened (read-only) \??\S: 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe File opened (read-only) \??\a: 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe File opened (read-only) \??\h: 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe File opened (read-only) \??\n: 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe File opened (read-only) \??\t: 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe File opened (read-only) \??\u: 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe File opened (read-only) \??\X: 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe File opened (read-only) \??\v: 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe File opened (read-only) \??\G: 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe File opened (read-only) \??\I: 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe File opened (read-only) \??\b: 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe File opened (read-only) \??\j: 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe File opened (read-only) \??\k: 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe File opened (read-only) \??\p: 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe File opened (read-only) \??\z: 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe File opened (read-only) \??\J: 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe File opened (read-only) \??\i: 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe File opened (read-only) \??\o: 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe File opened (read-only) \??\P: 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe File opened (read-only) \??\R: 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe File opened (read-only) \??\Y: 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe File opened (read-only) \??\Z: 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe File opened (read-only) \??\D: 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe File opened (read-only) \??\M: 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe File opened (read-only) \??\g: 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe File opened (read-only) \??\m: 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe File opened (read-only) \??\w: 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe File opened (read-only) \??\y: 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe File opened (read-only) \??\N: 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe File opened (read-only) \??\W: 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe File opened (read-only) \??\d: 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe File opened (read-only) \??\q: 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe File opened (read-only) \??\s: 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe File opened (read-only) \??\x: 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe File opened (read-only) \??\T: 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe File opened (read-only) \??\H: 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe File opened (read-only) \??\r: 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe - Modifies WinLogon 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\system = "Winhelp.exe" 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe - AutoIT Executable 4 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/1564-0-0x0000000000400000-0x00000000004B4000-memory.dmp autoit_exe behavioral2/memory/1564-24-0x0000000000400000-0x00000000004B4000-memory.dmp autoit_exe behavioral2/memory/1564-51-0x0000000000400000-0x00000000004B4000-memory.dmp autoit_exe behavioral2/memory/1564-107-0x0000000000400000-0x00000000004B4000-memory.dmp autoit_exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe File opened for modification F:\autorun.inf 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe - Drops file in System32 directory 5 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\winhelp.exe 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe File opened for modification C:\Windows\SysWOW64\setup.ini 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe File created C:\Windows\SysWOW64\regsvr.exe 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe File opened for modification C:\Windows\SysWOW64\regsvr.exe 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe File created C:\Windows\SysWOW64\winhelp.exe 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe -
resource yara_rule behavioral2/memory/1564-1-0x00000000033B0000-0x000000000443E000-memory.dmp upx behavioral2/memory/1564-11-0x00000000033B0000-0x000000000443E000-memory.dmp upx behavioral2/memory/1564-12-0x00000000033B0000-0x000000000443E000-memory.dmp upx behavioral2/memory/1564-4-0x00000000033B0000-0x000000000443E000-memory.dmp upx behavioral2/memory/1564-3-0x00000000033B0000-0x000000000443E000-memory.dmp upx behavioral2/memory/1564-15-0x00000000033B0000-0x000000000443E000-memory.dmp upx behavioral2/memory/1564-18-0x00000000033B0000-0x000000000443E000-memory.dmp upx behavioral2/memory/1564-16-0x00000000033B0000-0x000000000443E000-memory.dmp upx behavioral2/memory/1564-17-0x00000000033B0000-0x000000000443E000-memory.dmp upx behavioral2/memory/1564-13-0x00000000033B0000-0x000000000443E000-memory.dmp upx behavioral2/memory/1564-29-0x00000000033B0000-0x000000000443E000-memory.dmp upx behavioral2/memory/1564-32-0x00000000033B0000-0x000000000443E000-memory.dmp upx behavioral2/memory/1564-39-0x00000000033B0000-0x000000000443E000-memory.dmp upx behavioral2/memory/1564-40-0x00000000033B0000-0x000000000443E000-memory.dmp upx behavioral2/memory/1564-45-0x00000000033B0000-0x000000000443E000-memory.dmp upx behavioral2/memory/1564-47-0x00000000033B0000-0x000000000443E000-memory.dmp upx behavioral2/memory/1564-50-0x00000000033B0000-0x000000000443E000-memory.dmp upx behavioral2/memory/1564-52-0x00000000033B0000-0x000000000443E000-memory.dmp upx behavioral2/memory/1564-53-0x00000000033B0000-0x000000000443E000-memory.dmp upx behavioral2/memory/1564-54-0x00000000033B0000-0x000000000443E000-memory.dmp upx behavioral2/memory/1564-57-0x00000000033B0000-0x000000000443E000-memory.dmp upx behavioral2/memory/1564-58-0x00000000033B0000-0x000000000443E000-memory.dmp upx behavioral2/memory/1564-60-0x00000000033B0000-0x000000000443E000-memory.dmp upx behavioral2/memory/1564-61-0x00000000033B0000-0x000000000443E000-memory.dmp upx behavioral2/memory/1564-68-0x00000000033B0000-0x000000000443E000-memory.dmp upx behavioral2/memory/1564-69-0x00000000033B0000-0x000000000443E000-memory.dmp upx behavioral2/memory/1564-70-0x00000000033B0000-0x000000000443E000-memory.dmp upx behavioral2/memory/1564-72-0x00000000033B0000-0x000000000443E000-memory.dmp upx behavioral2/memory/1564-73-0x00000000033B0000-0x000000000443E000-memory.dmp upx behavioral2/memory/1564-74-0x00000000033B0000-0x000000000443E000-memory.dmp upx behavioral2/memory/1564-77-0x00000000033B0000-0x000000000443E000-memory.dmp upx behavioral2/memory/1564-80-0x00000000033B0000-0x000000000443E000-memory.dmp upx behavioral2/memory/1564-81-0x00000000033B0000-0x000000000443E000-memory.dmp upx behavioral2/memory/1564-82-0x00000000033B0000-0x000000000443E000-memory.dmp upx behavioral2/memory/1564-84-0x00000000033B0000-0x000000000443E000-memory.dmp upx behavioral2/memory/1564-83-0x00000000033B0000-0x000000000443E000-memory.dmp upx behavioral2/memory/1564-87-0x00000000033B0000-0x000000000443E000-memory.dmp upx behavioral2/memory/1564-89-0x00000000033B0000-0x000000000443E000-memory.dmp upx behavioral2/memory/1564-91-0x00000000033B0000-0x000000000443E000-memory.dmp upx behavioral2/memory/1564-101-0x00000000033B0000-0x000000000443E000-memory.dmp upx behavioral2/memory/1564-103-0x00000000033B0000-0x000000000443E000-memory.dmp upx - Drops file in Program Files directory 12 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\appvcleaner.exe 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\InspectorOfficeGadget.exe 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\MavInject32.exe 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\AppVShNotify.exe 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\IntegratedOffice.exe 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeC2RClient.exe 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OfficeClickToRun.exe 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7z.exe 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zFM.exe 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7zG.exe 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe File opened for modification C:\PROGRAM FILES\7-ZIP\Uninstall.exe 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe - Drops file in Windows directory 5 IoCs
description ioc Process File created C:\Windows\regsvr.exe 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe File opened for modification C:\Windows\regsvr.exe 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe File opened for modification C:\Windows\SYSTEM.INI 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe File created C:\Windows\winhelp.ini 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe File opened for modification C:\Windows\winhelp.ini 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4092 cmd.exe 3344 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language at.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe - Modifies registry class 30 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Key created \REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f481cffcda87848be43b5fdf8091c1c60d0260001002600efbe11000000174e6fa7ad0fdd0102a09f8fb90fdd0102a09f8fb90fdd0114000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 explorer.exe Key created \REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags explorer.exe Key created \REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\NotificationData explorer.exe Key created \REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Set value (data) \REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Key created \REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe - Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2040 explorer.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2040 explorer.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Token: SeDebugPrivilege 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Token: SeDebugPrivilege 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Token: SeDebugPrivilege 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Token: SeDebugPrivilege 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Token: SeDebugPrivilege 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Token: SeDebugPrivilege 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Token: SeDebugPrivilege 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Token: SeDebugPrivilege 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Token: SeDebugPrivilege 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Token: SeDebugPrivilege 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Token: SeDebugPrivilege 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Token: SeDebugPrivilege 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Token: SeDebugPrivilege 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Token: SeDebugPrivilege 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Token: SeDebugPrivilege 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Token: SeDebugPrivilege 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Token: SeDebugPrivilege 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Token: SeDebugPrivilege 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Token: SeDebugPrivilege 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Token: SeDebugPrivilege 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Token: SeDebugPrivilege 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Token: SeDebugPrivilege 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Token: SeDebugPrivilege 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Token: SeDebugPrivilege 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Token: SeDebugPrivilege 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Token: SeDebugPrivilege 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Token: SeDebugPrivilege 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Token: SeDebugPrivilege 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Token: SeDebugPrivilege 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Token: SeDebugPrivilege 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Token: SeDebugPrivilege 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Token: SeDebugPrivilege 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Token: SeDebugPrivilege 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Token: SeDebugPrivilege 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Token: SeDebugPrivilege 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Token: SeDebugPrivilege 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Token: SeDebugPrivilege 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Token: SeDebugPrivilege 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Token: SeDebugPrivilege 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Token: SeDebugPrivilege 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Token: SeDebugPrivilege 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Token: SeDebugPrivilege 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Token: SeDebugPrivilege 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Token: SeDebugPrivilege 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Token: SeDebugPrivilege 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Token: SeDebugPrivilege 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Token: SeDebugPrivilege 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Token: SeDebugPrivilege 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Token: SeDebugPrivilege 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Token: SeDebugPrivilege 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Token: SeDebugPrivilege 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Token: SeDebugPrivilege 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Token: SeDebugPrivilege 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Token: SeDebugPrivilege 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Token: SeDebugPrivilege 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Token: SeDebugPrivilege 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Token: SeDebugPrivilege 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Token: SeDebugPrivilege 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Token: SeDebugPrivilege 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Token: SeDebugPrivilege 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Token: SeDebugPrivilege 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Token: SeDebugPrivilege 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe Token: SeDebugPrivilege 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2040 explorer.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2040 explorer.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1564 wrote to memory of 4092 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 89 PID 1564 wrote to memory of 1276 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 17 PID 1564 wrote to memory of 3120 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 47 PID 1564 wrote to memory of 3216 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 48 PID 1564 wrote to memory of 3468 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 49 PID 1564 wrote to memory of 3304 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 56 PID 1564 wrote to memory of 4356 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 58 PID 1564 wrote to memory of 4396 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 59 PID 1564 wrote to memory of 4472 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 60 PID 1564 wrote to memory of 4764 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 62 PID 1564 wrote to memory of 5032 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 63 PID 1564 wrote to memory of 5052 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 64 PID 1564 wrote to memory of 5232 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 65 PID 1564 wrote to memory of 3748 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 78 PID 1564 wrote to memory of 4952 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 80 PID 1564 wrote to memory of 4120 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 81 PID 1564 wrote to memory of 4184 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 82 PID 1564 wrote to memory of 4724 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 83 PID 1564 wrote to memory of 4092 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 89 PID 1564 wrote to memory of 4092 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 89 PID 1564 wrote to memory of 1276 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 17 PID 1564 wrote to memory of 3120 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 47 PID 1564 wrote to memory of 3216 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 48 PID 1564 wrote to memory of 3468 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 49 PID 1564 wrote to memory of 3304 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 56 PID 1564 wrote to memory of 4356 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 58 PID 1564 wrote to memory of 4396 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 59 PID 1564 wrote to memory of 4472 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 60 PID 1564 wrote to memory of 4764 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 62 PID 1564 wrote to memory of 5032 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 63 PID 1564 wrote to memory of 5052 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 64 PID 1564 wrote to memory of 5232 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 65 PID 1564 wrote to memory of 3748 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 78 PID 1564 wrote to memory of 4952 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 80 PID 1564 wrote to memory of 4120 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 81 PID 1564 wrote to memory of 4184 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 82 PID 1564 wrote to memory of 4724 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 83 PID 1564 wrote to memory of 4092 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 89 PID 1564 wrote to memory of 4092 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 89 PID 1564 wrote to memory of 3600 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 90 PID 1564 wrote to memory of 256 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe PID 1564 wrote to memory of 124 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe PID 1564 wrote to memory of 4976 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 92 PID 1564 wrote to memory of 4436 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 91 PID 4092 wrote to memory of 2300 4092 cmd.exe 93 PID 1564 wrote to memory of 3344 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 96 PID 3344 wrote to memory of 1476 3344 cmd.exe 98 PID 1564 wrote to memory of 1276 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 17 PID 1564 wrote to memory of 3120 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 47 PID 1564 wrote to memory of 3216 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 48 PID 1564 wrote to memory of 3468 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 49 PID 1564 wrote to memory of 3304 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 56 PID 1564 wrote to memory of 4356 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 58 PID 1564 wrote to memory of 4396 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 59 PID 1564 wrote to memory of 4472 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 60 PID 1564 wrote to memory of 4764 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 62 PID 1564 wrote to memory of 5032 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 63 PID 1564 wrote to memory of 5052 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 64 PID 1564 wrote to memory of 5232 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 65 PID 1564 wrote to memory of 3748 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 78 PID 1564 wrote to memory of 4952 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 80 PID 1564 wrote to memory of 4120 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 81 PID 1564 wrote to memory of 4184 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 82 PID 1564 wrote to memory of 4724 1564 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe 83 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe
Processes
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:1276
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:3120
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc1⤵PID:3216
-
C:\Windows\System32\ShellHost.exe"C:\Windows\System32\ShellHost.exe"1⤵PID:3468
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3304
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4356
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4396
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc1⤵PID:4472
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:4764
-
C:\Windows\system32\ctfmon.exe/QuitInfo:0000000000000268;000000000000026C;1⤵PID:5032
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}1⤵PID:5052
-
C:\Windows\System32\SecurityHealthSystray.exe"C:\Windows\System32\SecurityHealthSystray.exe"1⤵PID:5232
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:3748
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_b74a5c1d23fbeee5ee7413d9fece9326_elex_stop.exe"3⤵
- Modifies WinLogon for persistence
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Disables RegEdit via registry modification
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Enumerates connected drives
- Modifies WinLogon
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1564 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT /delete /yes4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵PID:3600
-
-
C:\Windows\SysWOW64\at.exeAT /delete /yes5⤵
- System Location Discovery: System Language Discovery
PID:2300
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\winhelp.exe4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Windows\SysWOW64\at.exeAT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Windows\system32\winhelp.exe5⤵
- System Location Discovery: System Language Discovery
PID:1476
-
-
-
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵PID:4120
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4184
-
C:\Windows\System32\smartscreen.exeC:\Windows\System32\smartscreen.exe -Embedding1⤵PID:4724
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵PID:4436
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵PID:4976
-
C:\Windows\explorer.exeExplorer.exe rundll.exe1⤵
- Modifies registry class
PID:5284
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Drops desktop.ini file(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2040
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1396
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵PID:5740
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
1Winlogon Helper DLL
2Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
1Winlogon Helper DLL
2Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
9Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\setup.ini
- Size 96B
- SHA256 69815d4932ddde240ce6b1353305d2fab58ca402e9c478452c8e37ce8a7b2ac9
- MD5 9ece103c47335f0cc777f1132b8d522f
- SHA1 63afa171c64f86d99db81723e1335e960e85fa43
- SHA512 b1ac64c71c6338bf0ab33df938128822da680f20d0552edb2edb808f1c75bafb88467412fc8dc60ed8022a1f0c4f3fcbecb69a320ec871b3a766482f32d6eb05
- TLSH T100B00205F5594194154DB8049B8005F1B553D96115694F1253A958691290168E719A4B
- MD5 SHA1 SHA512 TLSH
- Path C:\hbvch.exe
- Size 100KB
- SHA256 590ff7343147daca6e83b34658929cdc7c1d114353f0bd898db8310b903423a3
- MD5 efed6f6871d128582a020440818b45e0
- SHA1 d205f6c0dba6075a19c71f6cc94f91bed482a117
- SHA512 0c4f76ab08e6053d19b7eb4e2ad9e9743a1743e5150994cb88fffea93f58b6f142b03f59f43d2f495ea6492bcabe604f66383b6aea25c44e6f3b9c3b1c4a80eb
- SSDEEP 3072:yP3Sk4Uy45dZ2SWNjKdZlPfw41VgxdJipG0nhB3:yqk4qMSWihY4VmkthR
- TLSH T13FA313446AE5D7F5D0B2663D47E672BD89228838AC678313E4751918FC5E48302FBEE8
- MD5 SHA1 SHA512 SSDEEP TLSH