Analysis
- max time kernel
123s - max time network
122s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
22/08/2026, 06:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
testrat.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
20 signatures
150 seconds
Behavioral task
behavioral2
Sample
testrat.exe
Resource
win11-20260513-en
windows11-21h2-x64
12 signatures
150 seconds
General
- Target testrat.exe
- Size 210KB
- Sample260822-g7f8essapd
- SHA256 391629b639fc8aa0e7147b4892793b9e4f98933b9126b9b311f70f438b5e8dd4
- MD5 614e05897e94ebdec61674d9a386a2fc
- SHA1 60b69ee9b7babae327ad062ad1120f18943d9ca8
- SHA512 9acb17c9488177c7238d76e7c5d01b41317681b454332096e115e3318c98ed714b15e7bcb277f77971125d7af6cbce6b8f35abce01a6f35ca9f90a9ec1835f94
- SSDEEP 3072:52jB4mtB8EInerDB5yewZHmE9GhHwZxHcoEmEYXAnPukt:52FH0x9GhIrEmEft
- TLSH T139241A5BA35318F9C21BC07846E79773B472BC110329AEEF42A0E7326E64D944E79B35
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in Drivers directory 64 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\RNDISMP.sys testrat.exe File opened for modification C:\Windows\System32\drivers\es-ES\smbdirect.sys.mui testrat.exe File opened for modification C:\Windows\System32\drivers\it-IT\cxwmbclass.sys.mui testrat.exe File opened for modification C:\Windows\System32\drivers\ja-JP\pdc.sys.mui testrat.exe File opened for modification C:\Windows\System32\drivers\1394ohci.sys testrat.exe File opened for modification C:\Windows\System32\drivers\en-US\usbhub.sys.mui testrat.exe File opened for modification C:\Windows\System32\drivers\fr-FR\netvsc.sys.mui testrat.exe File opened for modification C:\Windows\System32\drivers\it-IT\ataport.sys.mui testrat.exe File opened for modification C:\Windows\System32\drivers\it-IT\wacompen.sys.mui testrat.exe File opened for modification C:\Windows\System32\drivers\ja-JP\http.sys.mui testrat.exe File opened for modification C:\Windows\System32\drivers\HpSAMD.sys testrat.exe File opened for modification C:\Windows\System32\drivers\FWPKCLNT.SYS testrat.exe File opened for modification C:\Windows\System32\drivers\sermouse.sys testrat.exe File opened for modification C:\Windows\System32\drivers\UcmTcpciCx.sys testrat.exe File opened for modification C:\Windows\System32\drivers\it-IT\bthport.sys.mui testrat.exe File opened for modification C:\Windows\System32\drivers\wanarp.sys testrat.exe File opened for modification C:\Windows\System32\drivers\de-DE\ndis.sys.mui testrat.exe File opened for modification C:\Windows\System32\drivers\en-US\bthport.sys.mui testrat.exe File opened for modification C:\Windows\System32\drivers\en-US\cdrom.sys.mui testrat.exe File opened for modification C:\Windows\System32\drivers\en-US\ndiscap.sys.mui testrat.exe File opened for modification C:\Windows\System32\drivers\en-US\sermouse.sys.mui testrat.exe File opened for modification C:\Windows\System32\drivers\es-ES\isapnp.sys.mui testrat.exe File opened for modification C:\Windows\System32\drivers\es-ES\fltmgr.sys.mui testrat.exe File opened for modification C:\Windows\System32\drivers\es-ES\srv2.sys.mui testrat.exe File opened for modification C:\Windows\System32\drivers\it-IT\hidclass.sys.mui testrat.exe File opened for modification C:\Windows\System32\drivers\it-IT\winnat.sys.mui testrat.exe File opened for modification C:\Windows\System32\drivers\BthA2dp.sys testrat.exe File opened for modification C:\Windows\System32\drivers\IntelPMT.sys testrat.exe File opened for modification C:\Windows\System32\drivers\percsas3i.sys testrat.exe File opened for modification C:\Windows\System32\drivers\en-US\winnat.sys.mui testrat.exe File opened for modification C:\Windows\System32\drivers\fr-FR\kbdhid.sys.mui testrat.exe File opened for modification C:\Windows\System32\drivers\storufs.sys testrat.exe File opened for modification C:\Windows\System32\drivers\tape.sys testrat.exe File opened for modification C:\Windows\System32\drivers\de-DE\partmgr.sys.mui testrat.exe File opened for modification C:\Windows\System32\drivers\en-US\ataport.sys.mui testrat.exe File opened for modification C:\Windows\System32\drivers\es-ES\scmbus.sys.mui testrat.exe File opened for modification C:\Windows\System32\drivers\fr-FR\hidbatt.sys.mui testrat.exe File opened for modification C:\Windows\System32\drivers\fr-FR\mup.sys.mui testrat.exe File opened for modification C:\Windows\System32\drivers\fr-FR\ndisuio.sys.mui testrat.exe File opened for modification C:\Windows\System32\drivers\rasacd.sys testrat.exe File opened for modification C:\Windows\System32\drivers\werkernel.sys testrat.exe File opened for modification C:\Windows\System32\drivers\de-DE\EhStorTcgDrv.sys.mui testrat.exe File opened for modification C:\Windows\System32\drivers\fr-FR\nvmedisk.sys.mui testrat.exe File opened for modification C:\Windows\System32\drivers\UMDF\en-US\Microsoft.Bluetooth.Profiles.HidOverGatt.dll.mui testrat.exe File opened for modification C:\Windows\System32\drivers\mrxsmb.sys testrat.exe File opened for modification C:\Windows\System32\drivers\nvstor.sys testrat.exe File opened for modification C:\Windows\System32\drivers\fr-FR\pmem.sys.mui testrat.exe File opened for modification C:\Windows\System32\drivers\it-IT\rdpdr.sys.mui testrat.exe File opened for modification C:\Windows\System32\drivers\ja-JP\MTConfig.sys.mui testrat.exe File opened for modification C:\Windows\System32\drivers\UMDF\EhStorPwdDrv.dll testrat.exe File opened for modification C:\Windows\System32\drivers\BtaMPM.sys testrat.exe File opened for modification C:\Windows\System32\drivers\iaStorV.sys testrat.exe File opened for modification C:\Windows\System32\drivers\ItSas35i.sys testrat.exe File opened for modification C:\Windows\System32\drivers\vwififlt.sys testrat.exe File opened for modification C:\Windows\System32\drivers\winmad.sys testrat.exe File opened for modification C:\Windows\System32\drivers\en-US\ntfs.sys.mui testrat.exe File opened for modification C:\Windows\System32\drivers\es-ES\ndiscap.sys.mui testrat.exe File opened for modification C:\Windows\System32\drivers\fr-FR\partmgr.sys.mui testrat.exe File opened for modification C:\Windows\System32\drivers\Diskdump.sys testrat.exe File opened for modification C:\Windows\System32\drivers\fr-FR\sdstor.sys.mui testrat.exe File opened for modification C:\Windows\SysWOW64\drivers\en-US\ndiscap.sys.mui testrat.exe File opened for modification C:\Windows\SysWOW64\drivers\es-ES\wfplwfs.sys.mui testrat.exe File opened for modification C:\Windows\System32\drivers\UMDF\en-US\IddCx.dll.mui testrat.exe File opened for modification C:\Windows\System32\drivers\UMDF\en-US\SensorsCx.dll.mui testrat.exe - Manipulates Digital Signatures 4 IoCs
Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
description ioc Process File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\pwrshsip.dll testrat.exe File opened for modification C:\Windows\System32\WindowsPowerShell\v1.0\pwrshsip.dll testrat.exe File opened for modification C:\Windows\SysWOW64\wintrust.dll testrat.exe File opened for modification C:\Windows\System32\wintrust.dll testrat.exe - Boot or Logon Autostart Execution: Print Processors 1 TTPs 1 IoCs
Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.
description ioc Process File opened for modification C:\Windows\System32\spool\prtprocs\x64\winprint.dll testrat.exe - Creates a file in the Startup directory 1 TTPs 1 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini testrat.exe - Indicator Removal: Clear Windows Event Logs 1 TTPs 64 IoCs
Clear Windows Event Logs to hide the activity of an intrusion.
description ioc Process File opened for modification C:\Windows\System32\winevt\Logs\HardwareEvents.evtx testrat.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-Boot%4Operational.evtx testrat.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-NCSI%4Operational.evtx testrat.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Store%4Operational.evtx testrat.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Operational.evtx testrat.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeploymentServer%4Restricted.evtx testrat.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-UserPnp%4ActionCenter.evtx testrat.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-VHDMP-Operational.evtx testrat.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeploymentServer%4Operational.evtx testrat.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Operational.evtx testrat.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-DeviceSetupManager%4Admin.evtx testrat.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-TaskScheduler%4Maintenance.evtx testrat.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-UserPnp%4DeviceInstall.evtx testrat.exe File opened for modification C:\Windows\System32\winevt\Logs\Application.evtx testrat.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Crypto-DPAPI%4Operational.evtx testrat.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider%4Admin.evtx testrat.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-LiveId%4Operational.evtx testrat.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-ShellCommon-StartLayoutPopulation%4Operational.evtx testrat.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storsvc%4Diagnostic.evtx testrat.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-HotspotAuth%4Operational.evtx testrat.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-PushNotification-Platform%4Operational.evtx testrat.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-RestartManager%4Operational.evtx testrat.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4ConnectionSecurity.evtx testrat.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Compatibility-Assistant.evtx testrat.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Application-Experience%4Program-Telemetry.evtx testrat.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppXDeployment%4Operational.evtx testrat.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Audio%4CaptureMonitor.evtx testrat.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storage-Storport%4Health.evtx testrat.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-WindowsUpdateClient%4Operational.evtx testrat.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-ShimEngine%4Operational.evtx testrat.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-NetworkProfile%4Operational.evtx testrat.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Windows Firewall With Advanced Security%4Firewall.evtx testrat.exe File opened for modification C:\Windows\System32\winevt\Logs\Security.evtx testrat.exe File opened for modification C:\Windows\System32\winevt\Logs\Internet Explorer.evtx testrat.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnostics-Performance%4Operational.evtx testrat.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-SmbClient%4Audit.evtx testrat.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-WebAuthN%4Operational.evtx testrat.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-BackgroundTaskInfrastructure%4Operational.evtx testrat.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-TWinUI%4Operational.evtx testrat.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-AppModel-Runtime%4Admin.evtx testrat.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-CloudStore%4Operational.evtx testrat.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-DeviceSetupManager%4Operational.evtx testrat.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Diagnosis-DPS%4Operational.evtx testrat.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-HelloForBusiness%4Operational.evtx testrat.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Storage-Storport%4Operational.evtx testrat.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-TerminalServices-LocalSessionManager%4Admin.evtx testrat.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Crypto-NCrypt%4Operational.evtx testrat.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-PnP%4Configuration.evtx testrat.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-WHEA%4Errors.evtx testrat.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-VolumeSnapshot-Driver%4Operational.evtx testrat.exe File opened for modification C:\Windows\System32\winevt\Logs\Windows PowerShell.evtx testrat.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-Power%4Thermal-Operational.evtx testrat.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-WHEA%4Operational.evtx testrat.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Shell-Core%4ActionCenter.evtx testrat.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-AAD%4Operational.evtx testrat.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-PnP%4Device Management.evtx testrat.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-UniversalTelemetryClient%4Operational.evtx testrat.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Containers-Wcifs%4Operational.evtx testrat.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-GroupPolicy%4Operational.evtx testrat.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Partition%4Diagnostic.evtx testrat.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-VDRVROOT%4Operational.evtx testrat.exe File opened for modification C:\Windows\System32\winevt\Logs\OAlerts.evtx testrat.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-SMBClient%4Operational.evtx testrat.exe File opened for modification C:\Windows\System32\winevt\Logs\Microsoft-Windows-Audio%4Operational.evtx testrat.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..ini-maintenanceuser_31bf3856ad364e35_10.0.22000.1_none_5c4b3db25aa82850\Desktop.ini testrat.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini testrat.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini testrat.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\WinX\Group1\desktop.ini testrat.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..opini-accessibility_31bf3856ad364e35_10.0.22000.348_none_d5c2f424027f1f86\r\Desktop.ini testrat.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini testrat.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..opini-accessibility_31bf3856ad364e35_10.0.22000.348_none_d5c2f424027f1f86\Desktop.ini testrat.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..sktopini-sendtouser_31bf3856ad364e35_10.0.22000.1_none_5e882f2798e1d266\Desktop.ini testrat.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-shell-wallpaper-themed_31bf3856ad364e35_10.0.22000.1_none_2d1916daa9bc20db\Desktop.ini testrat.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini testrat.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini testrat.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-commonstartmenu_31bf3856ad364e35_10.0.22000.1_none_9741789b0187fcd2\desktop.ini testrat.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..ktopini-accessories_31bf3856ad364e35_10.0.22000.1_none_425ab98abe32f108\Desktop.ini testrat.exe File opened for modification C:\Windows\Web\Wallpaper\ThemeB\Desktop.ini testrat.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini testrat.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini testrat.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini testrat.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini testrat.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-fontext_31bf3856ad364e35_10.0.22000.1_none_f4c93628f8665e8e\desktop.ini testrat.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-commondownloads_31bf3856ad364e35_10.0.22000.1_none_4967740657087a96\desktop.ini testrat.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..i-accessibilityuser_31bf3856ad364e35_10.0.22000.348_none_5e9c11248df37d0b\Desktop.ini testrat.exe File opened for modification C:\Windows\Web\Wallpaper\ThemeC\Desktop.ini testrat.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini testrat.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini testrat.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini testrat.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..l32-kf-userprofiles_31bf3856ad364e35_10.0.22000.1_none_da2961292c6298e1\desktop.ini testrat.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini testrat.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini testrat.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini testrat.exe File opened for modification C:\$Recycle.Bin\S-1-5-21-2043432456-1617298091-2772621413-1000\desktop.ini testrat.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2043432456-1617298091-2772621413-1000\desktop.ini testrat.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-ie-offlinefavorites_31bf3856ad364e35_11.0.22000.1_none_eb60fb76c15c81dc\desktop.ini testrat.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini testrat.exe File opened for modification C:\Users\Public\Downloads\desktop.ini testrat.exe File opened for modification C:\Users\Public\Pictures\desktop.ini testrat.exe File opened for modification C:\Windows\Web\Wallpaper\ThemeD\Desktop.ini testrat.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini testrat.exe File opened for modification C:\Users\Public\Music\desktop.ini testrat.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-shell-sounds_31bf3856ad364e35_10.0.22000.1_none_6d5619d8ba52aa97\Desktop.ini testrat.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-s..i-accessibilityuser_31bf3856ad364e35_10.0.22000.348_none_5e9c11248df37d0b\f\Desktop.ini testrat.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini testrat.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini testrat.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini testrat.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini testrat.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..-kf-commondocuments_31bf3856ad364e35_10.0.22000.1_none_a514e307ccfabd4f\desktop.ini testrat.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini testrat.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini testrat.exe File opened for modification C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn1\desktop.ini testrat.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini testrat.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-shell-wallpaper-themec_31bf3856ad364e35_10.0.22000.1_none_2d192da2a9bc073a\Desktop.ini testrat.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..i-accessibilityuser_31bf3856ad364e35_10.0.22000.348_none_5e9c11248df37d0b\f\Desktop.ini testrat.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini testrat.exe File opened for modification C:\Users\Default\AppData\Local\Microsoft\Windows\WinX\Group2\desktop.ini testrat.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini testrat.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\WinX\Group3\desktop.ini testrat.exe File opened for modification C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini testrat.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini testrat.exe File opened for modification C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\desktop.ini testrat.exe File opened for modification C:\Windows\Downloaded Program Files\desktop.ini testrat.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..32-kf-commonstartup_31bf3856ad364e35_10.0.22000.1_none_5253db794fd19bbe\desktop.ini testrat.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI testrat.exe File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini testrat.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini testrat.exe File opened for modification C:\Users\Public\desktop.ini testrat.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\WinSxS\x86_microsoft-windows-s..ccessagent-binaries_31bf3856ad364e35_10.0.22000.1_none_d85560fac0cc6c41\autorun.inf testrat.exe File opened for modification C:\Windows\BitLockerDiscoveryVolumeContents\autorun.inf testrat.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\System32\easinvoker.exe testrat.exe File opened for modification C:\Windows\SysWOW64\mshtmler.dll testrat.exe File opened for modification C:\Windows\System32\en-US\prnfldr.dll.mui testrat.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-DHCP-Server-Package~31bf3856ad364e35~amd64~~10.0.22000.71.cat testrat.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-DisplayControl-Package~31bf3856ad364e35~amd64~~10.0.22000.1.cat testrat.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-UX-UI-Package~31bf3856ad364e35~amd64~es-ES~10.0.22000.1.cat testrat.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-WindowsCore-Network-FlowSteering-merged-Package~31bf3856ad364e35~amd64~it-IT~10.0.22000.1.cat testrat.exe File opened for modification C:\Windows\System32\wbem\AutoRecover\E322503208891AC94449BB2B3F53482D.mof testrat.exe File opened for modification C:\Windows\System32\wbem\AutoRecover\ECDFB9E4F5941EF63DFB007D02610E24.mof testrat.exe File opened for modification C:\Windows\System32\Windows.UI.Xaml.Resources.rs5.dll testrat.exe File opened for modification C:\Windows\SysWOW64\en-US\Windows.Gaming.Input.dll.mui testrat.exe File opened for modification C:\Windows\System32\en-US\TabletPC.cpl.mui testrat.exe File opened for modification C:\Windows\SysWOW64\es-ES\dot3gpui.dll.mui testrat.exe File opened for modification C:\Windows\System32\es-ES\MMDevAPI.dll.mui testrat.exe File opened for modification C:\Windows\System32\DriverStore\ja-JP\virtdisk.inf_loc testrat.exe File opened for modification C:\Windows\System32\EaseOfAccessDialog.exe testrat.exe File opened for modification C:\Windows\SysWOW64\lcphrase.tbl testrat.exe File opened for modification C:\Windows\System32\mprext.dll testrat.exe File opened for modification C:\Windows\System32\MUILanguageCleanup.dll testrat.exe File opened for modification C:\Windows\System32\en-US\FunDisc.dll.mui testrat.exe File opened for modification C:\Windows\SysWOW64\it-IT\mciavi32.dll.mui testrat.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\HyperV-UX-UI-merged-Package~31bf3856ad364e35~amd64~~10.0.22000.493.cat testrat.exe File opened for modification C:\Windows\System32\DriverStore\ja-JP\hidspi_km.inf_loc testrat.exe File opened for modification C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Storage\Partition.cdxml testrat.exe File opened for modification C:\Windows\System32\DriverStore\it-IT\adp80xx.inf_loc testrat.exe File opened for modification C:\Windows\System32\es-ES\winethc.dll.mui testrat.exe File opened for modification C:\Windows\System32\spp\tokens\skus\ProfessionalWorkstation\ProfessionalWorkstation-Volume-CSVLK-4-ul-oob-rtm.xrm-ms testrat.exe File opened for modification C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Appx\en-US\Appx.psd1 testrat.exe File opened for modification C:\Windows\SysWOW64\de-DE\register-cimprovider.exe.mui testrat.exe File opened for modification C:\Windows\SysWOW64\es-ES\at.exe.mui testrat.exe File opened for modification C:\Windows\SysWOW64\fr-FR\winmsipc.dll.mui testrat.exe File opened for modification C:\Windows\System32\it-IT\rwinsta.exe.mui testrat.exe File opened for modification C:\Windows\System32\ja-jp\fde.dll.mui testrat.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-OneCore-Containers-merged-Package~31bf3856ad364e35~amd64~uk-UA~10.0.22000.1.cat testrat.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\MultiPoint-Connector-Opt-Package~31bf3856ad364e35~amd64~fr-FR~10.0.22000.1.cat testrat.exe File opened for modification C:\Windows\System32\DriverStore\en-US\avc.inf_loc testrat.exe File opened for modification C:\Windows\System32\msinfo32.exe testrat.exe File opened for modification C:\Windows\System32\fr-FR\sppcommdlg.dll.mui testrat.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-DirectMusic-Package~31bf3856ad364e35~amd64~~10.0.22000.1.cat testrat.exe File opened for modification C:\Windows\System32\DriverStore\es-ES\mvumis.inf_loc testrat.exe File opened for modification C:\Windows\System32\DriverStore\ja-JP\msux64w10.INF_loc testrat.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\mdm5674a.inf_amd64_efdd0acc0bb41c64\mdm5674a.inf testrat.exe File opened for modification C:\Windows\System32\de-DE\iasacct.dll.mui testrat.exe File opened for modification C:\Windows\System32\en-US\Windows.Internal.SecurityMitigationsBroker.dll.mui testrat.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-ADSI-Package~31bf3856ad364e35~amd64~~10.0.22000.282.cat testrat.exe File opened for modification C:\Windows\SysWOW64\Dism\ja-JP\DismProv.dll.mui testrat.exe File opened for modification C:\Windows\System32\uk-UA\msctfuimanager.dll.mui testrat.exe File opened for modification C:\Windows\System32\wbem\en-US\Win32_DeviceGuard.mfl testrat.exe File opened for modification C:\Windows\System32\en-US\schtasks.exe.mui testrat.exe File opened for modification C:\Windows\System32\es-ES\APHostRes.dll.mui testrat.exe File opened for modification C:\Windows\SysWOW64\fr-FR\portabledevicestatus.dll.mui testrat.exe File opened for modification C:\Windows\SysWOW64\it-IT\iccvid.dll.mui testrat.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-ShellExperienceHost-Package~31bf3856ad364e35~amd64~it-IT~10.0.22000.1.cat testrat.exe File opened for modification C:\Windows\System32\wbem\uk-UA\CIWmi.mfl testrat.exe File opened for modification C:\Windows\System32\it-IT\WerFault.exe.mui testrat.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-LanguagePack-Package~31bf3856ad364e35~amd64~es-ES~10.0.22000.1.cat testrat.exe File opened for modification C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Telnet-Client-Package~31bf3856ad364e35~amd64~fr-FR~10.0.22000.1.cat testrat.exe File opened for modification C:\Windows\System32\DriverStore\ja-JP\c_sslaccel.inf_loc testrat.exe File opened for modification C:\Windows\SysWOW64\wbem\uk-UA\PrintManagementProvider.mfl testrat.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BranchCache\BranchCacheContentServerSettingData.cdxml testrat.exe File opened for modification C:\Windows\SysWOW64\de-DE\iexpress.exe.mui testrat.exe File opened for modification C:\Windows\System32\DriverStore\de-DE\scmbus.inf_loc testrat.exe File opened for modification C:\Windows\System32\KBDKHMR.DLL testrat.exe File opened for modification C:\Windows\System32\MdmDiagnostics.dll testrat.exe - Modifies termsrv.dll 1 TTPs 1 IoCs
Commonly used to allow simultaneous RDP sessions.
description ioc Process File opened for modification C:\Windows\System32\termsrv.dll testrat.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-96_altform-lightunplated.png testrat.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_x64__8wekyb3d8bbwe\Assets\CameraAppList.targetsize-48.png testrat.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Threading.Thread.dll testrat.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Snippets\Describe.snippets.ps1xml testrat.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\msolap.dll testrat.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\lib-amd\fonts\index.js testrat.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.contrast-black_targetsize-80.png testrat.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_x64__8wekyb3d8bbwe\Assets\CameraSmallTile.scale-100.png testrat.exe File opened for modification C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.0\Workflow.VisualBasic.Targets testrat.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SmallLogo.scale-200_contrast-white.png testrat.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_12104.1001.1.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\StoreWideTile.scale-125_altform-colorful_theme-light.png testrat.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_1.0.22.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-80_altform-lightunplated_contrast-black.png testrat.exe File opened for modification C:\Program Files\7-Zip\Lang\co.txt testrat.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\BridgeWebView.xbf testrat.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_12008.1001.1.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreMedTile.scale-200.png testrat.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsAlarms_1.0.36.0_neutral_split.scale-125_8wekyb3d8bbwe\AppxManifest.xml testrat.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\resources.pak testrat.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PaintAppList.targetsize-36.png testrat.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\SnippingTool\Assets\Square44x44Logo.targetsize-32_altform-unplated.png testrat.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\ResiliencyLinks\Locales\et.pak.DATA testrat.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\System.Core.dll testrat.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\AppxSignature.p7x testrat.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Trial-ul-oob.xrm-ms testrat.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\TerminalApp\TabHeaderControl.xaml testrat.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Exchange.scale-150.png testrat.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Locales\sv.pak testrat.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-commonjs\Toggle.js testrat.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\root\ui-strings.js testrat.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\OutlookMailWideTile.scale-150.png testrat.exe File opened for modification C:\Program Files\Java\jre-1.8\legal\jdk\thaidict.md testrat.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\prefs_enclave_x64.dll testrat.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe testrat.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\ExchangeSmallTile.scale-100.png testrat.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_1.0.6.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherAppList.targetsize-30_altform-lightunplated.png testrat.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\VisualElements\SmallLogo.png testrat.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\es-419_NEUTER.pak testrat.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ka\LC_MESSAGES\vlc.mo testrat.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_filter-hover_32.svg testrat.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\[email protected] testrat.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\AppxSignature.p7x testrat.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019VL_MAK_AE-ppd.xrm-ms testrat.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Locales\it.pak testrat.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\Assets\contrast-black\GetHelpSmallTile.scale-200_contrast-black.png testrat.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_1.0.22.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\MapsAppList.targetsize-30_contrast-black.png testrat.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\xmsrv.dll testrat.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\zh-tw\ui-strings.js testrat.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_1.0.6.0_x64__8wekyb3d8bbwe\Microsoft.Apps.Stubs.dll testrat.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\WinStore.Preview.winmd testrat.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEAWSDC.DLL testrat.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Retail-ul-phn.xrm-ms testrat.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\Assets\PaintWideTile.scale-125.png testrat.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_1.0.38.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderMedTile.scale-100_contrast-white.png testrat.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jawt.dll testrat.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\codec\libcrystalhd_plugin.dll testrat.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\manifest.xml testrat.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Paint_10.2104.17.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\PaintSmallTile.scale-125.png testrat.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\s_listview_18.svg testrat.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.50.24002.0_neutral_split.scale-100_8wekyb3d8bbwe\resources.pri testrat.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\Theme_Illustration_Seasons_Winter_Right.png testrat.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\gui\libqt_plugin.dll testrat.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-80_altform-unplated_contrast-black.png testrat.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\react\lib-amd\components\DocumentCard\DocumentCard.styles.js testrat.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\WebContent\node_modules\@fluentui\theme\node_modules\@uifabric\utilities\lib\hoistStatics.js testrat.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\tr-tr\ui-strings.js testrat.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-p..ting-spooler-client_31bf3856ad364e35_10.0.22000.282_none_98a8f441d26ae9c4\winspool.drv testrat.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_rdlsbuscbs.inf-languagepack_31bf3856ad364e35_10.0.22000.1_uk-ua_4bef30ad3b2877a2.manifest testrat.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_10.0.22000.348_sl-si_617dca18b4dc6bd3\r\bootmgr.efi.mui testrat.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-s..rofessional-license_31bf3856ad364e35_10.0.22000.348_none_7744f0e97b18358e\f\Professional-Retail-2-pl-rtm.xrm-ms testrat.exe File opened for modification C:\Windows\WinSxS\Fusion\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_none_ea33c8f0b247cd77\9.0\9.0.30729.6161\msvcr90.dll testrat.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-network-security_31bf3856ad364e35_10.0.22000.438_none_c886d8ddafb935ef.manifest testrat.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\Microsoft-Windows-AclUI-Package~31bf3856ad364e35~amd64~~10.0.22000.434.mum testrat.exe File opened for modification C:\Windows\WinSxS\x86_microsoft-windows-msmq-bpa_31bf3856ad364e35_10.0.22000.1_none_c13996b0c95ea954\Msmq.sch testrat.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-sstext3d_31bf3856ad364e35_10.0.22000.71_none_e67840367b6dc817.manifest testrat.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\Experiences\PreInstalledApps\DefaultSquareTileLogo1.contrast-white_scale-100.png testrat.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Permissions\createPermission.aspx testrat.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.318_none_82292a5c4e657627\r\Public\wsxpacks\Account\assets\__\lib-localization\dist\resources\zh-TW.json testrat.exe File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-DNS-Client-Management-Package~31bf3856ad364e35~amd64~~10.0.22000.1.mum testrat.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.22000.176_none_fded9bd0d2f09976\xboxTcuiContext.js testrat.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-g..-admfiles.resources_31bf3856ad364e35_10.0.22000.1_fr-fr_579ab94152aab74f\Conf.adml testrat.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\Microsoft-Windows-ServerManager-UX-ARW-Plugins-Client-merged-Package~31bf3856ad364e35~amd64~ja-JP~10.0.22000.120.cat testrat.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-rasrtutils_31bf3856ad364e35_10.0.22000.376_none_129f652da42bef6d\rtutils.dll testrat.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_prnms008.inf.resources_31bf3856ad364e35_10.0.22000.1_en-us_8e0ba80e303c931d.manifest testrat.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-l..em-ppipro.resources_31bf3856ad364e35_10.0.22000.493_tr-tr_93c51fd0599799e5.manifest testrat.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..riencehost.appxmain_31bf3856ad364e35_10.0.22000.176_none_fded9bd0d2f09976\Microsoft.CloudExperienceHost.winmd testrat.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\Microsoft-Windows-Editions-EnterpriseG-Package~31bf3856ad364e35~amd64~~10.0.22000.493.mum testrat.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\Microsoft-Windows-KernelMode-Minimal-Feature-Package~31bf3856ad364e35~amd64~tr-TR~10.0.22000.348.cat testrat.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\WinPE-MDAC-Package-onecorewindows~31bf3856ad364e35~amd64~fr-CA~10.0.22000.348.mum testrat.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-e..el-client.resources_31bf3856ad364e35_10.0.22000.1_de-de_a87d404c51664ac2.manifest testrat.exe File opened for modification C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\speech\4009\tokens_enIN.xml testrat.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation.Resources\v4.0_3.0.0.0_en_31bf3856ad364e35\System.Management.Automation.Resources.dll testrat.exe File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-Browser-Package~31bf3856ad364e35~amd64~en-US~10.0.22000.1.cat testrat.exe File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-DirectoryServices-ADAM-Snapins-Group-Package~31bf3856ad364e35~amd64~~10.0.22000.434.mum testrat.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-l..wslclient.resources_31bf3856ad364e35_10.0.22000.1_en-us_be9ba480a767f2c9\wslclient.dll.mui testrat.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-power-sysprep_31bf3856ad364e35_10.0.22000.1_none_bf9466f54cf7d46e\posetup.dll testrat.exe File opened for modification C:\Windows\WinSxS\Backup\amd64_microsoft-windows-d..ient-core.resources_31bf3856ad364e35_10.0.22000.1_es-es_6d520108062d2341_dnsrslvr.dll.mui_1e1a1ed1 testrat.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_c_dot4.inf-languagepack_31bf3856ad364e35_10.0.22000.1_es-es_a71c9422fdbee268.manifest testrat.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-p..iagnostic.resources_31bf3856ad364e35_10.0.22000.120_fi-fi_c627b4ad4e3cd5f4\f\RS_ChangeProcessorState.psd1 testrat.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\x86_microsoft-windows-l..fessional.resources_31bf3856ad364e35_10.0.22000.493_zh-tw_a1d0c85187256ccd\f\license.rtf testrat.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.22000.194_none_15db8cfb1c6a6b33\TileSmall.scale-400.png testrat.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-errorreportingfaults_31bf3856ad364e35_10.0.22000.348_none_75b35e16f6608fe4\Faultrep.dll testrat.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-winlogon-adm.resources_31bf3856ad364e35_10.0.22000.1_es-es_eb130c11e1d1fede.manifest testrat.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.493_none_81cdab704eaad423\Assets\contrast-black\GetStartedAppList.targetsize-40_altform-unplated_contrast-black.png testrat.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_product-containeros..esources-deployment_31bf3856ad364e35_10.0.22000.51_none_5c0d0327f3a47301.manifest testrat.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-xwizards.resources_31bf3856ad364e35_10.0.22000.1_it-it_d37abf1525903209\xwizards.mfl testrat.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-n..framework.resources_31bf3856ad364e35_10.0.22000.1_uk-ua_4af1a837d3c3d6ee.manifest testrat.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.22000.493_none_81cdab704eaad423\FileExplorerExtensions\Assets\images\contrast-white\windows.discimage.burn.svg testrat.exe File opened for modification C:\Windows\PLA\Templates\WDAC_Diagnostics.xml testrat.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-e..onitoring.resources_31bf3856ad364e35_10.0.22000.1_ja-jp_275d133cc5c5140a\esentprf.ini testrat.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-graphics-wdi_31bf3856ad364e35_10.0.22000.1_none_5f34fa669709a188\dxgwdi.dll testrat.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\Microsoft-Windows-SearchEngine-Client-Package-shell-Package~31bf3856ad364e35~amd64~sl-SI~10.0.22000.120.mum testrat.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-parentalcontrols-ots_31bf3856ad364e35_10.0.22000.37_none_7461fc8593f740b9\f\ApproveChildRequest.exe testrat.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\App_LocalResources\security0.aspx.fr.resx testrat.exe File opened for modification C:\Windows\WinSxS\Catalogs\92c96fbb0cc46fda05ca4012bad46cd5a4a4c5d52ebbf58999440a78496dc743.cat testrat.exe File opened for modification C:\Windows\WinSxS\x86_microsoft-windows-sxs.resources_31bf3856ad364e35_10.0.22000.1_es-es_ebc18cfdd260d774\SxsMigPlugin.dll.mui testrat.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\es\System.AddIn.resources.dll testrat.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-u..d-library.resources_31bf3856ad364e35_10.0.22000.120_nl-nl_9b754dffc6529a2d\f\Windows.UI.Cred.nl-NL.pri testrat.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.0\Windows Workflow Foundation\SQL\es\Tracking_Schema.sql testrat.exe File opened for modification C:\Windows\servicing\Packages\Microsoft-Windows-WMIEvents-merged-Package~31bf3856ad364e35~amd64~~10.0.22000.1.cat testrat.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\amd64_microsoft-windows-l..ult-coren.resources_31bf3856ad364e35_10.0.22000.493_fr-ca_49dbb6431723b0be.manifest testrat.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft.powershell.dsc.proxy.resources_31bf3856ad364e35_10.0.22000.1_fr-fr_15ceb52ac1cc65fa\DscProxy.dll.mui testrat.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_microsoft.certifica..ts.native.resources_31bf3856ad364e35_10.0.22000.1_de-de_8504bb9187967a7a.manifest testrat.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_tpmvsc.inf-languagepack_31bf3856ad364e35_10.0.22000.1_it-it_3c9318d80e3881b0.manifest testrat.exe File opened for modification C:\Windows\INF\ufxchipidea.PNF testrat.exe File opened for modification C:\Windows\WinSxS\amd64_dual_amdi2c.inf_31bf3856ad364e35_10.0.22000.1_none_f4b6da754cae4bb2\amdi2c.sys testrat.exe File opened for modification C:\Windows\WinSxS\amd64_dual_mdmaiwa4.inf_31bf3856ad364e35_10.0.22000.1_none_2b7e55826f35fa10\mdmaiwa4.inf testrat.exe File opened for modification C:\Windows\servicing\LCU\Package_for_RollupFix~31bf3856ad364e35~amd64~~22000.493.1.3\Microsoft-NanoServer-SPB-Devices-merged-Package~31bf3856ad364e35~amd64~nl-NL~10.0.22000.184.mum testrat.exe File opened for modification C:\Windows\WinSxS\wow64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.22000.1_none_4548a15e322e11ac\tskill.exe testrat.exe File opened for modification C:\Windows\WinSxS\Manifests\amd64_system.runtime.caching.resources_b03f5f7f11d50a3a_4.0.15806.0_ja-jp_2996503362195aa1.manifest testrat.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\testrat.exe"C:\Users\Admin\AppData\Local\Temp\testrat.exe"1⤵
- Drops file in Drivers directory
- Manipulates Digital Signatures
- Boot or Logon Autostart Execution: Print Processors
- Creates a file in the Startup directory
- Indicator Removal: Clear Windows Event Logs
- Drops desktop.ini file(s)
- Drops autorun.inf file
- Drops file in System32 directory
- Modifies termsrv.dll
- Drops file in Program Files directory
- Drops file in Windows directory
PID:3964
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Print Processors
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Print Processors
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1