414155bf11893ec64ba0f4ffb7de92885090845a0761cf8f6743462aa5991d5e

Analysis

user interaction
yes
max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/09/2026, 02:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0FF1C3 2016-2025/OInstall.exe
Size 10.9MB
Sample260909-cwtbds1apd
SHA256 414155bf11893ec64ba0f4ffb7de92885090845a0761cf8f6743462aa5991d5e
MD5 ebc58647462ad9c76395ef451064d115
SHA1 14e470812f13b278b2694a4cec5737a39784e9dd
SHA512 8a9ef093d151957ae3c4c8e572fcdbd2198398c95ff8186d532853856c12c8f9ae7408c4f24518c5903faa517ea4e1d5779e797c5a4d850073fbee3ab801e8cc
SSDEEP 196608:2ZnMGjZsDEsCaYsGEHy61bgUhufRswPU2/V8Gd83/PALDP0PiaQxhwf+9zYul28S:WnjZhsCOU6ZgfPPPuGdnv0fzfoDYtB
TLSH
T111B63376044290B6E0812DB6520EB4F5661E3857189BFC642D4BCDE87BBADC3D7D2A0F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution upx

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
http://officecdn.microsoft.com/pr/f2e724c1-748f-4b47-8fb8-8e0d210e9208/Office/Data/v32.cab

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
http://officecdn.microsoft.com/pr/f2e724c1-748f-4b47-8fb8-8e0d210e9208/Office/Data//i640.cab

Extracted

Language

Deobfuscated

Source

URLs

exe.dropper
http://officecdn.microsoft.com/pr/f2e724c1-748f-4b47-8fb8-8e0d210e9208/Office/Data//i643082.cab

Signatures

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
28	3136	powershell.exe
49	3136	powershell.exe
55	4360	powershell.exe
57	2416	powershell.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3136	powershell.exe
4824	powershell.exe
4360	powershell.exe
2416	powershell.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3700-0-0x0000000000400000-0x000000000199D000-memory.dmp	upx
behavioral1/memory/3700-3-0x0000000000400000-0x000000000199D000-memory.dmp	upx
behavioral1/memory/3700-4-0x0000000000400000-0x000000000199D000-memory.dmp	upx
behavioral1/memory/3700-5-0x0000000000400000-0x000000000199D000-memory.dmp	upx
behavioral1/memory/3700-23-0x0000000000400000-0x000000000199D000-memory.dmp	upx
behavioral1/memory/3700-110-0x0000000000400000-0x000000000199D000-memory.dmp	upx
behavioral1/memory/3700-113-0x0000000000400000-0x000000000199D000-memory.dmp	upx
behavioral1/memory/3700-114-0x0000000000400000-0x000000000199D000-memory.dmp	upx
behavioral1/memory/3700-116-0x0000000000400000-0x000000000199D000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.cab.cat	OInstall.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.en-us.dll	OInstall.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	OInstall.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp140.dll	OInstall.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll	OInstall.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll	OInstall.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClient.man	OInstall.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppvIsvSubsystems64.dll	OInstall.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nl-nl.dll	OInstall.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ru-ru.dll	OInstall.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.tr-tr.dll	OInstall.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml	OInstall.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll	OInstall.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	OInstall.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvVirtualization.dll	OInstall.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.he-il.dll	OInstall.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xml	OInstall.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	OInstall.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\SharedPerformance.man	OInstall.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll	OInstall.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll	OInstall.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll	OInstall.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RHeartbeatConfig.xml	OInstall.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-br.dll	OInstall.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.th-th.dll	OInstall.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\offreg.dll	OInstall.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\RepoMan.dll	OInstall.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\	OInstall.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-utility-l1-1-0.dll	OInstall.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\ApiClient.dll	OInstall.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIntegration.dll	OInstall.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.et-ee.dll	OInstall.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	OInstall.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\SubsystemController.man	OInstall.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll	OInstall.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\vcruntime140.dll	OInstall.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-xstate-l2-1-0.dll	OInstall.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.bg-bg.dll	OInstall.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.el-gr.dll	OInstall.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.es-es.dll	OInstall.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sv-se.dll	OInstall.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcr120.dll	OInstall.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe	OInstall.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll	OInstall.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-runtime-l1-1-0.dll	OInstall.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll	OInstall.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ar-sa.dll	OInstall.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.de-de.dll	OInstall.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nb-no.dll	OInstall.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.vi-vn.dll	OInstall.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-cn.dll	OInstall.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientCapabilities.json	OInstall.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVCatalog.dll	OInstall.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sl-si.dll	OInstall.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll	OInstall.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll	OInstall.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-filesystem-l1-1-0.dll	OInstall.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-heap-l1-1-0.dll	OInstall.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll	OInstall.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-stdio-l1-1-0.dll	OInstall.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll	OInstall.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hu-hu.dll	OInstall.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ja-jp.dll	OInstall.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz.dll	OInstall.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2956	sc.exe
2264	sc.exe
3520	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 13 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
928	cmd.exe
2696	cmd.exe
3620	cmd.exe
4376	cmd.exe
520	cmd.exe
4716	cmd.exe
1316	cmd.exe
4988	cmd.exe
2504	cmd.exe
2568	cmd.exe
3936	cmd.exe
2208	cmd.exe
4796	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	expand.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	expand.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OInstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	expand.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Kills process with taskkill 4 IoCs

defense_evasion

pid	Process
1416	taskkill.exe
2012	taskkill.exe
1368	taskkill.exe
3360	taskkill.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
2636	reg.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3136	powershell.exe
3136	powershell.exe
4824	powershell.exe
4824	powershell.exe
4360	powershell.exe
4360	powershell.exe
2416	powershell.exe
2416	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4724	WMIC.exe
Token: SeSecurityPrivilege	4724	WMIC.exe
Token: SeTakeOwnershipPrivilege	4724	WMIC.exe
Token: SeLoadDriverPrivilege	4724	WMIC.exe
Token: SeSystemProfilePrivilege	4724	WMIC.exe
Token: SeSystemtimePrivilege	4724	WMIC.exe
Token: SeProfSingleProcessPrivilege	4724	WMIC.exe
Token: SeIncBasePriorityPrivilege	4724	WMIC.exe
Token: SeCreatePagefilePrivilege	4724	WMIC.exe
Token: SeBackupPrivilege	4724	WMIC.exe
Token: SeRestorePrivilege	4724	WMIC.exe
Token: SeShutdownPrivilege	4724	WMIC.exe
Token: SeDebugPrivilege	4724	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4724	WMIC.exe
Token: SeRemoteShutdownPrivilege	4724	WMIC.exe
Token: SeUndockPrivilege	4724	WMIC.exe
Token: SeManageVolumePrivilege	4724	WMIC.exe
Token: 33	4724	WMIC.exe
Token: 34	4724	WMIC.exe
Token: 35	4724	WMIC.exe
Token: 36	4724	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4724	WMIC.exe
Token: SeSecurityPrivilege	4724	WMIC.exe
Token: SeTakeOwnershipPrivilege	4724	WMIC.exe
Token: SeLoadDriverPrivilege	4724	WMIC.exe
Token: SeSystemProfilePrivilege	4724	WMIC.exe
Token: SeSystemtimePrivilege	4724	WMIC.exe
Token: SeProfSingleProcessPrivilege	4724	WMIC.exe
Token: SeIncBasePriorityPrivilege	4724	WMIC.exe
Token: SeCreatePagefilePrivilege	4724	WMIC.exe
Token: SeBackupPrivilege	4724	WMIC.exe
Token: SeRestorePrivilege	4724	WMIC.exe
Token: SeShutdownPrivilege	4724	WMIC.exe
Token: SeDebugPrivilege	4724	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4724	WMIC.exe
Token: SeRemoteShutdownPrivilege	4724	WMIC.exe
Token: SeUndockPrivilege	4724	WMIC.exe
Token: SeManageVolumePrivilege	4724	WMIC.exe
Token: 33	4724	WMIC.exe
Token: 34	4724	WMIC.exe
Token: 35	4724	WMIC.exe
Token: 36	4724	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1288	WMIC.exe
Token: SeSecurityPrivilege	1288	WMIC.exe
Token: SeTakeOwnershipPrivilege	1288	WMIC.exe
Token: SeLoadDriverPrivilege	1288	WMIC.exe
Token: SeSystemProfilePrivilege	1288	WMIC.exe
Token: SeSystemtimePrivilege	1288	WMIC.exe
Token: SeProfSingleProcessPrivilege	1288	WMIC.exe
Token: SeIncBasePriorityPrivilege	1288	WMIC.exe
Token: SeCreatePagefilePrivilege	1288	WMIC.exe
Token: SeBackupPrivilege	1288	WMIC.exe
Token: SeRestorePrivilege	1288	WMIC.exe
Token: SeShutdownPrivilege	1288	WMIC.exe
Token: SeDebugPrivilege	1288	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1288	WMIC.exe
Token: SeRemoteShutdownPrivilege	1288	WMIC.exe
Token: SeUndockPrivilege	1288	WMIC.exe
Token: SeManageVolumePrivilege	1288	WMIC.exe
Token: 33	1288	WMIC.exe
Token: 34	1288	WMIC.exe
Token: 35	1288	WMIC.exe
Token: 36	1288	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1288	WMIC.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 3700 wrote to memory of 4988	3700	OInstall.exe	85
PID 4988 wrote to memory of 4724	4988	cmd.exe	87
PID 3700 wrote to memory of 3620	3700	OInstall.exe	89
PID 3620 wrote to memory of 1288	3620	cmd.exe	91
PID 3700 wrote to memory of 2636	3700	OInstall.exe	93
PID 3700 wrote to memory of 3136	3700	OInstall.exe	95
PID 3700 wrote to memory of 4092	3700	OInstall.exe	109
PID 3700 wrote to memory of 4824	3700	OInstall.exe	111
PID 3700 wrote to memory of 2504	3700	OInstall.exe	113
PID 2504 wrote to memory of 2264	2504	cmd.exe	115
PID 3700 wrote to memory of 1416	3700	OInstall.exe	116
PID 3700 wrote to memory of 2012	3700	OInstall.exe	118
PID 3700 wrote to memory of 1368	3700	OInstall.exe	120
PID 3700 wrote to memory of 4360	3700	OInstall.exe	122
PID 3700 wrote to memory of 3928	3700	OInstall.exe	124
PID 3700 wrote to memory of 2416	3700	OInstall.exe	126
PID 3700 wrote to memory of 3176	3700	OInstall.exe	128
PID 3700 wrote to memory of 4376	3700	OInstall.exe	130
PID 4376 wrote to memory of 3204	4376	cmd.exe	132
PID 3700 wrote to memory of 2568	3700	OInstall.exe	133
PID 2568 wrote to memory of 3136	2568	cmd.exe	135
PID 3700 wrote to memory of 3936	3700	OInstall.exe	136
PID 3936 wrote to memory of 3040	3936	cmd.exe	138
PID 3700 wrote to memory of 2208	3700	OInstall.exe	139
PID 2208 wrote to memory of 744	2208	cmd.exe	141
PID 3700 wrote to memory of 4796	3700	OInstall.exe	142
PID 4796 wrote to memory of 1176	4796	cmd.exe	144
PID 3700 wrote to memory of 928	3700	OInstall.exe	150
PID 928 wrote to memory of 3520	928	cmd.exe	152
PID 3700 wrote to memory of 2696	3700	OInstall.exe	153
PID 2696 wrote to memory of 2252	2696	cmd.exe	155
PID 2252 wrote to memory of 1760	2252	net.exe	156
PID 3700 wrote to memory of 520	3700	OInstall.exe	157
PID 520 wrote to memory of 2956	520	cmd.exe	159
PID 3700 wrote to memory of 4716	3700	OInstall.exe	160
PID 4716 wrote to memory of 4060	4716	cmd.exe	162
PID 4060 wrote to memory of 2964	4060	net.exe	163
PID 3700 wrote to memory of 1316	3700	OInstall.exe	164
PID 1316 wrote to memory of 3360	1316	cmd.exe	166

C:\Users\Admin\AppData\Local\Temp\0FF1C3 2016-2025\OInstall.exe
"C:\Users\Admin\AppData\Local\Temp\0FF1C3 2016-2025\OInstall.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3700
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\0FF1C3 2016-2025\OInstall.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4988
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\0FF1C3 2016-2025\OInstall.exe"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4724
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\0FF1C3 2016-2025\files"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3620
- - C:\Windows\System32\Wbem\WMIC.exe
    WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionPath="C:\Users\Admin\AppData\Local\Temp\0FF1C3 2016-2025\files"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1288
- C:\Windows\system32\reg.exe
  "C:\Windows\Sysnative\reg.exe" add HKLM\Software\Policies\Microsoft\Office\16.0\Common\OfficeUpdate /v UpdateBranch /d PerpetualVL2019 /f
  2⤵
  - Modifies registry key
  PID:2636
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -command "& { (New-Object Net.WebClient).DownloadFile('http://officecdn.microsoft.com/pr/f2e724c1-748f-4b47-8fb8-8e0d210e9208/Office/Data/v32.cab', 'C:\Users\Admin\AppData\Local\Temp\over170851\v32.cab') }"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3136
- C:\Windows\SysWOW64\expand.exe
  "expand" v32.cab -F:VersionDescriptor.xml C:\Users\Admin\AppData\Local\Temp\over170851
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4092
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -command "& { Get-Content C:\Users\Admin\AppData\Local\Temp\over170851\VersionDescriptor.xml | Set-Content -Encoding ASCII v32.txt }
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4824
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c sc.exe stop ClickToRunSvc
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2504
- - C:\Windows\System32\sc.exe
    sc.exe stop ClickToRunSvc
    3⤵
    - Launches sc.exe
    PID:2264
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /t /f /IM OfficeClickToRun.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  PID:1416
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /t /f /IM IntegratedOffice.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  PID:2012
- C:\Windows\SysWOW64\taskkill.exe
  "taskkill.exe" /t /f /IM OfficeC2RClient.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  PID:1368
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -command "& { (New-Object Net.WebClient).DownloadFile('http://officecdn.microsoft.com/pr/f2e724c1-748f-4b47-8fb8-8e0d210e9208/Office/Data//i640.cab', 'C:\Users\Admin\AppData\Local\Temp\over170851\i640.cab') }"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4360
- C:\Windows\SysWOW64\expand.exe
  "expand" i640.cab -F:* "C:\Program Files\Common Files\microsoft Shared\ClickToRun"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3928
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -command "& { (New-Object Net.WebClient).DownloadFile('http://officecdn.microsoft.com/pr/f2e724c1-748f-4b47-8fb8-8e0d210e9208/Office/Data//i643082.cab', 'C:\Users\Admin\AppData\Local\Temp\over170851\i643082.cab') }"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2416
- C:\Windows\SysWOW64\expand.exe
  "expand" i643082.cab -F:* "C:\Program Files\Common Files\microsoft Shared\ClickToRun"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3176
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /D /c reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Configuration" /f /v "AudienceId" /t REG_SZ /d f2e724c1-748f-4b47-8fb8-8e0d210e9208
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4376
- - C:\Windows\system32\reg.exe
    reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Configuration" /f /v "AudienceId" /t REG_SZ /d f2e724c1-748f-4b47-8fb8-8e0d210e9208
    3⤵
    PID:3204
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /D /c reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Configuration" /f /v "CDNBaseUrl" /t REG_SZ /d http://officecdn.microsoft.com/pr/f2e724c1-748f-4b47-8fb8-8e0d210e9208
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2568
- - C:\Windows\system32\reg.exe
    reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Configuration" /f /v "CDNBaseUrl" /t REG_SZ /d http://officecdn.microsoft.com/pr/f2e724c1-748f-4b47-8fb8-8e0d210e9208
    3⤵
    PID:3136
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /D /c reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Configuration" /f /v "UpdateChannel" /t REG_SZ /d http://officecdn.microsoft.com/pr/f2e724c1-748f-4b47-8fb8-8e0d210e9208
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3936
- - C:\Windows\system32\reg.exe
    reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Configuration" /f /v "UpdateChannel" /t REG_SZ /d http://officecdn.microsoft.com/pr/f2e724c1-748f-4b47-8fb8-8e0d210e9208
    3⤵
    PID:3040
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /D /c reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Configuration" /f /v "UpdateChannelChanged" /t REG_SZ /d True
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2208
- - C:\Windows\system32\reg.exe
    reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Configuration" /f /v "UpdateChannelChanged" /t REG_SZ /d True
    3⤵
    PID:744
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /D /c reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Configuration" /f /v "UpdateUrl" /t REG_SZ /d http://officecdn.microsoft.com/pr/f2e724c1-748f-4b47-8fb8-8e0d210e9208
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4796
- - C:\Windows\system32\reg.exe
    reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\Configuration" /f /v "UpdateUrl" /t REG_SZ /d http://officecdn.microsoft.com/pr/f2e724c1-748f-4b47-8fb8-8e0d210e9208
    3⤵
    PID:1176
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c sc.exe stop sppsvc
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:928
- - C:\Windows\System32\sc.exe
    sc.exe stop sppsvc
    3⤵
    - Launches sc.exe
    PID:3520
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c net.exe stop sppsvc /y
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2696
- - C:\Windows\System32\net.exe
    net.exe stop sppsvc /y
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2252
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop sppsvc /y
      4⤵
      PID:1760
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c sc.exe stop osppsvc
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:520
- - C:\Windows\System32\sc.exe
    sc.exe stop osppsvc
    3⤵
    - Launches sc.exe
    PID:2956
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c net.exe stop osppsvc /y
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4716
- - C:\Windows\System32\net.exe
    net.exe stop osppsvc /y
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4060
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop osppsvc /y
      4⤵
      PID:2964
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c taskkill.exe /t /f /IM sppsvc.exe
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1316
- - C:\Windows\System32\taskkill.exe
    taskkill.exe /t /f /IM sppsvc.exe
    3⤵
    - Kills process with taskkill
    PID:3360

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
PID:3640

C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE"
1⤵
PID:1032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 1KB
SHA256 e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359
MD5 4280e36a29fa31c01e4d8b2ba726a0d8
SHA1 c485c2c9ce0a99747b18d899b71dfa9a64dabe32
SHA512 494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4
TLSH
T17A316C303221B5D84D436F5309286AD5A3FF8749ABA89F5CB569231DCD2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba
MD5 06ad34f9739c5159b4d92d702545bd49
SHA1 9152a0d4f153f3f40f7e606be75f81b582ee0c17
SHA512 c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92
SSDEEP 1536:q5C+jH04tAHkCSMrxyNhftflJdPYoFi3j39MVvjMLUsszyhMUp7Fv+Eca5b/h4ie:KC+jH04tAHk5MrxyNhftflJdPYoFi3jc
TLSH
T169335193E9204E71E1A66F3EF15652227D34394690F8113212DC25EFA983D970B1FAFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 8680ac31238ff3439e15b723d7719a8589656bf95d995d14bf62a582b2321f05
MD5 b4341f673768f2c77508907f23b51bca
SHA1 1aca7609fb5b220e02801eb9d74dfd85b3a2b053
SHA512 87e85450fe6ed66d26e9ccbd27f70a68420115bcb3bff47c96e1d2609ff271531baf5b210ddd2cfb0bb5769ed045095f9095747ac65ca2c069b93d77eddf2723
SSDEEP 384:RIb+ja91FdAbGqpxHJk+o9oSKYY169VfPcifEMhgqoeH+PqiahRvOEAqp:RUFFd+xCjoSNF9Wif5xRmqvbn
TLSH
T11E822A5E212F26D3C4E563B8D42A479FDDF09D8F830407CDA79C1D3706A8A6A84BE5D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 13d3f5181fd0400e3abf6ce5cbca0dc2b223f6d0ab8306e2b391f59b4032341e
MD5 1772afdcca77467a53e32cdf77087c97
SHA1 80025f5b0222c16efff6171783cc22f6179a2737
SHA512 db2f4b1949309bf03736de37e8abc4d830012cc0d9d0c97c142c2e0e5d3727d4fca9f466e8476793614719b54332bb842a2f6f36dfedfafc908f28fef13b740e
SSDEEP 384:+rf+j79i+ahbpXzBNx1JkB6o9o2TNK6seY7UA/qi3SoZ3l16UPEBhW8Mc1XzETp:sfVh1j/x0ho2TNNQv5SccSEBYXmw
TLSH
T1FC82B65E611F16C3C8851378E11B055FE8F2DE8D531A03D8BB6E5F3B8AACA9E903D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 17KB
SHA256 6d569873f3ce7bdd35ed557e1ef28b41019a320d474c9c5e5d97199cf98088d1
MD5 ce2de3368ea6fdf6d39ea18f5662ce0e
SHA1 515efb7872fda1b817b554ea4fb60335fe150b7c
SHA512 f5f98679fc901c9c61d04071183ee7d1771088a06f5bf34fecc9c2e212c27d2932d11301d55cf5ec074b13847b284c029ebd04d1b04ca739795ae32651426091
SSDEEP 384:nb+TW291nPjNpBizJkdNAT8NY1BiNfPcifEMFN2UeMF0ibKXsVFDA5:b90nbHoe/AT8Nmi+if5AUzF1SsVM
TLSH
T14082195D222F26D7C0B163F8D426479BEDB09DCFD3040BC89B9D1D3701A9A5684A64E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_34iom000.vjx.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_34iom000.vjx.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2416-107-0x0000000005B40000-0x0000000005E94000-memory.dmp

Download

memory/3136-13-0x0000000005AA0000-0x0000000005AC2000-memory.dmp

Download

memory/3136-14-0x00000000062B0000-0x0000000006316000-memory.dmp

Download

memory/3136-15-0x0000000006320000-0x0000000006386000-memory.dmp

Download

memory/3136-12-0x0000000005C10000-0x0000000006238000-memory.dmp

Download

memory/3136-24-0x0000000006390000-0x00000000066E4000-memory.dmp

Download

memory/3136-11-0x0000000003390000-0x00000000033C6000-memory.dmp

Download

memory/3136-25-0x0000000006950000-0x000000000696E000-memory.dmp

Download

memory/3136-26-0x0000000006990000-0x00000000069DC000-memory.dmp

Download

memory/3136-27-0x0000000007F90000-0x000000000860A000-memory.dmp

Download

memory/3136-28-0x0000000006E90000-0x0000000006EAA000-memory.dmp

Download

memory/3640-30-0x000002215EF40000-0x000002215EF50000-memory.dmp

Download

memory/3640-46-0x000002215F040000-0x000002215F050000-memory.dmp

Download

memory/3640-65-0x000002216F390000-0x000002216F391000-memory.dmp

Download

memory/3640-64-0x000002216F390000-0x000002216F391000-memory.dmp

Download

memory/3640-62-0x000002216F360000-0x000002216F361000-memory.dmp

Download

memory/3640-66-0x000002216F4A0000-0x000002216F4A1000-memory.dmp

Download

memory/3700-1-0x000000000199B000-0x000000000199C000-memory.dmp

Download

memory/3700-0-0x0000000000400000-0x000000000199D000-memory.dmp

Download

memory/3700-23-0x0000000000400000-0x000000000199D000-memory.dmp

Download

memory/3700-5-0x0000000000400000-0x000000000199D000-memory.dmp

Download

memory/3700-116-0x0000000000400000-0x000000000199D000-memory.dmp

Download

memory/3700-114-0x0000000000400000-0x000000000199D000-memory.dmp

Download

memory/3700-113-0x0000000000400000-0x000000000199D000-memory.dmp

Download

memory/3700-110-0x0000000000400000-0x000000000199D000-memory.dmp

Download

memory/3700-4-0x0000000000400000-0x000000000199D000-memory.dmp

Download

memory/3700-3-0x0000000000400000-0x000000000199D000-memory.dmp

Download

memory/4360-96-0x0000000006210000-0x0000000006564000-memory.dmp

Download

memory/4824-79-0x00000000060C0000-0x0000000006414000-memory.dmp

Download

memory/4824-86-0x0000000007F20000-0x00000000084C4000-memory.dmp

Download

memory/4824-85-0x0000000006C80000-0x0000000006CA2000-memory.dmp

Download

memory/4824-84-0x00000000078D0000-0x0000000007966000-memory.dmp

Download