trickbot | 374ef83de2b254c4970b830bb93a1dd79955945d24b824a0b35636e14355fe05

Analysis

max time kernel
148s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/09/2026, 12:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
374ef83de2b254c4970b830bb93a1dd79955945d24b824a0b35636e14355fe05.exe
Size 456KB
Sample260914-pe5djscl6x
SHA256 374ef83de2b254c4970b830bb93a1dd79955945d24b824a0b35636e14355fe05
MD5 b855b1b7b59668ad991cf0501e4ff4cb
SHA1 581283899259e80b7da5d8be25f6ed1de58fdfac
SHA512 71e59b09678df1dca36caca3280687723406c2ccf638e2d7e57a34ea099fb269646730966c96d89dcaab23914f1915664fac4491f09bb17216ed3f3c6acb64c6
SSDEEP 6144:zJB0PLonpe1h5fqpErm9cRLBOtFWaCfmAU+wDhuN:zJB0lh5aILwtFPCfmAUtG
TLSH
T199A45D29EB557976F2530976B600699F2C818C391293DF4AAF4289CDB801DE3F2F5327
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

banker defense_evasion discovery evasion execution trickbot persistence trojan

Malware Config

Signatures

Family: Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 5 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	374ef83de2b254c4970b830bb93a1dd79955945d24b824a0b35636e14355fe05.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe

Modifies Windows Defender notification settings 3 TTPs 5 IoCs

defense_evasion trojan

Windows Service

T1543.003

Modify Registry

T1112

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1"	374ef83de2b254c4970b830bb93a1dd79955945d24b824a0b35636e14355fe05.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1"	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1"	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1"	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1"	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe

Trickbot x86 loader 5 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

resource	yara_rule
behavioral2/memory/3256-15-0x00000000023D0000-0x00000000023F9000-memory.dmp	trickbot_loader32
behavioral2/memory/3256-18-0x00000000023D0000-0x00000000023F9000-memory.dmp	trickbot_loader32
behavioral2/memory/3256-20-0x00000000023D0000-0x00000000023F9000-memory.dmp	trickbot_loader32
behavioral2/memory/3004-39-0x0000000002AD0000-0x0000000002AF9000-memory.dmp	trickbot_loader32
behavioral2/memory/3004-54-0x0000000002AD0000-0x0000000002AF9000-memory.dmp	trickbot_loader32

Disables one or more Microsoft Defender components 1 TTPs 5 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
4228	powershell.exe
1492	powershell.exe
1080	powershell.exe
1624	powershell.exe
5328	powershell.exe

Executes dropped EXE 4 IoCs

pid	Process
3004	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe
1684	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe
3344	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe
5448	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1080	powershell.exe
1624	powershell.exe
5328	powershell.exe
4228	powershell.exe
1492	powershell.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_ugxdkehd.2cs.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_vzgjgpva.2ep.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_rrkt222a.uia.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_dnvczswn.lbe.ps1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_ac34pfpk.uyz.psm1	powershell.exe
File created	C:\Windows\SystemTemp\~DFFBBC152F7A8498AF.TMP	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_5n5x1cqn.ji4.psm1	powershell.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_1dp4gm13.j55.ps1	powershell.exe
File created	C:\Windows\SystemTemp\~DF75C5A64C489DE824.TMP	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe
File created	C:\Windows\SystemTemp\__PSScriptPolicyTest_qqc1n40f.2zn.psm1	powershell.exe

Launches sc.exe 10 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2448	sc.exe
5472	sc.exe
1260	sc.exe
5996	sc.exe
1896	sc.exe
464	sc.exe
4380	sc.exe
3756	sc.exe
5100	sc.exe
4436	sc.exe

System Location Discovery: System Language Discovery 1 TTPs 35 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	374ef83de2b254c4970b830bb93a1dd79955945d24b824a0b35636e14355fe05.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe

Suspicious behavior: EnumeratesProcesses 40 IoCs

pid	Process
3256	374ef83de2b254c4970b830bb93a1dd79955945d24b824a0b35636e14355fe05.exe
3256	374ef83de2b254c4970b830bb93a1dd79955945d24b824a0b35636e14355fe05.exe
3256	374ef83de2b254c4970b830bb93a1dd79955945d24b824a0b35636e14355fe05.exe
3256	374ef83de2b254c4970b830bb93a1dd79955945d24b824a0b35636e14355fe05.exe
3256	374ef83de2b254c4970b830bb93a1dd79955945d24b824a0b35636e14355fe05.exe
3256	374ef83de2b254c4970b830bb93a1dd79955945d24b824a0b35636e14355fe05.exe
3004	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe
3004	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe
3004	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe
3004	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe
3004	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe
3004	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe
1624	powershell.exe
5328	powershell.exe
1624	powershell.exe
5328	powershell.exe
1684	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe
1684	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe
1684	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe
1684	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe
1684	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe
1684	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe
4228	powershell.exe
4228	powershell.exe
3344	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe
3344	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe
3344	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe
3344	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe
3344	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe
3344	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe
1492	powershell.exe
1492	powershell.exe
5448	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe
5448	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe
5448	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe
5448	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe
5448	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe
5448	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe
1080	powershell.exe
1080	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1624	powershell.exe
Token: SeDebugPrivilege	5328	powershell.exe
Token: SeIncreaseQuotaPrivilege	5328	powershell.exe
Token: SeSecurityPrivilege	5328	powershell.exe
Token: SeTakeOwnershipPrivilege	5328	powershell.exe
Token: SeLoadDriverPrivilege	5328	powershell.exe
Token: SeSystemProfilePrivilege	5328	powershell.exe
Token: SeSystemtimePrivilege	5328	powershell.exe
Token: SeProfSingleProcessPrivilege	5328	powershell.exe
Token: SeIncBasePriorityPrivilege	5328	powershell.exe
Token: SeCreatePagefilePrivilege	5328	powershell.exe
Token: SeBackupPrivilege	5328	powershell.exe
Token: SeRestorePrivilege	5328	powershell.exe
Token: SeShutdownPrivilege	5328	powershell.exe
Token: SeDebugPrivilege	5328	powershell.exe
Token: SeSystemEnvironmentPrivilege	5328	powershell.exe
Token: SeRemoteShutdownPrivilege	5328	powershell.exe
Token: SeUndockPrivilege	5328	powershell.exe
Token: SeManageVolumePrivilege	5328	powershell.exe
Token: 33	5328	powershell.exe
Token: 34	5328	powershell.exe
Token: 35	5328	powershell.exe
Token: 36	5328	powershell.exe
Token: SeIncreaseQuotaPrivilege	1624	powershell.exe
Token: SeSecurityPrivilege	1624	powershell.exe
Token: SeTakeOwnershipPrivilege	1624	powershell.exe
Token: SeLoadDriverPrivilege	1624	powershell.exe
Token: SeSystemProfilePrivilege	1624	powershell.exe
Token: SeSystemtimePrivilege	1624	powershell.exe
Token: SeProfSingleProcessPrivilege	1624	powershell.exe
Token: SeIncBasePriorityPrivilege	1624	powershell.exe
Token: SeCreatePagefilePrivilege	1624	powershell.exe
Token: SeBackupPrivilege	1624	powershell.exe
Token: SeRestorePrivilege	1624	powershell.exe
Token: SeShutdownPrivilege	1624	powershell.exe
Token: SeDebugPrivilege	1624	powershell.exe
Token: SeSystemEnvironmentPrivilege	1624	powershell.exe
Token: SeRemoteShutdownPrivilege	1624	powershell.exe
Token: SeUndockPrivilege	1624	powershell.exe
Token: SeManageVolumePrivilege	1624	powershell.exe
Token: 33	1624	powershell.exe
Token: 34	1624	powershell.exe
Token: 35	1624	powershell.exe
Token: 36	1624	powershell.exe
Token: SeDebugPrivilege	4228	powershell.exe
Token: SeIncreaseQuotaPrivilege	4228	powershell.exe
Token: SeSecurityPrivilege	4228	powershell.exe
Token: SeTakeOwnershipPrivilege	4228	powershell.exe
Token: SeLoadDriverPrivilege	4228	powershell.exe
Token: SeSystemProfilePrivilege	4228	powershell.exe
Token: SeSystemtimePrivilege	4228	powershell.exe
Token: SeProfSingleProcessPrivilege	4228	powershell.exe
Token: SeIncBasePriorityPrivilege	4228	powershell.exe
Token: SeCreatePagefilePrivilege	4228	powershell.exe
Token: SeBackupPrivilege	4228	powershell.exe
Token: SeRestorePrivilege	4228	powershell.exe
Token: SeShutdownPrivilege	4228	powershell.exe
Token: SeDebugPrivilege	4228	powershell.exe
Token: SeSystemEnvironmentPrivilege	4228	powershell.exe
Token: SeRemoteShutdownPrivilege	4228	powershell.exe
Token: SeUndockPrivilege	4228	powershell.exe
Token: SeManageVolumePrivilege	4228	powershell.exe
Token: 33	4228	powershell.exe
Token: 34	4228	powershell.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3256	374ef83de2b254c4970b830bb93a1dd79955945d24b824a0b35636e14355fe05.exe
3004	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe
1684	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe
3344	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe
5448	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3256 wrote to memory of 3308	3256	374ef83de2b254c4970b830bb93a1dd79955945d24b824a0b35636e14355fe05.exe	87
PID 3256 wrote to memory of 472	3256	374ef83de2b254c4970b830bb93a1dd79955945d24b824a0b35636e14355fe05.exe	88
PID 3256 wrote to memory of 5572	3256	374ef83de2b254c4970b830bb93a1dd79955945d24b824a0b35636e14355fe05.exe	89
PID 3256 wrote to memory of 3004	3256	374ef83de2b254c4970b830bb93a1dd79955945d24b824a0b35636e14355fe05.exe	93
PID 5572 wrote to memory of 1624	5572	cmd.exe	94
PID 3004 wrote to memory of 4792	3004	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe	95
PID 3004 wrote to memory of 5440	3004	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe	96
PID 3004 wrote to memory of 2460	3004	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe	97
PID 3004 wrote to memory of 6132	3004	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe	98
PID 3004 wrote to memory of 6132	3004	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe	98
PID 3004 wrote to memory of 6132	3004	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe	98
PID 3004 wrote to memory of 6132	3004	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe	98
PID 3004 wrote to memory of 6132	3004	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe	98
PID 3004 wrote to memory of 6132	3004	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe	98
PID 3004 wrote to memory of 6132	3004	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe	98
PID 3004 wrote to memory of 6132	3004	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe	98
PID 3004 wrote to memory of 6132	3004	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe	98
PID 3004 wrote to memory of 6132	3004	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe	98
PID 3004 wrote to memory of 6132	3004	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe	98
PID 3308 wrote to memory of 464	3308	cmd.exe	102
PID 472 wrote to memory of 4380	472	cmd.exe	103
PID 2460 wrote to memory of 5328	2460	cmd.exe	104
PID 4792 wrote to memory of 4436	4792	cmd.exe	105
PID 5440 wrote to memory of 2448	5440	cmd.exe	106
PID 1684 wrote to memory of 1840	1684	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe	110
PID 1684 wrote to memory of 1760	1684	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe	111
PID 1684 wrote to memory of 3988	1684	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe	112
PID 1684 wrote to memory of 5232	1684	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe	113
PID 1684 wrote to memory of 5232	1684	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe	113
PID 1684 wrote to memory of 5232	1684	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe	113
PID 1684 wrote to memory of 5232	1684	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe	113
PID 1684 wrote to memory of 5232	1684	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe	113
PID 1684 wrote to memory of 5232	1684	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe	113
PID 1684 wrote to memory of 5232	1684	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe	113
PID 1684 wrote to memory of 5232	1684	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe	113
PID 1684 wrote to memory of 5232	1684	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe	113
PID 1684 wrote to memory of 5232	1684	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe	113
PID 1684 wrote to memory of 5232	1684	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe	113
PID 1760 wrote to memory of 3756	1760	cmd.exe	117
PID 3988 wrote to memory of 4228	3988	cmd.exe	118
PID 1840 wrote to memory of 5472	1840	cmd.exe	119
PID 3344 wrote to memory of 1156	3344	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe	122
PID 3344 wrote to memory of 3260	3344	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe	123
PID 3344 wrote to memory of 4944	3344	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe	124
PID 3344 wrote to memory of 2384	3344	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe	126
PID 3344 wrote to memory of 2384	3344	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe	126
PID 3344 wrote to memory of 2384	3344	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe	126
PID 3344 wrote to memory of 2384	3344	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe	126
PID 3344 wrote to memory of 2384	3344	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe	126
PID 3344 wrote to memory of 2384	3344	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe	126
PID 3344 wrote to memory of 2384	3344	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe	126
PID 3344 wrote to memory of 2384	3344	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe	126
PID 3344 wrote to memory of 2384	3344	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe	126
PID 3344 wrote to memory of 2384	3344	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe	126
PID 3344 wrote to memory of 2384	3344	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe	126
PID 4944 wrote to memory of 1492	4944	cmd.exe	129
PID 3260 wrote to memory of 1260	3260	cmd.exe	130
PID 1156 wrote to memory of 5100	1156	cmd.exe	131
PID 5448 wrote to memory of 3096	5448	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe	133
PID 5448 wrote to memory of 2576	5448	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe	134
PID 5448 wrote to memory of 3640	5448	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe	136
PID 5448 wrote to memory of 4308	5448	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe	138
PID 5448 wrote to memory of 4308	5448	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe	138
PID 5448 wrote to memory of 4308	5448	384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe	138

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\374ef83de2b254c4970b830bb93a1dd79955945d24b824a0b35636e14355fe05.exe
"C:\Users\Admin\AppData\Local\Temp\374ef83de2b254c4970b830bb93a1dd79955945d24b824a0b35636e14355fe05.exe"
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender notification settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3256
- C:\Windows\SysWOW64\cmd.exe
  /c sc stop WinDefend
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3308
- - C:\Windows\SysWOW64\sc.exe
    sc stop WinDefend
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:464
- C:\Windows\SysWOW64\cmd.exe
  /c sc delete WinDefend
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:472
- - C:\Windows\SysWOW64\sc.exe
    sc delete WinDefend
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4380
- C:\Windows\SysWOW64\cmd.exe
  /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5572
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    - Disables one or more Microsoft Defender components
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1624
- C:\Users\Admin\AppData\Roaming\WinSocket\384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe
  C:\Users\Admin\AppData\Roaming\WinSocket\384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  - Modifies Windows Defender notification settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3004
- - C:\Windows\SysWOW64\cmd.exe
    /c sc stop WinDefend
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4792
  - - C:\Windows\SysWOW64\sc.exe
      sc stop WinDefend
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4436
- - C:\Windows\SysWOW64\cmd.exe
    /c sc delete WinDefend
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5440
  - - C:\Windows\SysWOW64\sc.exe
      sc delete WinDefend
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:2448
- - C:\Windows\SysWOW64\cmd.exe
    /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2460
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableRealtimeMonitoring $true
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5328
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:6132

C:\Users\Admin\AppData\Roaming\WinSocket\384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe
C:\Users\Admin\AppData\Roaming\WinSocket\384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender notification settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Windows\SysWOW64\cmd.exe
  /c sc stop WinDefend
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1840
- - C:\Windows\SysWOW64\sc.exe
    sc stop WinDefend
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5472
- C:\Windows\SysWOW64\cmd.exe
  /c sc delete WinDefend
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1760
- - C:\Windows\SysWOW64\sc.exe
    sc delete WinDefend
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3756
- C:\Windows\SysWOW64\cmd.exe
  /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3988
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    - Disables one or more Microsoft Defender components
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4228
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:5232

C:\Users\Admin\AppData\Roaming\WinSocket\384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe
"C:\Users\Admin\AppData\Roaming\WinSocket\384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe"
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender notification settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3344
- C:\Windows\SysWOW64\cmd.exe
  /c sc stop WinDefend
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1156
- - C:\Windows\SysWOW64\sc.exe
    sc stop WinDefend
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5100
- C:\Windows\SysWOW64\cmd.exe
  /c sc delete WinDefend
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3260
- - C:\Windows\SysWOW64\sc.exe
    sc delete WinDefend
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1260
- C:\Windows\SysWOW64\cmd.exe
  /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4944
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    - Disables one or more Microsoft Defender components
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:1492
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:2384

C:\Users\Admin\AppData\Roaming\WinSocket\384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe
"C:\Users\Admin\AppData\Roaming\WinSocket\384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe"
1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender notification settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5448
- C:\Windows\SysWOW64\cmd.exe
  /c sc stop WinDefend
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3096
- - C:\Windows\SysWOW64\sc.exe
    sc stop WinDefend
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1896
- C:\Windows\SysWOW64\cmd.exe
  /c sc delete WinDefend
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2576
- - C:\Windows\SysWOW64\sc.exe
    sc delete WinDefend
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5996
- C:\Windows\SysWOW64\cmd.exe
  /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3640
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    - Disables one or more Microsoft Defender components
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    PID:1080
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:4308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 bf337091035d3630350dd59b32e961bb72f9122b8e25263062b8acfa000eb0da
MD5 6d1575eb5e17ff1796da4881a7c9fb67
SHA1 d979ce2112ea4f3016635ee4bfc7c0a3e9213f17
SHA512 e2d9d5795c887be17638c1ce5437fdbb246d7b7cfc328310947b6c46560633da180d03386861f9b564ad4607718b2939ee145fb42fe9ce4a0af0b450b3a2a1d4
SSDEEP 384:I1eBaoT1iBViGW14b7Kgbrt0N8QC2r2Ln0IAXr4t+zWzVIzKw2vRbhNaPGlRA6ft:EexZ6V5WiHKgbrtG6QIAXrK+goUbhNaG
TLSH
T1B2A2A578213F6DC7D8D226B010D20AF7FBE4D489DAB651D4AF1BDE2F4C90EB64A60524
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_w3ohaerd.kfd.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_w3ohaerd.kfd.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe

Path C:\Users\Admin\AppData\Roaming\WinSocket\384ef93de2b264c4980b930bb93a1dd89966946d24b924a0b36737e14366fe06.exe
Size 456KB
SHA256 374ef83de2b254c4970b830bb93a1dd79955945d24b824a0b35636e14355fe05
MD5 b855b1b7b59668ad991cf0501e4ff4cb
SHA1 581283899259e80b7da5d8be25f6ed1de58fdfac
SHA512 71e59b09678df1dca36caca3280687723406c2ccf638e2d7e57a34ea099fb269646730966c96d89dcaab23914f1915664fac4491f09bb17216ed3f3c6acb64c6
SSDEEP 6144:zJB0PLonpe1h5fqpErm9cRLBOtFWaCfmAU+wDhuN:zJB0lh5aILwtFPCfmAUtG
TLSH
T199A45D29EB557976F2530976B600699F2C818C391293DF4AAF4289CDB801DE3F2F5327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.ini

Path C:\Users\Admin\AppData\Roaming\WinSocket\settings.ini
Size 42KB
SHA256 537cea81d13632b6caf8ff5ff622da7b9727d44caa7d82e21dc32dfabe91a2f9
MD5 7cc214443a61ef9f70417e6dd7a67ed5
SHA1 4255013f89bb4c0de7f39d11381aad27c1acc3de
SHA512 6124fd66b79574ef4d9554acdc1958b7d985ad84ab167dc372e2195405f8aba00c9e7f48d08c60533eaf096d5c2e0aa18cf879d72004c3f2b40f8f1641559ead
SSDEEP 768:jy1L3viiZ0v8f0Dx9epz91H1hMysVLlJNEkSvIgOvVkY+sfVgmVzQv+XNvLv6v89:giD0JAv
TLSH
T140131D448867ED0BCE5B11B87E329CB1E9B8D8246419E12BF5EF0994559FC4CDAF28F0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 fe9ef6d82dcff2f017e5404044f1572221812be5ccaf9ed20b55e40dfbf14d9c
MD5 7df51511bba29b52b6f71f09f4e4e8cc
SHA1 ef9ba0e3799c45ef47a3399f5b7b1cfe11acf399
SHA512 2846a4615b526f6d5bb90d505c4438ce7c981a8e979be8554af268cd2814788894909a245a51c016e3e7d05bf9d630c97255dd31f2819aa7c251bdebce66d230
SSDEEP 384:u1eBaoT1iBV6GW14bhDfx/pl+5xbFi0U0g2Pn5IAXr4taWmUXzKw6vRbhNaPWlR5:+exZ6VhWitLFD+52TmRIAXrKrLQbhNaG
TLSH
T1CFA2B578213F6DC7D8D226B410D10AE7FBE4D489DAF611D4BF2BDE2F4C90AB64A60524
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1080-191-0x0000000004750000-0x0000000004AAB000-memory.dmp

Download

memory/1080-193-0x0000000070CB0000-0x0000000070CFC000-memory.dmp

Download

memory/1492-152-0x00000000048B0000-0x00000000048FC000-memory.dmp

Download

memory/1492-153-0x0000000070CB0000-0x0000000070CFC000-memory.dmp

Download

memory/1492-156-0x0000000005B10000-0x0000000005BB3000-memory.dmp

Download

memory/1624-68-0x0000000074DE0000-0x0000000074E2C000-memory.dmp

Download

memory/1624-57-0x0000000005720000-0x0000000005742000-memory.dmp

Download

memory/1624-60-0x00000000058A0000-0x0000000005BFB000-memory.dmp

Download

memory/1624-65-0x0000000005DC0000-0x0000000005DDE000-memory.dmp

Download

memory/1624-66-0x0000000006110000-0x000000000615C000-memory.dmp

Download

memory/1624-56-0x0000000004F80000-0x00000000055CA000-memory.dmp

Download

memory/1624-67-0x0000000006380000-0x00000000063B6000-memory.dmp

Download

memory/1624-55-0x00000000048F0000-0x0000000004926000-memory.dmp

Download

memory/1624-75-0x0000000006FB0000-0x0000000007053000-memory.dmp

Download

memory/1684-91-0x0000000002220000-0x0000000002221000-memory.dmp

Download

memory/1684-96-0x0000000002220000-0x0000000002221000-memory.dmp

Download

memory/1684-110-0x0000000003C40000-0x0000000003D07000-memory.dmp

Download

memory/1684-111-0x0000000003D10000-0x00000000040B1000-memory.dmp

Download

memory/1684-97-0x0000000002220000-0x0000000002221000-memory.dmp

Download

memory/1684-98-0x0000000002220000-0x0000000002221000-memory.dmp

Download

memory/1684-101-0x0000000010000000-0x0000000010007000-memory.dmp

Download

memory/1684-95-0x0000000002220000-0x0000000002221000-memory.dmp

Download

memory/1684-88-0x0000000002220000-0x0000000002221000-memory.dmp

Download

memory/1684-89-0x0000000002220000-0x0000000002221000-memory.dmp

Download

memory/1684-87-0x0000000002220000-0x0000000002221000-memory.dmp

Download

memory/1684-90-0x0000000002220000-0x0000000002221000-memory.dmp

Download

memory/1684-92-0x0000000002220000-0x0000000002221000-memory.dmp

Download

memory/1684-93-0x0000000002220000-0x0000000002221000-memory.dmp

Download

memory/1684-94-0x0000000002220000-0x0000000002221000-memory.dmp

Download

memory/2384-159-0x0000000010000000-0x000000001001E000-memory.dmp

Download

memory/3004-35-0x0000000002A50000-0x0000000002A51000-memory.dmp

Download

memory/3004-28-0x0000000002A50000-0x0000000002A51000-memory.dmp

Download

memory/3004-52-0x0000000003BE0000-0x0000000003CA7000-memory.dmp

Download

memory/3004-53-0x0000000003CB0000-0x0000000004051000-memory.dmp

Download

memory/3004-54-0x0000000002AD0000-0x0000000002AF9000-memory.dmp

Download

memory/3004-31-0x0000000002A50000-0x0000000002A51000-memory.dmp

Download

memory/3004-33-0x0000000002A50000-0x0000000002A51000-memory.dmp

Download

memory/3004-24-0x0000000002A50000-0x0000000002A51000-memory.dmp

Download

memory/3004-32-0x0000000002A50000-0x0000000002A51000-memory.dmp

Download

memory/3004-39-0x0000000002AD0000-0x0000000002AF9000-memory.dmp

Download

memory/3004-38-0x0000000002A50000-0x0000000002A51000-memory.dmp

Download

memory/3004-30-0x0000000002A50000-0x0000000002A51000-memory.dmp

Download

memory/3004-29-0x0000000002A50000-0x0000000002A51000-memory.dmp

Download

memory/3004-27-0x0000000002A50000-0x0000000002A51000-memory.dmp

Download

memory/3004-40-0x0000000010000000-0x0000000010007000-memory.dmp

Download

memory/3004-45-0x0000000002B30000-0x0000000002B31000-memory.dmp

Download

memory/3004-26-0x0000000002A50000-0x0000000002A51000-memory.dmp

Download

memory/3004-25-0x0000000002A50000-0x0000000002A51000-memory.dmp

Download

memory/3004-46-0x0000000010000000-0x0000000010007000-memory.dmp

Download

memory/3004-34-0x0000000002A50000-0x0000000002A51000-memory.dmp

Download

memory/3256-5-0x00000000023B0000-0x00000000023B1000-memory.dmp

Download

memory/3256-17-0x00000000023B0000-0x00000000023B1000-memory.dmp

Download

memory/3256-12-0x00000000023B0000-0x00000000023B1000-memory.dmp

Download

memory/3256-8-0x00000000023B0000-0x00000000023B1000-memory.dmp

Download

memory/3256-6-0x00000000023B0000-0x00000000023B1000-memory.dmp

Download

memory/3256-14-0x00000000023B0000-0x00000000023B1000-memory.dmp

Download

memory/3256-15-0x00000000023D0000-0x00000000023F9000-memory.dmp

Download

memory/3256-18-0x00000000023D0000-0x00000000023F9000-memory.dmp

Download

memory/3256-7-0x00000000023B0000-0x00000000023B1000-memory.dmp

Download

memory/3256-2-0x00000000023B0000-0x00000000023B1000-memory.dmp

Download

memory/3256-13-0x00000000023B0000-0x00000000023B1000-memory.dmp

Download

memory/3256-11-0x00000000023B0000-0x00000000023B1000-memory.dmp

Download

memory/3256-10-0x00000000023B0000-0x00000000023B1000-memory.dmp

Download

memory/3256-9-0x00000000023B0000-0x00000000023B1000-memory.dmp

Download

memory/3256-4-0x00000000023B0000-0x00000000023B1000-memory.dmp

Download

memory/3256-3-0x00000000023B0000-0x00000000023B1000-memory.dmp

Download

memory/3256-20-0x00000000023D0000-0x00000000023F9000-memory.dmp

Download

memory/3344-136-0x0000000000F00000-0x0000000000F01000-memory.dmp

Download

memory/3344-149-0x0000000001F60000-0x0000000002301000-memory.dmp

Download

memory/3344-133-0x0000000000F00000-0x0000000000F01000-memory.dmp

Download

memory/3344-148-0x0000000001E90000-0x0000000001F57000-memory.dmp

Download

memory/3344-135-0x0000000000F00000-0x0000000000F01000-memory.dmp

Download

memory/3344-126-0x0000000000F00000-0x0000000000F01000-memory.dmp

Download

memory/3344-125-0x0000000000F00000-0x0000000000F01000-memory.dmp

Download

memory/3344-127-0x0000000000F00000-0x0000000000F01000-memory.dmp

Download

memory/3344-128-0x0000000000F00000-0x0000000000F01000-memory.dmp

Download

memory/3344-130-0x0000000000F00000-0x0000000000F01000-memory.dmp

Download

memory/3344-131-0x0000000000F00000-0x0000000000F01000-memory.dmp

Download

memory/3344-129-0x0000000000F00000-0x0000000000F01000-memory.dmp

Download

memory/3344-132-0x0000000000F00000-0x0000000000F01000-memory.dmp

Download

memory/3344-134-0x0000000000F00000-0x0000000000F01000-memory.dmp

Download

memory/4228-116-0x0000000006880000-0x00000000068CC000-memory.dmp

Download

memory/4228-117-0x0000000070C20000-0x0000000070C6C000-memory.dmp

Download

memory/4228-114-0x0000000005D40000-0x000000000609B000-memory.dmp

Download

memory/5328-69-0x0000000074DE0000-0x0000000074E2C000-memory.dmp

Download

memory/5328-78-0x0000000007910000-0x000000000791A000-memory.dmp

Download

memory/5328-77-0x00000000078A0000-0x00000000078BA000-memory.dmp

Download

memory/5328-76-0x0000000007EE0000-0x000000000855C000-memory.dmp

Download

memory/5328-79-0x0000000007B10000-0x0000000007BA6000-memory.dmp

Download

memory/5328-74-0x00000000074C0000-0x00000000074E0000-memory.dmp

Download

memory/5328-58-0x0000000005FB0000-0x0000000006016000-memory.dmp

Download

memory/5328-59-0x0000000006020000-0x0000000006086000-memory.dmp

Download

memory/5448-166-0x0000000000E90000-0x0000000000E91000-memory.dmp

Download

memory/5448-165-0x0000000000E90000-0x0000000000E91000-memory.dmp

Download

memory/5448-164-0x0000000000E90000-0x0000000000E91000-memory.dmp

Download

memory/6132-47-0x0000000010000000-0x000000001001E000-memory.dmp

Download

memory/6132-48-0x0000000010000000-0x000000001001E000-memory.dmp

Download