Analysis
- max time kernel
58s - max time network
61s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/09/2026, 20:12
Behavioral task
behavioral1
Sample
64d1612fc0f0ffe26467a7be5c5438e1c3ed1155052f5d941caab40ce0346e42.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
16 signatures
60 seconds
Behavioral task
behavioral2
Sample
64d1612fc0f0ffe26467a7be5c5438e1c3ed1155052f5d941caab40ce0346e42.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
21 signatures
60 seconds
General
- Target 64d1612fc0f0ffe26467a7be5c5438e1c3ed1155052f5d941caab40ce0346e42.exe
- Size 1.2MB
- Sample260916-yy5cbsdf53
- SHA256 64d1612fc0f0ffe26467a7be5c5438e1c3ed1155052f5d941caab40ce0346e42
- MD5 f7ce06aac970075ac0d92c9249eaa3b3
- SHA1 e1d81878ecd320b7ca2562277191f00655d4d593
- SHA512 4fcea5fee0c20c87351ad4b0d99589868226ae9cb8a2a2884b0ce94fb2e1bc0a8338c1361007cac093e6993170933a78c3830f1212f27fc0695a64361d800155
- SSDEEP 24576:45GXkH4nnwitNfuq9wgsdy3V5vgNyo3Py5yOdCN/j2GLl3iFSE33b9:4sXkHuXJOspgNx3a5qN/j2U4FH
- TLSH T19545C059A39402F8D0BBC235C5828527E7B2BC465571472F03D70E9B2F277A19F3AB26
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
remcos
Version
-
7.3.1 Pro
Botnet
-
tele@engineer_at_meta
C2
-
daksh.in.net:8080
-
appgo88.company:8080
-
33win.com:8080
-
liman3d.com:8080
-
hay88.london:8080
-
nohu90.com:8080
-
ee88-com.asia:8080
-
digitalwala.in.net:8080
-
u888d9.com:8080
-
jinyazhou888.net:8080
-
yakuza88.co:8080
-
jilicasinos.net:8080
-
imo88slot.co:8080
-
106nk88.com:8080
-
68gbsg.com:8080
-
f5tech.in:8080
-
saudi365.co:8080
-
ok365.org:8080
Attributes
-
audio_folder
MicRecords
-
audio_path
ApplicationPath
-
audio_record_time
3
-
connect_delay
0
-
connect_interval
1
-
copy_file
tele@engineer_at_meta.exe
-
copy_folder
Remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
true
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
mouse_option
false
-
mutex
Rmc-7IXOGO
-
screenshot_crypt
false
-
screenshot_flag
true
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
3
- startup_value
-
take_screenshot_option
true
-
take_screenshot_time
5
Signatures
- Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ 64d1612fc0f0ffe26467a7be5c5438e1c3ed1155052f5d941caab40ce0346e42.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Rmc-7IXOGO = "\"C:\\ProgramData\\Remcos\\tele@engineer_at_meta.exe\"" 64d1612fc0f0ffe26467a7be5c5438e1c3ed1155052f5d941caab40ce0346e42.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ tele@engineer_at_meta.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Rmc-7IXOGO = "\"C:\\ProgramData\\Remcos\\tele@engineer_at_meta.exe\"" tele@engineer_at_meta.exe - Executes dropped EXE 12 IoCs
pid Process 2928 tele@engineer_at_meta.exe 4412 elevation_service.exe 124 elevation_service.exe 3804 maintenanceservice.exe 6092 OSE.EXE 4316 PerceptionSimulationService.exe 5936 perfhost.exe 1524 ReFsDedupSvc.exe 2644 SensorDataService.exe 4956 ssh-agent.exe 3312 AgentService.exe 2156 SearchIndexer.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-7IXOGO = "\"C:\\ProgramData\\Remcos\\tele@engineer_at_meta.exe\"" 64d1612fc0f0ffe26467a7be5c5438e1c3ed1155052f5d941caab40ce0346e42.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-7IXOGO = "\"C:\\ProgramData\\Remcos\\tele@engineer_at_meta.exe\"" 64d1612fc0f0ffe26467a7be5c5438e1c3ed1155052f5d941caab40ce0346e42.exe Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-7IXOGO = "\"C:\\ProgramData\\Remcos\\tele@engineer_at_meta.exe\"" tele@engineer_at_meta.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-7IXOGO = "\"C:\\ProgramData\\Remcos\\tele@engineer_at_meta.exe\"" tele@engineer_at_meta.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe - Drops file in System32 directory 28 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\system32\SearchIndexer.exe tele@engineer_at_meta.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 64d1612fc0f0ffe26467a7be5c5438e1c3ed1155052f5d941caab40ce0346e42.exe File opened for modification C:\Windows\System32\alg.exe tele@engineer_at_meta.exe File opened for modification C:\Windows\System32\msdtc.exe tele@engineer_at_meta.exe File opened for modification C:\Windows\SysWow64\perfhost.exe tele@engineer_at_meta.exe File opened for modification C:\Windows\system32\locator.exe tele@engineer_at_meta.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe tele@engineer_at_meta.exe File opened for modification C:\Windows\system32\AppVClient.exe tele@engineer_at_meta.exe File opened for modification C:\Windows\system32\msiexec.exe tele@engineer_at_meta.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe tele@engineer_at_meta.exe File opened for modification C:\Windows\System32\snmptrap.exe tele@engineer_at_meta.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe tele@engineer_at_meta.exe File opened for modification C:\Windows\System32\vds.exe tele@engineer_at_meta.exe File opened for modification C:\Windows\system32\wbengine.exe tele@engineer_at_meta.exe File opened for modification C:\Windows\System32\alg.exe 64d1612fc0f0ffe26467a7be5c5438e1c3ed1155052f5d941caab40ce0346e42.exe File opened for modification C:\Windows\system32\AppVClient.exe 64d1612fc0f0ffe26467a7be5c5438e1c3ed1155052f5d941caab40ce0346e42.exe File opened for modification C:\Windows\system32\dllhost.exe 64d1612fc0f0ffe26467a7be5c5438e1c3ed1155052f5d941caab40ce0346e42.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\66a62f18b68fd3f0.bin elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe tele@engineer_at_meta.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe tele@engineer_at_meta.exe File opened for modification C:\Windows\system32\TieringEngineService.exe tele@engineer_at_meta.exe File opened for modification C:\Windows\system32\vssvc.exe tele@engineer_at_meta.exe File opened for modification C:\Windows\system32\dllhost.exe tele@engineer_at_meta.exe File opened for modification C:\Windows\System32\GameInputSvc.exe tele@engineer_at_meta.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe tele@engineer_at_meta.exe File opened for modification C:\Windows\system32\AgentService.exe tele@engineer_at_meta.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe tele@engineer_at_meta.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log maintenanceservice.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\7-Zip\7z.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116093\java.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 64d1612fc0f0ffe26467a7be5c5438e1c3ed1155052f5d941caab40ce0346e42.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe tele@engineer_at_meta.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe tele@engineer_at_meta.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 64d1612fc0f0ffe26467a7be5c5438e1c3ed1155052f5d941caab40ce0346e42.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe tele@engineer_at_meta.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c9ed15c11746dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically." SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a42e51c01746dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rmi SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asf SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mycomput.dll,-300 = "Computer Management" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000684127c01746dd01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ae5187c01746dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ab9a97c01746dd01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e4d9f2c01746dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Defender Firewall with Advanced Security" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2TS SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file" SearchProtocolHost.exe - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 2928 tele@engineer_at_meta.exe 2928 tele@engineer_at_meta.exe 2928 tele@engineer_at_meta.exe 2928 tele@engineer_at_meta.exe 2928 tele@engineer_at_meta.exe 2928 tele@engineer_at_meta.exe 2928 tele@engineer_at_meta.exe 2928 tele@engineer_at_meta.exe 2928 tele@engineer_at_meta.exe 2928 tele@engineer_at_meta.exe 2928 tele@engineer_at_meta.exe 2928 tele@engineer_at_meta.exe 2928 tele@engineer_at_meta.exe 2928 tele@engineer_at_meta.exe 2928 tele@engineer_at_meta.exe 2928 tele@engineer_at_meta.exe 2928 tele@engineer_at_meta.exe 2928 tele@engineer_at_meta.exe 2928 tele@engineer_at_meta.exe 2928 tele@engineer_at_meta.exe 2928 tele@engineer_at_meta.exe 2928 tele@engineer_at_meta.exe 2928 tele@engineer_at_meta.exe 2928 tele@engineer_at_meta.exe 2928 tele@engineer_at_meta.exe 2928 tele@engineer_at_meta.exe 2928 tele@engineer_at_meta.exe 2928 tele@engineer_at_meta.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2928 tele@engineer_at_meta.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 812 Process not Found 812 Process not Found - Suspicious use of AdjustPrivilegeToken 21 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 3664 64d1612fc0f0ffe26467a7be5c5438e1c3ed1155052f5d941caab40ce0346e42.exe Token: 33 2648 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2648 AUDIODG.EXE Token: SeBackupPrivilege 1524 ReFsDedupSvc.exe Token: SeRestorePrivilege 1524 ReFsDedupSvc.exe Token: SeBackupPrivilege 1524 ReFsDedupSvc.exe Token: SeRestorePrivilege 1524 ReFsDedupSvc.exe Token: SeBackupPrivilege 1524 ReFsDedupSvc.exe Token: SeRestorePrivilege 1524 ReFsDedupSvc.exe Token: SeBackupPrivilege 1524 ReFsDedupSvc.exe Token: SeRestorePrivilege 1524 ReFsDedupSvc.exe Token: SeBackupPrivilege 1524 ReFsDedupSvc.exe Token: SeRestorePrivilege 1524 ReFsDedupSvc.exe Token: SeAssignPrimaryTokenPrivilege 3312 AgentService.exe Token: 33 2156 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 2156 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2156 SearchIndexer.exe Token: SeDebugPrivilege 2928 tele@engineer_at_meta.exe Token: SeDebugPrivilege 2928 tele@engineer_at_meta.exe Token: SeDebugPrivilege 2928 tele@engineer_at_meta.exe Token: SeDebugPrivilege 2928 tele@engineer_at_meta.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2928 tele@engineer_at_meta.exe - Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2928 tele@engineer_at_meta.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 3664 wrote to memory of 2928 3664 64d1612fc0f0ffe26467a7be5c5438e1c3ed1155052f5d941caab40ce0346e42.exe 90 PID 2156 wrote to memory of 4388 2156 SearchIndexer.exe 104 PID 2156 wrote to memory of 5148 2156 SearchIndexer.exe 105 PID 2156 wrote to memory of 2308 2156 SearchIndexer.exe 106 PID 2156 wrote to memory of 4836 2156 SearchIndexer.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\64d1612fc0f0ffe26467a7be5c5438e1c3ed1155052f5d941caab40ce0346e42.exe"C:\Users\Admin\AppData\Local\Temp\64d1612fc0f0ffe26467a7be5c5438e1c3ed1155052f5d941caab40ce0346e42.exe"1⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\ProgramData\Remcos\tele@engineer_at_meta.exe"C:\ProgramData\Remcos\tele@engineer_at_meta.exe"2⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2928
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4412
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:124
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x0000000000000504 0x00000000000005081⤵
- Suspicious use of AdjustPrivilegeToken
PID:2648
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3804
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:6092
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:4316
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5936
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1524
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2644
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:4956
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3312
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:4388
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-461973139-3212354679-1508698038-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:5148
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2876 2872 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:2308
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2920 2916 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:4836
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:3020
Network
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 b8459f1123fe983e3d2fa2e6dff0cb78f9abf34c7e7a1d1ff79fb9193bfc456b
- MD5 9e12d6d29f60257297063fbb7370ae49
- SHA1 776558577f4f900cca4d6626931e638dd9714ed7
- SHA512 44675e384279d3fe6395cde9641feed55c20c718afc8f6413874096d8b38df8bd55394c7c3759bc47119245c5f4bca198556a605c670e7d2b1510e6d8a1fb7b0
- SSDEEP 49152:mb+632BuPkFKRrdE6ohmstBhuXjfS4LWxneN/j2U4FH:Y3q6HjB/j2jF
- TLSH T1F5D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 1.8MB
- SHA256 01b152166ad61bef3f9498249f88d9e9967e63c7b1d797c5498b3b286a30af09
- MD5 5c3953617025e732e3244700560b7abd
- SHA1 af45df170959912a7f021eb346ba5d1be20cbe21
- SHA512 f276913c63750413403d36057d92f3cf6e7d609a196bedda37a150574867fdb6531b3245b3b16b43dcc7967dd0fb860eee7fb4f0ebde7df52e09ee18d1e53024
- SSDEEP 12288:M1XLsswWkxy2lRq2czAWJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:6XYfDtczAadCN/j2GLl3iFSE33b9
- TLSH T1A585F128B7E409F9EC67827CC9A1C511E632B8948760E7CB03E49A661F337D85D3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 1.7MB
- SHA256 3f462274cb18528d8a20328a27efcf0d051b4e6963e6f1f8312b788ad6f531bf
- MD5 3fe30de417bc1dbbbedb4db21d831990
- SHA1 edbd8d339fe08feb6b1b1a027b0479f3438f54e4
- SHA512 66c1a8612c628ce6314cd9a9a95296612f703128461a2276d8ad90c7e5da8b5c8a1e2d805c28ec5a9697bac9cff190adaddcf9dd2a1ec3994902b4a87c7b62f0
- SSDEEP 12288:vmw5HEjsChNVBFgl0WDm+CXJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:OwuoOW4dCN/j2GLl3iFSE33b9
- TLSH T18085F14577E41CF9E96782398697C536F7B2BC512A21CB0F0360C69B6F37361AD2A720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 20560327f94cb1d6afda6c34c326e3cbf30b3868684d3a09bc3623a28a2dd0b3
- MD5 d9804376e35a67daefc8f0143b6fcb3d
- SHA1 a08945c7387afa03044f21d7ef51b5cdee44d1f0
- SHA512 9d1b00c20d4d9d0a5d87be3c1f56a109ec3e44a968b6abb0c8868bef086816cb188b51d9a76f1cc26620bb42d82537618e6777cf2a6ce0fa62b56f0f896d1b46
- SSDEEP 49152:HB+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl6N/j2U4FH:Ju6JmVxd2daj2jF
- TLSH T113D59D13F1DA01E8D06ED178974A9233FA62BC490B35B6DF0A9073562A77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 1.1MB
- SHA256 e952a7e44fd0f797c10b80277382d3ca4cbd7cfcb9fded10ae047fa32feae397
- MD5 36479694ad3b3964fd58c697f784a1fe
- SHA1 e436f7e959adc838b5d1896740759824b6217d5b
- SHA512 bd524960a0e19b275ec4c7235a37349f1464350d4a7014d813f7709c1020cb14d836ac4f27f4f4506356f5d00b8be44683ef26bfa0b843a8d8a2ddf8ac56ff12
- SSDEEP 12288:MAios0h+ZcJ1ycDPxQCiHn28YGxThO140lmkFBV0jFXH:M0D+qfDpQCiH28YcThOy0lmKV0Z
- TLSH T12B3507007666CB4FC6A980325E37D1CCAB707D11EE05AF0773C9873E9576A59BAF2281
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 390KB
- SHA256 1366685b4a6eecce03d7eae87f0b8a1b953db74ee677132155866d343d2b5408
- MD5 69f59e9371b6b45bfb01bbf78fe72957
- SHA1 e2e1936fa080cc5a06124102b400f2012f957f51
- SHA512 f70be8534784f70cee844afa8adb679f5d4d4a8edd3f3d36e1f65e7d28dcac62fdecf1ee6b6ffcaa06b024a7cb65c90af7953df35326931930998dfbbcbdeae7
- SSDEEP 1536:KkOWNJHKNYedKs1yuNJS72AZLG1pAR6dJRJ+fo:5bNJ2Is9JY2KLLIH
- TLSH T13D84F802B335E34FC4B98077983196CEAB38BC129F526E023BD51CB5C8F2159B5B6B95
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Remcos\tele@engineer_at_meta.exe
- Size 1.2MB
- SHA256 64d1612fc0f0ffe26467a7be5c5438e1c3ed1155052f5d941caab40ce0346e42
- MD5 f7ce06aac970075ac0d92c9249eaa3b3
- SHA1 e1d81878ecd320b7ca2562277191f00655d4d593
- SHA512 4fcea5fee0c20c87351ad4b0d99589868226ae9cb8a2a2884b0ce94fb2e1bc0a8338c1361007cac093e6993170933a78c3830f1212f27fc0695a64361d800155
- SSDEEP 24576:45GXkH4nnwitNfuq9wgsdy3V5vgNyo3Py5yOdCN/j2GLl3iFSE33b9:4sXkHuXJOspgNx3a5qN/j2U4FH
- TLSH T19545C059A39402F8D0BBC235C5828527E7B2BC465571472F03D70E9B2F277A19F3AB26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\66a62f18b68fd3f0.bin
- Size 12KB
- SHA256 056e8b578d92fb21580d90166d21a15fc745c171fe36f000888f397369624ad8
- MD5 8f3118b36f27c10d72966f5fbface087
- SHA1 e275a73331aceba1eaccae07b3472d388d4b806b
- SHA512 6b61f08b1d31611143be7bbf3bd0f9b5ac25ac862018a579e868c4817a47383ca0d7a1ca22ca35d6988e12129dac176d0fb62ed1e99b59ff83393aff95ce74f8
- SSDEEP 384:O3C825pPfNag3X7WBtUHQH2Ux0QzpkEx9s:O3aHUcX7WjH7rPHs
- TLSH T11E42C0971CACA0945A526CAB8CD93686DFEE68E6C4531628C82F1ECD926BE41180F359
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 1.5MB
- SHA256 b5db5353f5f7f231a88e932c75f9514fc5784fcab4d9086eeac5f290e986c904
- MD5 0d94609b26673d46791c4df4f887b057
- SHA1 db1bc3a73ac367d4323946e1a5e61daa3c6ef4d0
- SHA512 8fa3c2652296d7c1016a829926b676029a263098992684e7a97c1ab4bd99ec999b56981632d624d3d4bbc0fbf818817257c54a930ffe341e2c39a804de270556
- SSDEEP 12288:2M7FJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFHi:zBdCN/j2GLl3iFSE33b97
- TLSH T12F752360D7A9BA55F47A837802ADDA316200FEF8EB1184C7C54167EB6278FD89832563
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 3e8d41d8d6f49a06882fca42e06adc71bef48fe60a4501524ac06bb141048fe4
- MD5 925c159db85e402585aadd2994ca9deb
- SHA1 96f1b707859c4b8de5c0086ed7b636ef22fb194f
- SHA512 fd2204498a0669034ae6281c9241def0cdb73929202c5fbe01689783f74546951b80717bdd068ea54146d39b15bdcaacfa5a9d4f2b4b1886c8b13777cf19d9c5
- SSDEEP 24576:Xgb6bmBIi49WNNFpg1rSvFv7bYXdCN/j2GLl3iFSE33b9:Xgb4mBIBhGFbN/j2U4FH
- TLSH T15565AE1E22EC02F5E0FAD2B88DAA4417D6B278165731D2CF1151427D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 2.0MB
- SHA256 fba6fed133d236913d78b039c3e6c432e38454a76570e8039e4ea6b27ef4d539
- MD5 7149d9ae005ff4a031a0bc72965cb1ab
- SHA1 abe48603615916eae53af701c8cd0dbfe29e6895
- SHA512 c2b38efe98b6071f9973ece6df572a4946bf73c81e96300e7041d30310d70835c370e1fccf5a81f9d459baae883cabde1c0e99e389e2afbfabf31dcb8ad3fe75
- SSDEEP 24576:FG88u8FpJqH1bzria7/mgdCN/j2GLl3iFSE33b9:o7ZFPqVea7/MN/j2U4FH
- TLSH T106A5F16576E101F0D47BD1388A864663F671B8251364EFDF07A88B961F23BE44B3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 1.7MB
- SHA256 9b44504890f9ed38c7bc45a344c744bd0babd172d43afe8fd08bafaea4f55b68
- MD5 24f6f6a5433e6d98f91844a73d13d3ea
- SHA1 45d318ea0d49e96fe14bef68ebef3efea8240544
- SHA512 2372a45f6aa3996a7f544c4bfc09e70aa295e0566754cff53a999f7bcfb0da9f6b69530ac78c9cc33dec029f8e6c543f8accd36197809ecb3faa8c576e5cff15
- SSDEEP 12288:CHvUrBFrEjwaQ8JNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:CPUr+NQ0dCN/j2GLl3iFSE33b9
- TLSH T11F85F22E62E818E5E67AD17D86868719F731B8615712D2CF02D0817E4F77EE8BC39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 2597b2cf39381725ea9dbf9b7e1d7ea70446e15417358476b3bddefe80504374
- MD5 c09e9bc599be76e44c1ee824404b85af
- SHA1 5d477dbe4ba078ca97b3d7593239e8011c2f9815
- SHA512 7f1093b846b46ef7d86226b4644e16c891fa644d6409c382be33420be5e044779e426e2147ddd4e741666f9a9558902b848d0841edcfa155b7b4f1f714c8e580
- SSDEEP 49152:lBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjvN/j2U4FH:uG05lO43bSj2jF
- TLSH T107D5CF6A62EC11F9D1BBC17CDAC64A0BEBB23815033556CF02A486A91F27FF4957E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 547929e16d757050141c3576a0aa88ff0832c5a1dd915515fcb5afdfc04bc082
- MD5 0a70b42c9876adc4020c3dc52c01871f
- SHA1 3915358819de78f06c3f60c9702c1f7b4440ca0a
- SHA512 27ff98e68ce3a754152cad17d676a0c170004a32456035df654e42ffcc3e6955cba94a58ccd00425f930266aa7c26a832f5092f62a158c50c1efa2dc5653ac65
- SSDEEP 24576:Rfa5POZ3dpFWVM50JicR2hG0lasx2+47eidn6dCN/j2GLl3iFSE33b9:xa5POZ3+Jt2pasx2+mnN/j2U4FH
- TLSH T1F865BF5DA6FC01D5D1B9D17DC5838A1AF5B1342553329BCB022182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 8906935ebb1241dc4b802b8b4e5b6150051089c6ea79f746101d3aa8e77267be
- MD5 18d4bf1d85dc2a70b24ed531196f44eb
- SHA1 62cd129f24e200e0a7960db11ed101aac867c556
- SHA512 ec9dffb680b1f3e57dfb3fab162d12c31632d69e141a4bc48cf969824e1f21c0e51e54b044383124123e0df549f1203d571513136b670b1c38e3654db6c40531
- SSDEEP 24576:5NcwHdjbyQ4nLC18lb/EOjowL7FkYdCN/j2GLl3iFSE33b9:5Nc/zEOVHFsN/j2U4FH
- TLSH T118857B2623E901E4F1BBE1BE89779546FA71786553308ACF0291851B1E73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 79603d28359d0d92b183528250d747017b2a3e095ecdeec40d09ce194ebfd8fc
- MD5 b2921ded76535bcc0a72484edc569eb0
- SHA1 da03f5e495c2aa361193d8e5363a938de0451cd6
- SHA512 0988b0f78a80399ca18cfbada0ace57466acde432ce489c69fd15ce4ae30b55c9767fa045589d398633c3694a417b4ccaac1d4c81bd7c26fe12a6b4d78e479f6
- SSDEEP 24576:08kNvNnaFeYhJNtmZBm5dCN/j2GLl3iFSE33b9:08MwBtOmON/j2U4FH
- TLSH T10255AF6EBAF846E4D1FEC6B58E238512E6727461173293CB4290C13F0E679D89D36F21
- MD5 SHA1 SHA512 SSDEEP TLSH