Resubmissions
18/09/2026, 14:18
260918-rmhkvsxtes1022/08/2026, 10:50
260822-mxk2hseg881022/08/2026, 10:36
260822-mnhj2axybz1001/08/2026, 21:00
260801-zts9yaxwfs04/07/2026, 18:23
260704-w1vvkafw7r504/07/2026, 18:21
260704-wzqjfsfw2q10Analysis
- user interaction
yes - max time kernel
252s - max time network
255s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/09/2026, 14:18
Static task
static1
1 signatures
General
- Target NotPetya.dll
- Size 353KB
- Sample260918-rmhkvsxtes
- SHA256 027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745
- MD5 71b6a493388e7d0b40c83ce903bc6b04
- SHA1 34f917aaba5684fbe56d3c57d48ef2a1aa7cf06d
- SHA512 072205eca5099d9269f358fe534b370ff21a4f12d7938d6d2e2713f69310f0698e53b8aff062849f0b2a521f68bee097c1840993825d2a5a3aa8cf4145911c6f
- SSDEEP 6144:y/Bt80VmNTBo/x95ZjAetGDN3VFNq7pC+9OqFoK30b3ni5rdQY/CdUOs2:y/X4NTS/x9jNG+w+9OqFoK323qdQYKUG
- TLSH T1BC74126171C341B2F1F38A3455CAB75B8FFDE06687B065CECA2B1A0A1821746F739297
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Family: Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
- mimikatz is an open source tool to dump credentials on Windows 1 IoCs
resource yara_rule behavioral1/files/0x000500000001b855-16.dat mimikatz - Deletes itself 1 IoCs
pid Process 4804 rundll32.exe - Executes dropped EXE 1 IoCs
pid Process 5700 6B33.tmp - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 rundll32.exe - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\LogFiles\WMI\FaceTelManually.etl svchost.exe File opened for modification C:\WINDOWS\SYSTEM32\WINBIODATABASE\51F39552-1075-4199-B513-0C10EA185DB0.DAT svchost.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Sign White Paper.pdf rundll32.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\win32\jni_md.h rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.PPT rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\POSTIT.CFG rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\RESEND.CFG rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\ENUtxt.pdf rundll32.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\java.settings.cfg rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\REC.CFG rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf rundll32.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\jawt.h rundll32.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\deploy\ffjcext.zip rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\CNFRES.CFG rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\RSSITEM.CFG rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\SCHDCNCL.CFG rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\PDFSigQFormalRep.pdf rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileAcrobatCard_Dark.pdf rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileAcrobatCard_Light.pdf rundll32.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCallbacks.h rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\REPORT.CFG rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Click on 'Change' to select default PDF handler.pdf rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\MobileScanCard_Dark.pdf rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Cloud Services.pdf rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Welcome.pdf rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\SMIMEE.CFG rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\TASKUPD.CFG rundll32.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\classfile_constants.h rundll32.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgePackages.h rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\IPM.CFG rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\OMSMMS.CFG rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\SECREC.CFG rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner_Light.pdf rundll32.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\win32\jawt_md.h rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SAMPLES\SOLVSAMP.XLS rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\BIN\1033\FPEXT.MSG rundll32.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.cfg rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Complex Machine.pdf rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\REPLTMPL.CFG rundll32.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPP.VBS rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.PPT rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\CONTACT.CFG rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\INFOMAIL.CFG rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\SIGN.CFG rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\SHELLNEW\EXCEL12.XLSX rundll32.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrome.7z rundll32.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\jdwpTransport.h rundll32.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\jni.h rundll32.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\jvmticmlr.h rundll32.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\amd64\jvm.cfg rundll32.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\deploy\ffjcext.zip rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\RCLRPT.CFG rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\REMOTE.CFG rundll32.exe File opened for modification C:\Program Files\Java\jdk-1.8\include\win32\bridge\AccessBridgeCalls.c rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\CNFNOT.CFG rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\SMIMES.CFG rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\TASK.CFG rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\Words.pdf rundll32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Acrobat Pro DC.pdf rundll32.exe File opened for modification C:\Program Files\CompareStep.vbs rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\ACTIVITY.CFG rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\DISTLIST.CFG rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\NOTE.CFG rundll32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\SCHDREST.CFG rundll32.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\NotPetya rundll32.exe File created C:\Windows\dllhost.dat rundll32.exe - System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe - Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe - Modifies data under HKEY_USERS 7 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\SOFTWARE svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey svchost.exe Key created \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey svchost.exe Key created \REGISTRY\USER\S-1-5-19 svchost.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4644 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4804 rundll32.exe 4804 rundll32.exe 5700 6B33.tmp 5700 6B33.tmp 5700 6B33.tmp 5700 6B33.tmp 5700 6B33.tmp 5700 6B33.tmp 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe - Suspicious behavior: LoadsDriver 7 IoCs
pid 4 4 4 4 4 4 4 - Suspicious use of AdjustPrivilegeToken 13 IoCs
description pid Process Token: SeShutdownPrivilege 4804 rundll32.exe Token: SeDebugPrivilege 4804 rundll32.exe Token: SeTcbPrivilege 4804 rundll32.exe Token: SeDebugPrivilege 5700 6B33.tmp Token: SeDebugPrivilege 2576 taskmgr.exe Token: SeSystemProfilePrivilege 2576 taskmgr.exe Token: SeCreateGlobalPrivilege 2576 taskmgr.exe Token: 33 2576 taskmgr.exe Token: SeIncBasePriorityPrivilege 2576 taskmgr.exe Token: SeShutdownPrivilege 5380 svchost.exe Token: SeDebugPrivilege 6120 taskmgr.exe Token: SeSystemProfilePrivilege 6120 taskmgr.exe Token: SeCreateGlobalPrivilege 6120 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe 2576 taskmgr.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2576 taskmgr.exe 1964 SecHealthUI.exe 6120 taskmgr.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1716 wrote to memory of 4804 1716 rundll32.exe 88 PID 4804 wrote to memory of 4716 4804 rundll32.exe 89 PID 4804 wrote to memory of 5700 4804 rundll32.exe 91 PID 4716 wrote to memory of 4644 4716 cmd.exe 93
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\NotPetya.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\NotPetya.dll,#12⤵
- Deletes itself
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4804 -
C:\Windows\SysWOW64\cmd.exe/c schtasks /Create /SC once /TN "" /TR "C:\Windows\system32\shutdown.exe /r /f" /ST 16:213⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /SC once /TN "" /TR "C:\Windows\system32\shutdown.exe /r /f" /ST 16:214⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4644
-
-
-
C:\Users\Admin\AppData\Local\Temp\6B33.tmp"C:\Users\Admin\AppData\Local\Temp\6B33.tmp" \\.\pipe\{5DCF261E-34FD-4025-8508-FD969A5EA965}3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5700
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2576
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:3168
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵PID:3352
-
C:\Windows\system32\SystemSettingsAdminFlows.exe"C:\Windows\system32\SystemSettingsAdminFlows.exe" StorageAdminHelper1⤵PID:5776
-
C:\Windows\system32\sudo.exe"C:\Windows\system32\sudo.exe" config --enable forceNewWindow1⤵PID:5856
-
C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe"C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe" -ServerName:SecHealthUI.AppX8tam42xc7v2czs3s1nt0nkxvfjtepzp9.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:1964
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding1⤵PID:4488
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k WbioSvcGroup -s WbioSrvc1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5380
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4852
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
- Modifies data under HKEY_USERS
PID:5420
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc1⤵PID:5228
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:6120
Network
MITRE ATT&CK Enterprise v16
Persistence
Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\D3DSCache\b7c78e20530d35f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
- Size 64KB
- SHA256 42c4fcd383e47854e66057644f88979287b077564fa0e83dd5097623e224804c
- MD5 d5b8e33845632b223ead9f7767ee1379
- SHA1 5c1b01562bc2bd424d2d703de91e00b40379f3c8
- SHA512 5ca20e1fadc3d123a174427c582e6822453d233accd614ae0e0d77978b631e9c0b355a0090f2602cfb451f5aec4021898e6a294597d7787424e761071834e2a8
- SSDEEP 3:t89llGlll/l/lXp9ZjrPBY06llqlHeU/ZP:sl0dPBY0OcPJ
- TLSH T12053244151C30317C443033004CF07443F75130C4343043143105370C45CF0040F11C5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\D3DSCache\b7c78e20530d35f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
- Size 4B
- SHA256 7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
- MD5 f49655f856acb8884cc0ace29216f511
- SHA1 cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
- SHA512 599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\D3DSCache\b7c78e20530d35f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
- Size 960B
- SHA256 565de87de825884dfdd98f37a1b05d5293eb72bb28ba1950f879e0082b0344c8
- MD5 41771ed4b8806ab6a027db8f95942da4
- SHA1 7fa42f8cc0b391d46d29dd25c08ca7483646c430
- SHA512 5b6e35b911a88c142ea61a14ebe98987da3f5e1b1d6898b28558a1f80f45ca27fc1518c21464bdb9ac86e2f1b7cbeaab02cedb2b89ba34ea96e46b4f6116b44a
- TLSH T1EB118C483BCB2CB0E33A7830002992201203B12208D2D20C8AC084668A31104D032FA8
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\TaskManager\settings.json
- Size 14KB
- SHA256 9bd9450bce42680c5fa5f028d776df33f068e5b218939527ff3b27508a5bc4bb
- MD5 da67eb411535cda9241f7f476351314e
- SHA1 f0c48debb8358042c536d5871cc05e1d091440c6
- SHA512 dc73783eea332b580f089f84f8b43e8fceb4d5a3d287c6626da3e67c85a6bd3389fa19c13e485dadb2788175345caf4eced8b0279e66ed6edcdf132ea70daf1e
- SSDEEP 384:sriol3FwaVp8lzrZZrzDqT5fERZW7j5U/qdc741ybaS:Giol3FwaVp8lzrZlCT5fERZW7j5UaS
- TLSH T1DC627A29A465DE2C87A01ED03C3F294F5E963310BFE596F8E1FF4E0476818AD2326765
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\6B33.tmp
- Size 55KB
- SHA256 02ef73bd2458627ed7b397ec26ee2de2e92c71a0e7588f78734761d8edbdcd9f
- MD5 7e37ab34ecdcc3e77e24522ddfd4852d
- SHA1 38e2855e11e353cedf9a8a4f2f2747f1c5c07fcf
- SHA512 1b037a2aa8bf951d2ffe2f724aa0b2fbb39c2173215806ba0327bda7b096301d887f9bb7db46f9e04584b16aa6b1aaeaf67f0ecf5f20eb02ceac27c8753ca587
- SSDEEP 768:wglvV3eE6cYdk8TcqiAjpEhtFLIZJ92evTlvGTIRVIRYcwq22zDcENaiaX+kDt9J:3ihTaAjZNlGT5YcdYENvkA+ChJfSz
- TLSH T1F5435B5A23A001FCE1679231C8B2DA1AE7B3B8166375434F12A4866B6FB37D15D3C772
- MD5 SHA1 SHA512 SSDEEP TLSH