remcos | 8f7fb4280577ff9114d045e055dba2deba6688636f4315cc152e6154c71d73c1

Analysis

max time kernel
17s
max time network
63s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/09/2026, 20:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8f7fb4280577ff9114d045e055dba2deba6688636f4315cc152e6154c71d73c1.exe
Size 1.2MB
Sample260918-yywp7adn9t
SHA256 8f7fb4280577ff9114d045e055dba2deba6688636f4315cc152e6154c71d73c1
MD5 b3e62cb4e3e3ca6548e2165c366df282
SHA1 68bab18e49d35e053a340d3c2890a449a258a111
SHA512 78bcca3cb76620944ff2e742eb81e3b5aa70ce54505186984d5b3e529c4425abbb16713184f120d728a496ec096eac1e3db21ff330302e51ae2a89dc0042232d
SSDEEP 24576:E5GXkH4nnwitNfuq9wgsdy3V5vgNyo3Py58dCN/j2GLl3iFSE33b9:EsXkHuXJOspgNx3a5nN/j2U4FH
TLSH
T12245C059A39402F8D0BBC235C5828527E7B2BC465571472F03D70E9B2F277A19F3AB26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

remotehost discovery remcos persistence rat spyware stealer

Malware Config

Extracted

Family

remcos

Version

7.3.1 Pro

Botnet

RemoteHost

slotsite-top10.com:8080
pinslot.vip:8080
j-88.co:8080
news27.co.in:8080
j88viet.com:8080
badana.me:8080
w88chinhthuc11.com:8080
w88saba13.com:8080
w88thethao26.com:8080
ok365.org:8080
saudi365.co:8080
c2.slotsite-top10.com:8080
c2.pinslot.vip:8080
c2.j-88.co:8080
c2.news27.co.in:8080
c2.j88viet.com:8080
c2.badana.me:8080
c2.w88chinhthuc11.com:8080
c2.w88saba13.com:8080
c2.w88thethao26.com:8080
c2.ok365.org:8080
c2.saudi365.co:8080

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
1
connect_delay
0
connect_interval
1
copy_file
ay391stx.exe
copy_folder
Remcos
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
remcos
mouse_option
false
mutex
Rmc-VAQRLX
screenshot_crypt
false
screenshot_flag
true
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
1
startup_value
take_screenshot_option
true
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Executes dropped EXE 12 IoCs

pid	Process
5112	ay391stx.exe
4588	elevation_service.exe
2556	elevation_service.exe
2900	maintenanceservice.exe
760	OSE.EXE
824	PerceptionSimulationService.exe
5716	perfhost.exe
720	ReFsDedupSvc.exe
432	SensorDataService.exe
1200	ssh-agent.exe
6104	AgentService.exe
3268	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-VAQRLX = "\"C:\\ProgramData\\Remcos\\ay391stx.exe\""	8f7fb4280577ff9114d045e055dba2deba6688636f4315cc152e6154c71d73c1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-VAQRLX = "\"C:\\ProgramData\\Remcos\\ay391stx.exe\""	8f7fb4280577ff9114d045e055dba2deba6688636f4315cc152e6154c71d73c1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rmc-VAQRLX = "\"C:\\ProgramData\\Remcos\\ay391stx.exe\""	ay391stx.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rmc-VAQRLX = "\"C:\\ProgramData\\Remcos\\ay391stx.exe\""	ay391stx.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe

Drops file in System32 directory 27 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\snmptrap.exe	ay391stx.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	ay391stx.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	8f7fb4280577ff9114d045e055dba2deba6688636f4315cc152e6154c71d73c1.exe
File opened for modification	C:\Windows\system32\dllhost.exe	ay391stx.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	ay391stx.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	ay391stx.exe
File opened for modification	C:\Windows\system32\vssvc.exe	ay391stx.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	ay391stx.exe
File opened for modification	C:\Windows\System32\alg.exe	8f7fb4280577ff9114d045e055dba2deba6688636f4315cc152e6154c71d73c1.exe
File opened for modification	C:\Windows\System32\alg.exe	ay391stx.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	ay391stx.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	ay391stx.exe
File opened for modification	C:\Windows\system32\AgentService.exe	ay391stx.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\wbengine.exe	ay391stx.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	ay391stx.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	ay391stx.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\930f549d3a35217a.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	ay391stx.exe
File opened for modification	C:\Windows\System32\vds.exe	ay391stx.exe
File opened for modification	C:\Windows\system32\dllhost.exe	8f7fb4280577ff9114d045e055dba2deba6688636f4315cc152e6154c71d73c1.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	ay391stx.exe
File opened for modification	C:\Windows\System32\msdtc.exe	ay391stx.exe
File opened for modification	C:\Windows\system32\msiexec.exe	ay391stx.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	ay391stx.exe
File opened for modification	C:\Windows\system32\locator.exe	ay391stx.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	ay391stx.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	ay391stx.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	ay391stx.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	ay391stx.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	ay391stx.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	ay391stx.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	ay391stx.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	ay391stx.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	ay391stx.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\helper.exe	ay391stx.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	ay391stx.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	ay391stx.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	ay391stx.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	ay391stx.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	ay391stx.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	ay391stx.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	ay391stx.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	ay391stx.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	ay391stx.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	ay391stx.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	ay391stx.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	ay391stx.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	ay391stx.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	ay391stx.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	ay391stx.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	ay391stx.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	ay391stx.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	ay391stx.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	ay391stx.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	ay391stx.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	ay391stx.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	ay391stx.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	ay391stx.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	ay391stx.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	ay391stx.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	ay391stx.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	ay391stx.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	ay391stx.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	ay391stx.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	ay391stx.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	ay391stx.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	ay391stx.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	ay391stx.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	ay391stx.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	ay391stx.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	ay391stx.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	ay391stx.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	ay391stx.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	ay391stx.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	ay391stx.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	ay391stx.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	ay391stx.exe
File created	C:\Program Files (x86)\Mozilla Maintenance Service\logs\maintenanceservice.log	maintenanceservice.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	ay391stx.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	ay391stx.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	ay391stx.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	ay391stx.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	ay391stx.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	ay391stx.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	ay391stx.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	ay391stx.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_122484\java.exe	ay391stx.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	ay391stx.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	ay391stx.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	ay391stx.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wpl\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000176fdb07aa47dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a6992409aa47dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {000214F9-0000-0000-C000-000000000046} 0xFFFF = 010000000000000082532809aa47dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpeg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4a\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bfaf2908aa47dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3g2	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5284	8f7fb4280577ff9114d045e055dba2deba6688636f4315cc152e6154c71d73c1.exe
Token: 33	5728	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5728	AUDIODG.EXE
Token: SeBackupPrivilege	720	ReFsDedupSvc.exe
Token: SeRestorePrivilege	720	ReFsDedupSvc.exe
Token: SeBackupPrivilege	720	ReFsDedupSvc.exe
Token: SeRestorePrivilege	720	ReFsDedupSvc.exe
Token: SeBackupPrivilege	720	ReFsDedupSvc.exe
Token: SeRestorePrivilege	720	ReFsDedupSvc.exe
Token: SeBackupPrivilege	720	ReFsDedupSvc.exe
Token: SeRestorePrivilege	720	ReFsDedupSvc.exe
Token: SeBackupPrivilege	720	ReFsDedupSvc.exe
Token: SeRestorePrivilege	720	ReFsDedupSvc.exe
Token: SeAssignPrimaryTokenPrivilege	6104	AgentService.exe
Token: 33	3268	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3268	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3268	SearchIndexer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5112	ay391stx.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
5112	ay391stx.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 5284 wrote to memory of 5112	5284	8f7fb4280577ff9114d045e055dba2deba6688636f4315cc152e6154c71d73c1.exe	87
PID 3268 wrote to memory of 4292	3268	SearchIndexer.exe	101
PID 3268 wrote to memory of 5540	3268	SearchIndexer.exe	102
PID 3268 wrote to memory of 3360	3268	SearchIndexer.exe	103
PID 3268 wrote to memory of 5348	3268	SearchIndexer.exe	104

C:\Users\Admin\AppData\Local\Temp\8f7fb4280577ff9114d045e055dba2deba6688636f4315cc152e6154c71d73c1.exe
"C:\Users\Admin\AppData\Local\Temp\8f7fb4280577ff9114d045e055dba2deba6688636f4315cc152e6154c71d73c1.exe"
1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5284
- C:\ProgramData\Remcos\ay391stx.exe
  "C:\ProgramData\Remcos\ay391stx.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:5112

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4588

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004D8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5728

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2556

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2900

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:760

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:824

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5716

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:720

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:432

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1200

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6104

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3268
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4292
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1404337215-1550464601-2805570857-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:5540
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2956 2804 932 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:3360
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 952 2980 2920 932 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 85e3c38cc706892f31c5997517974d75ac820d3bda862eb63e3085c3bac98762
MD5 947999bcb9b77db3b9b515b704b4868b
SHA1 dc320a165d00427f5ce05fe6259f327f7be66fc5
SHA512 705792ef7ddce0dc03317833bd1a483b79033f14279676e0bf8f57ece2f88d983c7b563d65269ef6f151cc3e12758d65f49889e0a85b28fea2cb3cf76237b1ba
SSDEEP 49152:qb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnFN/j2U4FH:c3q6HjBOj2jF
TLSH
T152D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.8MB
SHA256 e1f32197ba183a07d66bcab4cfa24bf5d9213060513ad79357ed744cfbc84177
MD5 026d521d9449f095ba06a69d21916c8d
SHA1 49db348052a38bcaa16625c27ab60431e88dea60
SHA512 fe75e2a68559ccd83ae29fe8a0bc145c1822869cb94965133e5997dc3c7828e462de7531b8eca15248f4ca98b46182dfcf14b48a11120d9f9aaefeb280dd040f
SSDEEP 12288:51XLsswWkxy2lRq2czABJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:XXYfDtczA1dCN/j2GLl3iFSE33b9
TLSH
T15485F128B7E409F9EC67827CC9A1C511E632B8948760E7CB03E49A661F337D85D3EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 5cbd84005f19c83604a315de4f938af687598410a2378f42c79804ae59cde4d9
MD5 6a60e6b376f8e1eb32f989dbb7d23298
SHA1 fbba4e0bb5fdd3419b76cdef1f2061f3eb4654ab
SHA512 97e0a4211083640fda698c284bdecde9c18d259ca9f889161b597eb4d0528d498e8bcd715017951527c6db394b88cba69bea6e1495eea4c7f9e48930f17a5431
SSDEEP 12288:+mw5HEjsChNVBFgl0WDm+CUJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:XwuoOW/dCN/j2GLl3iFSE33b9
TLSH
T1E985F14577E41CF9E96782388697C536F7B2BC512A21CB0F0760C69B6F37361AD2A720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 be526738eccde973f7d3595df3d25a0d8e2977abb72ee28715eb807e47d6e5a8
MD5 53b29165fea0eff93aba70a37ee7c7ea
SHA1 571cf2fc42a53f678ea102176877676d0e26fe7a
SHA512 e2c2b547eb8bc1aa360ef05dda485e02c501ad049a8d1d5c5c0c88581f1c31dcbd8799341bd50cd3a9f04db0203c5496b059be6ef6c046a42ac65ef66254be58
SSDEEP 49152:+B+taZ3usBWOBr4tEGT0bqx0z+n217aau1gl6N/j2U4FH:su6JmVxd2daj2jF
TLSH
T1E4D59D13F1DA01E8D06ED178974A9233EA62BC490B35B6DF0A9073562A77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ay391stx.exe

Path C:\ProgramData\Remcos\ay391stx.exe
Size 1.2MB
SHA256 8f7fb4280577ff9114d045e055dba2deba6688636f4315cc152e6154c71d73c1
MD5 b3e62cb4e3e3ca6548e2165c366df282
SHA1 68bab18e49d35e053a340d3c2890a449a258a111
SHA512 78bcca3cb76620944ff2e742eb81e3b5aa70ce54505186984d5b3e529c4425abbb16713184f120d728a496ec096eac1e3db21ff330302e51ae2a89dc0042232d
SSDEEP 24576:E5GXkH4nnwitNfuq9wgsdy3V5vgNyo3Py58dCN/j2GLl3iFSE33b9:EsXkHuXJOspgNx3a5nN/j2U4FH
TLSH
T12245C059A39402F8D0BBC235C5828527E7B2BC465571472F03D70E9B2F277A19F3AB26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

930f549d3a35217a.bin

Path C:\Users\Admin\AppData\Roaming\930f549d3a35217a.bin
Size 12KB
SHA256 6ec8b85e7e471aef5e51aa9072cd51112c8dff7e62652035bdf44d355a5660dd
MD5 60869d462e35d3a2a0bb1d135db69d1c
SHA1 ba9ba1c85b44194e57c8477361e29bdb7e298666
SHA512 50aba100a51ad11160b43184e2cbb0873714c990ffc9ccfd20c5275811d68d16ac2e3333ed8d13aa8e823016a16eec508586340475a68b505e0ed47cc5ca0efd
SSDEEP 384:9q27/VX/5EFxLZoxPP2Kn9kv4vYKzymKDT77B:9zj9hEFp2JYGymO
TLSH
T15442C0B0B5CE979E85C795D1497733ECA0469ECE7F2875CDE28AD798170027C110C456
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 df215efbf2142b1ebd3318efe9cebc291c1162f06db8c3c4012f3eada72d0c8b
MD5 a2f7bbc4eb3eeb7b85459fa78d26b9ba
SHA1 9ec64c887635ac8ce556bee214d923a5ff69d04d
SHA512 ebb3dd7f412bf1522552423a9eaec2b033a37c8bdda9532cdf77bfbd8b22a6c144e7e89428ebf3ad40fb1e39036035990da15f0c79dd3d879680af236aef6f08
SSDEEP 12288:PM7WJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFHW:kadCN/j2GLl3iFSE33b9z
TLSH
T119752360D7E9AA55F47A837803ADDA316200FEF8EB1184C7C54167EB6278FD8D832563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 c04a686f01e80290a47a82574bdc4bd476cc8aa947a022c8fcd4eff47c5b08ee
MD5 a5754f1598f9b585186c6e69a9eb86e4
SHA1 b7e04581a33ad0747cda1bdf01b059ae735212ad
SHA512 9f94de1a56923da103d5a311f91e2a9d71654977558b9470303e6b116a674bdec2fe7a6b087118d44dae7eecc40f7971bc5eb02658fb231199999122410e6aaf
SSDEEP 24576:Jgb6bmBIi49WNNFpg1rSvFv7bY8dCN/j2GLl3iFSE33b9:Jgb4mBIBhGFEN/j2U4FH
TLSH
T13065AE1E22EC02F5E0FAD2B88DAA4417D6B278165731D2CF1151427D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 518cc5d3047afe1db97af79fc5e2de8c102b4060ffdc6c1510dafb852de67b05
MD5 c772a072c757e4a62680c85d736805b5
SHA1 d4e691b71bb371496bc14318a18e4ebe5605b565
SHA512 e6484b010deb5ca4298c082fe5348f99a7bcdb39c35954f5d1204d125acce282214ef1b5cc7967172866aa8c5c9af75f0acea55c145e9c9b7c6cd97682140a79
SSDEEP 24576:3G88u8FpJqH1bzria7/mndCN/j2GLl3iFSE33b9:27ZFPqVea7/vN/j2U4FH
TLSH
T12DA5F16576E101F0D47BD1388A864663F671B8251364EBDF07A88B961F23BE44B3FB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 e3b1c89f0563b9df05adecd6bc94e64e8ae25bee61d2603335e3061f3dfca5e8
MD5 5d06f4ec3058d313064ecfd2128b1e1d
SHA1 1d0635e3677a6df885728306290d016a755d1560
SHA512 a2a4e70a14c28f268b518946cb4f60db00f554e8eeb99446ece2abbf2554115c513cefab8e9eb05eb9f51d7089cf751f6efd5a3e548eb399444bde3ab05b7894
SSDEEP 12288:+HvUrBFrEjwaQLJNTpWSgN/wwRN0UL0G/TVOo3HC75nSE33b9YvFH:+PUr+NQTdCN/j2GLl3iFSE33b9
TLSH
T1CF85F22E62E918E5E67AD17D86868719F731B8615312D2CF02D0817E4F77EE8BC39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 08a337550bf6d33bcdcd310a66279151e1431a26bb7fc30dc9176615a26a47db
MD5 f90246beefd042747af4245d047971e4
SHA1 d532b636933c851dc5d50cdd90ea8335cefe22f4
SHA512 c3742f4e98bc5068c17d36b5cda1e2cd28a0f0fcdfc84a56e90d3257c89655a9b91c72eb6cccb8ea57b23164ba92c6742ae1fa7d63e84da07481e823d461aad7
SSDEEP 49152:0BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjgN/j2U4FH:XG05lO43bfj2jF
TLSH
T189D5CF6A62EC11F9D1BBC17CDAC64A0BEBB23815033556CF02A486A91F27FF4957E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 d19fb8516ef4de6e8eb1f596505f64003682dcf1240e6f427dc6681d975e4393
MD5 ceb0e15f8ae10f28d050c0bc3abaf0c4
SHA1 fad1b330dcdd3ac8813b245fb0bb09bf51a9533a
SHA512 d761e3bae50d55b7d22391fd6464420efede90d640df40f1e8866e2ec5170cbe6f89c8f1fe7b97ba855feb4facd6c4c4700bfb72d961c2bec4752fcf4e2f83b5
SSDEEP 24576:Pfa5POZ3dpFWVM50JicR2hG0lasx2+47eidnVdCN/j2GLl3iFSE33b9:3a5POZ3+Jt2pasx2+mYN/j2U4FH
TLSH
T19E65BF5EA6FC01D5D179D17DC5838A1AF5B1346153329BCB022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 2b6c4417cbc4544d7e0357ba84bc26aa5c10a6742900d9c3926ec78b54c14d94
MD5 a4cacf916162f3b5e2bae120847a0b18
SHA1 0c2316ec803505eae4514633c304667ccba61944
SHA512 f3841dc57ceb2ac55e159ee4a1e9507bcbfaccdecab6c3f6e1bae37a6f4a46ad84e7d4675b5ef5b179f532543ddda08c19ae213307fd4493fa225d28a30421c4
SSDEEP 24576:1NcwHdjbyQ4nLC18lb/EOjowL7FkfdCN/j2GLl3iFSE33b9:1Nc/zEOVHFPN/j2U4FH
TLSH
T199857B2623E901E4F1BBE1BE89779546FA71786553308ACF0291851B1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 494a8af973a0407cab08003086ceabc16203b81a32ece1bc92711f3324dc6a94
MD5 5211ee14d591131fb7d190991d54a785
SHA1 7260dd1e4745cce13b7faa1210c46832393cc695
SHA512 5174ac01eb75622f69948317ffd8dca6ccdbb141582f6a0e362ee4b3f8aa16bb33bc0e0e82eb9f1c02ec07afce2017a8850a73639359318c933855b45efd595e
SSDEEP 24576:f8kNvNnaFeYhJNtmZBm5dCN/j2GLl3iFSE33b9:f8MwBtOmON/j2U4FH
TLSH
T13355AF6EBAF846E4D1FEC6B58E238512E6727461173293CB4290C13F0E679D89D36F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/432-116-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/432-122-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/432-328-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/432-115-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/432-332-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/432-331-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/720-110-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/720-327-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/720-104-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/720-344-0x0000000000750000-0x00000000007B0000-memory.dmp

Download

memory/720-103-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/720-346-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/760-77-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/760-71-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/760-70-0x0000000140000000-0x00000001402B8000-memory.dmp

Download

memory/760-294-0x0000000140000000-0x00000001402B8000-memory.dmp

Download

memory/824-311-0x0000000140000000-0x00000001402B4000-memory.dmp

Download

memory/824-89-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/824-83-0x0000000000C70000-0x0000000000CD0000-memory.dmp

Download

memory/824-81-0x0000000140000000-0x00000001402B4000-memory.dmp

Download

memory/1200-130-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/1200-329-0x0000000140000000-0x0000000140327000-memory.dmp

Download

memory/1200-129-0x0000000140000000-0x0000000140327000-memory.dmp

Download

memory/1200-136-0x00000000007C0000-0x0000000000820000-memory.dmp

Download

memory/2556-51-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2556-193-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2556-44-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/2556-45-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/2900-55-0x0000000140000000-0x00000001402BE000-memory.dmp

Download

memory/2900-56-0x0000000002330000-0x0000000002390000-memory.dmp

Download

memory/2900-62-0x0000000002330000-0x0000000002390000-memory.dmp

Download

memory/2900-65-0x0000000002330000-0x0000000002390000-memory.dmp

Download

memory/2900-67-0x0000000140000000-0x00000001402BE000-memory.dmp

Download

memory/3268-165-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3268-333-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3268-158-0x00000000006A0000-0x0000000000700000-memory.dmp

Download

memory/3268-164-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/4588-32-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4588-157-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4588-38-0x0000000000D10000-0x0000000000D70000-memory.dmp

Download

memory/4588-31-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5112-24-0x0000000002110000-0x0000000002170000-memory.dmp

Download

memory/5112-25-0x0000000002110000-0x0000000002170000-memory.dmp

Download

memory/5112-128-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5112-18-0x0000000002110000-0x0000000002170000-memory.dmp

Download

memory/5112-17-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5284-1-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/5284-14-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5284-0-0x0000000140000000-0x000000014013E000-memory.dmp

Download

memory/5284-8-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/5284-7-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/5284-15-0x0000000001F70000-0x0000000001FD0000-memory.dmp

Download

memory/5716-93-0x0000000000400000-0x0000000000680000-memory.dmp

Download

memory/5716-316-0x0000000000400000-0x0000000000680000-memory.dmp

Download

memory/5716-94-0x0000000000B00000-0x0000000000B67000-memory.dmp

Download

memory/5716-99-0x0000000000B00000-0x0000000000B67000-memory.dmp

Download

memory/6104-153-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/6104-150-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/6104-147-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/6104-141-0x0000000000BC0000-0x0000000000C20000-memory.dmp

Download

memory/6104-140-0x0000000140000000-0x0000000140168000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads