778b307929f1d87aa1f64b0784881d369ccbd6c7f9aa80262105300d7028ce10

Analysis

user interaction
yes
max time kernel
49s
max time network
30s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/09/2026, 14:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
client-rust(5).exe
Size 18.0MB
Sample260919-rtfpvaswdt
SHA256 778b307929f1d87aa1f64b0784881d369ccbd6c7f9aa80262105300d7028ce10
MD5 40d703702dffedd5593c8eb9d81fb0f8
SHA1 a636a4836483e9e0404faf38eeaeb1e6bda9e4e6
SHA512 095237506d55f09abc97221d201080afc96fa7a969a66dba514ca777043d6e75dc4ad581422d472d4f55da92185c49ab004047d68c6bf2c7884c1eaba5365d24
SSDEEP 98304:EP4TiCCUDQcdPsVyqFtN/r+JeG4vB6U17U1Nz+s0rNpWoKApglsiWQfVcjHRFrvF:UDNq9g5Ujz6rNpWoKRlsndvF
TLSH
T136178E83E50208E9C153C63B492F363EF6743B5C77A4A6E79C484E3A9F5A6D18F06748
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution persistence

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
5292	taskhostw.exe
4260	taskhostw.exe
4356	taskhostw.exe
3284	taskhostw.exe
1272	sihost.exe
4320	RuntimeBroker.exe
1148	ctfmon.exe
3344	dllhost.exe
564	taskhostw.exe
5964	taskhostw.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\taskhostw.exe\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\taskhostw.exe\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\ctfmon = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\taskhostw.exe\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\taskhostw.exe\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\Software\Microsoft\Windows\CurrentVersion\Run\taskhostw = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\taskhostw.exe\""	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
908	powershell.exe

Kills process with taskkill 5 IoCs

defense_evasion

pid	Process
4512	taskkill.exe
4220	taskkill.exe
364	taskkill.exe
4116	taskkill.exe
688	taskkill.exe

Modifies registry key 1 TTPs 37 IoCs

Modify Registry

T1112

pid	Process
4272	reg.exe
5372	reg.exe
3100	reg.exe
2972	reg.exe
4508	reg.exe
2672	reg.exe
5940	reg.exe
676	reg.exe
5936	reg.exe
5580	reg.exe
3468	reg.exe
2860	reg.exe
5480	reg.exe
4992	reg.exe
2944	reg.exe
3672	reg.exe
4920	reg.exe
4116	reg.exe
3096	reg.exe
3400	reg.exe
2044	reg.exe
4660	reg.exe
4772	reg.exe
1608	reg.exe
1904	reg.exe
1976	reg.exe
4416	reg.exe
1736	reg.exe
1848	reg.exe
3164	reg.exe
5044	reg.exe
2588	reg.exe
4832	reg.exe
2520	reg.exe
5372	reg.exe
1008	reg.exe
3760	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5152	schtasks.exe
3244	schtasks.exe
2940	schtasks.exe
4904	schtasks.exe
3436	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
908	powershell.exe
908	powershell.exe
908	powershell.exe
908	powershell.exe
908	powershell.exe

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeDebugPrivilege	4116	taskkill.exe
Token: SeDebugPrivilege	688	taskkill.exe
Token: SeDebugPrivilege	4512	taskkill.exe
Token: SeDebugPrivilege	4220	taskkill.exe
Token: SeDebugPrivilege	364	taskkill.exe
Token: SeDebugPrivilege	908	powershell.exe
Token: SeIncreaseQuotaPrivilege	908	powershell.exe
Token: SeSecurityPrivilege	908	powershell.exe
Token: SeTakeOwnershipPrivilege	908	powershell.exe
Token: SeLoadDriverPrivilege	908	powershell.exe
Token: SeSystemProfilePrivilege	908	powershell.exe
Token: SeSystemtimePrivilege	908	powershell.exe
Token: SeProfSingleProcessPrivilege	908	powershell.exe
Token: SeIncBasePriorityPrivilege	908	powershell.exe
Token: SeCreatePagefilePrivilege	908	powershell.exe
Token: SeBackupPrivilege	908	powershell.exe
Token: SeRestorePrivilege	908	powershell.exe
Token: SeShutdownPrivilege	908	powershell.exe
Token: SeDebugPrivilege	908	powershell.exe
Token: SeSystemEnvironmentPrivilege	908	powershell.exe
Token: SeRemoteShutdownPrivilege	908	powershell.exe
Token: SeUndockPrivilege	908	powershell.exe
Token: SeManageVolumePrivilege	908	powershell.exe
Token: 33	908	powershell.exe
Token: 34	908	powershell.exe
Token: 35	908	powershell.exe
Token: 36	908	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 4508	2664	client-rust(5).exe	90
PID 2664 wrote to memory of 3096	2664	client-rust(5).exe	91
PID 2664 wrote to memory of 3400	2664	client-rust(5).exe	92
PID 2664 wrote to memory of 2672	2664	client-rust(5).exe	93
PID 2664 wrote to memory of 2044	2664	client-rust(5).exe	94
PID 2664 wrote to memory of 3100	2664	client-rust(5).exe	95
PID 2664 wrote to memory of 2588	2664	client-rust(5).exe	96
PID 2664 wrote to memory of 5940	2664	client-rust(5).exe	97
PID 2664 wrote to memory of 1608	2664	client-rust(5).exe	98
PID 2664 wrote to memory of 1904	2664	client-rust(5).exe	99
PID 2664 wrote to memory of 2972	2664	client-rust(5).exe	100
PID 2664 wrote to memory of 1976	2664	client-rust(5).exe	101
PID 2664 wrote to memory of 4660	2664	client-rust(5).exe	102
PID 2664 wrote to memory of 4832	2664	client-rust(5).exe	103
PID 2664 wrote to memory of 5480	2664	client-rust(5).exe	104
PID 2664 wrote to memory of 3672	2664	client-rust(5).exe	105
PID 2664 wrote to memory of 676	2664	client-rust(5).exe	106
PID 2664 wrote to memory of 3624	2664	client-rust(5).exe	107
PID 2664 wrote to memory of 4416	2664	client-rust(5).exe	108
PID 2664 wrote to memory of 2896	2664	client-rust(5).exe	109
PID 2664 wrote to memory of 1736	2664	client-rust(5).exe	110
PID 2664 wrote to memory of 4076	2664	client-rust(5).exe	111
PID 2664 wrote to memory of 2520	2664	client-rust(5).exe	112
PID 2664 wrote to memory of 5832	2664	client-rust(5).exe	113
PID 2664 wrote to memory of 5936	2664	client-rust(5).exe	114
PID 2664 wrote to memory of 3236	2664	client-rust(5).exe	115
PID 2664 wrote to memory of 5372	2664	client-rust(5).exe	116
PID 2664 wrote to memory of 5044	2664	client-rust(5).exe	117
PID 2664 wrote to memory of 4116	2664	client-rust(5).exe	118
PID 2664 wrote to memory of 688	2664	client-rust(5).exe	120
PID 2664 wrote to memory of 4512	2664	client-rust(5).exe	121
PID 2664 wrote to memory of 4220	2664	client-rust(5).exe	122
PID 2664 wrote to memory of 364	2664	client-rust(5).exe	123
PID 2664 wrote to memory of 908	2664	client-rust(5).exe	124
PID 2664 wrote to memory of 1600	2664	client-rust(5).exe	125
PID 2664 wrote to memory of 1380	2664	client-rust(5).exe	126
PID 2664 wrote to memory of 1924	2664	client-rust(5).exe	127
PID 2664 wrote to memory of 1644	2664	client-rust(5).exe	128
PID 2664 wrote to memory of 3692	2664	client-rust(5).exe	129
PID 2664 wrote to memory of 1008	2664	client-rust(5).exe	130
PID 2664 wrote to memory of 5152	2664	client-rust(5).exe	131
PID 2664 wrote to memory of 4992	2664	client-rust(5).exe	132
PID 2664 wrote to memory of 3244	2664	client-rust(5).exe	133
PID 2664 wrote to memory of 5580	2664	client-rust(5).exe	134
PID 2664 wrote to memory of 2940	2664	client-rust(5).exe	135
PID 2664 wrote to memory of 2944	2664	client-rust(5).exe	136
PID 2664 wrote to memory of 4904	2664	client-rust(5).exe	137
PID 2664 wrote to memory of 4920	2664	client-rust(5).exe	138
PID 2664 wrote to memory of 3436	2664	client-rust(5).exe	139
PID 5292 wrote to memory of 3284	5292	taskhostw.exe	145
PID 2664 wrote to memory of 1272	2664	client-rust(5).exe	147
PID 2664 wrote to memory of 4320	2664	client-rust(5).exe	149
PID 2664 wrote to memory of 1148	2664	client-rust(5).exe	151
PID 2664 wrote to memory of 3344	2664	client-rust(5).exe	153
PID 2664 wrote to memory of 3760	2664	client-rust(5).exe	155
PID 5292 wrote to memory of 564	5292	taskhostw.exe	156
PID 1272 wrote to memory of 3468	1272	sihost.exe	158
PID 4320 wrote to memory of 4272	4320	RuntimeBroker.exe	159
PID 1148 wrote to memory of 4772	1148	ctfmon.exe	160
PID 3344 wrote to memory of 1848	3344	dllhost.exe	161
PID 5292 wrote to memory of 5964	5292	taskhostw.exe	163
PID 2664 wrote to memory of 5372	2664	client-rust(5).exe	165
PID 1272 wrote to memory of 2860	1272	sihost.exe	168
PID 4320 wrote to memory of 5044	4320	RuntimeBroker.exe	166

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 5 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1644	attrib.exe
3692	attrib.exe
1600	attrib.exe
1380	attrib.exe
1924	attrib.exe

C:\Users\Admin\AppData\Local\Temp\client-rust(5).exe
"C:\Users\Admin\AppData\Local\Temp\client-rust(5).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Windows\system32\reg.exe
  "reg" query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v taskhostw
  2⤵
  - Modifies registry key
  PID:4508
- C:\Windows\system32\reg.exe
  "reg" query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v sihost
  2⤵
  - Modifies registry key
  PID:3096
- C:\Windows\system32\reg.exe
  "reg" query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v RuntimeBroker
  2⤵
  - Modifies registry key
  PID:3400
- C:\Windows\system32\reg.exe
  "reg" query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v ctfmon
  2⤵
  - Modifies registry key
  PID:2672
- C:\Windows\system32\reg.exe
  "reg" query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v dllhost
  2⤵
  - Modifies registry key
  PID:2044
- C:\Windows\system32\reg.exe
  "reg" query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v backgroundTaskHost
  2⤵
  - Modifies registry key
  PID:3100
- C:\Windows\system32\reg.exe
  "reg" query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v StartMenuExperienceHost
  2⤵
  - Modifies registry key
  PID:2588
- C:\Windows\system32\reg.exe
  "reg" query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v ApplicationFrameHost
  2⤵
  - Modifies registry key
  PID:5940
- C:\Windows\system32\reg.exe
  "reg" query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v smartscreen
  2⤵
  - Modifies registry key
  PID:1608
- C:\Windows\system32\reg.exe
  "reg" query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SecurityHealthSystray
  2⤵
  - Modifies registry key
  PID:1904
- C:\Windows\system32\reg.exe
  "reg" query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v depre
  2⤵
  - Modifies registry key
  PID:2972
- C:\Windows\system32\reg.exe
  "reg" query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsAudioService
  2⤵
  - Modifies registry key
  PID:1976
- C:\Windows\system32\reg.exe
  "reg" query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsAudioHost
  2⤵
  - Modifies registry key
  PID:4660
- C:\Windows\system32\reg.exe
  "reg" query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsAudioEndpoint
  2⤵
  - Modifies registry key
  PID:4832
- C:\Windows\system32\reg.exe
  "reg" query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsDeviceService
  2⤵
  - Modifies registry key
  PID:5480
- C:\Windows\system32\reg.exe
  "reg" query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsMediaService
  2⤵
  - Modifies registry key
  PID:3672
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v depre /f
  2⤵
  - Modifies registry key
  PID:676
- C:\Windows\system32\schtasks.exe
  "schtasks" /Delete /F /TN depre
  2⤵
  PID:3624
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsAudioService /f
  2⤵
  - Modifies registry key
  PID:4416
- C:\Windows\system32\schtasks.exe
  "schtasks" /Delete /F /TN WindowsAudioService
  2⤵
  PID:2896
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsAudioHost /f
  2⤵
  - Modifies registry key
  PID:1736
- C:\Windows\system32\schtasks.exe
  "schtasks" /Delete /F /TN WindowsAudioHost
  2⤵
  PID:4076
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsAudioEndpoint /f
  2⤵
  - Modifies registry key
  PID:2520
- C:\Windows\system32\schtasks.exe
  "schtasks" /Delete /F /TN WindowsAudioEndpoint
  2⤵
  PID:5832
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsDeviceService /f
  2⤵
  - Modifies registry key
  PID:5936
- C:\Windows\system32\schtasks.exe
  "schtasks" /Delete /F /TN WindowsDeviceService
  2⤵
  PID:3236
- C:\Windows\system32\reg.exe
  "reg" delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsMediaService /f
  2⤵
  - Modifies registry key
  PID:5372
- C:\Windows\system32\schtasks.exe
  "schtasks" /Delete /F /TN WindowsMediaService
  2⤵
  PID:5044
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM WindowsAudioService.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4116
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM WindowsAudioHost.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:688
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM WindowsAudioEndpoint.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4512
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM WindowsDeviceService.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4220
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /IM WindowsMediaService.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:364
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -NonInteractive -Command "Get-CimInstance Win32_Process -Filter \"CommandLine LIKE '%.wd.bat%'\" | ForEach-Object { Stop-Process -Id $_.ProcessId -Force }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:908
- C:\Windows\system32\attrib.exe
  "attrib" +H +S C:\Users\Admin\AppData\Local\Microsoft\Windows\taskhostw.exe
  2⤵
  - Views/modifies file attributes
  PID:1600
- C:\Windows\system32\attrib.exe
  "attrib" +H +S C:\Users\Admin\AppData\Local\Microsoft\Windows\sihost.exe
  2⤵
  - Views/modifies file attributes
  PID:1380
- C:\Windows\system32\attrib.exe
  "attrib" +H +S C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBroker.exe
  2⤵
  - Views/modifies file attributes
  PID:1924
- C:\Windows\system32\attrib.exe
  "attrib" +H +S C:\Users\Admin\AppData\Local\Microsoft\Windows\ctfmon.exe
  2⤵
  - Views/modifies file attributes
  PID:1644
- C:\Windows\system32\attrib.exe
  "attrib" +H +S C:\Users\Admin\AppData\Local\Microsoft\Windows\dllhost.exe
  2⤵
  - Views/modifies file attributes
  PID:3692
- C:\Windows\system32\reg.exe
  "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v taskhostw /t REG_SZ /d \"C:\Users\Admin\AppData\Local\Microsoft\Windows\taskhostw.exe\" /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:1008
- C:\Windows\system32\schtasks.exe
  "schtasks" /Create /F /TN taskhostw /TR \"C:\Users\Admin\AppData\Local\Microsoft\Windows\taskhostw.exe\" /SC ONLOGON
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5152
- C:\Windows\system32\reg.exe
  "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v sihost /t REG_SZ /d \"C:\Users\Admin\AppData\Local\Microsoft\Windows\taskhostw.exe\" /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:4992
- C:\Windows\system32\schtasks.exe
  "schtasks" /Create /F /TN sihost /TR \"C:\Users\Admin\AppData\Local\Microsoft\Windows\taskhostw.exe\" /SC ONLOGON
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3244
- C:\Windows\system32\reg.exe
  "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v RuntimeBroker /t REG_SZ /d \"C:\Users\Admin\AppData\Local\Microsoft\Windows\taskhostw.exe\" /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:5580
- C:\Windows\system32\schtasks.exe
  "schtasks" /Create /F /TN RuntimeBroker /TR \"C:\Users\Admin\AppData\Local\Microsoft\Windows\taskhostw.exe\" /SC ONLOGON
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2940
- C:\Windows\system32\reg.exe
  "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v ctfmon /t REG_SZ /d \"C:\Users\Admin\AppData\Local\Microsoft\Windows\taskhostw.exe\" /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:2944
- C:\Windows\system32\schtasks.exe
  "schtasks" /Create /F /TN ctfmon /TR \"C:\Users\Admin\AppData\Local\Microsoft\Windows\taskhostw.exe\" /SC ONLOGON
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4904
- C:\Windows\system32\reg.exe
  "reg" add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v dllhost /t REG_SZ /d \"C:\Users\Admin\AppData\Local\Microsoft\Windows\taskhostw.exe\" /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:4920
- C:\Windows\system32\schtasks.exe
  "schtasks" /Create /F /TN dllhost /TR \"C:\Users\Admin\AppData\Local\Microsoft\Windows\taskhostw.exe\" /SC ONLOGON
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3436
- C:\Users\Admin\AppData\Local\Microsoft\Windows\sihost.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\sihost.exe" --watchdog 2664 C:\Users\Admin\AppData\Local\Microsoft\Windows\taskhostw.exe 1
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1272
- - C:\Windows\system32\reg.exe
    "reg" query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v taskhostw
    3⤵
    - Modifies registry key
    PID:3468
- - C:\Windows\system32\reg.exe
    "reg" query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v taskhostw
    3⤵
    - Modifies registry key
    PID:2860
- C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBroker.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\RuntimeBroker.exe" --watchdog 2664 C:\Users\Admin\AppData\Local\Microsoft\Windows\taskhostw.exe 2
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4320
- - C:\Windows\system32\reg.exe
    "reg" query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v taskhostw
    3⤵
    - Modifies registry key
    PID:4272
- - C:\Windows\system32\reg.exe
    "reg" query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v taskhostw
    3⤵
    - Modifies registry key
    PID:5044
- C:\Users\Admin\AppData\Local\Microsoft\Windows\ctfmon.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\ctfmon.exe" --watchdog 2664 C:\Users\Admin\AppData\Local\Microsoft\Windows\taskhostw.exe 3
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1148
- - C:\Windows\system32\reg.exe
    "reg" query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v taskhostw
    3⤵
    - Modifies registry key
    PID:4772
- - C:\Windows\system32\reg.exe
    "reg" query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v taskhostw
    3⤵
    - Modifies registry key
    PID:3164
- C:\Users\Admin\AppData\Local\Microsoft\Windows\dllhost.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\dllhost.exe" --watchdog 2664 C:\Users\Admin\AppData\Local\Microsoft\Windows\taskhostw.exe 4
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3344
- - C:\Windows\system32\reg.exe
    "reg" query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v taskhostw
    3⤵
    - Modifies registry key
    PID:1848
- - C:\Windows\system32\reg.exe
    "reg" query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v taskhostw
    3⤵
    - Modifies registry key
    PID:4116
- C:\Windows\system32\reg.exe
  "reg" query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v taskhostw
  2⤵
  - Modifies registry key
  PID:3760
- C:\Windows\system32\reg.exe
  "reg" query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v taskhostw
  2⤵
  - Modifies registry key
  PID:5372

C:\Users\Admin\AppData\Local\Microsoft\Windows\taskhostw.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\taskhostw.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5292
- C:\Users\Admin\AppData\Local\Microsoft\Windows\taskhostw.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\taskhostw.exe" --session-agent
  2⤵
  - Executes dropped EXE
  PID:3284
- C:\Users\Admin\AppData\Local\Microsoft\Windows\taskhostw.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\taskhostw.exe" --session-agent
  2⤵
  - Executes dropped EXE
  PID:564
- C:\Users\Admin\AppData\Local\Microsoft\Windows\taskhostw.exe
  "C:\Users\Admin\AppData\Local\Microsoft\Windows\taskhostw.exe" --session-agent
  2⤵
  - Executes dropped EXE
  PID:5964

C:\Users\Admin\AppData\Local\Microsoft\Windows\taskhostw.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\taskhostw.exe
1⤵
- Executes dropped EXE
PID:4356

C:\Users\Admin\AppData\Local\Microsoft\Windows\taskhostw.exe
"C:\Users\Admin\AppData\Local\Microsoft\Windows\taskhostw.exe"
1⤵
- Executes dropped EXE
PID:4260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sihost.exe

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\sihost.exe
Size 18.0MB
SHA256 778b307929f1d87aa1f64b0784881d369ccbd6c7f9aa80262105300d7028ce10
MD5 40d703702dffedd5593c8eb9d81fb0f8
SHA1 a636a4836483e9e0404faf38eeaeb1e6bda9e4e6
SHA512 095237506d55f09abc97221d201080afc96fa7a969a66dba514ca777043d6e75dc4ad581422d472d4f55da92185c49ab004047d68c6bf2c7884c1eaba5365d24
SSDEEP 98304:EP4TiCCUDQcdPsVyqFtN/r+JeG4vB6U17U1Nz+s0rNpWoKApglsiWQfVcjHRFrvF:UDNq9g5Ujz6rNpWoKRlsndvF
TLSH
T136178E83E50208E9C153C63B492F363EF6743B5C77A4A6E79C484E3A9F5A6D18F06748
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/564-35-0x00007FF780C70000-0x00007FF781AA2000-memory.dmp

Download

memory/908-9-0x0000021FEE1A0000-0x0000021FEE1C4000-memory.dmp

Download

memory/908-7-0x0000021FEDD30000-0x0000021FEDD3A000-memory.dmp

Download

memory/908-8-0x0000021FEE1A0000-0x0000021FEE1CA000-memory.dmp

Download

memory/908-2-0x0000021FEDC80000-0x0000021FEDCA2000-memory.dmp

Download

memory/908-6-0x0000021FEDF60000-0x0000021FEE012000-memory.dmp

Download

memory/908-5-0x0000021FEDF40000-0x0000021FEDF5E000-memory.dmp

Download

memory/1148-42-0x00007FF728340000-0x00007FF729172000-memory.dmp

Download

memory/1148-37-0x00007FF728340000-0x00007FF729172000-memory.dmp

Download

memory/1272-40-0x00007FF76E2B0000-0x00007FF76F0E2000-memory.dmp

Download

memory/1272-32-0x00007FF76E2B0000-0x00007FF76F0E2000-memory.dmp

Download

memory/2664-25-0x00007FF71D240000-0x00007FF71E072000-memory.dmp

Download

memory/2664-30-0x00007FF71D240000-0x00007FF71E072000-memory.dmp

Download

memory/3284-24-0x00007FF780C70000-0x00007FF781AA2000-memory.dmp

Download

memory/3344-43-0x00007FF728340000-0x00007FF729172000-memory.dmp

Download

memory/3344-38-0x00007FF728340000-0x00007FF729172000-memory.dmp

Download

memory/4260-21-0x00007FF780C70000-0x00007FF781AA2000-memory.dmp

Download

memory/4320-33-0x00007FF6BEA70000-0x00007FF6BF8A2000-memory.dmp

Download

memory/4320-41-0x00007FF6BEA70000-0x00007FF6BF8A2000-memory.dmp

Download

memory/4356-23-0x00007FF780C70000-0x00007FF781AA2000-memory.dmp

Download

memory/5292-31-0x00007FF780C70000-0x00007FF781AA2000-memory.dmp

Download

memory/5964-46-0x00007FF780C70000-0x00007FF781AA2000-memory.dmp

Download