Analysis
- max time kernel
298s - max time network
297s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260911-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
25/09/2026, 22:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
minerr.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
25 signatures
300 seconds
Behavioral task
behavioral2
Sample
minerr.exe
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
25 signatures
300 seconds
Behavioral task
behavioral3
Sample
minerr.exe
Resource
win11-20260911-en
windows11-21h2-x64
25 signatures
300 seconds
Behavioral task
behavioral4
Sample
minerr.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
25 signatures
300 seconds
General
- Target minerr.exe
- Size 6.5MB
- Sample260925-2ynalay17p
- SHA256 dd37e789ab8c3788ed0b5899eff5fdcb7caf6265190d4ee643fbe0ec59eae7c2
- MD5 49f205fa07c1d678c42f82ed43e4e934
- SHA1 629817189a6d28c175c7bc83e443624351fcb004
- SHA512 10fa754a6e1991f2e0e26556b547139209a19800362127a825092ec6ca3576b1e918d603d49381d6e5085a9de243da8684fd1fb50f6aa380550c398732d42a87
- SSDEEP 196608:tWJKl0I02t4nU9X+zv5IaygizBsraMyw0HNgowG/sa:tWJKlbjAfy1GOBDHsG//
- TLSH T1946633C2674C42DEFFD9B179E24209487FB513B246D202C369D4E8C2AE25AE0EF1D55E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 33 IoCs
resource yara_rule behavioral2/memory/4180-57-0x0000000000CA0000-0x00000000018F7000-memory.dmp family_salatstealer behavioral2/memory/4180-58-0x0000000000CA0000-0x00000000018F7000-memory.dmp family_salatstealer behavioral2/memory/4180-59-0x0000000000CA0000-0x00000000018F7000-memory.dmp family_salatstealer behavioral2/memory/4180-60-0x0000000000CA0000-0x00000000018F7000-memory.dmp family_salatstealer behavioral2/memory/4180-69-0x0000000000CA0000-0x00000000018F7000-memory.dmp family_salatstealer behavioral2/memory/3004-70-0x0000000000B50000-0x00000000017A7000-memory.dmp family_salatstealer behavioral2/memory/3692-74-0x0000000000A50000-0x00000000016A7000-memory.dmp family_salatstealer behavioral2/memory/3692-75-0x0000000000A50000-0x00000000016A7000-memory.dmp family_salatstealer behavioral2/memory/3692-76-0x0000000000A50000-0x00000000016A7000-memory.dmp family_salatstealer behavioral2/memory/3692-79-0x0000000000A50000-0x00000000016A7000-memory.dmp family_salatstealer behavioral2/memory/3692-115-0x0000000000A50000-0x00000000016A7000-memory.dmp family_salatstealer behavioral2/memory/3692-116-0x0000000000A50000-0x00000000016A7000-memory.dmp family_salatstealer behavioral2/memory/3692-117-0x0000000000A50000-0x00000000016A7000-memory.dmp family_salatstealer behavioral2/memory/3692-118-0x0000000000A50000-0x00000000016A7000-memory.dmp family_salatstealer behavioral2/memory/3692-119-0x0000000000A50000-0x00000000016A7000-memory.dmp family_salatstealer behavioral2/memory/3692-120-0x0000000000A50000-0x00000000016A7000-memory.dmp family_salatstealer behavioral2/memory/3692-121-0x0000000000A50000-0x00000000016A7000-memory.dmp family_salatstealer behavioral2/memory/3692-122-0x0000000000A50000-0x00000000016A7000-memory.dmp family_salatstealer behavioral2/memory/3692-123-0x0000000000A50000-0x00000000016A7000-memory.dmp family_salatstealer behavioral2/memory/3692-124-0x0000000000A50000-0x00000000016A7000-memory.dmp family_salatstealer behavioral2/memory/3692-125-0x0000000000A50000-0x00000000016A7000-memory.dmp family_salatstealer behavioral2/memory/3692-126-0x0000000000A50000-0x00000000016A7000-memory.dmp family_salatstealer behavioral2/memory/3692-127-0x0000000000A50000-0x00000000016A7000-memory.dmp family_salatstealer behavioral2/memory/5028-130-0x0000000000B50000-0x00000000017A7000-memory.dmp family_salatstealer behavioral2/memory/3548-133-0x0000000000A50000-0x00000000016A7000-memory.dmp family_salatstealer behavioral2/memory/3692-134-0x0000000000A50000-0x00000000016A7000-memory.dmp family_salatstealer behavioral2/memory/3692-135-0x0000000000A50000-0x00000000016A7000-memory.dmp family_salatstealer behavioral2/memory/3692-136-0x0000000000A50000-0x00000000016A7000-memory.dmp family_salatstealer behavioral2/memory/3692-137-0x0000000000A50000-0x00000000016A7000-memory.dmp family_salatstealer behavioral2/memory/3692-138-0x0000000000A50000-0x00000000016A7000-memory.dmp family_salatstealer behavioral2/memory/3692-139-0x0000000000A50000-0x00000000016A7000-memory.dmp family_salatstealer behavioral2/memory/3692-140-0x0000000000A50000-0x00000000016A7000-memory.dmp family_salatstealer behavioral2/memory/3692-141-0x0000000000A50000-0x00000000016A7000-memory.dmp family_salatstealer - UAC bypass 3 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" powershell.exe - Windows security bypass 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\COMWindows\MicrosoftUpdateAssistant.exe = "0" minerr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\checker.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\WinInetCache\checker.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\COMWindows\miner.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\MicrosoftUpdateAssistant.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\MicrosoftUpdateHealth.exe = "0" minerr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\checker.exe = "0" minerr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\COMWindows\checker.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\watchdog.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SettingsSync.exe = "0" MicrosoftUpdateAssistant.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes minerr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\miner.exe = "0" minerr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\COMWindows\SettingsSync.exe = "0" minerr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\xmrig.exe = "0" minerr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\SettingsSync.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\miner.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\COMWindows\MicrosoftUpdateWorker.exe = "0" minerr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\MicrosoftUpdateAssistant.exe = "0" minerr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SettingsSync.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\COMWindows\checker.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\COMWindows = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt = "0" minerr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\MicrosoftUpdateAssistant.exe = "0" minerr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\MicrosoftUpdateWorker.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\miner.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\watchdog.exe = "0" minerr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateHealth.exe = "0" minerr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\SettingsSync.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\WinInetCache\MicrosoftUpdateWorker.exe = "0" minerr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\miner.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\MicrosoftUpdateWorker.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\COMWindows\MicrosoftUpdateHealth.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\SettingsSync.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\watchdog.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\COMWindows\watchdog.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\MicrosoftUpdateWorker.exe = "0" minerr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe = "0" minerr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\checker.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\checker.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\watchdog.exe = "0" minerr.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths minerr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\xmrig.exe = "0" minerr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\MicrosoftUpdateAssistant.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\COMWindows\xmrig.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\watchdog.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\xmrig.exe = "0" MicrosoftUpdateAssistant.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes MicrosoftUpdateAssistant.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\watchdog.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\SettingsSync.exe = "0" minerr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\checker.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\MicrosoftUpdateHealth.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\COMWindows\checker.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\.exe = "0" minerr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\MicrosoftUpdateHealth.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\COMWindows = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\MicrosoftUpdateWorker.exe = "0" MicrosoftUpdateAssistant.exe - XMRig Miner payload 2 IoCs
resource yara_rule behavioral2/files/0x0008000000028395-52.dat family_xmrig behavioral2/files/0x0008000000028395-52.dat xmrig - Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 68 116 powershell.exe 69 116 powershell.exe 70 116 powershell.exe 71 116 powershell.exe 72 116 powershell.exe - Creates a file in the Startup directory 1 TTPs 2 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.vbs minerr.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.vbs minerr.exe - Executes dropped EXE 10 IoCs
pid Process 4712 minerr.exe 4180 dd.exe 3572 MicrosoftUpdateAssistant.exe 3424 MicrosoftUpdateAssistant.exe 1840 MicrosoftUpdateHealth.exe 3480 MicrosoftUpdateWorker.exe 3004 dwm.exe 3692 OfficeClickToRun.exe 5028 dwm.exe 3548 OfficeClickToRun.exe - Windows security modification 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\WinInetCache = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\watchdog.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue = "0" minerr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\COMWindows\MicrosoftUpdateHealth.exe = "0" minerr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\xmrig.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\COMWindows\checker.exe = "0" minerr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\checker.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\WinInetCache\MicrosoftUpdateAssistant.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\MicrosoftUpdateAssistant.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\SettingsSync.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\MicrosoftUpdateAssistant.exe = "0" minerr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\MicrosoftUpdateWorker.exe = "0" minerr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\miner.exe = "0" minerr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\watchdog.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\COMWindows\MicrosoftUpdateWorker.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\COMWindows\watchdog.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update = "0" minerr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\xmrig.exe = "0" minerr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\MicrosoftUpdateAssistant.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\SettingsSync.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\WinInetCache\MicrosoftUpdateWorker.exe = "0" minerr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\WinInetCache\watchdog.exe = "0" minerr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\COMWindows\xmrig.exe = "0" minerr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\watchdog.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\MicrosoftUpdateHealth.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\SettingsSync.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\xmrig.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\COMWindows = "0" minerr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths MicrosoftUpdateAssistant.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\COMWindows\MicrosoftUpdateHealth.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\checker.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\SettingsSync.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\COMWindows\SettingsSync.exe = "0" minerr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\miner.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\watchdog.exe = "0" minerr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\SettingsSync.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\COMWindows\MicrosoftUpdateWorker.exe = "0" MicrosoftUpdateAssistant.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths minerr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\checker.exe = "0" minerr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\watchdog.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\watchdog.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\MicrosoftUpdateHealth.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\COMWindows\MicrosoftUpdateHealth.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\watchdog.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\WinInetCache\MicrosoftUpdateHealth.exe = "0" minerr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes = "0" minerr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\exe = "0" minerr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\watchdog.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\MicrosoftUpdateAssistant.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\MicrosoftUpdateAssistant.exe = "0" minerr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\WinInetCache\SettingsSync.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\watchdog.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\checker.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\COMWindows\SettingsSync.exe = "0" MicrosoftUpdateAssistant.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths minerr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\COMWindows\MicrosoftUpdateWorker.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\checker.exe = "0" MicrosoftUpdateAssistant.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\Update\\MicrosoftUpdateAssistant.exe\"" minerr.exe Set value (str) \REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "C:\\Users\\Admin\\AppData\\Local\\PeerDistRepub\\OfficeClickToRun.exe" dd.exe Set value (str) \REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dwm = "C:\\Program Files (x86)\\Windows NT\\dwm.exe" dd.exe - Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 12 pastebin.com 13 pastebin.com - Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
ioc Process \??\F:\ powershell.exe -
resource yara_rule behavioral2/files/0x0007000000028393-11.dat upx behavioral2/memory/4180-13-0x0000000000CA0000-0x00000000018F7000-memory.dmp upx behavioral2/memory/4180-57-0x0000000000CA0000-0x00000000018F7000-memory.dmp upx behavioral2/memory/4180-58-0x0000000000CA0000-0x00000000018F7000-memory.dmp upx behavioral2/memory/4180-59-0x0000000000CA0000-0x00000000018F7000-memory.dmp upx behavioral2/memory/4180-60-0x0000000000CA0000-0x00000000018F7000-memory.dmp upx behavioral2/memory/3004-68-0x0000000000B50000-0x00000000017A7000-memory.dmp upx behavioral2/memory/4180-69-0x0000000000CA0000-0x00000000018F7000-memory.dmp upx behavioral2/memory/3004-70-0x0000000000B50000-0x00000000017A7000-memory.dmp upx behavioral2/memory/3692-73-0x0000000000A50000-0x00000000016A7000-memory.dmp upx behavioral2/memory/3692-74-0x0000000000A50000-0x00000000016A7000-memory.dmp upx behavioral2/memory/3692-75-0x0000000000A50000-0x00000000016A7000-memory.dmp upx behavioral2/memory/3692-76-0x0000000000A50000-0x00000000016A7000-memory.dmp upx behavioral2/memory/3692-79-0x0000000000A50000-0x00000000016A7000-memory.dmp upx behavioral2/memory/3692-115-0x0000000000A50000-0x00000000016A7000-memory.dmp upx behavioral2/memory/3692-116-0x0000000000A50000-0x00000000016A7000-memory.dmp upx behavioral2/memory/3692-117-0x0000000000A50000-0x00000000016A7000-memory.dmp upx behavioral2/memory/3692-118-0x0000000000A50000-0x00000000016A7000-memory.dmp upx behavioral2/memory/3692-119-0x0000000000A50000-0x00000000016A7000-memory.dmp upx behavioral2/memory/3692-120-0x0000000000A50000-0x00000000016A7000-memory.dmp upx behavioral2/memory/3692-121-0x0000000000A50000-0x00000000016A7000-memory.dmp upx behavioral2/memory/3692-122-0x0000000000A50000-0x00000000016A7000-memory.dmp upx behavioral2/memory/3692-123-0x0000000000A50000-0x00000000016A7000-memory.dmp upx behavioral2/memory/3692-124-0x0000000000A50000-0x00000000016A7000-memory.dmp upx behavioral2/memory/3692-125-0x0000000000A50000-0x00000000016A7000-memory.dmp upx behavioral2/memory/3692-126-0x0000000000A50000-0x00000000016A7000-memory.dmp upx behavioral2/memory/3692-127-0x0000000000A50000-0x00000000016A7000-memory.dmp upx behavioral2/memory/5028-129-0x0000000000B50000-0x00000000017A7000-memory.dmp upx behavioral2/memory/5028-130-0x0000000000B50000-0x00000000017A7000-memory.dmp upx behavioral2/memory/3548-132-0x0000000000A50000-0x00000000016A7000-memory.dmp upx behavioral2/memory/3548-133-0x0000000000A50000-0x00000000016A7000-memory.dmp upx behavioral2/memory/3692-134-0x0000000000A50000-0x00000000016A7000-memory.dmp upx behavioral2/memory/3692-135-0x0000000000A50000-0x00000000016A7000-memory.dmp upx behavioral2/memory/3692-136-0x0000000000A50000-0x00000000016A7000-memory.dmp upx behavioral2/memory/3692-137-0x0000000000A50000-0x00000000016A7000-memory.dmp upx behavioral2/memory/3692-138-0x0000000000A50000-0x00000000016A7000-memory.dmp upx behavioral2/memory/3692-139-0x0000000000A50000-0x00000000016A7000-memory.dmp upx behavioral2/memory/3692-140-0x0000000000A50000-0x00000000016A7000-memory.dmp upx behavioral2/memory/3692-141-0x0000000000A50000-0x00000000016A7000-memory.dmp upx - Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Windows NT\8251874c-ea4f-1c95-63e4-534ef88e4cea dd.exe File opened for modification C:\Program Files (x86)\Windows NT\dwm.exe dd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 15 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname minerr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dd.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dd.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain MicrosoftUpdateAssistant.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname MicrosoftUpdateAssistant.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain MicrosoftUpdateAssistant.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain minerr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dwm.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname MicrosoftUpdateWorker.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname MicrosoftUpdateAssistant.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain MicrosoftUpdateWorker.exe - System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OfficeClickToRun.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dwm.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OfficeClickToRun.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4696 schtasks.exe 3172 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4180 dd.exe 4180 dd.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4180 dd.exe 4180 dd.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 3692 OfficeClickToRun.exe 3692 OfficeClickToRun.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3692 OfficeClickToRun.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeLockMemoryPrivilege 3480 MicrosoftUpdateWorker.exe Token: SeLockMemoryPrivilege 3480 MicrosoftUpdateWorker.exe Token: SeDebugPrivilege 116 powershell.exe Token: SeIncreaseQuotaPrivilege 116 powershell.exe Token: SeSecurityPrivilege 116 powershell.exe Token: SeTakeOwnershipPrivilege 116 powershell.exe Token: SeLoadDriverPrivilege 116 powershell.exe Token: SeSystemProfilePrivilege 116 powershell.exe Token: SeSystemtimePrivilege 116 powershell.exe Token: SeProfSingleProcessPrivilege 116 powershell.exe Token: SeIncBasePriorityPrivilege 116 powershell.exe Token: SeCreatePagefilePrivilege 116 powershell.exe Token: SeBackupPrivilege 116 powershell.exe Token: SeRestorePrivilege 116 powershell.exe Token: SeShutdownPrivilege 116 powershell.exe Token: SeDebugPrivilege 116 powershell.exe Token: SeSystemEnvironmentPrivilege 116 powershell.exe Token: SeRemoteShutdownPrivilege 116 powershell.exe Token: SeUndockPrivilege 116 powershell.exe Token: SeManageVolumePrivilege 116 powershell.exe Token: 33 116 powershell.exe Token: 34 116 powershell.exe Token: 35 116 powershell.exe Token: 36 116 powershell.exe Token: SeIncreaseQuotaPrivilege 116 powershell.exe Token: SeSecurityPrivilege 116 powershell.exe Token: SeTakeOwnershipPrivilege 116 powershell.exe Token: SeLoadDriverPrivilege 116 powershell.exe Token: SeSystemProfilePrivilege 116 powershell.exe Token: SeSystemtimePrivilege 116 powershell.exe Token: SeProfSingleProcessPrivilege 116 powershell.exe Token: SeIncBasePriorityPrivilege 116 powershell.exe Token: SeCreatePagefilePrivilege 116 powershell.exe Token: SeBackupPrivilege 116 powershell.exe Token: SeRestorePrivilege 116 powershell.exe Token: SeShutdownPrivilege 116 powershell.exe Token: SeDebugPrivilege 116 powershell.exe Token: SeSystemEnvironmentPrivilege 116 powershell.exe Token: SeRemoteShutdownPrivilege 116 powershell.exe Token: SeUndockPrivilege 116 powershell.exe Token: SeManageVolumePrivilege 116 powershell.exe Token: 33 116 powershell.exe Token: 34 116 powershell.exe Token: 35 116 powershell.exe Token: 36 116 powershell.exe Token: SeIncreaseQuotaPrivilege 116 powershell.exe Token: SeSecurityPrivilege 116 powershell.exe Token: SeTakeOwnershipPrivilege 116 powershell.exe Token: SeLoadDriverPrivilege 116 powershell.exe Token: SeSystemProfilePrivilege 116 powershell.exe Token: SeSystemtimePrivilege 116 powershell.exe Token: SeProfSingleProcessPrivilege 116 powershell.exe Token: SeIncBasePriorityPrivilege 116 powershell.exe Token: SeCreatePagefilePrivilege 116 powershell.exe Token: SeBackupPrivilege 116 powershell.exe Token: SeRestorePrivilege 116 powershell.exe Token: SeShutdownPrivilege 116 powershell.exe Token: SeDebugPrivilege 116 powershell.exe Token: SeSystemEnvironmentPrivilege 116 powershell.exe Token: SeRemoteShutdownPrivilege 116 powershell.exe Token: SeUndockPrivilege 116 powershell.exe Token: SeManageVolumePrivilege 116 powershell.exe Token: 33 116 powershell.exe Token: 34 116 powershell.exe - Suspicious use of FindShellTrayWindow 60 IoCs
pid Process 4712 minerr.exe 3480 MicrosoftUpdateWorker.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe - Suspicious use of SendNotifyMessage 59 IoCs
pid Process 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe 4712 minerr.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 1892 wrote to memory of 4712 1892 minerr.exe 84 PID 4712 wrote to memory of 4180 4712 minerr.exe 86 PID 4712 wrote to memory of 4696 4712 minerr.exe 87 PID 4712 wrote to memory of 2872 4712 minerr.exe 91 PID 4712 wrote to memory of 1840 4712 minerr.exe 97 PID 4712 wrote to memory of 3172 4712 minerr.exe 98 PID 4712 wrote to memory of 4300 4712 minerr.exe 100 PID 4712 wrote to memory of 3480 4712 minerr.exe 102 PID 4180 wrote to memory of 3004 4180 dd.exe 113 PID 3692 wrote to memory of 116 3692 OfficeClickToRun.exe 115 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\minerr.exe"C:\Users\Admin\AppData\Local\Temp\minerr.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\minerr.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\minerr.exe"2⤵
- Windows security bypass
- Creates a file in the Startup directory
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\WinInetCache\dd.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\WinInetCache\dd.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Program Files (x86)\Windows NT\dwm.exe"C:\Program Files (x86)\Windows NT\dwm.exe"4⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:3004
-
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /F /TN WindowsUpdate /SC ONLOGON /IT /RL LIMITED /TR "C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe"3⤵
- Scheduled Task/Job: Scheduled Task
PID:4696
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /Delete /F /TN WindowsUpdateBoot3⤵PID:2872
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateHealth.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateHealth.exe"3⤵
- Executes dropped EXE
PID:1840
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /F /TN WindowsUpdate /SC ONLOGON /IT /RL LIMITED /TR "C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe"3⤵
- Scheduled Task/Job: Scheduled Task
PID:3172
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /Delete /F /TN WindowsUpdateBoot3⤵PID:4300
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateWorker.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateWorker.exe"3⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3480
-
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe"1⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Reads the TCP/IP host and domain name from the registry
PID:3572
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exeC:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe1⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Reads the TCP/IP host and domain name from the registry
PID:3424
-
C:\Users\Admin\AppData\Local\PeerDistRepub\OfficeClickToRun.exeC:\Users\Admin\AppData\Local\PeerDistRepub\OfficeClickToRun.exe1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3692 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe2⤵
- UAC bypass
- Badlisted process makes network request
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:116
-
-
C:\Program Files (x86)\Windows NT\dwm.exe"C:\Program Files (x86)\Windows NT\dwm.exe"1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:5028
-
C:\Users\Admin\AppData\Local\PeerDistRepub\OfficeClickToRun.exe"C:\Users\Admin\AppData\Local\PeerDistRepub\OfficeClickToRun.exe"1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:3548
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateHealth.exe
- Size 214KB
- SHA256 8a55fe0b044ba31e3d9e2d6169530437af9b9371407c67f12018c601ebbd303e
- MD5 4c49a7bb1dfaf23a555fb0a9630b35be
- SHA1 e8a217cd61603279b523521d2b3134ae6fc07b8d
- SHA512 e13ebbc06a4484a6884a47103958d3e610d442d39567b865ee90ce3e415e35808fcfca7d62ddff228619cfb7386ce00387b6d8f5117080fa2a6f63608e656c78
- SSDEEP 3072:b99sR/nqlC7DVRUsnXZBZwzNGRrsDJVlQ1q6Tkmgm+iA0oXMeoW2n:peYCfUsnpBZwZzVSkWbA0oXMeAn
- TLSH T1B4241943A18819F4E856E13CE34BE225DB627C720795E0DF17A05322AF5BEE06D3DE61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateWorker.exe
- Size 6.2MB
- SHA256 0eadb9cc8098d0fb1ac1e80f13de901435a4c5e974ea0dc7306e037178e84ee0
- MD5 e8a7266e92b8409445d9161d17d41e6c
- SHA1 59d7e0b94180530a6136a7da4ae8db26a176c440
- SHA512 f4c71cb9a4f6529e3263b0de123f999b3b138bd153b844ff2707170bc13510364ef68b1d694ce8cb0e3ae30e486e292f979fbff23a1cb70bbcea0614008f8d65
- SSDEEP 98304:SqFp6S568NMyOefiH7cXdHkByf1WCseto4tMQXfXDox+Sxw427x2vHkZvfl3TDQF:SRC/NM0rDoxrix2PkZvdAv5n1gpgR
- TLSH T19C569D26B7A401E8C87AC53CC6469A13E7F2B81A5370A7DB17B0567A1F336D45E3EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\build.json
- Size 1KB
- SHA256 c0384cb9fd00a451c1d43bd886c6033fd4aa19161b4dc135dce3085de4554f63
- MD5 f69ac6b8152afcef93da61c78822b181
- SHA1 ab52e498997a093e7fa3d1b721edc97abdcba7b8
- SHA512 efcc237df1e39fff66afe67f2a10acb66d11359ce21bd18824fa5f57556f5a16e097c024d46ec8a697ce7bfcc777aa3f2b30d674f3a0bb7b68cdcc45706b19df
- TLSH T1CD41942AC8180EB22AE0A4594CB99F4345134D637E4A782877CB660C8F8D73F217C77C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\build.json
- Size 1KB
- SHA256 0de51db8586fba72ce00c1073c7f0cd4935f7d3a3374b0a63c0accca90211464
- MD5 0f79d97513c071b16b8bced7a9260b7c
- SHA1 6df726edc2865f49131adb30155b17358591d629
- SHA512 c4a83e114f0b83f19e2d166c64bed3905cdef572b33b12a270ed611336ba0642951018f7eb7e77f26ca6397aa8ef20647cd33081e4b070b7cffe751c6f018cad
- TLSH T1D441B62AC8180EB22AD0A4094CB98F4349138D277E0A396837CB960C4F9D73F217C77D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\config.json
- Size 831B
- SHA256 5097874347deeb1c21f65b5561f8d2b18446e5af410d8d9cb6fe048980da6a36
- MD5 cd026c4c5d99f32e208ee4d7834d2cd0
- SHA1 c1a6990be8fe8463f8ee1a0fcae64f226c7a86ce
- SHA512 7cb9bd62215d0563f4b93e5c65a02e1779e21a17659d641959230e19614334b79c7fc4bfa6526ea72827fa282d23254e40fb8ba8e20673680016f4063a91d8bf
- TLSH T14501FD17C4140CFB66E4959C5C3863E31B6C85A2E35E3C3CA183B96072AE7B222327E4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\minerr.exe
- Size 6.4MB
- SHA256 192ad26c60741fe0733313323d01ab43af5f59e4a50c5258fd04cec7f466fc4a
- MD5 e44a52d185a87105ca5194695574dd8e
- SHA1 9dc4114eae33eaecf698ee5788b569528f9d0478
- SHA512 1d95fbd8950d790223a4fb0771de12072f60c51c25466aea642c9e09e411366fabb552c4edff7dc5d4ed7e1cb9c4fb096b53ceb64f0cc944798aa0a9dbeefab0
- SSDEEP 196608:MYVe8+wsY7Dn7bQ5PhvzyJ6H4fpuqdpw2:MYVeTLo7bYve6Hqry2
- TLSH T10D663357D5A994B4E81AE27CD30EE246DE2238214395E5CF07A017352F6F9F0AE7CB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\WinInetCache\dd.exe
- Size 3.4MB
- SHA256 62dff0cf5917b57524122f8d040041857e7bd9a66bf9a1c49e69245281c529cd
- MD5 db6b9f86dcf61cc01d4d39459ca90ba6
- SHA1 ab3f551350523160fe319a118f8f80951b4b01f7
- SHA512 79ace543861b1d078911716e50381477a94384ded85e10d71f6543c89fa8d91eb33abcb416eb25c715ab0026b0cba2284f75f77ab24055b442d8051224462c80
- SSDEEP 98304:K3Q5PhHPA/O5yJJU8CLR4fRT7pwdc7if7mdpwK:sQ5PhvzyJ6H4fpuqdpw
- TLSH T1A3F5336F5B33FD18E10A65F2C90EE2871C99530D226CD7C65EB34179BA7B042AE7C099
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\taskmgr_hook.dll
- Size 14KB
- SHA256 62cb87ab1c49886dd5e36990192d759a7ca281cff60b12e98486893e1d7c4a17
- MD5 21a1e2d980bc6a354cb6abfbdc3d5a5e
- SHA1 100ec561950925c330fa1627d3fd15e0b2064142
- SHA512 63a72ae0bea24f0d7739774011e18e12d6e33bc4691660b325e9bbdfb28d055acffd2fa3ccb36b6d08b2f4213f4ac29a3cd20fdf01542209ec9ead1dea6b07ec
- SSDEEP 192:F+bDZXsZNJmalh/BcZKu+RTX72GrV4lQ0:F+buXJTr2D+d6YV4lQ
- TLSH T12052090D325248AEC24ED53481FB8B38B6F1F9219993573C4274FA321E957AA236AF01
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ldr0q1k4.4qq.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdate.vbs
- Size 128B
- SHA256 f0a6f60d1b23f58976fdbee8d0e36d0794e95aeddf786c6e97fdb0af4cdc5845
- MD5 7b0b153b564a5d6043722746a9cac16f
- SHA1 21643a1d193056d4aa537e875bd2d43c8879a03d
- SHA512 ae66418715a21919cf50334a297f0180bb8e6f53f1f0b24b5bfbfbc32155d6c1ca1adc83bef51c981645e2dd30a2819229c6e74ab20b66ceb1974c869c44231d
- TLSH T1D9B02B02D80CFA3C301484BB0F3DCA0CCDD05404200631306F04C01C3498984CC83041
- MD5 SHA1 SHA512 TLSH