1adc2e35bc4b0b7c3ba645796a8481b5d2277253c6fd41d458d9c5599d937d0f

Analysis

max time kernel
19s
max time network
24s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 08:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
1adc2e35bc4b0b7c3ba645796a8481b5d2277253c6fd41d458d9c5599d937d0f.exe
Size 3.6MB
Sample260925-kkqecscd65
SHA256 1adc2e35bc4b0b7c3ba645796a8481b5d2277253c6fd41d458d9c5599d937d0f
MD5 5667c2bd639baa46e724d7e100a86f7d
SHA1 64cc71041da2c1e3713fb5a2b7b9b937326bd83a
SHA512 727d026ba2593bde247d4f35ae9dd8f2ef9938728ae69b31ffa85dcb93ef7ad9c38a26d7e4b73c59033f70705ecb20624f7ced6c484a11ea463708d5e689457a
SSDEEP 49152:1G1ASBfV2x+EUxWtU1dN5nvMFo/oERcUIXMFo/oERcUIj11XR7:0agd2x+ELtU1NvIscVIscff7
TLSH
T1E106AD12E252A0F5E21E95704262573EEBF27E151B20E7DBDFD0FD212E326D1A63B205
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

credential_access defense_evasion discovery evasion execution persistence ransomware

Malware Config

Signatures

Modifies boot configuration data using bcdedit 1 TTPs 3 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
5748	bcdedit.exe
2856	bcdedit.exe
2276	bcdedit.exe

Installs a root certificate to the trusted certificate store 1 TTPs 2 IoCs

A root certificate was added to the trusted certificate store using CertUtil.

defense_evasion

Install Root Certificate

T1553.004

pid	Process
2756	cmd.exe
4592	certutil.exe

Manipulates Digital Signatures 1 TTPs 1 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\43DBB0D8926FEBC69B7663673161BC063ED10E04\Blob = 03000000010000001400000043dbb0d8926febc69b7663673161bc063ed10e0420000000010000001803000030820314308201fca003020102021057f22d200fedd2a646700c9ac5bfb563300d06092a864886f70d01010b050030163114301206035504030c0b57444b5465737443657274301e170d3236303533303231333735385a170d3336303533303231343735385a30163114301206035504030c0b57444b546573744365727430820122300d06092a864886f70d01010105000382010f003082010a0282010100bb22151c5ed381ba1ca5d23d08543311f9eaa57b2af57911066d53e3ede87aa5b3f6e0b9aa5f054b68c2b559276e0998b8d01ef9ebb3b17326c2a3d23d0e1e6d13071bbd417b948db4b57308089c2e473952189376da210cdfd9aaa9b12b5762953c65b4834801996de86f85b2f91e9d1984cf488e690d42cf9e7ba15f12538c98a8baac5258c4f39a8beb44976d6e3f3ecb5966b990ea667dd4ed3bf6adf5e1a2f4b8356c819352747ee7fdbcd25202a82398df383668f939971c1b7150f9576eede0cfb3eea50464e7e8fb19cd9dd3c99efe5c4fc176e4c8855d4269fc649cf194916458797fdf63e6599a51d40260c900906a4eab95ae5d083c2f9962a7310203010001a35e305c300e0603551d0f0101ff040403020780302b0603551d250424302206082b06010505070303060a2b0601040182370a0305060a2b0601040182373d0101301d0603551d0e0416041415f59026fd3b5de62dca6813ea552d7344dbfaed300d06092a864886f70d01010b050003820101002614d970ce546514bb87c5088985e02b5132049872095c127a118a177ccd741532f0983f3b76090f5787f95ac45e808cf417b1e425f0f950627840010a63fa18331a4ebf53d4fd07828e7babeb25bb08fb5ae18336de0524a576f91edb486eab108347fc80f5b200af6830cf2652cd513bcb66ca6c241d7033c57de76bf1272d1737cece5bccffc5cc526f6ae26cb6a0dd1e8b974953f08aec4cacd9a807ddab182eeaa9558dc5bf8ff958fe738188b3d6360aace1b11eda3cc4904db15f4af5de9018410c9048da687dc83e63496d81f566963158f8f7617e3e94a42170b4c98e66df36c5c232c2e338ed49e6c9d83fdfd994e0025e52dc59fc1cc8a567f23f	certutil.exe

Modify Registry: Disable Windows Driver Blocklist 2 TTPs 1 IoCs

Disable Windows Driver Blocklist via Registry.

defense_evasion

Modify Registry

T1112

Impair Defenses

T1562

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\CI\Config\VulnerableDriverBlocklistEnable = "0"	reg.exe

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\longdiequdong1\ImagePath = "\\??\\C:\\Windows\\Temp\\longdiequdong1.sys"	1adc2e35bc4b0b7c3ba645796a8481b5d2277253c6fd41d458d9c5599d937d0f.exe

Boot or Logon Autostart Execution: LSASS Driver 2 TTPs 1 IoCs

Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems.

persistence credential_access

LSASS Driver

T1547.008

LSASS Memory

T1003.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\RunAsPPL = "0"	reg.exe

Executes dropped EXE 2 IoCs

pid	Process
1040	longdiequdong1.sys
4604	SignGuiPatcher.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	mountvol.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 37 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
676	cmd.exe
3304	cmd.exe
4560	cmd.exe
3552	cmd.exe
1608	cmd.exe
1428	cmd.exe
2220	cmd.exe
2060	cmd.exe
440	cmd.exe
3108	cmd.exe
4116	cmd.exe
1360	cmd.exe
4440	cmd.exe
4080	cmd.exe
5752	cmd.exe
4120	cmd.exe
1008	cmd.exe
5564	cmd.exe
1160	cmd.exe
3652	cmd.exe
5996	cmd.exe
2116	cmd.exe
3432	cmd.exe
6104	cmd.exe
4144	cmd.exe
1816	cmd.exe
248	cmd.exe
4512	cmd.exe
4608	cmd.exe
576	cmd.exe
1376	cmd.exe
2820	cmd.exe
4656	cmd.exe
3624	cmd.exe
4648	cmd.exe
4580	cmd.exe
3512	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 57 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1adc2e35bc4b0b7c3ba645796a8481b5d2277253c6fd41d458d9c5599d937d0f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe

Modifies registry key 1 TTPs 18 IoCs

Modify Registry

T1112

pid	Process
3372	reg.exe
5200	reg.exe
4264	reg.exe
4556	reg.exe
3524	reg.exe
3876	reg.exe
244	reg.exe
1740	reg.exe
2404	reg.exe
4348	reg.exe
4056	reg.exe
2760	reg.exe
3348	reg.exe
2448	reg.exe
2708	reg.exe
2616	reg.exe
5656	reg.exe
1532	reg.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4604	SignGuiPatcher.exe
4604	SignGuiPatcher.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4604	SignGuiPatcher.exe
Token: SeImpersonatePrivilege	4604	SignGuiPatcher.exe
Token: SeDebugPrivilege	4604	SignGuiPatcher.exe
Token: SeShutdownPrivilege	2920	shutdown.exe
Token: SeRemoteShutdownPrivilege	2920	shutdown.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1272	1adc2e35bc4b0b7c3ba645796a8481b5d2277253c6fd41d458d9c5599d937d0f.exe
1272	1adc2e35bc4b0b7c3ba645796a8481b5d2277253c6fd41d458d9c5599d937d0f.exe
1104	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1272 wrote to memory of 1608	1272	1adc2e35bc4b0b7c3ba645796a8481b5d2277253c6fd41d458d9c5599d937d0f.exe	89
PID 1608 wrote to memory of 4144	1608	cmd.exe	91
PID 4144 wrote to memory of 5072	4144	cmd.exe	92
PID 1272 wrote to memory of 1816	1272	1adc2e35bc4b0b7c3ba645796a8481b5d2277253c6fd41d458d9c5599d937d0f.exe	96
PID 1816 wrote to memory of 3372	1816	cmd.exe	98
PID 1272 wrote to memory of 1428	1272	1adc2e35bc4b0b7c3ba645796a8481b5d2277253c6fd41d458d9c5599d937d0f.exe	99
PID 1428 wrote to memory of 2760	1428	cmd.exe	101
PID 1272 wrote to memory of 2220	1272	1adc2e35bc4b0b7c3ba645796a8481b5d2277253c6fd41d458d9c5599d937d0f.exe	102
PID 2220 wrote to memory of 2708	2220	cmd.exe	104
PID 1272 wrote to memory of 4648	1272	1adc2e35bc4b0b7c3ba645796a8481b5d2277253c6fd41d458d9c5599d937d0f.exe	105
PID 4648 wrote to memory of 5200	4648	cmd.exe	107
PID 1272 wrote to memory of 1376	1272	1adc2e35bc4b0b7c3ba645796a8481b5d2277253c6fd41d458d9c5599d937d0f.exe	108
PID 1376 wrote to memory of 4264	1376	cmd.exe	110
PID 1272 wrote to memory of 2060	1272	1adc2e35bc4b0b7c3ba645796a8481b5d2277253c6fd41d458d9c5599d937d0f.exe	111
PID 2060 wrote to memory of 3876	2060	cmd.exe	113
PID 1272 wrote to memory of 440	1272	1adc2e35bc4b0b7c3ba645796a8481b5d2277253c6fd41d458d9c5599d937d0f.exe	114
PID 440 wrote to memory of 244	440	cmd.exe	116
PID 1272 wrote to memory of 248	1272	1adc2e35bc4b0b7c3ba645796a8481b5d2277253c6fd41d458d9c5599d937d0f.exe	117
PID 248 wrote to memory of 3348	248	cmd.exe	119
PID 1272 wrote to memory of 676	1272	1adc2e35bc4b0b7c3ba645796a8481b5d2277253c6fd41d458d9c5599d937d0f.exe	120
PID 676 wrote to memory of 1740	676	cmd.exe	122
PID 1272 wrote to memory of 1360	1272	1adc2e35bc4b0b7c3ba645796a8481b5d2277253c6fd41d458d9c5599d937d0f.exe	123
PID 1360 wrote to memory of 4556	1360	cmd.exe	125
PID 1272 wrote to memory of 4512	1272	1adc2e35bc4b0b7c3ba645796a8481b5d2277253c6fd41d458d9c5599d937d0f.exe	126
PID 4512 wrote to memory of 2616	4512	cmd.exe	128
PID 1272 wrote to memory of 1160	1272	1adc2e35bc4b0b7c3ba645796a8481b5d2277253c6fd41d458d9c5599d937d0f.exe	129
PID 1160 wrote to memory of 2404	1160	cmd.exe	131
PID 1272 wrote to memory of 3304	1272	1adc2e35bc4b0b7c3ba645796a8481b5d2277253c6fd41d458d9c5599d937d0f.exe	132
PID 3304 wrote to memory of 5656	3304	cmd.exe	134
PID 1272 wrote to memory of 3108	1272	1adc2e35bc4b0b7c3ba645796a8481b5d2277253c6fd41d458d9c5599d937d0f.exe	135
PID 3108 wrote to memory of 3524	3108	cmd.exe	137
PID 1272 wrote to memory of 4116	1272	1adc2e35bc4b0b7c3ba645796a8481b5d2277253c6fd41d458d9c5599d937d0f.exe	138
PID 4116 wrote to memory of 2448	4116	cmd.exe	140
PID 1272 wrote to memory of 4580	1272	1adc2e35bc4b0b7c3ba645796a8481b5d2277253c6fd41d458d9c5599d937d0f.exe	141
PID 4580 wrote to memory of 4348	4580	cmd.exe	143
PID 1272 wrote to memory of 3652	1272	1adc2e35bc4b0b7c3ba645796a8481b5d2277253c6fd41d458d9c5599d937d0f.exe	144
PID 3652 wrote to memory of 4056	3652	cmd.exe	146
PID 1272 wrote to memory of 4440	1272	1adc2e35bc4b0b7c3ba645796a8481b5d2277253c6fd41d458d9c5599d937d0f.exe	147
PID 4440 wrote to memory of 5996	4440	cmd.exe	149
PID 1272 wrote to memory of 3552	1272	1adc2e35bc4b0b7c3ba645796a8481b5d2277253c6fd41d458d9c5599d937d0f.exe	150
PID 3552 wrote to memory of 3512	3552	cmd.exe	152
PID 1272 wrote to memory of 4080	1272	1adc2e35bc4b0b7c3ba645796a8481b5d2277253c6fd41d458d9c5599d937d0f.exe	153
PID 4080 wrote to memory of 4608	4080	cmd.exe	155
PID 1272 wrote to memory of 4560	1272	1adc2e35bc4b0b7c3ba645796a8481b5d2277253c6fd41d458d9c5599d937d0f.exe	156
PID 4560 wrote to memory of 3344	4560	cmd.exe	158
PID 1272 wrote to memory of 576	1272	1adc2e35bc4b0b7c3ba645796a8481b5d2277253c6fd41d458d9c5599d937d0f.exe	159
PID 576 wrote to memory of 6104	576	cmd.exe	161
PID 1272 wrote to memory of 5752	1272	1adc2e35bc4b0b7c3ba645796a8481b5d2277253c6fd41d458d9c5599d937d0f.exe	162
PID 5752 wrote to memory of 2116	5752	cmd.exe	164
PID 1272 wrote to memory of 3432	1272	1adc2e35bc4b0b7c3ba645796a8481b5d2277253c6fd41d458d9c5599d937d0f.exe	165
PID 3432 wrote to memory of 2712	3432	cmd.exe	167
PID 1272 wrote to memory of 2820	1272	1adc2e35bc4b0b7c3ba645796a8481b5d2277253c6fd41d458d9c5599d937d0f.exe	168
PID 2820 wrote to memory of 1532	2820	cmd.exe	170
PID 1272 wrote to memory of 4120	1272	1adc2e35bc4b0b7c3ba645796a8481b5d2277253c6fd41d458d9c5599d937d0f.exe	171
PID 4120 wrote to memory of 5748	4120	cmd.exe	173
PID 1272 wrote to memory of 4656	1272	1adc2e35bc4b0b7c3ba645796a8481b5d2277253c6fd41d458d9c5599d937d0f.exe	174
PID 4656 wrote to memory of 2856	4656	cmd.exe	176
PID 1272 wrote to memory of 1008	1272	1adc2e35bc4b0b7c3ba645796a8481b5d2277253c6fd41d458d9c5599d937d0f.exe	177
PID 1008 wrote to memory of 2276	1008	cmd.exe	179
PID 1272 wrote to memory of 2756	1272	1adc2e35bc4b0b7c3ba645796a8481b5d2277253c6fd41d458d9c5599d937d0f.exe	180
PID 2756 wrote to memory of 4592	2756	cmd.exe	182
PID 1272 wrote to memory of 5564	1272	1adc2e35bc4b0b7c3ba645796a8481b5d2277253c6fd41d458d9c5599d937d0f.exe	183
PID 5564 wrote to memory of 5852	5564	cmd.exe	185
PID 1272 wrote to memory of 4604	1272	1adc2e35bc4b0b7c3ba645796a8481b5d2277253c6fd41d458d9c5599d937d0f.exe	186

C:\Users\Admin\AppData\Local\Temp\1adc2e35bc4b0b7c3ba645796a8481b5d2277253c6fd41d458d9c5599d937d0f.exe
"C:\Users\Admin\AppData\Local\Temp\1adc2e35bc4b0b7c3ba645796a8481b5d2277253c6fd41d458d9c5599d937d0f.exe"
1⤵
- Sets service image path in registry
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1272
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cmd /c "C:\Users\Admin\AppData\Local\Temp\\_bl_240707718_29849.bat"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1608
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\\_bl_240707718_29849.bat"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4144
  - - C:\Windows\system32\manage-bde.exe
      C:\Windows\Sysnative\manage-bde.exe -status C: -protectionaserrorlevel
      4⤵
      PID:5072
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity /v Enabled /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1816
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity /v Enabled /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:3372
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\CredentialGuard /v Enabled /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1428
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\CredentialGuard /v Enabled /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2760
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\SystemGuard /v Enabled /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2220
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\SystemGuard /v Enabled /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2708
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\WindowsHello /v Enabled /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4648
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\WindowsHello /v Enabled /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:5200
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard /v EnableVirtualizationBasedSecurity /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1376
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard /v EnableVirtualizationBasedSecurity /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4264
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard /v RequirePlatformSecurityFeatures /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2060
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard /v RequirePlatformSecurityFeatures /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:3876
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard /v Locked /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:440
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard /v Locked /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:244
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LsaCfgFlags /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:248
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v LsaCfgFlags /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:3348
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v EnableVirtualizationBasedSecurity /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:676
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v EnableVirtualizationBasedSecurity /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:1740
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v RequirePlatformSecurityFeatures /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1360
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v RequirePlatformSecurityFeatures /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4556
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v HypervisorEnforcedCodeIntegrity /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4512
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v HypervisorEnforcedCodeIntegrity /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2616
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v LsaCfgFlags /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1160
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v LsaCfgFlags /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2404
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v RunAsPPL /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3304
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\Lsa /v RunAsPPL /t REG_DWORD /d 0 /f
    3⤵
    - Boot or Logon Autostart Execution: LSASS Driver
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:5656
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\PolicyManager\default\WindowsHello\Enabled /v value /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3108
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\PolicyManager\default\WindowsHello\Enabled /v value /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:3524
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Policies\Microsoft\PassportForWork\Biometrics /v Enabled /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4116
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Policies\Microsoft\PassportForWork\Biometrics /v Enabled /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:2448
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\CI\Config /v VulnerableDriverBlocklistEnable /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4580
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\CI\Config /v VulnerableDriverBlocklistEnable /t REG_DWORD /d 0 /f
    3⤵
    - Modify Registry: Disable Windows Driver Blocklist
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4348
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy /v VerifiedAndReputablePolicyState /t REG_DWORD /d 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3652
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy /v VerifiedAndReputablePolicyState /t REG_DWORD /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4056
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cmd /c "C:\Users\Admin\AppData\Local\Temp\\_vv_240717453.bat"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4440
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\\_vv_240717453.bat"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5996
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cmd /c for %f in (C:\Windows\System32\CodeIntegrity\CiPolicies\Active\*.cip) do ren "%f" %~nf.cip.bak.wdkt.240717453
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3552
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c for %f in (C:\Windows\System32\CodeIntegrity\CiPolicies\Active\*.cip) do ren "%f" %~nf.cip.bak.wdkt.240717453
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3512
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cmd /c if exist C:\Windows\System32\CodeIntegrity\SIPolicy.p7b ren C:\Windows\System32\CodeIntegrity\SIPolicy.p7b SIPolicy.p7b.bak.wdkt.240717453
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4080
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c if exist C:\Windows\System32\CodeIntegrity\SIPolicy.p7b ren C:\Windows\System32\CodeIntegrity\SIPolicy.p7b SIPolicy.p7b.bak.wdkt.240717453
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4608
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\Sysnative\mountvol.exe X: /s
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4560
- - C:\Windows\system32\mountvol.exe
    C:\Windows\Sysnative\mountvol.exe X: /s
    3⤵
    PID:3344
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cmd /c for %f in (X:\EFI\Microsoft\Boot\CIPolicies\Active\*.cip) do ren "%f" %~nf.cip.bak.wdkt.240717453
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:576
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c for %f in (X:\EFI\Microsoft\Boot\CIPolicies\Active\*.cip) do ren "%f" %~nf.cip.bak.wdkt.240717453
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:6104
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c cmd /c if exist X:\EFI\Microsoft\Boot\SIPolicy.p7b ren X:\EFI\Microsoft\Boot\SIPolicy.p7b SIPolicy.p7b.bak.wdkt.240717453
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5752
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c if exist X:\EFI\Microsoft\Boot\SIPolicy.p7b ren X:\EFI\Microsoft\Boot\SIPolicy.p7b SIPolicy.p7b.bak.wdkt.240717453
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2116
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\Sysnative\mountvol.exe X: /d
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3432
- - C:\Windows\system32\mountvol.exe
    C:\Windows\Sysnative\mountvol.exe X: /d
    3⤵
    - Enumerates connected drives
    PID:2712
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\WdKtBackup /v LastRenameSuffix /t REG_SZ /d ".bak.wdkt.240717453" /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2820
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\WdKtBackup /v LastRenameSuffix /t REG_SZ /d ".bak.wdkt.240717453" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:1532
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\Sysnative\bcdedit.exe /set hypervisorlaunchtype off
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4120
- - C:\Windows\system32\bcdedit.exe
    C:\Windows\Sysnative\bcdedit.exe /set hypervisorlaunchtype off
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5748
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\Sysnative\bcdedit.exe /set vsmlaunchtype off
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4656
- - C:\Windows\system32\bcdedit.exe
    C:\Windows\Sysnative\bcdedit.exe /set vsmlaunchtype off
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2856
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\Sysnative\bcdedit.exe /set testsigning on
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1008
- - C:\Windows\system32\bcdedit.exe
    C:\Windows\Sysnative\bcdedit.exe /set testsigning on
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2276
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\Sysnative\certutil.exe -f -addstore Root "C:\Users\Admin\AppData\Local\Temp\_wdkt_240719125_99783.cer"
  2⤵
  - Installs a root certificate to the trusted certificate store
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2756
- - C:\Windows\system32\certutil.exe
    C:\Windows\Sysnative\certutil.exe -f -addstore Root "C:\Users\Admin\AppData\Local\Temp\_wdkt_240719125_99783.cer"
    3⤵
    - Installs a root certificate to the trusted certificate store
    PID:4592
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\Sysnative\certutil.exe -f -addstore TrustedPublisher "C:\Users\Admin\AppData\Local\Temp\_wdkt_240719125_99783.cer"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5564
- - C:\Windows\system32\certutil.exe
    C:\Windows\Sysnative\certutil.exe -f -addstore TrustedPublisher "C:\Users\Admin\AppData\Local\Temp\_wdkt_240719125_99783.cer"
    3⤵
    - Manipulates Digital Signatures
    PID:5852
- C:\Users\Admin\AppData\Local\Temp\SignGuiPatcher.exe
  "C:\Users\Admin\AppData\Local\Temp\SignGuiPatcher.exe" -apply
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4604
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\Sysnative\shutdown.exe /r /t 0 /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3624
- - C:\Windows\system32\shutdown.exe
    C:\Windows\Sysnative\shutdown.exe /r /t 0 /f
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2920

C:\Windows\Temp\longdiequdong1.sys
C:\Windows\Temp\longdiequdong1.sys
1⤵
- Executes dropped EXE
PID:1040

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39d6055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1104

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:2852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

LSASS Driver

T1547.008

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

LSASS Driver

T1547.008

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

OS Credential Dumping

T1003

LSASS Memory

T1003.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

SignGuiPatcher.exe

Path C:\Users\Admin\AppData\Local\Temp\SignGuiPatcher.exe
Size 27KB
SHA256 32fc89230f272a47c702b366f4cdba6c37a9bf4a323ab69d8b96effb9809d416
MD5 bf3bab59d74bf6244dbdde2eab294801
SHA1 59419491b377aa43a8ee7333d1599ff9fb6ae104
SHA512 ae9718a73d92778b06988afc95f6ff8a9b002bed543f4da8ab7857c31e520401bd346a31e993155ea808fc8a7d7e4469cabd2285f107924b80205da92df60061
SSDEEP 384:DPysd9jpAZsQ+lNyvo3ugNoovS5uZYreLe+GzXcN7bA4//cuJXp1:DBjpC+QovSKE2Y4/keXb
TLSH
T1ECC20A5AA2F405DAF532A171D9B67326F036F518183147DF83620A5E0F72AC0BB35BAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bl_240707718_29849.bat

Path C:\Users\Admin\AppData\Local\Temp\_bl_240707718_29849.bat
Size 173B
SHA256 232da1125fc313184e9581130b7d41a444e7e228e4b69ceeea60f4b36a47b881
MD5 da9efb8201ebdc4fc0baf32bb498c4aa
SHA1 f593f8c19798ff74ac8164e11cb666d46cba7b7b
SHA512 7379b13ef5d7bc600ce598c029d3e3b3972b6dd2815df151db7f518d3230fef5db3edec9099b1bdf7b4ee40f24d2f2e5fc1e5210e2b573dfc5d9ff443122b980
TLSH
T155C0224213408CED0010A00AA063C08420B3898B29C03AA0026544A85850485AE0E203
MD5 SHA1 SHA512 TLSH

Submit Download

_bl_240707718_29849.txt

Path C:\Users\Admin\AppData\Local\Temp\_bl_240707718_29849.txt
Size 5B
SHA256 b6626dde5feadbb3302a67528088e8f7cf8536de683f152639d3727ac4b24b3a
MD5 a77299bfbf6fc09712da498c168f9e71
SHA1 347ea3c48644143aaf8b8fce49bc8ba817cf953f
SHA512 d803f52c41a271efc811861ae0848a7a892455fb97997cc97503bcedd7ffbb94858e43978cfca0bebf6f0003825079237d465e67e4d905343573913bff22e487
MD5 SHA1 SHA512

Submit Download

_vv_240717453.bat

Path C:\Users\Admin\AppData\Local\Temp\_vv_240717453.bat
Size 71B
SHA256 f87be638d0a4dd8580b21f20936b7a5c24122a1d79aca80db6934a2050f4eab8
MD5 fe5fc285384f609bc0f232cfc6a1eb84
SHA1 ae0d74119d5f591da2c37a3495e05a70286a25a7
SHA512 f2429c9a5637f0c6b5214600c6d055a3f3e3e16319164e3bd9676fd02c3922b624b1080bf886ae90018080f806610f06297b19d816455db3747901d001f7a67b
TLSH
T1D2A024014145C74C4004511341F3C04CD35104473DC5570003D1C045CCC000CDF4D303
MD5 SHA1 SHA512 TLSH

Submit Download

_vv_240717453.txt

Path C:\Users\Admin\AppData\Local\Temp\_vv_240717453.txt
Size 47B
SHA256 3827cbd05a50743b57acddb70bbeb3c2118eb07e528c8d6e9449ae18553e41fa
MD5 99746df3450c18c32b6e617f2d27f934
SHA1 4bde2cc83326ad3386b0dfaea363304a52da5dd0
SHA512 048367c362a8e45154fca1da91c9561fd04b04d96f02b2bff3ed45385350fa591d3913dfd771cec4e277ea071267cf95c612382fea94decfa3803b5eca275307
MD5 SHA1 SHA512

Submit Download

_wdkt_240719125_99783.cer

Path C:\Users\Admin\AppData\Local\Temp\_wdkt_240719125_99783.cer
Size 792B
SHA256 4ba1a74c97dbbaba1d4b4119d41f5c764791cd568a3c7f6f20a98cdae36fddb6
MD5 f86961a3e60a0c917b1eee487922e374
SHA1 43dbb0d8926febc69b7663673161bc063ed10e04
SHA512 bcc3ea7c9cee6ce3322ebe6b443760a180bf28ed6c3ee1622f94714622d78d72de98b684e1f2f7b50993940ebc1a9cae797672c09b80faeda9d8c256cf413a4f
TLSH
T11F01757D256FB2855D5705505389E70E6872EAC445D14E3ADA3F4054C4C7981EF2F216
MD5 SHA1 SHA512 TLSH

Submit Download

longdiequdong1.sys

Path C:\Windows\Temp\longdiequdong1.sys
Size 604KB
SHA256 61b3dd3c3aa8783a8bb9689e7d19711eaa74b261bd075119ec124be120a38f0a
MD5 821f11f4784f699dacd5ec9bf7e2c3e5
SHA1 8d9d5320bfe623b46d638b0e6b013ff60a483c80
SHA512 3bbdfd54d6601d2c8d90661024801fbbd6ed5ef66623d0dc55fe2e9d99b04a3db86590a070ddccc24e428dfc877439d0324f608fd0edd3e512335a588e4cc73b
SSDEEP 12288:WSMrr1+d/lvUQtKPMqnNMR4tUkw9RCsAlh:WSMX1o/KQtKP5NMRcUF7ChL
TLSH
T1F8D48C95E29111F4E2AAD179C557933BE7F37818132296DF82B0CE262F57BC0AE39311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1272-13-0x0000000000400000-0x00000000007E8000-memory.dmp

Download

memory/1272-17-0x0000000000400000-0x00000000007E8000-memory.dmp

Download

memory/1272-18-0x0000000000400000-0x00000000007E8000-memory.dmp

Download

memory/1272-1-0x000000000040D000-0x000000000040E000-memory.dmp

Download

memory/1272-20-0x0000000000400000-0x00000000007E8000-memory.dmp

Download

memory/1272-12-0x0000000000400000-0x00000000007E8000-memory.dmp

Download

memory/1272-9-0x0000000000400000-0x00000000007E8000-memory.dmp

Download

memory/1272-3-0x0000000000400000-0x00000000007E8000-memory.dmp

Download

memory/1272-27-0x0000000000400000-0x00000000007E8000-memory.dmp

Download

memory/1272-0-0x0000000002950000-0x000000000297B000-memory.dmp

Download

memory/1272-36-0x0000000000400000-0x00000000007E8000-memory.dmp

Download

memory/1272-37-0x0000000000400000-0x00000000007E8000-memory.dmp

Download

memory/1272-39-0x0000000000400000-0x00000000007E8000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads