Analysis
- max time kernel
149s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/09/2026, 16:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
file.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
22 signatures
150 seconds
General
- Target file.exe
- Size 6.5MB
- Sample260925-tgctjavyay
- SHA256 97a76527d77d1d8e1f8a64ebdbccf60abc10220d1a8425ff48fd10a8f658b181
- MD5 e11d3d121c7943ab703068153999a69c
- SHA1 17f643eb4e381c811ad212f19473e1d358d553d4
- SHA512 c45d2cc12313919cf8be00b806e953411d29df623ad97ee24b30ea93c4299de2caf0fe3bd708eec7ac17e7b8e150907c47bd96b38620bb949a4557f2d7eb65a4
- SSDEEP 196608:i7cJxWz7sfwErLgnNuoNe1nd9PL3EHGAV80w7jxB1u:MUToEUNuoNe1XPL0HGAVVmjj1u
- TLSH T122663341C1B0EC93E850E0F6D6C225507EBC9B2B0BA774FB76A71876E152FF148B41A6
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 17 IoCs
resource yara_rule behavioral2/memory/3580-52-0x0000000000380000-0x0000000000FD7000-memory.dmp family_salatstealer behavioral2/memory/3580-53-0x0000000000380000-0x0000000000FD7000-memory.dmp family_salatstealer behavioral2/memory/3580-55-0x0000000000380000-0x0000000000FD7000-memory.dmp family_salatstealer behavioral2/memory/3580-57-0x0000000000380000-0x0000000000FD7000-memory.dmp family_salatstealer behavioral2/memory/3580-59-0x0000000000380000-0x0000000000FD7000-memory.dmp family_salatstealer behavioral2/memory/4576-69-0x0000000000DE0000-0x0000000001A37000-memory.dmp family_salatstealer behavioral2/memory/3580-70-0x0000000000380000-0x0000000000FD7000-memory.dmp family_salatstealer behavioral2/memory/5396-75-0x0000000000850000-0x00000000014A7000-memory.dmp family_salatstealer behavioral2/memory/5396-77-0x0000000000850000-0x00000000014A7000-memory.dmp family_salatstealer behavioral2/memory/5396-79-0x0000000000850000-0x00000000014A7000-memory.dmp family_salatstealer behavioral2/memory/5396-81-0x0000000000850000-0x00000000014A7000-memory.dmp family_salatstealer behavioral2/memory/5396-107-0x0000000000850000-0x00000000014A7000-memory.dmp family_salatstealer behavioral2/memory/5396-109-0x0000000000850000-0x00000000014A7000-memory.dmp family_salatstealer behavioral2/memory/5396-111-0x0000000000850000-0x00000000014A7000-memory.dmp family_salatstealer behavioral2/memory/5396-113-0x0000000000850000-0x00000000014A7000-memory.dmp family_salatstealer behavioral2/memory/5396-115-0x0000000000850000-0x00000000014A7000-memory.dmp family_salatstealer behavioral2/memory/5396-117-0x0000000000850000-0x00000000014A7000-memory.dmp family_salatstealer - UAC bypass 3 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" powershell.exe - Windows security bypass 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\miner.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\MicrosoftUpdateHealth.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\COMWindows\checker.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\file.exe = "0" file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\miner.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\MicrosoftUpdateWorker.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\COMWindows\miner.exe = "0" file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\checker.exe = "0" file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\checker.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\MicrosoftUpdateHealth.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateWorker.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\WinInetCache\checker.exe = "0" file.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\xmrig.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\MicrosoftUpdateHealth.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\COMWindows\MicrosoftUpdateWorker.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\MicrosoftUpdateWorker.exe = "0" file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\MicrosoftUpdateWorker.exe = "0" file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\MicrosoftUpdateHealth.exe = "0" file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\xmrig.exe = "0" file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\MicrosoftUpdateWorker.exe = "0" file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\WinInetCache\MicrosoftUpdateHealth.exe = "0" file.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\MicrosoftUpdateHealth.exe = "0" file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\.exe = "0" file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateWorker.exe = "0" file.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\MicrosoftUpdateAssistant.exe = "0" file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\SettingsSync.exe = "0" file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\xmrig.exe = "0" file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update = "0" file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\file.exe = "0" file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe = "0" file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\COMWindows\miner.exe = "0" file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\COMWindows\watchdog.exe = "0" file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe = "0" file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\MicrosoftUpdateHealth.exe = "0" file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\xmrig.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\SettingsSync.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer = "0" file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\xmrig.exe = "0" file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\checker.exe = "0" file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\SettingsSync.exe = "0" file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\SettingsSync.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\MicrosoftUpdateWorker.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\WinInetCache\MicrosoftUpdateAssistant.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\WinInetCache\miner.exe = "0" MicrosoftUpdateAssistant.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe = "0" file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\MicrosoftUpdateHealth.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\watchdog.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\SettingsSync.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\checker.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\COMWindows\SettingsSync.exe = "0" file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\xmrig.exe = "0" file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\COMWindows\watchdog.exe = "0" file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\checker.exe = "0" file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\SettingsSync.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\COMWindows\watchdog.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\WinInetCache\xmrig.exe = "0" file.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes MicrosoftUpdateAssistant.exe - XMRig Miner payload 2 IoCs
resource yara_rule behavioral2/files/0x000d00000001c526-45.dat family_xmrig behavioral2/files/0x000d00000001c526-45.dat xmrig - Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 35 4432 powershell.exe 36 4432 powershell.exe 37 4432 powershell.exe 38 4432 powershell.exe 39 4432 powershell.exe - Executes dropped EXE 7 IoCs
pid Process 5920 file.exe 3580 dd.exe 4596 MicrosoftUpdateAssistant.exe 1984 MicrosoftUpdateHealth.exe 944 MicrosoftUpdateWorker.exe 4576 MicrosoftUpdateHealth.exe 5396 OfficeClickToRun.exe - Windows security modification 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateWorker.exe = "0" file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\checker.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\COMWindows\MicrosoftUpdateHealth.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\MicrosoftUpdateWorker.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateWorker.exe = "0" file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\checker.exe = "0" file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\miner.exe = "0" file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\checker.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\COMWindows\watchdog.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\miner.exe = "0" MicrosoftUpdateAssistant.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\WinInetCache\watchdog.exe = "0" file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\SettingsSync.exe = "0" file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\COMWindows\MicrosoftUpdateWorker.exe = "0" file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\MicrosoftUpdateHealth.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\SettingsSync.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\MicrosoftUpdateWorker.exe = "0" file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\watchdog.exe = "0" file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\MicrosoftUpdateAssistant.exe = "0" file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\MicrosoftUpdateWorker.exe = "0" file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\watchdog.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\COMWindows\miner.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\COMWindows\xmrig.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\checker.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\SettingsSync.exe = "0" file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\MicrosoftUpdateWorker.exe = "0" file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\miner.exe = "0" file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\xmrig.exe = "0" file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\MicrosoftUpdateAssistant.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\MicrosoftUpdateWorker.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\miner.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\xmrig.exe = "0" file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\SettingsSync.exe = "0" file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\MicrosoftUpdateWorker.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\MicrosoftUpdateHealth.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\watchdog.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\COMWindows\SettingsSync.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\xmrig.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Processes\SettingsSync.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateHealth.exe = "0" file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\xmrig.exe = "0" file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\MicrosoftUpdateAssistant.exe = "0" file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\SettingsSync.exe = "0" file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\COMWindows\MicrosoftUpdateHealth.exe = "0" file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\COMWindows\watchdog.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Extensions\exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\WinInetCache\xmrig.exe = "0" file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\MicrosoftUpdateAssistant.exe = "0" file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\COMWindows\MicrosoftUpdateAssistant.exe = "0" file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateWorker.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\WinInetCache\MicrosoftUpdateAssistant.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\xmrig.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\COMWindows\MicrosoftUpdateAssistant.exe = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\COMWindows\MicrosoftUpdateHealth.exe = "0" MicrosoftUpdateAssistant.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\MicrosoftUpdateAssistant.exe = "0" file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\ReportQueue\checker.exe = "0" file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\SettingsSync.exe = "0" file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\MicrosoftUpdateAssistant.exe = "0" file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update = "0" MicrosoftUpdateAssistant.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\checker.exe = "0" MicrosoftUpdateAssistant.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\OfficeClickToRun = "C:\\Program Files (x86)\\WindowsPowerShell\\OfficeClickToRun.exe" dd.exe Set value (str) \REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftUpdateHealth = "C:\\Users\\Admin\\AppData\\Local\\Temp\\MicrosoftUpdateHealth.exe" dd.exe - Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 1 pastebin.com 8 pastebin.com - Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
ioc Process \??\F:\ powershell.exe -
resource yara_rule behavioral2/files/0x000d00000001c520-11.dat upx behavioral2/memory/3580-13-0x0000000000380000-0x0000000000FD7000-memory.dmp upx behavioral2/memory/3580-52-0x0000000000380000-0x0000000000FD7000-memory.dmp upx behavioral2/memory/3580-53-0x0000000000380000-0x0000000000FD7000-memory.dmp upx behavioral2/memory/3580-55-0x0000000000380000-0x0000000000FD7000-memory.dmp upx behavioral2/memory/3580-57-0x0000000000380000-0x0000000000FD7000-memory.dmp upx behavioral2/memory/3580-59-0x0000000000380000-0x0000000000FD7000-memory.dmp upx behavioral2/memory/4576-68-0x0000000000DE0000-0x0000000001A37000-memory.dmp upx behavioral2/memory/4576-69-0x0000000000DE0000-0x0000000001A37000-memory.dmp upx behavioral2/memory/3580-70-0x0000000000380000-0x0000000000FD7000-memory.dmp upx behavioral2/memory/5396-73-0x0000000000850000-0x00000000014A7000-memory.dmp upx behavioral2/memory/5396-75-0x0000000000850000-0x00000000014A7000-memory.dmp upx behavioral2/memory/5396-77-0x0000000000850000-0x00000000014A7000-memory.dmp upx behavioral2/memory/5396-79-0x0000000000850000-0x00000000014A7000-memory.dmp upx behavioral2/memory/5396-81-0x0000000000850000-0x00000000014A7000-memory.dmp upx behavioral2/memory/5396-107-0x0000000000850000-0x00000000014A7000-memory.dmp upx behavioral2/memory/5396-109-0x0000000000850000-0x00000000014A7000-memory.dmp upx behavioral2/memory/5396-111-0x0000000000850000-0x00000000014A7000-memory.dmp upx behavioral2/memory/5396-113-0x0000000000850000-0x00000000014A7000-memory.dmp upx behavioral2/memory/5396-115-0x0000000000850000-0x00000000014A7000-memory.dmp upx behavioral2/memory/5396-117-0x0000000000850000-0x00000000014A7000-memory.dmp upx - Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\WindowsPowerShell\7f31ead7-229d-9e4d-b183-64dc1d3cd722 dd.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\OfficeClickToRun.exe dd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 11 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain dd.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain MicrosoftUpdateAssistant.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname MicrosoftUpdateWorker.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname MicrosoftUpdateHealth.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname dd.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname MicrosoftUpdateAssistant.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain MicrosoftUpdateWorker.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain OfficeClickToRun.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname file.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain file.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftUpdateHealth.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OfficeClickToRun.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 300 schtasks.exe 2688 schtasks.exe 2264 schtasks.exe 3016 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5920 file.exe 5920 file.exe 5920 file.exe 5920 file.exe 5920 file.exe 5920 file.exe 5920 file.exe 5920 file.exe 5920 file.exe 5920 file.exe 5920 file.exe 5920 file.exe 5920 file.exe 5920 file.exe 5920 file.exe 5920 file.exe 5920 file.exe 5920 file.exe 3580 dd.exe 3580 dd.exe 5920 file.exe 5920 file.exe 5920 file.exe 5920 file.exe 5920 file.exe 5920 file.exe 5920 file.exe 5920 file.exe 3580 dd.exe 3580 dd.exe 5920 file.exe 5920 file.exe 5920 file.exe 5920 file.exe 5920 file.exe 5920 file.exe 5920 file.exe 5920 file.exe 5920 file.exe 5920 file.exe 5396 OfficeClickToRun.exe 5396 OfficeClickToRun.exe 5920 file.exe 5920 file.exe 5920 file.exe 5920 file.exe 5920 file.exe 5920 file.exe 5920 file.exe 5920 file.exe 4432 powershell.exe 4432 powershell.exe 4432 powershell.exe 5920 file.exe 5920 file.exe 5920 file.exe 5920 file.exe 5920 file.exe 5920 file.exe 5920 file.exe 5920 file.exe 5920 file.exe 5920 file.exe 5920 file.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeLockMemoryPrivilege 944 MicrosoftUpdateWorker.exe Token: SeLockMemoryPrivilege 944 MicrosoftUpdateWorker.exe Token: SeDebugPrivilege 4432 powershell.exe Token: SeIncreaseQuotaPrivilege 4432 powershell.exe Token: SeSecurityPrivilege 4432 powershell.exe Token: SeTakeOwnershipPrivilege 4432 powershell.exe Token: SeLoadDriverPrivilege 4432 powershell.exe Token: SeSystemProfilePrivilege 4432 powershell.exe Token: SeSystemtimePrivilege 4432 powershell.exe Token: SeProfSingleProcessPrivilege 4432 powershell.exe Token: SeIncBasePriorityPrivilege 4432 powershell.exe Token: SeCreatePagefilePrivilege 4432 powershell.exe Token: SeBackupPrivilege 4432 powershell.exe Token: SeRestorePrivilege 4432 powershell.exe Token: SeShutdownPrivilege 4432 powershell.exe Token: SeDebugPrivilege 4432 powershell.exe Token: SeSystemEnvironmentPrivilege 4432 powershell.exe Token: SeRemoteShutdownPrivilege 4432 powershell.exe Token: SeUndockPrivilege 4432 powershell.exe Token: SeManageVolumePrivilege 4432 powershell.exe Token: 33 4432 powershell.exe Token: 34 4432 powershell.exe Token: 35 4432 powershell.exe Token: 36 4432 powershell.exe Token: SeIncreaseQuotaPrivilege 4432 powershell.exe Token: SeSecurityPrivilege 4432 powershell.exe Token: SeTakeOwnershipPrivilege 4432 powershell.exe Token: SeLoadDriverPrivilege 4432 powershell.exe Token: SeSystemProfilePrivilege 4432 powershell.exe Token: SeSystemtimePrivilege 4432 powershell.exe Token: SeProfSingleProcessPrivilege 4432 powershell.exe Token: SeIncBasePriorityPrivilege 4432 powershell.exe Token: SeCreatePagefilePrivilege 4432 powershell.exe Token: SeBackupPrivilege 4432 powershell.exe Token: SeRestorePrivilege 4432 powershell.exe Token: SeShutdownPrivilege 4432 powershell.exe Token: SeDebugPrivilege 4432 powershell.exe Token: SeSystemEnvironmentPrivilege 4432 powershell.exe Token: SeRemoteShutdownPrivilege 4432 powershell.exe Token: SeUndockPrivilege 4432 powershell.exe Token: SeManageVolumePrivilege 4432 powershell.exe Token: 33 4432 powershell.exe Token: 34 4432 powershell.exe Token: 35 4432 powershell.exe Token: 36 4432 powershell.exe Token: SeIncreaseQuotaPrivilege 4432 powershell.exe Token: SeSecurityPrivilege 4432 powershell.exe Token: SeTakeOwnershipPrivilege 4432 powershell.exe Token: SeLoadDriverPrivilege 4432 powershell.exe Token: SeSystemProfilePrivilege 4432 powershell.exe Token: SeSystemtimePrivilege 4432 powershell.exe Token: SeProfSingleProcessPrivilege 4432 powershell.exe Token: SeIncBasePriorityPrivilege 4432 powershell.exe Token: SeCreatePagefilePrivilege 4432 powershell.exe Token: SeBackupPrivilege 4432 powershell.exe Token: SeRestorePrivilege 4432 powershell.exe Token: SeShutdownPrivilege 4432 powershell.exe Token: SeDebugPrivilege 4432 powershell.exe Token: SeSystemEnvironmentPrivilege 4432 powershell.exe Token: SeRemoteShutdownPrivilege 4432 powershell.exe Token: SeUndockPrivilege 4432 powershell.exe Token: SeManageVolumePrivilege 4432 powershell.exe Token: 33 4432 powershell.exe Token: 34 4432 powershell.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 944 MicrosoftUpdateWorker.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 5656 wrote to memory of 5920 5656 file.exe 89 PID 5920 wrote to memory of 3580 5920 file.exe 91 PID 5920 wrote to memory of 2264 5920 file.exe 92 PID 5920 wrote to memory of 3016 5920 file.exe 94 PID 5920 wrote to memory of 1984 5920 file.exe 98 PID 5920 wrote to memory of 300 5920 file.exe 99 PID 5920 wrote to memory of 2688 5920 file.exe 101 PID 5920 wrote to memory of 944 5920 file.exe 103 PID 3580 wrote to memory of 4576 3580 dd.exe 107 PID 5396 wrote to memory of 4432 5396 OfficeClickToRun.exe 110 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5656 -
C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\file.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\file.exe"2⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5920 -
C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\WinInetCache\dd.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\WinInetCache\dd.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\MicrosoftUpdateHealth.exeC:\Users\Admin\AppData\Local\Temp\MicrosoftUpdateHealth.exe4⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:4576
-
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /F /TN WindowsUpdate /SC ONLOGON /IT /RL HIGHEST /TR "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe\" --mnr-task"3⤵
- Scheduled Task/Job: Scheduled Task
PID:2264
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /F /TN WindowsUpdateBoot /SC ONSTART /RU SYSTEM /RL HIGHEST /TR "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe\" --mnr-excl"3⤵
- Scheduled Task/Job: Scheduled Task
PID:3016
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateHealth.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateHealth.exe"3⤵
- Executes dropped EXE
PID:1984
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /F /TN WindowsUpdate /SC ONLOGON /IT /RL HIGHEST /TR "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe\" --mnr-task"3⤵
- Scheduled Task/Job: Scheduled Task
PID:300
-
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /F /TN WindowsUpdateBoot /SC ONSTART /RU SYSTEM /RL HIGHEST /TR "\"C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe\" --mnr-excl"3⤵
- Scheduled Task/Job: Scheduled Task
PID:2688
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateWorker.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateWorker.exe"3⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:944
-
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateAssistant.exe"1⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Reads the TCP/IP host and domain name from the registry
PID:4596
-
C:\Program Files (x86)\WindowsPowerShell\OfficeClickToRun.exe"C:\Program Files (x86)\WindowsPowerShell\OfficeClickToRun.exe"1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5396 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe2⤵
- UAC bypass
- Badlisted process makes network request
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4432
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateHealth.exe
- Size 214KB
- SHA256 60919ea36226412ec602ef032bcfc5586bbdd0a1fc408a7a5ce0c640e1a28196
- MD5 1ae1ddb04a069d03cc46c49ba46c4635
- SHA1 2c03ac649e8911b23a85eb4d578d993601d642cd
- SHA512 e9817c10069be2eb8c74d9419e716ddb6f6da4af1c1f84a8c709a56052fca372b198334618735d9e567936f4ac924fe5e9214364d19ccb9477f1a61f378157de
- SSDEEP 3072:J99sR/nqlC7DVRUsnXZBZwzNGRrsDJVlQ1q6Tkmgm+SA0oXMeoW2n:TeYCfUsnpBZwZzVSkWzA0oXMeAn
- TLSH T11D241943A18819F4E856E13CE34BE225DB627C720795E0DF17A05322AF5BEE06D3DE61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\MicrosoftUpdateWorker.exe
- Size 6.2MB
- SHA256 0eadb9cc8098d0fb1ac1e80f13de901435a4c5e974ea0dc7306e037178e84ee0
- MD5 e8a7266e92b8409445d9161d17d41e6c
- SHA1 59d7e0b94180530a6136a7da4ae8db26a176c440
- SHA512 f4c71cb9a4f6529e3263b0de123f999b3b138bd153b844ff2707170bc13510364ef68b1d694ce8cb0e3ae30e486e292f979fbff23a1cb70bbcea0614008f8d65
- SSDEEP 98304:SqFp6S568NMyOefiH7cXdHkByf1WCseto4tMQXfXDox+Sxw427x2vHkZvfl3TDQF:SRC/NM0rDoxrix2PkZvdAv5n1gpgR
- TLSH T19C569D26B7A401E8C87AC53CC6469A13E7F2B81A5370A7DB17B0567A1F336D45E3EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\build.json
- Size 1KB
- SHA256 931f69325b17405a56659a23adcaffc9a02d67bf452b5c6e5988c06bba83e777
- MD5 6e9e76dbbb9b0d2698c26991dc6b53aa
- SHA1 05218f311c3fe41e8dbbe787478a821ad53f3d8b
- SHA512 b30f6d14010f50b15d683598dc6f49d52efbe211ea1d518e2cfb008fd0d2fac2e39773fa16cfc7ab7dc3ac8b5747cf1c8afbc1af7c827ff4e4c6174a78b54d74
- TLSH T1B421F132C80C42F61BE1640D4CB9EA43C6220D7232877C355387DB58894D73B703AB78
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\build.json
- Size 1KB
- SHA256 90c2b7c15666390339964fa15c060874adb6989b2967f27e7f16293f86d3580e
- MD5 d1a3477f3e2216d812b0d708d424c818
- SHA1 dbd5755d7c7e3cdb83645547b06d5ea25100d106
- SHA512 446af0dd5616fbdcc12e31caf87e369e01bab75239649ac4d96c86064da6228a5e79c539b95b6b6ea0ce2041d4699e4f2d415955be09a7380902e965997c108e
- TLSH T1C821F132C80C42F61BE1640D5CB9EA43C5220D7232877C355387DB58894D73F703AA78
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\build.json
- Size 1KB
- SHA256 bd8260ae141749cb0a1a13a7b2c679b44acb08acf15075580d4adf9fae688313
- MD5 5ac01d0736083dcac1115dd26e68286e
- SHA1 d8e1f9568b6e701d583a589eba0530b1ec5fe87a
- SHA512 9b44550afcec181d77aab798df91ce64beaffebb0131b35a2dd92c4de64726baf44ef2f76e56efdb071ea49e0b747ec9acb6b5592b1cbae8fc2890d9aecb784b
- TLSH T1AC21AB72881883B62BD5B90E5CB9EA43CA224D7632477C751287DA18894D33F653AA7C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\config.json
- Size 837B
- SHA256 04276625ada3d6e438f3d5d56dae0ec4c6e08c5841adf16490925925a57ccd9e
- MD5 c0766580ca88e6f85c79715e95f419e1
- SHA1 9f38c99b635759a568b41844af180a181737fe15
- SHA512 330dfd7184e78c7bb92c29b2b66a77e808e3a3cd14c174371e62d512aff6ac6fe8273ebba6ef82f4983e82d2e7d8ac521c904cc60cbd7d8e7b09f7713539a763
- TLSH T1DF01CE22C1180CFBB7D5A90C5838339347AC8593524E7C39E283B5A0B20E73651756A5
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\file.exe
- Size 6.4MB
- SHA256 4e77685bced54d0af96c0d49cab81dad371aabd74217f789448ff51fd071a8bc
- MD5 754252c4c1a72bda77af726484e9e86b
- SHA1 ea17318c23c30a53f2d5ce8e787b06e50559cab3
- SHA512 3f13d028a3aed2e1e18de372e8a11802486bed3e3a6b9486329422c079a2facd0c4776ae7f209b3e258a2862b1fb0ab553ae8187a43edc3e59b8a1887ca723ee
- SSDEEP 98304:zv+nJ7Z3GdZbEN55wnlSqmH3Q5PhHPA/O5yJJU8CLR4fRT7pwdc7if7mdpwK6:DCV3CbEn6xmXQ5PhvzyJ6H4fpuqdpw3
- TLSH T1D566335BD699D8E4EC07E17DC70EE206DE22352403A9E5CF07A01A353D6BEE49E7CA11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\rt\WinInetCache\dd.exe
- Size 3.4MB
- SHA256 62dff0cf5917b57524122f8d040041857e7bd9a66bf9a1c49e69245281c529cd
- MD5 db6b9f86dcf61cc01d4d39459ca90ba6
- SHA1 ab3f551350523160fe319a118f8f80951b4b01f7
- SHA512 79ace543861b1d078911716e50381477a94384ded85e10d71f6543c89fa8d91eb33abcb416eb25c715ab0026b0cba2284f75f77ab24055b442d8051224462c80
- SSDEEP 98304:K3Q5PhHPA/O5yJJU8CLR4fRT7pwdc7if7mdpwK:sQ5PhvzyJ6H4fpuqdpw
- TLSH T1A3F5336F5B33FD18E10A65F2C90EE2871C99530D226CD7C65EB34179BA7B042AE7C099
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Update\taskmgr_hook.dll
- Size 14KB
- SHA256 51b5a78601180da791ff4de2e0728999f2d64080919dc5fbc5dc24be6bf440b0
- MD5 85d85c142a06f21ee1db780c440637f0
- SHA1 40e874f516e7a664ed969ee49b7bb3f1443d567c
- SHA512 5cefec6946ffdf0aa9ccec2e56cf0f6a9f7123bd24bbcde48bae2246fbb5a1c7b9c358fd6bd7130069cddfc21b5686fad021e39c63ccc5e8a90138515d625ca7
- SSDEEP 192:H+bDZXsZNJmalh/BcZKu+ROCaj2G2V4l10:H+buXJTr2D+YCaSRV4l1
- TLSH T18A52E90D325248ADC64ED53681FB8B38F6B1F9019D93D72D4274E9321E997AA332AF05
- MD5 SHA1 SHA512 SSDEEP TLSH