Analysis
- max time kernel
150s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/10/2026, 18:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-10_261d531c3e13cb0e7d3eae140c6622ad_icedid.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
21 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-10_261d531c3e13cb0e7d3eae140c6622ad_icedid.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
22 signatures
150 seconds
General
- Target 2026-10-10_261d531c3e13cb0e7d3eae140c6622ad_icedid.exe
- Size 12.6MB
- Sample261011-xc4cgaeh33
- SHA256 27412f63efaa35951f430bb991ea64ffe6adbf91a0b5e864ca02f4295b161aa4
- MD5 261d531c3e13cb0e7d3eae140c6622ad
- SHA1 a7ca8ea777b0cd62792dfba47d5ec6f5e2c7ec22
- SHA512 b597eaace08650c4f1f1c6fd595615c9fbd7a320f68861ab400583e3a8fba41ebe194cc2239d3397521cd6fe3cd721ec3849c10ae44d046e73b75b27c1439c79
- SSDEEP 393216:KAGOQFCqf8cOIFgmzw+3Ixx/xMt/WdYu/pW/O5eZN1vSIdIR82NRhH+AFVJbXLWU:KAjqfdOIFgD9xMtmR/p23vVqOYlVJbA2
- TLSH T1C9D62A494C7280BD66FC57291ADA8EA83E5817CDD286BE3E906450F17340F7E21C97EE
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 5 IoCs
description pid Process procid_target PID 3224 created 3520 3224 2026-10-10_261d531c3e13cb0e7d3eae140c6622ad_icedid.exe 82 PID 3224 created 3520 3224 2026-10-10_261d531c3e13cb0e7d3eae140c6622ad_icedid.exe 82 PID 3224 created 3520 3224 2026-10-10_261d531c3e13cb0e7d3eae140c6622ad_icedid.exe 82 PID 3224 created 3520 3224 2026-10-10_261d531c3e13cb0e7d3eae140c6622ad_icedid.exe 82 PID 3224 created 3520 3224 2026-10-10_261d531c3e13cb0e7d3eae140c6622ad_icedid.exe 82 - Windows security bypass 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths svchost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes svchost.exe - Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 3 IoCs
resource yara_rule behavioral2/memory/3220-1-0x00007FFBF1F60000-0x00007FFBF383C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/files/0x001200000001c59f-7.dat INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/4860-10-0x0000000140000000-0x0000000140A63000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs - Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 3 IoCs
resource yara_rule behavioral2/memory/3220-1-0x00007FFBF1F60000-0x00007FFBF383C000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/files/0x001200000001c59f-7.dat INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4860-10-0x0000000140000000-0x0000000140A63000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers - Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 3 IoCs
resource yara_rule behavioral2/memory/3220-1-0x00007FFBF1F60000-0x00007FFBF383C000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/files/0x001200000001c59f-7.dat INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/4860-10-0x0000000140000000-0x0000000140A63000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store - Command and Scripting Interpreter: PowerShell 1 TTPs 16 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1872 powershell.exe 2948 powershell.exe 4624 powershell.exe 3340 powershell.exe 2984 powershell.exe 3456 powershell.exe 2916 powershell.exe 4636 powershell.exe 2984 powershell.exe 3456 powershell.exe 2916 powershell.exe 4636 powershell.exe 1872 powershell.exe 2948 powershell.exe 4624 powershell.exe 3340 powershell.exe - Executes dropped EXE 11 IoCs
pid Process 5812 32b03f97.exe 4312 windows.exe 464 svchost.exe 5700 dllhost.exe 1320 windows.exe 5736 SearchProtocolHost.exe 6040 windows.exe 3312 SearchFilterHost.exe 4784 dllhost.exe 4004 windows.exe 1872 windows.exe - Loads dropped DLL 8 IoCs
pid Process 2744 svchost.exe 3728 svchost.exe 5812 32b03f97.exe 464 svchost.exe 464 svchost.exe 464 svchost.exe 464 svchost.exe 2564 chrome.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1262770251-41185387-1005173349-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Users\\Admin\\AppData\\Roaming\\Windows\\windows.exe" windows.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows = "\"C:\\Users\\Admin\\AppData\\Roaming\\Windows\\windows.exe\"" windows.exe - Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 api.ipify.org 9 api.ipify.org - Suspicious use of SetThreadContext 17 IoCs
description pid Process procid_target PID 3224 set thread context of 3220 3224 2026-10-10_261d531c3e13cb0e7d3eae140c6622ad_icedid.exe 91 PID 3224 set thread context of 3220 3224 2026-10-10_261d531c3e13cb0e7d3eae140c6622ad_icedid.exe 91 PID 3224 set thread context of 3220 3224 2026-10-10_261d531c3e13cb0e7d3eae140c6622ad_icedid.exe 91 PID 3224 set thread context of 2744 3224 2026-10-10_261d531c3e13cb0e7d3eae140c6622ad_icedid.exe 95 PID 3224 set thread context of 2744 3224 2026-10-10_261d531c3e13cb0e7d3eae140c6622ad_icedid.exe 95 PID 3224 set thread context of 2744 3224 2026-10-10_261d531c3e13cb0e7d3eae140c6622ad_icedid.exe 95 PID 3224 set thread context of 3728 3224 2026-10-10_261d531c3e13cb0e7d3eae140c6622ad_icedid.exe 98 PID 3224 set thread context of 3728 3224 2026-10-10_261d531c3e13cb0e7d3eae140c6622ad_icedid.exe 98 PID 3224 set thread context of 3728 3224 2026-10-10_261d531c3e13cb0e7d3eae140c6622ad_icedid.exe 98 PID 3224 set thread context of 4860 3224 2026-10-10_261d531c3e13cb0e7d3eae140c6622ad_icedid.exe 101 PID 3224 set thread context of 4860 3224 2026-10-10_261d531c3e13cb0e7d3eae140c6622ad_icedid.exe 101 PID 3224 set thread context of 4860 3224 2026-10-10_261d531c3e13cb0e7d3eae140c6622ad_icedid.exe 101 PID 5812 set thread context of 464 5812 32b03f97.exe 105 PID 464 set thread context of 5700 464 svchost.exe 106 PID 464 set thread context of 5736 464 svchost.exe 113 PID 464 set thread context of 3312 464 svchost.exe 116 PID 464 set thread context of 4784 464 svchost.exe 117 - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe - Enumerates system info in registry 2 TTPs 5 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer svchost.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5432 schtasks.exe - Suspicious behavior: EnumeratesProcesses 52 IoCs
pid Process 3224 2026-10-10_261d531c3e13cb0e7d3eae140c6622ad_icedid.exe 3224 2026-10-10_261d531c3e13cb0e7d3eae140c6622ad_icedid.exe 3224 2026-10-10_261d531c3e13cb0e7d3eae140c6622ad_icedid.exe 3224 2026-10-10_261d531c3e13cb0e7d3eae140c6622ad_icedid.exe 3224 2026-10-10_261d531c3e13cb0e7d3eae140c6622ad_icedid.exe 3224 2026-10-10_261d531c3e13cb0e7d3eae140c6622ad_icedid.exe 3224 2026-10-10_261d531c3e13cb0e7d3eae140c6622ad_icedid.exe 3224 2026-10-10_261d531c3e13cb0e7d3eae140c6622ad_icedid.exe 3224 2026-10-10_261d531c3e13cb0e7d3eae140c6622ad_icedid.exe 3224 2026-10-10_261d531c3e13cb0e7d3eae140c6622ad_icedid.exe 5812 32b03f97.exe 5812 32b03f97.exe 464 svchost.exe 464 svchost.exe 464 svchost.exe 464 svchost.exe 464 svchost.exe 464 svchost.exe 464 svchost.exe 464 svchost.exe 464 svchost.exe 464 svchost.exe 464 svchost.exe 1872 powershell.exe 1872 powershell.exe 1872 powershell.exe 2948 powershell.exe 2948 powershell.exe 2948 powershell.exe 4624 powershell.exe 4624 powershell.exe 4624 powershell.exe 3340 powershell.exe 3340 powershell.exe 3340 powershell.exe 2984 powershell.exe 2984 powershell.exe 2984 powershell.exe 3456 powershell.exe 3456 powershell.exe 3456 powershell.exe 464 svchost.exe 464 svchost.exe 464 svchost.exe 464 svchost.exe 464 svchost.exe 464 svchost.exe 464 svchost.exe 2916 powershell.exe 2916 powershell.exe 4636 powershell.exe 4636 powershell.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid Process 816 Process not Found - Suspicious behavior: MapViewOfSection 1 TTPs 2 IoCs
pid Process 3224 2026-10-10_261d531c3e13cb0e7d3eae140c6622ad_icedid.exe 3224 2026-10-10_261d531c3e13cb0e7d3eae140c6622ad_icedid.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeLoadDriverPrivilege 5812 32b03f97.exe Token: SeDebugPrivilege 5812 32b03f97.exe Token: SeDebugPrivilege 5812 32b03f97.exe Token: SeDebugPrivilege 464 svchost.exe Token: SeDebugPrivilege 464 svchost.exe Token: SeDebugPrivilege 5700 dllhost.exe Token: SeDebugPrivilege 5700 dllhost.exe Token: SeDebugPrivilege 4312 windows.exe Token: SeDebugPrivilege 464 svchost.exe Token: SeDebugPrivilege 5736 SearchProtocolHost.exe Token: SeDebugPrivilege 5736 SearchProtocolHost.exe Token: SeDebugPrivilege 464 svchost.exe Token: SeDebugPrivilege 464 svchost.exe Token: SeDebugPrivilege 3312 SearchFilterHost.exe Token: SeDebugPrivilege 3312 SearchFilterHost.exe Token: SeDebugPrivilege 4784 dllhost.exe Token: SeDebugPrivilege 4784 dllhost.exe Token: SeDebugPrivilege 1872 powershell.exe Token: SeIncreaseQuotaPrivilege 1872 powershell.exe Token: SeSecurityPrivilege 1872 powershell.exe Token: SeTakeOwnershipPrivilege 1872 powershell.exe Token: SeLoadDriverPrivilege 1872 powershell.exe Token: SeSystemProfilePrivilege 1872 powershell.exe Token: SeSystemtimePrivilege 1872 powershell.exe Token: SeProfSingleProcessPrivilege 1872 powershell.exe Token: SeIncBasePriorityPrivilege 1872 powershell.exe Token: SeCreatePagefilePrivilege 1872 powershell.exe Token: SeBackupPrivilege 1872 powershell.exe Token: SeRestorePrivilege 1872 powershell.exe Token: SeShutdownPrivilege 1872 powershell.exe Token: SeDebugPrivilege 1872 powershell.exe Token: SeSystemEnvironmentPrivilege 1872 powershell.exe Token: SeRemoteShutdownPrivilege 1872 powershell.exe Token: SeUndockPrivilege 1872 powershell.exe Token: SeManageVolumePrivilege 1872 powershell.exe Token: 33 1872 powershell.exe Token: 34 1872 powershell.exe Token: 35 1872 powershell.exe Token: 36 1872 powershell.exe Token: SeDebugPrivilege 2948 powershell.exe Token: SeIncreaseQuotaPrivilege 2948 powershell.exe Token: SeSecurityPrivilege 2948 powershell.exe Token: SeTakeOwnershipPrivilege 2948 powershell.exe Token: SeLoadDriverPrivilege 2948 powershell.exe Token: SeSystemProfilePrivilege 2948 powershell.exe Token: SeSystemtimePrivilege 2948 powershell.exe Token: SeProfSingleProcessPrivilege 2948 powershell.exe Token: SeIncBasePriorityPrivilege 2948 powershell.exe Token: SeCreatePagefilePrivilege 2948 powershell.exe Token: SeBackupPrivilege 2948 powershell.exe Token: SeRestorePrivilege 2948 powershell.exe Token: SeShutdownPrivilege 2948 powershell.exe Token: SeDebugPrivilege 2948 powershell.exe Token: SeSystemEnvironmentPrivilege 2948 powershell.exe Token: SeRemoteShutdownPrivilege 2948 powershell.exe Token: SeUndockPrivilege 2948 powershell.exe Token: SeManageVolumePrivilege 2948 powershell.exe Token: 33 2948 powershell.exe Token: 34 2948 powershell.exe Token: 35 2948 powershell.exe Token: 36 2948 powershell.exe Token: SeDebugPrivilege 4624 powershell.exe Token: SeIncreaseQuotaPrivilege 4624 powershell.exe Token: SeSecurityPrivilege 4624 powershell.exe - Suspicious use of UnmapMainImage 1 TTPs 3 IoCs
pid Process 3224 2026-10-10_261d531c3e13cb0e7d3eae140c6622ad_icedid.exe 3224 2026-10-10_261d531c3e13cb0e7d3eae140c6622ad_icedid.exe 3224 2026-10-10_261d531c3e13cb0e7d3eae140c6622ad_icedid.exe - Suspicious use of WriteProcessMemory 43 IoCs
description pid Process procid_target PID 3224 wrote to memory of 3220 3224 2026-10-10_261d531c3e13cb0e7d3eae140c6622ad_icedid.exe 91 PID 3224 wrote to memory of 3220 3224 2026-10-10_261d531c3e13cb0e7d3eae140c6622ad_icedid.exe 91 PID 3224 wrote to memory of 3220 3224 2026-10-10_261d531c3e13cb0e7d3eae140c6622ad_icedid.exe 91 PID 3224 wrote to memory of 3220 3224 2026-10-10_261d531c3e13cb0e7d3eae140c6622ad_icedid.exe 91 PID 3224 wrote to memory of 3220 3224 2026-10-10_261d531c3e13cb0e7d3eae140c6622ad_icedid.exe 91 PID 3224 wrote to memory of 3220 3224 2026-10-10_261d531c3e13cb0e7d3eae140c6622ad_icedid.exe 91 PID 3224 wrote to memory of 3220 3224 2026-10-10_261d531c3e13cb0e7d3eae140c6622ad_icedid.exe 91 PID 3224 wrote to memory of 3220 3224 2026-10-10_261d531c3e13cb0e7d3eae140c6622ad_icedid.exe 91 PID 3224 wrote to memory of 3220 3224 2026-10-10_261d531c3e13cb0e7d3eae140c6622ad_icedid.exe 91 PID 3224 wrote to memory of 3220 3224 2026-10-10_261d531c3e13cb0e7d3eae140c6622ad_icedid.exe 91 PID 3224 wrote to memory of 3220 3224 2026-10-10_261d531c3e13cb0e7d3eae140c6622ad_icedid.exe 91 PID 3224 wrote to memory of 3220 3224 2026-10-10_261d531c3e13cb0e7d3eae140c6622ad_icedid.exe 91 PID 3224 wrote to memory of 2744 3224 2026-10-10_261d531c3e13cb0e7d3eae140c6622ad_icedid.exe 95 PID 3224 wrote to memory of 3728 3224 2026-10-10_261d531c3e13cb0e7d3eae140c6622ad_icedid.exe 98 PID 3224 wrote to memory of 4860 3224 2026-10-10_261d531c3e13cb0e7d3eae140c6622ad_icedid.exe 101 PID 3224 wrote to memory of 4860 3224 2026-10-10_261d531c3e13cb0e7d3eae140c6622ad_icedid.exe 101 PID 3224 wrote to memory of 4860 3224 2026-10-10_261d531c3e13cb0e7d3eae140c6622ad_icedid.exe 101 PID 3224 wrote to memory of 4860 3224 2026-10-10_261d531c3e13cb0e7d3eae140c6622ad_icedid.exe 101 PID 3224 wrote to memory of 4860 3224 2026-10-10_261d531c3e13cb0e7d3eae140c6622ad_icedid.exe 101 PID 3224 wrote to memory of 4860 3224 2026-10-10_261d531c3e13cb0e7d3eae140c6622ad_icedid.exe 101 PID 3224 wrote to memory of 4860 3224 2026-10-10_261d531c3e13cb0e7d3eae140c6622ad_icedid.exe 101 PID 3224 wrote to memory of 4860 3224 2026-10-10_261d531c3e13cb0e7d3eae140c6622ad_icedid.exe 101 PID 3224 wrote to memory of 5812 3224 2026-10-10_261d531c3e13cb0e7d3eae140c6622ad_icedid.exe 102 PID 5812 wrote to memory of 4312 5812 32b03f97.exe 104 PID 5812 wrote to memory of 464 5812 32b03f97.exe 105 PID 464 wrote to memory of 5700 464 svchost.exe 106 PID 4312 wrote to memory of 3396 4312 windows.exe 107 PID 4312 wrote to memory of 5432 4312 windows.exe 110 PID 464 wrote to memory of 5736 464 svchost.exe 113 PID 464 wrote to memory of 3312 464 svchost.exe 116 PID 464 wrote to memory of 4784 464 svchost.exe 117 PID 464 wrote to memory of 1812 464 svchost.exe 118 PID 464 wrote to memory of 1872 464 svchost.exe 120 PID 464 wrote to memory of 2948 464 svchost.exe 123 PID 464 wrote to memory of 4624 464 svchost.exe 127 PID 464 wrote to memory of 3340 464 svchost.exe 129 PID 464 wrote to memory of 4756 464 svchost.exe 131 PID 464 wrote to memory of 2984 464 svchost.exe 133 PID 464 wrote to memory of 3456 464 svchost.exe 135 PID 464 wrote to memory of 2564 464 svchost.exe 137 PID 464 wrote to memory of 2916 464 svchost.exe 139 PID 464 wrote to memory of 4636 464 svchost.exe 141 PID 464 wrote to memory of 3920 464 svchost.exe 143 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\2026-10-10_261d531c3e13cb0e7d3eae140c6622ad_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-10_261d531c3e13cb0e7d3eae140c6622ad_icedid.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3224
-
-
C:\Windows\System32\svchost.exe"C:\Windows\System32\svchost.exe"2⤵PID:3220
-
-
C:\Windows\System32\svchost.exe"C:\Windows\System32\svchost.exe"2⤵
- Loads dropped DLL
PID:2744
-
-
C:\Windows\System32\svchost.exe"C:\Windows\System32\svchost.exe"2⤵
- Loads dropped DLL
PID:3728
-
-
C:\Windows\System32\svchost.exe"C:\Windows\System32\svchost.exe"2⤵PID:4860
-
-
C:\Users\Admin\AppData\Local\Temp\32b03f97.exe"C:\Users\Admin\AppData\Local\Temp\32b03f97.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5812 -
C:\Users\Admin\AppData\Roaming\Windows\windows.exe"C:\Users\Admin\AppData\Roaming\Windows\windows.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "Windows" /F4⤵PID:3396
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /XML "C:\Users\Admin\AppData\Local\Temp\fs4erdwn.ium.xml" /TN "Windows" /F4⤵
- Scheduled Task/Job: Scheduled Task
PID:5432
-
-
-
C:\Windows\system32\svchost.exe"C:\Windows\system32\svchost.exe"3⤵
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Windows\system32\dllhost.exe"C:\Windows\system32\dllhost.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5700
-
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5736
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3312
-
-
C:\Windows\system32\dllhost.exe"C:\Windows\system32\dllhost.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4784
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Query /TN "Windows"4⤵PID:1812
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Windows'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1872
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\WindowsServices'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2948
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Windows'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4624
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\WindowsServices'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3340
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Query /TN "Windows"4⤵PID:4756
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Windows'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2984
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\WindowsServices'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"4⤵
- Loads dropped DLL
PID:2564
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Windows'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2916
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\WindowsServices'"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4636
-
-
C:\Windows\system32\schtasks.exe"schtasks.exe" /Query /TN "Windows"4⤵PID:3920
-
-
-
-
C:\Users\Admin\AppData\Roaming\Windows\windows.exeC:\Users\Admin\AppData\Roaming\Windows\windows.exe1⤵
- Executes dropped EXE
PID:1320
-
C:\Users\Admin\AppData\Roaming\Windows\windows.exe"C:\Users\Admin\AppData\Roaming\Windows\windows.exe"1⤵
- Executes dropped EXE
PID:6040
-
C:\Users\Admin\AppData\Roaming\Windows\windows.exe"C:\Users\Admin\AppData\Roaming\Windows\windows.exe" --vx054c-task1⤵
- Executes dropped EXE
PID:4004
-
C:\Users\Admin\AppData\Roaming\Windows\windows.exe"C:\Users\Admin\AppData\Roaming\Windows\windows.exe" --vx054c-task1⤵
- Executes dropped EXE
PID:1872
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Access Token Manipulation
1Parent PID Spoofing
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Process Injection
2Process Hollowing
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Access Token Manipulation
1Parent PID Spoofing
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2Process Injection
2Process Hollowing
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 535980b1dd63325ec980664be4525e33f9c1d329313941ffbafdc2f069d7f120
- MD5 60c84ca1ce9d84dff89caa2b1a402940
- SHA1 c1617f979e260613308343410c93a26218ae1c5a
- SHA512 3349f47e35cf2cf36635af77408a1b912951fb078684ca1cfcfe8b1fdd7e6c8b00f6669a9dad336a088c7d0da7027555057066b735bf5664863a34085091e901
- TLSH T165216833B3DD8624C89A413A10CDAC1036B6C7DB41DECFAB6B84E655A43F699CE61160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 cedd5237783d7e304b4ce8e7062ff65e554ad7b3be067a92fbb4ddfe3e188e7d
- MD5 e59f72c462c370bbe6aea47d7f2dd73a
- SHA1 f6fd98e8e777a9eb77848c3363cdad21a12a6089
- SHA512 1cf7050cb9a38a487cedcca6e223b4aeb72b58de4fc9b2fc9161d5191cd40f7e397115200e115c60f495082d0eff5196e1c8ae5665afdfca2af1e9ce6598f243
- TLSH T13C219837B3CC8614C89A013A10CDAC0036B6CBCB40DECE5B6B80E655A43F698CE60060
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 9f57d2e9e7f59b0619f5916324f47087c3c7081e523a29307a65cd100c1e5bc1
- MD5 1c0240f491a6e5c8e03a84ae6e3c7528
- SHA1 7460dfbc5b03a507b8cd9934382a5644c4be2279
- SHA512 3b338ebbe11852a9b339253b392e2b4c8ad2b5dfb0f1f7e33de44b210495f3a6351a39473ebbb5e9070b971da28a3b179765f06168ee2250cf891b1381ab1162
- TLSH T193216837B3DD8614C89A413A10CDAD1036B6CBDB40DECE5B6B84E655A43F699CE61160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 e86ea29d5aaa9164cc3269e41b61e7ae574db7ed89ad3391ac83a29aee93c4ab
- MD5 4f4141deb177e2882826a41b775aa5a5
- SHA1 602ecf03a83d9c4835a7ae257fed6cd9aae1bfb6
- SHA512 18a614a19c815d98632afd8ec9409c0ce4638e3c600766861bbb6998dd404c25c3e8faeea15e2b79cf31d45a46c148501eff6b36f5910e4762a339481f95db21
- TLSH T145219833F3CC8624C89A013A10CDAC1036B6C7CB40DECFAB6B80E659A43F698CE60160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 e56f4a38e0c60f0196c589e1952198368a10927e65ff24d1476ffafc489657f4
- MD5 78b9021e0576c01ec958b87ec52832c1
- SHA1 76df758d602c2d4cc4a4bfa0f3b435cae1ed3ffa
- SHA512 4402163ed9623a392f120417ea0b5049bf0d76b88dd7f4fc70428ef7e76601f25bd534ae916ed9daba859fb6308d6f370712985ccd165f6393dbce7c5c507514
- TLSH T11F216833F3DD8614C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699CE61160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 ca81aed6d41a228db41e9b0093ef306a01ab164608401db38056e1094724d927
- MD5 4f0788cfb3bb797ddb33dc011b627924
- SHA1 d0f17f373d854b1a53620f4462fc8e68d7ccaff8
- SHA512 4d5a3128cd78e78ffe22094e183b1a3cb23e8b6def42e00304074e3aa84c84e190b608661b18dfb0dd56d8f42c83e5c26ec3e5ccead3d4aa62c8fd2ee7f8b26b
- TLSH T11F219833B3CC8614C89A003A10CDAC0036B6CBCB40DECF5B6B84E655A43F698CE60160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 1KB
- SHA256 1f69320870f7ed8c31491482d9d76ce7460a0f2c294d4751cefcad978015ad7f
- MD5 ff8ec3ec22da374af4db2f226e9961b3
- SHA1 23c7fb8303df65e22aefb634187e88505bad6ab3
- SHA512 cb6beed209a562b0552a66d35301dba4e0cf0948119216843846400e224f2c5bbbb4ab3bdae87912800ddb5024044590e4d2560b3fd84b4b1556af96bf3d709e
- TLSH T141216837B3DD8614C89A413A10CDAD1036B6CBDB40DECE5B6B84E655A43F699CE61160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\6062e609.tmp
- Size 10.2MB
- SHA256 b37e85a1e3bd3db62fc9baef4888d51ac31350347f3eb44840e3b7c785e8b8ef
- MD5 d7676ab64b022df2a637639fae265077
- SHA1 58cd9ee4b54a37e6435c64c807457f4ee769e69b
- SHA512 e3750ac702961dd75bbda0864463e26176435e7bf9f40a29ee9ebe36ba1d175d6e2b78193e68fdc63eed90d312319b16ff7b89c381b79e4933b6087843bd2181
- SSDEEP 98304:LaNDMD7Y2uvrT8mNVOhVzB73BWUxGx02ZRoZi:e2D7Y2if8bzBbBxx4ZRoZi
- TLSH T108B68D15E3D045E1F6EAC638CE65C23AFFF1BC7526258A0A1495F30A1F33AD04E6E526
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_n0bz1020.m5w.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\fs4erdwn.ium.xml
- Size 2KB
- SHA256 ff4ccdc8a80b065e6b167f742b9b67c88309afbce44096c8bffe16d361c44c39
- MD5 7ea0563d9d4cceec9b570ada3e7f051f
- SHA1 545fdee83cf181b0d627896df070f82fe18eee5c
- SHA512 e7c4dc61a31d7a539fc733e3c6cec56e633c13ffe4b8b3308980927a3f589e20d6820874b4c5c18bf6eb0be3c1764bbccb10eec0e5eacf5c21e59d42ad82e3e8
- TLSH T1B2513A4367FE1109F1F36BACBEB754529E67BC596D35C86D00AC060D0BB79228960B36
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\vx054c_abe_4cfb324c37.dll
- Size 103KB
- SHA256 d0f2273f828b10391adcf877ff0775924e4b63435ec240b1047d89a1fa95a229
- MD5 79145aeb30802f73692b4aed57ea50f3
- SHA1 8b35496305c8b84dabf4d09e0945816d9db67ffd
- SHA512 a418b74fda428a79f0eaa786036339ce74739d8135877f5b7e8269c382b22818de05d9f999ab06aa49c4c9f269c5450b62611dbcb49f38471963701726ee68e2
- SSDEEP 3072:DJtP1P0mbIIpA6qxYNgk2GgNJlLJKJKfybKHUNzPyfUzUR:n9sWLzqxYqYbbfI
- TLSH T1B3A3395B72E600BBE1768638C8A70A49D776F8511761AFEF43A0425A1F273E18D3DF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\vx054c_sq_04498b2d.db
- Size 256KB
- SHA256 b0c72944fc5bd02ac464a83ac972277e38d0dbc674f2a634c0d432bf882ef89a
- MD5 b9ac2e3133012e6df701783726dd2e73
- SHA1 2027d37725c5f18085038027fb7ccb6fc6568a24
- SHA512 6fa34bb32da7171c554d4b3b2988e25598427f3f485632cbbecb12a545909563b01ec12a1393d4c3307652eaee787977a88538c639221a43d46d1e49411adc04
- SSDEEP 384:K8NTRZyCSDnxTICYMEhIKyll7svbFKfk7:KoNZJSDniwyI1l7svbF9
- TLSH T16544640A7B747001EDE2D9725CB080771E3C616E8F26E6816DB654694EB3853A23D8FF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\vx054c_sq_05fc6ad3.db
- Size 224KB
- SHA256 65e05a87c201ce6dda63ce830736497875934d3ad28068439aced62dabb7b809
- MD5 1b0c58c700ca5de42845182a6755e2cf
- SHA1 4c52fa008feb389377ff4f0b56d68408a4817d9e
- SHA512 001e1ae53fd97c30d7472dfaf1c777fc87d34b0567624db6e3e5a24fd092543bdead4c75bdd871043fc123797f7ad64040a861ed87c62e7a5beb1bf1c75d3baf
- SSDEEP 96:bxnFtejzH+bF+UIYysX0fxQp97oEHt/DfLjLqL/9bbEOVpZf24JkMfXSFR+CFqrn:bcH+bF+UI3iWGVoWN3qL/9VVV63
- TLSH T14224EE4E5F343722CDBD913668E644A35C7CF03F8B5366DA686114B4CEE2652A02C8BE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\vx054c_sq_37f1983a.db
- Size 50KB
- SHA256 92deb9024ca49204bb9a97b2936ac1aaf6e20e437ed40db53a5409bf801c0a20
- MD5 9625c2e35b5d9a880a08161bdbb8e27a
- SHA1 1441f4838a6ba52b6116c16a4e67dec8eeab6f92
- SHA512 5925fbe50c4f8c34d1ad55992d67c5a997410207e3180733ff1a6fb1866b6b467067d17ab77d256335f71e137ed817b1289bed759529a15cf459bea1c023de17
- SSDEEP 96:MkYUCn8MouB6w9fUP3mwilmqUvJKLReyG32ff44:uUG7Iw9f2iwcf4
- TLSH T13433451F2F682802C8698632BCB155F2AD7CA13F4B53AED22CB554354DB5852F02D5EF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\vx054c_sq_5abf8a99.db
- Size 24KB
- SHA256 4cc1a146d871eea502899024db7a2ff4ab46d4e787819a0fd75cc74aa7dd9926
- MD5 f20c4b926daf368f14b347d55a16cb41
- SHA1 aedbb95b2328494e27a76d02ac5409154865d9c3
- SHA512 8ec39bf908f1781a50fd054587a2b64f9051fc79ed1482674be1936f614d20bbc49dcef5033e1ecf2f219345414230b4421305de76ba25b28c49d3521d953885
- SSDEEP 24:TL8z/bXYFpFNYbatyTM2Wkweka60y6UwbdQ9rPWTZ61:TQz/LopFMaty423w/a9NUuT
- TLSH T140B2594D1F307220C0F44B36EDD189572F7C211CD3A326599E1810F3DE925ABF61956A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\vx054c_sq_63d319b7.db
- Size 160KB
- SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
- MD5 ea2f1147ca310fa5d8e3dc3cca218f60
- SHA1 fd7e6239dac6d57876fc8536feb7bbf2307b0bc1
- SHA512 7427e2055015af3721dfaa2f3e16dd12b158dfa3ea8c75130bd66a6610b657d51a5d7fad8c1f2e27e79ba05bdfef1e961171611c2668759bc09dd79cb97cbc9b
- SSDEEP 96:JY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:JY/tH+bF+UI3iWGVYWNkqp3
- TLSH T14AF30A1E5F243312CDBD92366CE745B3597CF03F8B632A856CA514B1CEE2652A02C4BE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\vx054c_sq_8e64f7d7.db
- Size 20KB
- SHA256 433bfd21beb6b37c6d74c15ee71de4f15472232b0a8fddd68d98d3522a8c0140
- MD5 06a4be2345755a4d0b6ba5cb9d670945
- SHA1 ce72b68bf7c98b3ca8397651a9f41a859499ece1
- SHA512 f542ae85e3e637329f0b23dcf31c43c9b17151864718f756b5720455dc6a8fb5c05026b2509ccf9cdb13491f8a7e944e8d56677f0b3eaefc0b8d07a4c694252d
- SSDEEP 48:TeW9aw/aHLopFMavU1iBwHGNdCqFlI8V5:nPareMaZxqqXI8V5
- TLSH T11192008E0F307761C4F48B72D9C109961F7C112CD317BA89EE6464F2CCC655BF6061A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\vx054c_sq_b062f2bf.db
- Size 138KB
- SHA256 a3fc8362e1464eea606c8555f2d79d7d2a5541cf33c4e9df48c9315e25f0f601
- MD5 8cd0f1e5390336f5cfa990a9a64d2d7c
- SHA1 83f1600d0715a3920f5de6836948b5ce1806852a
- SHA512 c62eb30c13cf0f1523ba3aa06a30963c814943c2fdd58c5e95ad2cc948eed67071731e2dc7ec8ea33a9ce06eb06e0b063fb7d5c8021abfd6f48794ff8dd759da
- SSDEEP 384:zeuvBnhJsueMEGvIW1DcP2OOj6GVum4nr:FnbZeMrv/hGtOWxnr
- TLSH T1BDD3774B3A743002DDE69A721CE050BB5D3CB16D8F5595D428B620688EF2953B23E4FF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\vx054c_sq_bf2a0ec7.db
- Size 288KB
- SHA256 8e4daa4e138b9d5b36c6dca3bed4bae8dfb4de1631c32459b6c01901f1a7b071
- MD5 b1d7519bb671401453736e9e9242dfbf
- SHA1 f55cf8003d1b9ee3e486d76d527c0a0e51558e2d
- SHA512 e83b647e8e8ad2599ed2f48e7a17ba8ff892eb9329f9d317e6255ff11d7c2c4f9687a889bc9401e538c3107a3913a234166b25ea24ca7e1768e92604fb1f520c
- SSDEEP 192:fva0zkVmvQhyn+Zoz679fqlQbGhMHPaVAL23v6OX9+ChC:f1zkVmvQhyn+Zoz67Q9ThC
- TLSH T10354EB46ED84F50AD70E6830C6454DF23940AB1843811E2BDBFC1E3E1EB164EBAAD1C5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\vx054c_sq_e203b569.db
- Size 40KB
- SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
- MD5 ba979c77c714b67908bc582ec373c723
- SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
- SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
- SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
- TLSH T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
- MD5 SHA1 SHA512 SSDEEP TLSH