18ecbc71bcf39a72fe431cfab9176b08a83150b24894cfb73845df41f2b9961f

Analysis

max time kernel
149s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/10/2026, 08:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
18ecbc71bcf39a72fe431cfab9176b08a83150b24894cfb73845df41f2b9961f.exe
Size 4.2MB
Sample261014-knmsmsfc95
SHA256 18ecbc71bcf39a72fe431cfab9176b08a83150b24894cfb73845df41f2b9961f
MD5 04ca9805257d809a27e83e5c8556d9c9
SHA1 c8b44bafb3c9eb843b6291a830b8a1c87d8ccd2b
SHA512 d9113d6fb8026c063d7c69f68d5adc1bdf126b0136ecab343bb6275d6ed1825e7635d4d28381db789bd7395ebc6ea8a184d0c912a864feaffa0394c769a8067d
SSDEEP 49152:DV8T2iaqKZzMLDBJGCa//VThMY+2plID6znMKSyklFV2PJ5yyqM5zlmHCSjdidYe:DWa5q65CMnMbCMKdPJT5zIHCSjPAO
TLSH
T1E2268E10D7419127F4F300F6C6BE467AAD247B30232594DBA3C46E5E6BB46D1BA31B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

bootkit defense_evasion discovery macro persistence spyware stealer upx

Malware Config

Signatures

Suspicious Office macro 3 IoCs

Office document equipped with macros.

macro

resource
behavioral1/files/0x0003000000000729-109.dat
behavioral1/files/0x000300000000072f-110.dat
behavioral1/files/0x0003000000000727-111.dat

Executes dropped EXE 1 IoCs

pid	Process
1780	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	18ecbc71bcf39a72fe431cfab9176b08a83150b24894cfb73845df41f2b9961f.exe

Drops file in System32 directory 42 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbengine.exe	18ecbc71bcf39a72fe431cfab9176b08a83150b24894cfb73845df41f2b9961f.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	SearchIndexer.exe
File opened for modification	C:\Windows\system32\locator.exe	SearchIndexer.exe
File opened for modification	C:\Windows\system32\vssvc.exe	SearchIndexer.exe
File opened for modification	C:\Windows\System32\alg.exe	18ecbc71bcf39a72fe431cfab9176b08a83150b24894cfb73845df41f2b9961f.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	18ecbc71bcf39a72fe431cfab9176b08a83150b24894cfb73845df41f2b9961f.exe
File opened for modification	C:\Windows\system32\msiexec.exe	SearchIndexer.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	18ecbc71bcf39a72fe431cfab9176b08a83150b24894cfb73845df41f2b9961f.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	18ecbc71bcf39a72fe431cfab9176b08a83150b24894cfb73845df41f2b9961f.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	18ecbc71bcf39a72fe431cfab9176b08a83150b24894cfb73845df41f2b9961f.exe
File opened for modification	C:\Windows\system32\wbengine.exe	SearchIndexer.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	18ecbc71bcf39a72fe431cfab9176b08a83150b24894cfb73845df41f2b9961f.exe
File opened for modification	C:\Windows\System32\msdtc.exe	SearchIndexer.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	SearchIndexer.exe
File opened for modification	C:\Windows\system32\msiexec.exe	18ecbc71bcf39a72fe431cfab9176b08a83150b24894cfb73845df41f2b9961f.exe
File opened for modification	C:\Windows\System32\vds.exe	18ecbc71bcf39a72fe431cfab9176b08a83150b24894cfb73845df41f2b9961f.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	SearchIndexer.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	SearchIndexer.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	18ecbc71bcf39a72fe431cfab9176b08a83150b24894cfb73845df41f2b9961f.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	18ecbc71bcf39a72fe431cfab9176b08a83150b24894cfb73845df41f2b9961f.exe
File opened for modification	C:\Windows\system32\AgentService.exe	18ecbc71bcf39a72fe431cfab9176b08a83150b24894cfb73845df41f2b9961f.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	SearchIndexer.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	SearchIndexer.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	SearchIndexer.exe
File opened for modification	C:\Windows\system32\spectrum.exe	SearchIndexer.exe
File opened for modification	C:\Windows\System32\vds.exe	SearchIndexer.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	18ecbc71bcf39a72fe431cfab9176b08a83150b24894cfb73845df41f2b9961f.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	18ecbc71bcf39a72fe431cfab9176b08a83150b24894cfb73845df41f2b9961f.exe
File opened for modification	C:\Windows\system32\vssvc.exe	18ecbc71bcf39a72fe431cfab9176b08a83150b24894cfb73845df41f2b9961f.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	18ecbc71bcf39a72fe431cfab9176b08a83150b24894cfb73845df41f2b9961f.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\1af58681a26b1277.bin	SearchIndexer.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	SearchIndexer.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	SearchIndexer.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	SearchIndexer.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	18ecbc71bcf39a72fe431cfab9176b08a83150b24894cfb73845df41f2b9961f.exe
File opened for modification	C:\Windows\System32\alg.exe	SearchIndexer.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	SearchIndexer.exe
File opened for modification	C:\Windows\system32\AgentService.exe	SearchIndexer.exe
File opened for modification	C:\Windows\System32\msdtc.exe	18ecbc71bcf39a72fe431cfab9176b08a83150b24894cfb73845df41f2b9961f.exe
File opened for modification	C:\Windows\system32\locator.exe	18ecbc71bcf39a72fe431cfab9176b08a83150b24894cfb73845df41f2b9961f.exe
File opened for modification	C:\Windows\system32\spectrum.exe	18ecbc71bcf39a72fe431cfab9176b08a83150b24894cfb73845df41f2b9961f.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	18ecbc71bcf39a72fe431cfab9176b08a83150b24894cfb73845df41f2b9961f.exe

UPX packed file 26 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00010000000177ca-19.dat	upx
behavioral1/memory/1780-20-0x00007FF7287E0000-0x00007FF728B5E000-memory.dmp	upx
behavioral1/files/0x000100000001700e-27.dat	upx
behavioral1/files/0x000100000001704d-29.dat	upx
behavioral1/files/0x0001000000017bd4-30.dat	upx
behavioral1/files/0x0001000000017431-65.dat	upx
behavioral1/files/0x0001000000023365-70.dat	upx
behavioral1/files/0x000100000000c513-71.dat	upx
behavioral1/files/0x000100000000c534-72.dat	upx
behavioral1/files/0x0002000000021b53-73.dat	upx
behavioral1/files/0x0001000000017ec8-74.dat	upx
behavioral1/files/0x000100000000fa69-75.dat	upx
behavioral1/files/0x000100000000c3fb-76.dat	upx
behavioral1/files/0x00010000000177f0-77.dat	upx
behavioral1/files/0x0001000000017816-78.dat	upx
behavioral1/files/0x000100000000c8dc-79.dat	upx
behavioral1/files/0x0001000000017ec2-81.dat	upx
behavioral1/files/0x0001000000017854-80.dat	upx
behavioral1/files/0x00010000000178ce-82.dat	upx
behavioral1/files/0x0001000000017039-83.dat	upx
behavioral1/files/0x000100000001797d-89.dat	upx
behavioral1/files/0x000100000001799c-90.dat	upx
behavioral1/files/0x00010000000179a2-91.dat	upx
behavioral1/files/0x00010000000180b2-92.dat	upx
behavioral1/files/0x0001000000016795-93.dat	upx
behavioral1/memory/1780-95-0x00007FF7287E0000-0x00007FF728B5E000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	SearchIndexer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	SearchIndexer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	SearchIndexer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	SearchIndexer.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	SearchIndexer.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	SearchIndexer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	SearchIndexer.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105406\java.exe	SearchIndexer.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	18ecbc71bcf39a72fe431cfab9176b08a83150b24894cfb73845df41f2b9961f.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	SearchIndexer.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	SearchIndexer.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	SearchIndexer.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	SearchIndexer.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	SearchIndexer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	SearchIndexer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	SearchIndexer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	SearchIndexer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	SearchIndexer.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	SearchIndexer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	SearchIndexer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	SearchIndexer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	SearchIndexer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	SearchIndexer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	SearchIndexer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	SearchIndexer.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	SearchIndexer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	SearchIndexer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	SearchIndexer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	SearchIndexer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	SearchIndexer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	SearchIndexer.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105406\javaw.exe	SearchIndexer.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_105406\javaws.exe	SearchIndexer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	SearchIndexer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	SearchIndexer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	SearchIndexer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	SearchIndexer.exe
File opened for modification	C:\Program Files\Mozilla Firefox\default-browser-agent.exe	SearchIndexer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	SearchIndexer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	SearchIndexer.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	SearchIndexer.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	18ecbc71bcf39a72fe431cfab9176b08a83150b24894cfb73845df41f2b9961f.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	SearchIndexer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	SearchIndexer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	SearchIndexer.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	SearchIndexer.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	SearchIndexer.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	SearchIndexer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	SearchIndexer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	SearchIndexer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	SearchIndexer.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	SearchIndexer.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	SearchIndexer.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	SearchIndexer.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	SearchIndexer.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	SearchIndexer.exe
File opened for modification	C:\Program Files\Mozilla Firefox\nmhproxy.exe	SearchIndexer.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	SearchIndexer.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	SearchIndexer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	SearchIndexer.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	SearchIndexer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	SearchIndexer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	SearchIndexer.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	SearchIndexer.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	18ecbc71bcf39a72fe431cfab9176b08a83150b24894cfb73845df41f2b9961f.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	SearchIndexer.exe

Direct Volume Access: Opens a physical disk for reading 1 TTPs 1 IoCs

Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.

defense_evasion

Direct Volume Access

T1006

description	ioc	Process
File opened (read-only)	\??\PhysicalDrive0	SearchIndexer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	18ecbc71bcf39a72fe431cfab9176b08a83150b24894cfb73845df41f2b9961f.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	18ecbc71bcf39a72fe431cfab9176b08a83150b24894cfb73845df41f2b9961f.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	18ecbc71bcf39a72fe431cfab9176b08a83150b24894cfb73845df41f2b9961f.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000bc75a75b85bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.asx	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ee4cad66b85bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002608da74b85bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-915 = "XHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000046c0e166b85bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aif	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002971f266b85bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008da85e76b85bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000082411e66b85bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E46787A1-4629-4423-A693-BE1F003B2742} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bda57d76b85bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3588	18ecbc71bcf39a72fe431cfab9176b08a83150b24894cfb73845df41f2b9961f.exe
Token: 33	1780	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1780	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1780	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1780	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1780	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1780	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1780	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1780	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1780	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1780	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1780	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1780	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1780	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1780	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1780	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1780	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1780	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1780	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1780	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1780	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1780	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1780	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1780	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1780	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1780	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1780	SearchIndexer.exe
Token: SeDebugPrivilege	1780	SearchIndexer.exe
Token: SeDebugPrivilege	1780	SearchIndexer.exe
Token: SeDebugPrivilege	1780	SearchIndexer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1780 wrote to memory of 2328	1780	SearchIndexer.exe	102
PID 1780 wrote to memory of 4248	1780	SearchIndexer.exe	103

C:\Users\Admin\AppData\Local\Temp\18ecbc71bcf39a72fe431cfab9176b08a83150b24894cfb73845df41f2b9961f.exe
"C:\Users\Admin\AppData\Local\Temp\18ecbc71bcf39a72fe431cfab9176b08a83150b24894cfb73845df41f2b9961f.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3588

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Direct Volume Access: Opens a physical disk for reading
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1780
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2328
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 952 956 964 8192 960 932
  2⤵
  - Modifies data under HKEY_USERS
  PID:4248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.9MB
SHA256 c510ccf5c06736b57c831f5fcab96e27754a6dae609612274c82a38426f9f8d1
MD5 063e1a80aabed962a9e0c338e2cb9582
SHA1 dcb31a1a71321e271a58b2d7e14e81231dfcf43f
SHA512 05240bffd6a90114bd6917044cc1d78b059fc9ac4fe2fda4ae6e0d5ccd684f68dad11618e4b437afd9e06f8e134488e95316f7b9898d1b18f5f8b40835841647
SSDEEP 49152:nb+632BuPkFKRrdE6oh7stBhuXjfS4LWxnBSjdidYZSnBG68H/Ak:V3q6gjBmSjPAOV
TLSH
T144E59D03F29900E8E069D178D7469133EAA2BC890B35B6DF0790B6562F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1017KB
SHA256 6bcd122e57b76c0c674d29e6ddeb184eae704f0a69c1901743e5cb0729506ff7
MD5 1c0a01fcd2c7c29adb6d14a5be109abf
SHA1 01d5118435739b082db36feb67ca4154ae61d3b4
SHA512 d23409c83f3ade70e625607ebba59fd1e009380f40865b96f9dd5c298a4d34ef6eecfb709f13d5cc664d8bcd00613814796895ce92e1b1e076ed683cc59cd841
SSDEEP 24576:fXYfDtczAkSjvViL57YtZCJqinBGhElqfLAdO9CY2TbTQ:qtcdSjdidYZSnBG68H/Ak
TLSH
T12F250128A7E509F9EC678138CD52C521EB3378558371EB8B03F499261F237852DBEB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.3MB
SHA256 b3f8f003c39828cdfbd316bdcb4a6933c36a2908ad58503d981dc0494fe15da4
MD5 120865406f750fc336a479f9f6f6e134
SHA1 cba0aac1f2506bae0138768558e065909d601a3e
SHA512 fb28761b3110933e45ca89b43c71b3f8dfe5120130a805c9c583d7b0d0af66309ed70936aa3fd9083faa348eb80956fb6fe4c7ee88a8901197e2427a6e12cc1c
SSDEEP 24576:c03eA7B0hmxOrMGSjvViL57YtZCJqinBGhElqfLAdO9CY2TbTQ:cC7B0AobSjdidYZSnBG68H/Ak
TLSH
T11C55BE16F6748331D073C0B9C5D2A69AEA7230865B318ACB4295D77C3F27BD6853A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 3.0MB
SHA256 723c53366bddb2b2d83e695d9ca4f6022b1b845d27ca2d08a3be8b5f3e67a929
MD5 96b8935974ad57e51ba03d415d561a54
SHA1 b8ad6fac5bd83cdeac557ecf32580cd0174d7cd0
SHA512 5a197fcfdc457cfe4112cf21ec27a51148cd70f8d31d4612ae188cc77e537cbfca59aac0d371cb8174fbb605ce37ce23c9b8a639f199edc9aabb75c0c34b58f4
SSDEEP 49152:vB+taZ3usBWOBr4tEGp0bqx0z+n217aau1gl1SjdidYZSnBG68H/Ak:Ru6JmTxd2d1SjPAOV
TLSH
T160E5AD13F1DA01E8D06AD478974A9233EA62BC490B35B6DF0B9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.7MB
SHA256 91309058b93cce3e8fc33d02d0e8de1fe8d600498fa7468ceb0fc4735cdf618a
MD5 b7707c058755e58c090e3b297f264db3
SHA1 9dd58c4d5928e367a6049b8686ecd7a6dd2ae5f7
SHA512 15a652d48e3d8e56b9fd469906dc72d071d03e45f0544cdec50fe6ee4e06878d7f60fe7fb06a21bfc65518caa9046eb443af5623f43b8a4bda36e082ed2d73f0
SSDEEP 24576:ScP4mcvIjkGOxhKP2l71zNKbrh/8KBySjvViL57YtZCJqinBGhElqfLAdO9CY2TY:dP4m4IpOO6768K4SjdidYZSnBG68H/Ak
TLSH
T14685BE2DABDC0096D0BA913486668A59FAB2742A1F3386CB1170933D3F77ED14E35F16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DismountCheckpoint.docm

Path C:\Users\Admin\Desktop\DismountCheckpoint.docm
Size 775KB
SHA256 d581d85f4367254fc9f3330e011efafc293515f323fdb0c809f8e362ce98dbde
MD5 bdff73c56d9dffd8728bafaa507e2efb
SHA1 9b48138364f4eca198cd363220d6a6f54ab0d10d
SHA512 c8725064db976efb8c14add874d925104f31707e2fcf1e1ce0a896a1642f605e24e306d0a534e04c702c9113b5dd7e7a904b3ab4fafd02a199f6aefcbddb24f2
SSDEEP 24576:+LHwomWY8qhj0oTTlzrFA1Cv12bZ6mNEI:+Twn80IoHl3FAYq6mqI
TLSH
T1D0F423A4C673E6A8D2D24B379B089632A4DF924740B588B717E03B3D3E549DBF507827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnpublishSelect.docm

Path C:\Users\Admin\Desktop\UnpublishSelect.docm
Size 776KB
SHA256 43dbe2773ccd6f4973e645baff5bb452b2a607d0735d7401885a6025e7ea38e7
MD5 d913cd76fde305e91ee153daebdb6948
SHA1 f5cb974873019bdf1659e95d1923d7d6a05cdf33
SHA512 de75f03ed7f90806e6e96ce65ebad414cbf92857fd8ee1cad01e2c2f52878e2c762dba4500a5075e81c0dd59cd5e9b07149ac63b6ecb143f8ebbcb8e85f147ad
SSDEEP 24576:plS46a6YINKubROym4lzEEeBrF3bPXm+NVCa0pa:pEa6jOylzEEeVF36+NGQ
TLSH
T1750533D0C8311CA8D7B215B24A1F5185BCFF9D1629D356F30B1E3479BDA9BBB60C9888
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UnregisterOut.docm

Path C:\Users\Admin\Documents\UnregisterOut.docm
Size 771KB
SHA256 eec9765c5f50e35f51047e9a39d39c7e4fd1f829b598c5220ec22b539ca429d6
MD5 c7e792fb77f5d8d7c2e7e40074b9993a
SHA1 edf83d13cf10b54437ef059fed7713495c801f04
SHA512 ea966748dd4d1e8b13e805b43fd1a41e413f469fba6489040e522ccb35027ab06a3f5dbdad500c8c583a625c8bde28c62848e3c2aa78e0524a195ec0945f9eaa
SSDEEP 12288:4WIum8Wu/ivpdj2T/HY6gfPsxThLioKMDaNzuk3oi9/SzZt4ve4FHNd5xHDE77xi:41u07jn6kPDMDaAsxSzZ815xjO74
TLSH
T167F42328DFB289E0E4642375F0B65405D17D06768EC2E6A3EB7DF37D028952A1271EEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWow64\perfhost.exe
Size 777KB
SHA256 0b05f58495ed4a0ca0ecac62aad1680bb072cca83454bbf944c9b4b842644540
MD5 360dbb69f0d4ac08a0ba7b0c9a25da4c
SHA1 ef4ed2330d656071b5f0b563c8a67ee9beb532e9
SHA512 3ad007cdad95e3853bc91e43073afb13141edf8d20aeb8cbf4e5fa7d164392320f4140e09d1ac8265a1bc539eb4d1718f1a1adadfe8d6ee30280284418a3baac
SSDEEP 24576:0FSjvViL57YtZCJqinBGhElqfLAdO9CY2TbTQ:0FSjdidYZSnBG68H/Ak
TLSH
T1940523569ABA5671F475E8304E0BD234673774A9C8336B83B3E42A4B1F14A0368D6B3D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.1MB
SHA256 a4613f045bfa910b008c6fbfe66960ad1d5560e0c7a00ca0a9c0ddff93efe8de
MD5 809225d16b1dcfa88390235c12c71fb1
SHA1 e5ada06c512e8aad5d4fe0713a3c9de1cf6f6efb
SHA512 868bac51e5e5996f66ac95a281ae9399c8fcae1ef484389e6aaa13337d312e8f5af567ac8b014a8ca4b998c9b1f7a149865bdc7c8c1ef78b73532c4c3e231186
SSDEEP 24576:6HL3UTXSjvViL57YtZCJqinBGhElqfLAdO9CY2TbTQ:6HL3UbSjdidYZSnBG68H/Ak
TLSH
T148350155EAA500F5E87BD038C967C626E373749D0335EBDB03A84A561F137924EBEB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.6MB
SHA256 7910b9fe4917119a398200392c2352841780a3c59b0bc571d15113d6f0d61519
MD5 8402d88a589f4f38b2fb1d75669d0ee5
SHA1 8d90f70b58614615f7af5d368afa308056c7c3f7
SHA512 d1d41113d15311ae14d8c5cbb9f6b76be8186bb8e6d12170c5d4ece4ed4da0a8896090938151376d82a0240f3531a95333b322879043b8209d899898baaed7c8
SSDEEP 49152:87cBWMpPjN8DbEh/SjdidYZSnBG68H/Ak:DbSjPAOV
TLSH
T13485BF2E6BEC81E5D477D13DC9928205F6B2B4611B328BCB1262433E7F27AE45E35721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.9MB
SHA256 2c74f8237214f82f69707395ee94e01050e3e6d50459a760dffb6e1b54431507
MD5 9df310bb941e8273f957f530bc27bece
SHA1 1cf5cb32e5eb45755dab5c258f0ea94da5b4d6fb
SHA512 c45f24079105357a6f750cf9a21a03015d3122ad6d0940480d6de8b1c3d83c248cd7732d5d09f09b7da97b42a4e6bb3aad3075f981686ca67174a7a4221504f9
SSDEEP 49152:0F2YuHNETovIvNYf8kmqSjdidYZSnBG68H/Ak:B6ZCf8k1SjPAOV
TLSH
T1A4959E2927ED80A4E0BBD27D45B7D246FAB2B8551B3156CB0255862E1F33AF44C3DB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 850KB
SHA256 5309a2af2c437ba6a8918aed8824de2795d66edb6813e908a8956aaaf2db1b65
MD5 d0c6c3df8a62f13f4d4e7b1fb6b42e52
SHA1 370f79a83f95ea050ccba60f9301da4a20d50d96
SHA512 f8cafeda6a56ca8782413224cb4c6b3105f8251284342842c76621f69785517440c619c9e19226987d958079248a8db578333ba1586fdf156e33bd9a4c0a21c0
SSDEEP 24576:oipSjvViL57YtZCJqinBGhElqfLAdO9CY2TbTQ:oipSjdidYZSnBG68H/Ak
TLSH
T18705125D6AAD61F5E436D4388946C225D373B06597332BDF53E0863E4F22AC62CF9B20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 901KB
SHA256 9129783ffecd8bd33ba45e68af8634a2763f5190d932bab7994bfe60b81b5091
MD5 da7e886f78e00c689c6de30e7f8f0349
SHA1 73c7098158e41acb12d0cce8a00fd5cf19b80026
SHA512 4695f36504c75b8af42931c9de8142369db92c95fdbda398c19480a1e082d1b77a9aa996cb21ab0d2ff2d6ec452a01f23f7db946285117e5abd6b070087f7928
SSDEEP 24576:6IyWSjvViL57YtZCJqinBGhElqfLAdO9CY2TbTQ:6IlSjdidYZSnBG68H/Ak
TLSH
T11415120566A951B0F87598348E57C2749B337C249B3327DF62E06A2F2F31BC268F5B25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 773KB
SHA256 952af64b3543caa155b5eac681317c8f4c1a5a1cd65654f5b25b3817fd25873c
MD5 550a7df1cb0ec4afcad13ba88ec88425
SHA1 b913aa80e47cb5bee8e05d26d440fec4e0105929
SHA512 af526b4edb9b65bcfce845b0e502cfff08b9d2a615a9582fdad69a368943ba49cdf791a57710301d08ed3ea9210f2dba5e6d760fb1592e0e8840287ebe03ce70
SSDEEP 24576:zRSjvViL57YtZCJqinBGhElqfLAdO9CY2TbTQ:zRSjdidYZSnBG68H/Ak
TLSH
T141F4224999BB6271F836D8708E0BD335973334A9C5333B9763F42A675F10A4320E6A79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.4MB
SHA256 4712615d703ba6b70fd4d03dfd47fd5317e28e392ac7759ffe8a3daab57f5dc3
MD5 af916f6b5eac36b7bdd17e83fa2fed9d
SHA1 0b96341f92590629d068abe96a79049d2847a077
SHA512 16de14bbeff11baf97e238da8304ad9f6f20c736ddbe4a556ff5cc09a815340c8e68a4ee1ba4547d9007931179b5b78df4d8bbd422344cd1afeac32bc73d755e
SSDEEP 24576:VQ9MxZKdcz9ew3ZSjvViL57YtZCJqinBGhElqfLAdO9CY2TbTQ:VVKiZSjdidYZSnBG68H/Ak
TLSH
T147659D2DABF9059AE177D23595A250C3A633B4311B32D6CF2448D03D4E7AED8AE74F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\system32\AgentService.exe
Size 1.9MB
SHA256 4988f64f9863fc882d050fad2dd1d47aae039a866fd18d0d2f795f080024b27c
MD5 5076bae96858b8e12da7fe1ca9e5cb01
SHA1 d417ddfb6de7ea7a30013bf748a2929e3ecdc234
SHA512 94296a531e1db25980afbf30c0768d25ed4a603d51dbd27a2566822733cbe7c65a52dca7bee0920e202acd3f58e7a74c2dc6e61be3c4981277a14b3b39e77878
SSDEEP 49152:oa0h2GEkuAe73q3ppt6zwwQJSjdidYZSnBG68H/Ak:oa0hNYGtJw6SjPAOV
TLSH
T16795AF1E67EC82B5D0BAD278C9A6854AE7B2B4260B3156CF1190853D3F37DE44D3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.5MB
SHA256 b8c6e6c005bf44286c7f2f73b484d19aacb34de16ea46eaf555b7222aece88cc
MD5 a1d7dee0ce02e46b4990740fcc0d6ca2
SHA1 424a8841db366866d7cf629f6bcc59e1ba42623f
SHA512 4d9bf6cfe220c91d9954dda8058a730a91ee12538257f8303354b2ced4e542a889e5193bbe469512f7ee9b24eefba07204e63b672595d83c027e103594c5d42b
SSDEEP 24576:a1QT7EcpfxR+N5AWAz3ooiYhjMqbGSjvViL57YtZCJqinBGhElqfLAdO9CY2TbTQ:nTDxR+N5YzTTjMjSjdidYZSnBG68H/Ak
TLSH
T1E975B02EA7F915E5E17E85798A23C512FB727861033293CB42A0C17E1F279D85E7AF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 848KB
SHA256 85f4515e7e298f7b5f36144a820f5d9f38b58d8f54d3e92beed7e868a4f42180
MD5 2758f2f9f85d03694d8300e3d7c61778
SHA1 52e1eeef2ac5cef67d417552bf4fa59d28f8c6c9
SHA512 6636d242a8a173a9021d1198454ba4859712c3a5674f4f50a8ac40de86ff36ca5da2bf0000e16345378ad24d6b095130408417241c43fd34043e126093006ad9
SSDEEP 24576:uhbHjPFSjvViL57YtZCJqinBGhElqfLAdO9CY2TbTQ:uhbHj9SjdidYZSnBG68H/Ak
TLSH
T11005126E5ABD11B5F471E4788A46C226D3337869473367DF23E0426A0F26EC22CF5B61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 860KB
SHA256 31355843026776ff5cbd9dffc9e2357f2d67d9e36ee23f8859e45b179bc9f6d6
MD5 0ba85431723053f8e3ce2be2ae2474dc
SHA1 75fc9b0bc4477949f41ddb1e25e8adac6d197fcb
SHA512 e2e746879946ac0249d5c206fb5bba026744505f5ef1178308412f2f7479b85abe1c806b4d0947e0ee755c4589376b5c15bf4afba8541edc706da457d461db8f
SSDEEP 24576:6O9SjvViL57YtZCJqinBGhElqfLAdO9CY2TbTQ:6O9SjdidYZSnBG68H/Ak
TLSH
T1FA15011A26AE11F5E476E4388A47C229D373B866473327DF03E0456E1F13EC56CFAA61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\SgrmBroker.exe
Size 1.0MB
SHA256 a64a9b54d70308d074b0fdb82f806a30d5c7ad2d40278e4d02d81c8d5fd0fa5a
MD5 4e95e087428af02ccafe3a0d91b89255
SHA1 230513b29a0c4935c2a83a318b3fb42cef44fdee
SHA512 29379bdc0ec3f239a56beff53b57ffa5fc5d18403578db37c1d51449ff557f98248c3b95f1fea8fdca4155ff65904f4b0d9556da239dcba089f5c0196c4a9555
SSDEEP 24576:rTMdOz0FFS+HmSLOSjvViL57YtZCJqinBGhElqfLAdO9CY2TbTQ:50K+HmSLOSjdidYZSnBG68H/Ak
TLSH
T19635F13EA7AD14F5E47AC17C8A43C916E673346503326ADB03E0817A2F57ED439BAB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TieringEngineService.exe

Path C:\Windows\system32\TieringEngineService.exe
Size 1.0MB
SHA256 c881deb10640e379952d733ead2edcc65b5cf2b6d1802a3bc2a8e1e9e381b21a
MD5 26fee8b2a2cccfcb94e4e1b9d0a752c2
SHA1 086c2cb2984f4f8818849614de8e90546acde175
SHA512 4cffa5d640cf3012747fbdb613d79d3fecabc433f96f42c242e08865cf8eb6d11d60ab8ea44725d8669bcfb480275e4fe272a26c68ad59216a6b3a2944c80abf
SSDEEP 24576:9JnJ5D3W2/SjvViL57YtZCJqinBGhElqfLAdO9CY2TbTQ:9JnJ5DG2/SjdidYZSnBG68H/Ak
TLSH
T11335E02DD2A810F4E4B7C274824A5765FF72383D2B226AC725B4D5353F12ED0A9B9F18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fxssvc.exe

Path C:\Windows\system32\fxssvc.exe
Size 1.4MB
SHA256 ff988b4c14d94957ee643d5d152fdb8a5c2a423bb90f8f730ba48e4eb140e942
MD5 8060e9ab5136277fd4fa9bc37c81f705
SHA1 20b7cd0ddf2d7b29b92cd8fc55a9ce14c992b5ab
SHA512 05c43ae48652abb134132819710eb5ad6108235356f074b1458496d430198286f5514a5632ec91c672375c270f8095d7e2838ccff6ca6751cebc22f1e0bc84b9
SSDEEP 24576:5fYgnJcRTk4yti+R5dUR/XSjvViL57YtZCJqinBGhElqfLAdO9CY2TbTQ:5QgnaTk46pUR/XSjdidYZSnBG68H/Ak
TLSH
T1C965CF2EF2B910B9D8A6D136450243B5BB72782D1F319BC702B0C539AF0AED85E35F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

locator.exe

Path C:\Windows\system32\locator.exe
Size 767KB
SHA256 0634da2bdf9682ff3ab61a7daf155c8ab61a50961d50c33857c244b00cc9ca38
MD5 8395181307665060381985c4e904a1fe
SHA1 a5f959500499852a1d3fd2202eb8fcb006693abe
SHA512 9ef2677c6fca381635368003da3716e676ab6eba722a41cd861f3c1e986bc750e34bd5e6a56e787439b0831b705b27bcfda302e2005ed5255afe98da78a50df0
SSDEEP 12288:Kk28ToZrORjvViL57YHNZH6xPUMq9oIwBcz3ymElqgzHAjLMOLmMrOT5GrvlnCYV:Kk+SjvViL57YtZCJqinBGhElqfLAdO9d
TLSH
T176F4234699BB5671F875D8708E0BD239673378A9C4373B83A3F42E472B04A4334E6679
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msiexec.exe

Path C:\Windows\system32\msiexec.exe
Size 824KB
SHA256 d7e735efa0576cf578e153090c83bf07d533549432bddb6e8cde9fcd324e4870
MD5 50fd0c6c8d072720f31321728ef749fa
SHA1 003961eaacc79de73805b76802c5f702fdf1fafb
SHA512 71404546c04e065950051a844ddf9d5c26c572020d5ed3f88163c8450722e5f90c635f2c02cb7bf1d477a82c2a5f3c658792d22bdb9fe9a39356e3dc1e6c0302
SSDEEP 24576:/iSjvViL57YtZCJqinBGhElqfLAdO9CY2TbTQ:/iSjdidYZSnBG68H/Ak
TLSH
T14E05120966F921B4F472D4308A1BC2359732786553332BEF33E49A7B5F21AC264F9B25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spectrum.exe

Path C:\Windows\system32\spectrum.exe
Size 1.6MB
SHA256 e5a265c9e784df469fcb392dfcb3c66a74fc4c46413a42b8b45816429a60a2ac
MD5 004aeceb4635adeddaea72bddb64a99a
SHA1 4a665adedc3bc4e9dff38a2cfdab4a1cfc13be87
SHA512 50d0eb53aa8df5b9393a129c125c50bab1f2f1f5b157ae0ed388a3be5bc7f8619c719babce1cfa2992041694c226ff0211714c381d5f50931e318d7a95537269
SSDEEP 24576:OAFs06+OmlfzNXEbTo+SjvViL57YtZCJqinBGhElqfLAdO9CY2TbTQ:HFs060lBXuzSjdidYZSnBG68H/Ak
TLSH
T10075BF2F66AC00D5E07ED17D8997C91AF7B1746707225ACB0260863E7F6BEE41E39B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vssvc.exe

Path C:\Windows\system32\vssvc.exe
Size 2.1MB
SHA256 06355983bac824a3cb99cbfc9cc48af9f8b3be5ba970eb51d5d1c05e2cd9280d
MD5 baf1fa0a33f73a5c83dd01dd4ef84d88
SHA1 57084c1a260187ca70ba2905b7b886cccc3efde6
SHA512 d4321e8d79c998b9aa2801cbfcd9afafc25d42ed3ffe1f06091220d28cc3d98275b498c7fb0cc68da157fd09a700282cbe3b84d055726efd08f00ef384edc13e
SSDEEP 49152:AF06DIKdwc+eQnSt65aV9SjdidYZSnBG68H/Ak:U/SjPAOV
TLSH
T169A57D16BBEA5294E8B3CAB1C96291159B327C509B34F7DF0AC0C92E1E33BD1D935B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WmiApSrv.exe

Path C:\Windows\system32\wbem\WmiApSrv.exe
Size 961KB
SHA256 51abbe6df58172c3e2e23c3dd341e9c07ac187629008f4758e8bb95ff62916bd
MD5 7bbf136c983542a42f1b1cb29ac1c303
SHA1 e650cc38899ca9494d0cb8a53d654f807c54ab8e
SHA512 dd29f60c430224af662d949da9164d480d676614a8592472dec6d19d8bd3087758bdfe03e8a3d25ec74cda84e1fdd11b2beff07556bec7a840c48a7b4a9b5032
SSDEEP 24576:Iyoc8Ap5SjvViL57YtZCJqinBGhElqfLAdO9CY2TbTQ:loc8Ap5SjdidYZSnBG68H/Ak
TLSH
T1C725F11FBB6A40A2E076C13889868325E77370745B6367CB62D0873E4F23AD97CB5B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wbengine.exe

Path C:\Windows\system32\wbengine.exe
Size 2.3MB
SHA256 f21ca46a7a31aaa3ff8a80eb627863a69af36c53c31494c0979df299e2190a75
MD5 d2f56d06496fa917fd79cd15dd727d2e
SHA1 0099c38e279b5369ee1fa89b4173c26e4879bc8a
SHA512 dfdfb660ea104dd9ba226b0728b0541eb2a721e0c75448444b9ea40d7b9480a269bb241d4c089ac7515c4e655b9d9cf303bdebabc6f435efacc551c1dbb4939f
SSDEEP 49152:LWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK2IKVSjdidYZSnBG68H/Ak:70zuNIVSjPAOV
TLSH
T18AB58C3DA2FC00A8D8AAC375C5461365EA71742E3F2065DB01B0C57CBF2AEE19A39F55
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
Size 997KB
SHA256 d0aaeb09bdc3db5a49b99c69f3c92493ba6dede9f4238d798db923aacb766fdc
MD5 3e3c8dd2744658bae8770872de91b9d0
SHA1 c44048c99c633733e3f98b24b5aa225163cf42a5
SHA512 94c1233c13d4c134d140ba9bd91eb1ffc143c09f443e8be4fc58ee827f4e5f8684803143b92bf9fdcc880e5acfecbe94de0866bac5c35fa6fb1123e78f80e68d
SSDEEP 24576:dwu7OWgSjvViL57YtZCJqinBGhElqfLAdO9CY2TbT:dwIOHSjdidYZSnBG68H/A
TLSH
T17A25014676A50CF9E97795388A47C135F7B3B8152A32DB1B13B0C65B5F233027DAAB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1780-97-0x000001FED7AB0000-0x000001FED81CD000-memory.dmp

Download

memory/1780-95-0x00007FF7287E0000-0x00007FF728B5E000-memory.dmp

Download

memory/1780-63-0x000001FED6100000-0x000001FED6108000-memory.dmp

Download

memory/1780-87-0x000001FED6BF0000-0x000001FED6BF8000-memory.dmp

Download

memory/1780-47-0x000001FECDDB0000-0x000001FECDDC0000-memory.dmp

Download

memory/1780-23-0x000001FECC990000-0x000001FECCA13000-memory.dmp

Download

memory/1780-31-0x000001FECDB90000-0x000001FECDBA0000-memory.dmp

Download

memory/1780-96-0x000001FED7AB0000-0x000001FED81CD000-memory.dmp

Download

memory/1780-21-0x000001FECC990000-0x000001FECCA13000-memory.dmp

Download

memory/1780-20-0x00007FF7287E0000-0x00007FF728B5E000-memory.dmp

Download

memory/3588-18-0x0000000000400000-0x000000000085C000-memory.dmp

Download

memory/3588-14-0x0000000000400000-0x000000000085C000-memory.dmp

Download

memory/3588-1-0x0000000000400000-0x000000000085C000-memory.dmp

Download

memory/3588-8-0x0000000002820000-0x00000000028A5000-memory.dmp

Download

memory/3588-2-0x0000000002820000-0x00000000028A5000-memory.dmp

Download

memory/3588-0-0x0000000002560000-0x00000000026F7000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads