da9e3303f6bc4f008653b9ca375309b32513161f457342fbe9d187d0e7bd8e7d

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/10/2026, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
da9e3303f6bc4f008653b9ca375309b32513161f457342fbe9d187d0e7bd8e7d.exe
Size 599KB
Sample261017-e896sahw4k
SHA256 da9e3303f6bc4f008653b9ca375309b32513161f457342fbe9d187d0e7bd8e7d
MD5 a098b17d6e398ebfa5cc0eb99a1d454e
SHA1 a31c40fde5ca1cede279d745446249ea0ea35b14
SHA512 054ab3c36fdfa976f3fdb2f5e20e36513d83fbe2c083fb33e2e2348f0192fb048544f8bc3835b4d22e2392ef1b26a5ff4ad8944dbfb72b42d8b9e3993bf82c09
SSDEEP 12288:8WaJmgZJ/H9yC3L2dziqdldsrvcEfSOQzC0aO4+We:8j3/9y02deqdldAHfZ0aO4+b
TLSH
T1EBD44854FB9791F1E95304B0320AF7BF5622BE308432DCC5F290EF89A973EA65609746
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	DataSyncM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SecurityHealthSystray.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	DataSyncM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safe.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	DataSyncM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360leakfixer.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	DataSyncM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPCTray.exe	DataSyncM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPCMgr.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	DataSyncM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPCSoftMgr.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	DataSyncM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360se.exe	DataSyncM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360EntClient.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	DataSyncM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQMiniDL.exe	DataSyncM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TAVService.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	DataSyncM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsSense.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	DataSyncM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHActiveDefense.exe	DataSyncM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360se.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	DataSyncM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\usysdiag.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	DataSyncM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPCTray.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	DataSyncM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TAVService.exe	DataSyncM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPCWSC.exe	DataSyncM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	DataSyncM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe	DataSyncM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\softmgr.exe	DataSyncM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360EntClient.exe	DataSyncM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Speedld.exe	DataSyncM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HipsDaemon.exe	DataSyncM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsctrl.exe	DataSyncM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHSafeTray.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	DataSyncM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\softmgr.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	DataSyncM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPCMgrUpdate.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	DataSyncM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPCUpdate.exe	DataSyncM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe	DataSyncM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safe.exe	DataSyncM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LiveUpdate360.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	DataSyncM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Speedld.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	DataSyncM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360AppLoader.exe	DataSyncM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPCRTP.exe	DataSyncM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQMiniDL.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	DataSyncM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPCRealTimeSpeedup.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	DataSyncM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPCRealTimeSpeedup.exe	DataSyncM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360leakfixer.exe	DataSyncM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZhuDongFangYu.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	DataSyncM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360sd.exe	DataSyncM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SecurityHealthService.exe	DataSyncM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HipsMain.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	DataSyncM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPCMgr.exe	DataSyncM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsSense.exe	DataSyncM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SecurityHealthSystray.exe	DataSyncM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NisSrv.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	DataSyncM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HipsMain.exe	DataSyncM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HipsDaemon.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	DataSyncM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360rp.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	DataSyncM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LiveUpdate360.exe	DataSyncM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPCWSC.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	DataSyncM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QHActiveDefense.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	DataSyncM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360MobileMgr.exe	DataSyncM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\NisSrv.exe	DataSyncM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360rp.exe	DataSyncM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPCRTP.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	DataSyncM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SecurityHealthService.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	DataSyncM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\usysdiag.exe	DataSyncM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsctrl.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	DataSyncM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPCSoftMgr.exe	DataSyncM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QQPCUpdate.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	DataSyncM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360MobileMgr.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	DataSyncM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe	DataSyncM.exe

Executes dropped EXE 3 IoCs

pid	Process
5644	DataSyncM.exe
312	DataSyncM.exe
1708	DataSyncM.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SmartHelperK = "\"C:\\Users\\Admin\\AppData\\Local\\4CFA39D2\\DataSyncM.exe\" -boot"	DataSyncM.exe

Checks for any installed AV software in registry 1 TTPs 1 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense	DataSyncM.exe

Modifies WinLogon 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\ShellHelperValue = "1"	DataSyncM.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3328	sc.exe
1856	sc.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3096	cmd.exe
2460	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 16 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DataSyncM.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DataSyncM.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe

System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DataSyncM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	da9e3303f6bc4f008653b9ca375309b32513161f457342fbe9d187d0e7bd8e7d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DataSyncM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DataSyncM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmic.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4140	da9e3303f6bc4f008653b9ca375309b32513161f457342fbe9d187d0e7bd8e7d.exe
4140	da9e3303f6bc4f008653b9ca375309b32513161f457342fbe9d187d0e7bd8e7d.exe
4140	da9e3303f6bc4f008653b9ca375309b32513161f457342fbe9d187d0e7bd8e7d.exe
4140	da9e3303f6bc4f008653b9ca375309b32513161f457342fbe9d187d0e7bd8e7d.exe
4140	da9e3303f6bc4f008653b9ca375309b32513161f457342fbe9d187d0e7bd8e7d.exe
4140	da9e3303f6bc4f008653b9ca375309b32513161f457342fbe9d187d0e7bd8e7d.exe
4140	da9e3303f6bc4f008653b9ca375309b32513161f457342fbe9d187d0e7bd8e7d.exe
4140	da9e3303f6bc4f008653b9ca375309b32513161f457342fbe9d187d0e7bd8e7d.exe
4140	da9e3303f6bc4f008653b9ca375309b32513161f457342fbe9d187d0e7bd8e7d.exe
4140	da9e3303f6bc4f008653b9ca375309b32513161f457342fbe9d187d0e7bd8e7d.exe
4140	da9e3303f6bc4f008653b9ca375309b32513161f457342fbe9d187d0e7bd8e7d.exe
4140	da9e3303f6bc4f008653b9ca375309b32513161f457342fbe9d187d0e7bd8e7d.exe
4140	da9e3303f6bc4f008653b9ca375309b32513161f457342fbe9d187d0e7bd8e7d.exe
4140	da9e3303f6bc4f008653b9ca375309b32513161f457342fbe9d187d0e7bd8e7d.exe
5644	DataSyncM.exe
5644	DataSyncM.exe
5644	DataSyncM.exe
5644	DataSyncM.exe
5644	DataSyncM.exe
5644	DataSyncM.exe
5644	DataSyncM.exe
5644	DataSyncM.exe
5644	DataSyncM.exe
5644	DataSyncM.exe
5644	DataSyncM.exe
5644	DataSyncM.exe
5644	DataSyncM.exe
5644	DataSyncM.exe
5644	DataSyncM.exe
5644	DataSyncM.exe
5644	DataSyncM.exe
5644	DataSyncM.exe
5644	DataSyncM.exe
5644	DataSyncM.exe
5644	DataSyncM.exe
5644	DataSyncM.exe
5644	DataSyncM.exe
5644	DataSyncM.exe
5644	DataSyncM.exe
5644	DataSyncM.exe
5644	DataSyncM.exe
5644	DataSyncM.exe
5644	DataSyncM.exe
5644	DataSyncM.exe
5644	DataSyncM.exe
5644	DataSyncM.exe
5644	DataSyncM.exe
5644	DataSyncM.exe
5644	DataSyncM.exe
5644	DataSyncM.exe
5644	DataSyncM.exe
5644	DataSyncM.exe
5644	DataSyncM.exe
5644	DataSyncM.exe
5644	DataSyncM.exe
5644	DataSyncM.exe
5644	DataSyncM.exe
5644	DataSyncM.exe
5644	DataSyncM.exe
5644	DataSyncM.exe
5644	DataSyncM.exe
5644	DataSyncM.exe
5644	DataSyncM.exe
5644	DataSyncM.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4140	da9e3303f6bc4f008653b9ca375309b32513161f457342fbe9d187d0e7bd8e7d.exe
Token: SeDebugPrivilege	5644	DataSyncM.exe
Token: SeDebugPrivilege	5644	DataSyncM.exe
Token: SeIncreaseQuotaPrivilege	2328	wmic.exe
Token: SeSecurityPrivilege	2328	wmic.exe
Token: SeTakeOwnershipPrivilege	2328	wmic.exe
Token: SeLoadDriverPrivilege	2328	wmic.exe
Token: SeSystemProfilePrivilege	2328	wmic.exe
Token: SeSystemtimePrivilege	2328	wmic.exe
Token: SeProfSingleProcessPrivilege	2328	wmic.exe
Token: SeIncBasePriorityPrivilege	2328	wmic.exe
Token: SeCreatePagefilePrivilege	2328	wmic.exe
Token: SeBackupPrivilege	2328	wmic.exe
Token: SeRestorePrivilege	2328	wmic.exe
Token: SeShutdownPrivilege	2328	wmic.exe
Token: SeDebugPrivilege	2328	wmic.exe
Token: SeSystemEnvironmentPrivilege	2328	wmic.exe
Token: SeRemoteShutdownPrivilege	2328	wmic.exe
Token: SeUndockPrivilege	2328	wmic.exe
Token: SeManageVolumePrivilege	2328	wmic.exe
Token: 33	2328	wmic.exe
Token: 34	2328	wmic.exe
Token: 35	2328	wmic.exe
Token: 36	2328	wmic.exe
Token: SeIncreaseQuotaPrivilege	1940	wmic.exe
Token: SeSecurityPrivilege	1940	wmic.exe
Token: SeTakeOwnershipPrivilege	1940	wmic.exe
Token: SeLoadDriverPrivilege	1940	wmic.exe
Token: SeSystemProfilePrivilege	1940	wmic.exe
Token: SeSystemtimePrivilege	1940	wmic.exe
Token: SeProfSingleProcessPrivilege	1940	wmic.exe
Token: SeIncBasePriorityPrivilege	1940	wmic.exe
Token: SeCreatePagefilePrivilege	1940	wmic.exe
Token: SeBackupPrivilege	1940	wmic.exe
Token: SeRestorePrivilege	1940	wmic.exe
Token: SeShutdownPrivilege	1940	wmic.exe
Token: SeDebugPrivilege	1940	wmic.exe
Token: SeSystemEnvironmentPrivilege	1940	wmic.exe
Token: SeRemoteShutdownPrivilege	1940	wmic.exe
Token: SeUndockPrivilege	1940	wmic.exe
Token: SeManageVolumePrivilege	1940	wmic.exe
Token: 33	1940	wmic.exe
Token: 34	1940	wmic.exe
Token: 35	1940	wmic.exe
Token: 36	1940	wmic.exe
Token: SeIncreaseQuotaPrivilege	1940	wmic.exe
Token: SeSecurityPrivilege	1940	wmic.exe
Token: SeTakeOwnershipPrivilege	1940	wmic.exe
Token: SeLoadDriverPrivilege	1940	wmic.exe
Token: SeSystemProfilePrivilege	1940	wmic.exe
Token: SeSystemtimePrivilege	1940	wmic.exe
Token: SeProfSingleProcessPrivilege	1940	wmic.exe
Token: SeIncBasePriorityPrivilege	1940	wmic.exe
Token: SeCreatePagefilePrivilege	1940	wmic.exe
Token: SeBackupPrivilege	1940	wmic.exe
Token: SeRestorePrivilege	1940	wmic.exe
Token: SeShutdownPrivilege	1940	wmic.exe
Token: SeDebugPrivilege	1940	wmic.exe
Token: SeSystemEnvironmentPrivilege	1940	wmic.exe
Token: SeRemoteShutdownPrivilege	1940	wmic.exe
Token: SeUndockPrivilege	1940	wmic.exe
Token: SeManageVolumePrivilege	1940	wmic.exe
Token: 33	1940	wmic.exe
Token: 34	1940	wmic.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 4140 wrote to memory of 5644	4140	da9e3303f6bc4f008653b9ca375309b32513161f457342fbe9d187d0e7bd8e7d.exe	91
PID 5644 wrote to memory of 3328	5644	DataSyncM.exe	93
PID 5644 wrote to memory of 1856	5644	DataSyncM.exe	95
PID 5644 wrote to memory of 5988	5644	DataSyncM.exe	97
PID 5644 wrote to memory of 3776	5644	DataSyncM.exe	99
PID 5644 wrote to memory of 2328	5644	DataSyncM.exe	101
PID 5644 wrote to memory of 3920	5644	DataSyncM.exe	103
PID 5644 wrote to memory of 2008	5644	DataSyncM.exe	106
PID 5644 wrote to memory of 1940	5644	DataSyncM.exe	109
PID 5644 wrote to memory of 3960	5644	DataSyncM.exe	112
PID 5644 wrote to memory of 768	5644	DataSyncM.exe	115
PID 5644 wrote to memory of 3096	5644	DataSyncM.exe	117
PID 3096 wrote to memory of 5392	3096	cmd.exe	119
PID 5644 wrote to memory of 2588	5644	DataSyncM.exe	128
PID 5644 wrote to memory of 4044	5644	DataSyncM.exe	130
PID 5644 wrote to memory of 5036	5644	DataSyncM.exe	132
PID 5644 wrote to memory of 2944	5644	DataSyncM.exe	134
PID 5644 wrote to memory of 1588	5644	DataSyncM.exe	136
PID 5644 wrote to memory of 2460	5644	DataSyncM.exe	138
PID 2460 wrote to memory of 5400	2460	cmd.exe	140

C:\Users\Admin\AppData\Local\Temp\da9e3303f6bc4f008653b9ca375309b32513161f457342fbe9d187d0e7bd8e7d.exe
"C:\Users\Admin\AppData\Local\Temp\da9e3303f6bc4f008653b9ca375309b32513161f457342fbe9d187d0e7bd8e7d.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Users\Admin\AppData\Local\4CFA39D2\DataSyncM.exe
  "C:\Users\Admin\AppData\Local\4CFA39D2\DataSyncM.exe"
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks for any installed AV software in registry
  - Modifies WinLogon
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5644
- - C:\Windows\SysWOW64\sc.exe
    sc stop NwSvc
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3328
- - C:\Windows\SysWOW64\sc.exe
    sc delete NwSvc
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1856
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Delete /F /TN "Northwind Update"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5988
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Delete /F /TN "Northwind Sync"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3776
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /namespace:\\root\subscription WHERE "Name='NwFilter' OR Name='NwConsumer'" DELETE
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2328
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Delete /F /TN "SafeServiceR"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3920
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Delete /F /TN "CoreMonitorK"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2008
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /namespace:\\root\subscription PATH CommandLineEventConsumer WHERE "CommandLineTemplate LIKE '%4CFA39D2%'" DELETE
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1940
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /namespace:\\root\subscription PATH ActiveScriptEventConsumer WHERE "ScriptText LIKE '%4CFA39D2%'" DELETE
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    PID:3960
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /namespace:\\root\subscription PATH __EventFilter WHERE "Query LIKE '%4CFA39D2%'" DELETE
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    PID:768
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c schtasks /Query /FO CSV /V > "C:\Users\Admin\AppData\Local\Temp\qbsvc.csv" 2>nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3096
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Query /FO CSV /V
      4⤵
      System Location Discovery: System Language Discovery
      PID:5392
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Delete /F /TN "SafeServiceR"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2588
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Delete /F /TN "CoreMonitorK"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4044
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /namespace:\\root\subscription PATH CommandLineEventConsumer WHERE "CommandLineTemplate LIKE '%4CFA39D2%'" DELETE
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    PID:5036
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /namespace:\\root\subscription PATH ActiveScriptEventConsumer WHERE "ScriptText LIKE '%4CFA39D2%'" DELETE
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    PID:2944
- - C:\Windows\SysWOW64\Wbem\wmic.exe
    wmic /namespace:\\root\subscription PATH __EventFilter WHERE "Query LIKE '%4CFA39D2%'" DELETE
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    PID:1588
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c schtasks /Query /FO CSV /V > "C:\Users\Admin\AppData\Local\Temp\qbsvc.csv" 2>nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2460
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Query /FO CSV /V
      4⤵
      System Location Discovery: System Language Discovery
      PID:5400

C:\Users\Admin\AppData\Local\4CFA39D2\DataSyncM.exe
"C:\Users\Admin\AppData\Local\4CFA39D2\DataSyncM.exe" -boot
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:312

C:\Users\Admin\AppData\Local\4CFA39D2\DataSyncM.exe
"C:\Users\Admin\AppData\Local\4CFA39D2\DataSyncM.exe" -boot -svc
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Software Discovery

T1518

Security Software Discovery

T1518.001

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

DataSyncM.exe

Path C:\Users\Admin\AppData\Local\4CFA39D2\DataSyncM.exe
Size 600KB
SHA256 02003c91aea5775e3d244cf0ab932f21d6c3590fa2cc14d215ab767415260588
MD5 3172f47a5d335b6851266b3329e6015b
SHA1 a36d51f4c32d473978911bc95a12cc4f764b60d7
SHA512 0f4086eecbd0211e44b7021d21c901533bbb04372ba9af0eb839b75c111c32eb1d4544381e16b957ca25f18a8bb6a7334471fa5eb6aa5046b93d7662870c9c7b
SSDEEP 12288:8WaJmgZJ/H9yC3L2dziqdldsrvcEfSOQzC0aO4+WPg:8j3/9y02deqdldAHfZ0aO4+B
TLSH
T14ED44954FB9791F0E95304B0320AF7BF5622BE318432DCC5F290EF89A973EA65609746
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qbsvc.csv

Path C:\Users\Admin\AppData\Local\Temp\qbsvc.csv
Size 11KB
SHA256 9c09f159c3cf6895b4bde13de154557e08f18049a59098550096f1e34a2b17c4
MD5 0616ed4fc9013f0dffc6b09089f9891d
SHA1 cd33014a0795fc857d7a67dc2fcad95e0c3268e2
SHA512 7e2e1bf36a7cb02b90e0047442ac1bcde6c79d98ee4f4f442afe7cdf2928acbdc4bc6ac2dcb182de4275e29d5a91bd16a3f8589383b80fcb61e2fdba00d632f0
SSDEEP 192:alwnlwnlwnlwnlwnlwnlwnlwnlwnlwnlwVQMlw4LohauuuuI9EbvYxOe:aSnSnSnSnSnSnSnSnSnSnSVPSl
TLSH
T11C32BC6E03C5DE77DBD41DA8E0BD2B4A2E24925AE78B85449AC41034C0BE2D6C377F39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qbsvc.csv

Path C:\Users\Admin\AppData\Local\Temp\qbsvc.csv
Size 10KB
SHA256 035a25bfd04a76a8fc80e7cd0e8334d80b2b9fc1e0ea295b0d1f78a26b6fcdeb
MD5 f3ff5686bd103320f0506657277f32fa
SHA1 00023bd0b3e2c01aacab8d7a2941ed2156599f2a
SHA512 bdd14401bffa17d868ff10c8d5fd733e85a7406793f7c49960c1059398b83009297ed752f207c7c212c5cfddf555942212a30af6cfc30729d4c06fc572edc089
SSDEEP 192:alwnlwnlwnlwnlwnlwnlwnlwnlwnlwnlwVQMlw4raauuuuI9EbUYre:aSnSnSnSnSnSnSnSnSnSnSVPSN
TLSH
T10332CC6D03C5DE77DBD41DA8E0BD2B4A2E24925AA78B8548DAC51034C0BE2D6C377F39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsus_upd.log

Path C:\Users\Public\wsus_upd.log
Size 1KB
SHA256 b05840ad9d9e2f0a7118ec094049ef6775aa3541918e6a70fe705e374a6d60f7
MD5 375abc11e3eb2337385422ab897ff6c6
SHA1 b97781de54125b90c8d4cc5207a7dfc8455c16ad
SHA512 25924ef23acf6a1ca699dad6bf027d6743fae03bae30f7b4a359422e6e06412033cea6d8d7d7d7472b324e10831057bfcc7caf24c6193813f3a126f26f852452
TLSH
T1F8217CE738FB279A8B26968D3401A0C0BADD33382B61F0249FDDDC65429503A4CE7DB4
MD5 SHA1 SHA512 TLSH

Submit Download

wsus_upd.log

Path C:\Users\Public\wsus_upd.log
Size 1KB
SHA256 7b48ae3405e73054845cf4c64f227afca45443759e433f4f06d85ad73efd4395
MD5 71b830919a5e212dc738632a86c0d893
SHA1 33aa2c9bc0685c921c991c7cf96b8cb6f561d60d
SHA512 7c6fded0226c74b75e096f7662d56f60f9dc206f7a376570956b7a5e9d34c052cb1426c82b0fca96028722adffd042dad5306a90fbccfdf65c0f08a34cebfbf3
TLSH
T1FD319EE668FA279A8B26964D3455B0C1BADD32382771F014CFDEDC66418603A5CE7CB8
MD5 SHA1 SHA512 TLSH

Submit Download

wsus_upd.log

Path C:\Users\Public\wsus_upd.log
Size 188B
SHA256 2b95a4b243fc09feb7e23fcd65d95fe60629d9c3d62614683f5d8348d390eda1
MD5 b703502849c72beae44d2f76e351d758
SHA1 1187faeb75ed93d05d640f83e7fe66b1523db211
SHA512 24bcaab8beadac5fa8f3ed6f42ccb64066af61161b6ef90ea89c8b6c16162edf6e13470f1c689e4cdb9e80b53fc26fedbe0fbe08cde26ab696effc22dbf8c016
TLSH
T13FC022ABF4AA6729CB16F00C3013B08272DC33762101A1045C2DA89400C200BACBED2C
MD5 SHA1 SHA512 TLSH

Submit Download

memory/312-34-0x0000000000400000-0x000000000049D000-memory.dmp

Download

memory/312-44-0x0000000000400000-0x000000000049D000-memory.dmp

Download

memory/1708-35-0x0000000000400000-0x000000000049D000-memory.dmp

Download

memory/1708-43-0x0000000000400000-0x000000000049D000-memory.dmp

Download

memory/4140-11-0x0000000000400000-0x000000000049D000-memory.dmp

Download

memory/4140-0-0x0000000000498000-0x0000000000499000-memory.dmp

Download

memory/5644-47-0x0000000000400000-0x000000000049D000-memory.dmp

Download

memory/5644-50-0x0000000000400000-0x000000000049D000-memory.dmp

Download

memory/5644-39-0x0000000000400000-0x000000000049D000-memory.dmp

Download

memory/5644-45-0x0000000000400000-0x000000000049D000-memory.dmp

Download

memory/5644-46-0x0000000000400000-0x000000000049D000-memory.dmp

Download

memory/5644-36-0x0000000000400000-0x000000000049D000-memory.dmp

Download

memory/5644-10-0x0000000000400000-0x000000000049D000-memory.dmp

Download

memory/5644-33-0x0000000000400000-0x000000000049D000-memory.dmp

Download

memory/5644-51-0x0000000000400000-0x000000000049D000-memory.dmp

Download

memory/5644-52-0x0000000000400000-0x000000000049D000-memory.dmp

Download

memory/5644-53-0x0000000000400000-0x000000000049D000-memory.dmp

Download

memory/5644-54-0x0000000000400000-0x000000000049D000-memory.dmp

Download

memory/5644-55-0x0000000000400000-0x000000000049D000-memory.dmp

Download

memory/5644-56-0x0000000000400000-0x000000000049D000-memory.dmp

Download

memory/5644-57-0x0000000000400000-0x000000000049D000-memory.dmp

Download