Analysis
- max time kernel
899s - max time network
452s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/10/2026, 10:07
Behavioral task
behavioral1
Sample
Payload.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
24 signatures
900 seconds
Behavioral task
behavioral2
Sample
Payload.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
16 signatures
900 seconds
General
- Target Payload.exe
- Size 55KB
- Sample261024-l56graa14j
- SHA256 ee8276cee83e2aa69aab51e6b0ae02da734b9d9ecd42d66af463e5ba9b8f3a3c
- MD5 76f391bd2be703da503c511854bd47f3
- SHA1 e103dd9517b4e8e47adb23e42e6fd597dad4ac87
- SHA512 e12ec631ab1add197d9baa4c0b953725d3fed554df16238bce2163bcdab4792baf08efa852e8099461df1af7483e337a9109b69c40d91d56d6d5ac1ccbf44251
- SSDEEP 768:p0CPl+t1Man0KI2NO5SioJ3Q8kSNFmwFvfu0YMDHPseL7XJSxI3pmgm:p02sDnXNO5SiKlDkwsNMDNXExI3pmgm
- TLSH T1D1432744BFEA4A05E2BD8F3468F659150A34AA63F532EB1F48D568DB13327C58C40FE6
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 1 IoCs
pid Process 5300 53b0cfc95ee14777ba7b9c2385cb2a6e.exe - Modifies system executable filetype association 2 TTPs 47 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\{00021401-0000-0000-C000-000000000046} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\lnkfile\shellex\ContextMenuHandlers reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\DefaultIcon reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\print reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\ContextMenuHandlers reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runasuser reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\PintoStartScreen reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\DropHandler reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\DefaultIcon reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\edit\command reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\edit reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runas reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shellex\DropHandler reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shellex\DropHandler reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runasuser\command reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\DropHandler reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\print\command reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shellex\IconHandler reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runas\command reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser\command reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\Compatibility reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\IconHandler reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\tabsets reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\ContextMenuHandlers\Compatibility reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\DropHandler reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\CLSID reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\OpenContainingFolderMenu reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\{8895b1c6-b41f-4c1c-a562-0d564250836f} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shellex reg.exe - Enumerates video capture drivers 2 TTPs 1 IoCs
Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9 Payload.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4168 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname Payload.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain Payload.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Payload.exe - Modifies registry class 64 IoCs
description ioc Process Key deleted \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0165-ABCDEFFEDCBB} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\IE.FTP\shell\open reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0002E17A-0000-0000-C000-000000000046}\TypeLib reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{F47B8A5E-EC02-3EE0-B487-3227D9DC609D}\15.0.0.0 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\wordhtmltemplate\shell\Open reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000C0334-0000-0000-C000-000000000046} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000C172A-0000-0000-C000-000000000046} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{577F8B82-4D9C-3461-9045-C379319A9185}\15.0.0.0 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\VersionIndependentProgID reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0024-ABCDEFFEDCBA}\InprocServer32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0258-ABCDEFFEDCBA} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CE349364-86AE-44B0-BCB9-008C62875C60}\NumMethods reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B4CD3EA-4981-101B-9CA8-9240CE2738AE} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.dav reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0006F011-0000-0000-C000-000000000046}\Verb\0 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{19FED08E-EFD1-45da-B524-7BE4774A6AEE}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0006F04E-0000-0000-C000-000000000046}\InprocServer32\15.0.0.0 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.hxd reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0002E101-0000-0000-C000-000000000046}\InprocServer32 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F0B4F6AD-5E09-4CB1-B763-EC390CBDE51D}\MiscStatus reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00000507-0000-0010-8000-00AA006D2EA4} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0010-ABCDEFFEDCBA}\InprocServer32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0130-ABCDEFFEDCBC} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\VLC.flac\shell\Open\command reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{048EB43E-2059-422F-95E0-557DA96038AF}\DataFormats\GetSet\1 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0197-ABCDEFFEDCBB}\InprocServer32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0231-ABCDEFFEDCBB} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0054-ABCDEFFEDCBC}\InprocServer32 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.Workfolders\DefaultIcon reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\ms-excel\DefaultIcon reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\wmffile\shell reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0073-ABCDEFFEDCBA} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0BFA2C0C-DF88-4631-BF04-C12E281B3962} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D8252C5E-EB9F-4D74-AA72-C178B128FAC4}\ProxyStubClsid32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.CloudExperienceHost_10.0.26100.1_neutral_neutral_cw5n1h2txyewy\Applications\Micros reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CredentialDialogMachine.1.0\CLSID reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\RecommendationsFile\ShellEx\ContextMenuHandlers\OpenContainingFolderMenu reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1F822F34-B003-55C5-B0F9-891743128CF3} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{266EEE40-6C63-11cf-8A03-00AA006ECB65}\InprocServer32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0005-ABCDEFFEDCBB}\InprocServer32 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BA72E552-4FF5-48F4-8215-5505F990966F} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.DirectMusicSynthSink\CurVer reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{02BCC737-B171-4746-94C9-0D8A0B2C0089}\InprocServer32 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.vbx\PersistentHandler reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{51973C17-CB0C-11D0-B5C9-00A0244A0E7A}\ProxyStubClsid32 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7EDF9A92-4750-41A5-A17F-879A6F4F7DCB} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Word.Wizard.8 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.pdf\OpenWithList\AcroRd32.exe reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0091-ABCDEFFEDCBC}\InprocServer32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0312-ABCDEFFEDCBB}\InprocServer32 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\c:|Program Files (x86)|Common Files|Microsoft Shared|VSTA|Pipeline.v10.0|AddInSideAdapters|Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\c:|Program Files (x86)|Common Files|Microsoft Shared|VSTA|Pipeline.v10.0|HostSideAdapters|Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00020913-0000-0000-C000-000000000046}\ProxyStubClsid32 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{E1DBA742-1E0E-3633-B1C2-168561C6F0B0} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shellex\DropHandler reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0002E132-0000-0000-C000-000000000046}\InprocServer32\15.0.0.0 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0132-ABCDEFFEDCBB}\InprocServer32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\CLSID\{CAFEEFAC-0018-0000-0201-ABCDEFFEDCBC}\InprocServer32 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3853EAB3-ADB3-4BE8-9C96-C883B98E76AD}\ProxyStubClsid32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-19479607-1015771884-3827151630-3301822711-2267158487-4079414233-1230461222\Children reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{3AB0C28E-43A6-3568-AAE8-2370C9706320}\15.0.0.0 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EE3B94C8-9037-4D15-83A5-A758CF9DD164}\ProxyStubClsid32 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.doc\ShellEx reg.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1788 Payload.exe Token: 33 1788 Payload.exe Token: SeIncBasePriorityPrivilege 1788 Payload.exe Token: 33 1788 Payload.exe Token: SeIncBasePriorityPrivilege 1788 Payload.exe Token: 33 1788 Payload.exe Token: SeIncBasePriorityPrivilege 1788 Payload.exe Token: 33 1788 Payload.exe Token: SeIncBasePriorityPrivilege 1788 Payload.exe Token: 33 1788 Payload.exe Token: SeIncBasePriorityPrivilege 1788 Payload.exe Token: 33 1788 Payload.exe Token: SeIncBasePriorityPrivilege 1788 Payload.exe Token: 33 1788 Payload.exe Token: SeIncBasePriorityPrivilege 1788 Payload.exe Token: 33 1788 Payload.exe Token: SeIncBasePriorityPrivilege 1788 Payload.exe Token: 33 1788 Payload.exe Token: SeIncBasePriorityPrivilege 1788 Payload.exe Token: 33 1788 Payload.exe Token: SeIncBasePriorityPrivilege 1788 Payload.exe Token: 33 1788 Payload.exe Token: SeIncBasePriorityPrivilege 1788 Payload.exe Token: 33 1788 Payload.exe Token: SeIncBasePriorityPrivilege 1788 Payload.exe Token: 33 1788 Payload.exe Token: SeIncBasePriorityPrivilege 1788 Payload.exe Token: 33 1788 Payload.exe Token: SeIncBasePriorityPrivilege 1788 Payload.exe Token: 33 1788 Payload.exe Token: SeIncBasePriorityPrivilege 1788 Payload.exe Token: 33 1788 Payload.exe Token: SeIncBasePriorityPrivilege 1788 Payload.exe Token: 33 1788 Payload.exe Token: SeIncBasePriorityPrivilege 1788 Payload.exe Token: 33 1788 Payload.exe Token: SeIncBasePriorityPrivilege 1788 Payload.exe Token: 33 1788 Payload.exe Token: SeIncBasePriorityPrivilege 1788 Payload.exe Token: 33 1788 Payload.exe Token: SeIncBasePriorityPrivilege 1788 Payload.exe Token: 33 1788 Payload.exe Token: SeIncBasePriorityPrivilege 1788 Payload.exe Token: 33 1788 Payload.exe Token: SeIncBasePriorityPrivilege 1788 Payload.exe Token: 33 1788 Payload.exe Token: SeIncBasePriorityPrivilege 1788 Payload.exe Token: 33 1788 Payload.exe Token: SeIncBasePriorityPrivilege 1788 Payload.exe Token: 33 1788 Payload.exe Token: SeIncBasePriorityPrivilege 1788 Payload.exe Token: 33 1788 Payload.exe Token: SeIncBasePriorityPrivilege 1788 Payload.exe Token: 33 1788 Payload.exe Token: SeIncBasePriorityPrivilege 1788 Payload.exe Token: 33 1788 Payload.exe Token: SeIncBasePriorityPrivilege 1788 Payload.exe Token: 33 1788 Payload.exe Token: SeIncBasePriorityPrivilege 1788 Payload.exe Token: 33 1788 Payload.exe Token: SeIncBasePriorityPrivilege 1788 Payload.exe Token: 33 1788 Payload.exe Token: SeIncBasePriorityPrivilege 1788 Payload.exe Token: 33 1788 Payload.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 700 sihost.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1788 wrote to memory of 5300 1788 Payload.exe 92 PID 5300 wrote to memory of 200 5300 53b0cfc95ee14777ba7b9c2385cb2a6e.exe 93 PID 5300 wrote to memory of 4168 5300 53b0cfc95ee14777ba7b9c2385cb2a6e.exe 95 PID 4168 wrote to memory of 3060 4168 cmd.exe 97 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Payload.exe"C:\Users\Admin\AppData\Local\Temp\Payload.exe"1⤵
- Enumerates video capture drivers
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\53b0cfc95ee14777ba7b9c2385cb2a6e.exe"C:\Users\Admin\AppData\Local\Temp\53b0cfc95ee14777ba7b9c2385cb2a6e.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5300 -
C:\Windows\System32\mshta.exe"C:\Windows\System32\mshta.exe" vbscript:Execute("msgbox ""You Hacked By Shay7lebb"", 48, ""Warning"":close")3⤵PID:200
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k reg delete HKCR /f3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Windows\system32\reg.exereg delete HKCR /f4⤵
- Modifies system executable filetype association
- Modifies registry class
PID:3060
-
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004FC 0x00000000000004F01⤵PID:3464
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:4368
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
PID:700
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:3052
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:3984
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2708
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:4532
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:3088
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵PID:3136
Network
MITRE ATT&CK Enterprise v16
Persistence
Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Privilege Escalation
Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\53b0cfc95ee14777ba7b9c2385cb2a6e.exe
- Size 12KB
- SHA256 121dbce9a60d8f122d22cde73678b511c31e3168dea67a5b01944c0dd7160792
- MD5 ed6fe70c8ae9bab054a55f894deb2dfb
- SHA1 48da88e4eea3e45a304f2cab139d25a0606020cc
- SHA512 daed26a779fc534da69728f1f918c0057801f370e01fe3be2446036050eccdb09286024fc4026b1dbe79fc0f83014bfa7ef50d0967d57a48b4c4dbd1175ea10f
- SSDEEP 192:BxCCVwsjHMGzW6sfSurf11eb7vptT5avt2rXbEILcOGzbP:B0BGHMGC6sfZrf/eb7DT5It2rXLcOGf
- TLSH T1BD423C46BFD68830C5AD0B3D287747D56A30A44A8A33DB5E1DCD81BB5E767480EC86F4
- MD5 SHA1 SHA512 SSDEEP TLSH