Analysis
- max time kernel
150s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
27/10/2026, 22:18
General
- Target 2026-10-27_f0d5373e068ff54b4c74097475ccb3c9_amadey_darkgate_elex_glassworm_icedid.exe
- Size 6.0MB
- Sample261027-172c5see99
- SHA256 7e62d2ca53e48cc27f833013ea7283970653949c38d137cb469bc224f7e86133
Score
10/10
Malware Config
Signatures
- Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Detects Sheetrat Payload 5 IoCs
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 3 IoCs
- UAC bypass 3 TTPs 12 IoCs
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 5 IoCs
- Detects executables (downlaoders) containing URLs to raw contents of a paste 5 IoCs
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen 5 IoCs
- Modifies Windows Firewall 2 TTPs 3 IoCs
- Creates new service(s) 2 TTPs
- Executes a file named after a Windows system binary 1 TTPs 3 IoCs
The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
- Executes dropped EXE 17 IoCs
- Loads dropped DLL 15 IoCs
- Registers new Windows logon scripts automatically executed at logon. 1 TTPs 2 IoCs
- Stops running service(s) 4 TTPs
- Checks whether UAC is enabled 1 TTPs 6 IoCs
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory 1 IoCs
- Drops file in Windows directory 4 IoCs
- Launches sc.exe 9 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Direct Volume Access: Opens a physical disk for reading 1 TTPs 3 IoCs
Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Executes a command shell one-liner 1 TTPs 16 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 32 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 7 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 29 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 18 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-27_f0d5373e068ff54b4c74097475ccb3c9_amadey_darkgate_elex_glassworm_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-27_f0d5373e068ff54b4c74097475ccb3c9_amadey_darkgate_elex_glassworm_icedid.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\antivirus.exe"C:\Users\Admin\AppData\Local\Temp\antivirus.exe"2⤵
- Modifies WinLogon for persistence
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Registers new Windows logon scripts automatically executed at logon.
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\antivirus.exe" enable=yes & exit3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Users\Admin\AppData\Local\Temp\antivirus.exe" enable=yes4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /S3⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete "WindowsUpdaterDefenderMicrosoft"3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Users\Admin\AppData\Local\Temp\antivirus.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" start "WindowsUpdaterDefenderMicrosoft"3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /D3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /S3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /D3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /S3⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "User_Feed_Synchronization-1fc16bf7-f17c-48ef-a5f3-25e512bae043" /F3⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "User_Feed_Synchronization-1fc16bf7-f17c-48ef-a5f3-25e512bae043" /XML "C:\Users\Admin\AppData\Local\Temp\b40b0cd5-aae5-4cb7-b565-38fe16e9baa3.xml" /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 11 /tn "MicrosoftEdgeUpdate" /tr "C:\Windows\System32\BootFiles\BootExecutor.exe" /RL HIGHEST & exit3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 11 /tn "MicrosoftEdgeUpdate" /tr "C:\Windows\System32\BootFiles\BootExecutor.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_409543d3" /F3⤵
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" netsh advfirewall firewall add rule name="WindowsControl" dir=in action=allow program="C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" enable=yes & exit3⤵
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c schtasks /delete /F /TN "antivirus" & exit3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /delete /F /TN "antivirus"4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc onlogon /tn "antivirus" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" & exit3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /tn "antivirus" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c schtasks /create /f /tn "antivirus_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /tn "antivirus_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c schtasks /create /f /tn "antivirus_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /tn "antivirus_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c schtasks /create /f /tn "antivirus_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance" & exit3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /tn "antivirus_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c schtasks /create /f /tn "antivirus_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance" & exit3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /tn "antivirus_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_409543d3" /XML "C:\Users\Admin\AppData\Local\Temp\4d93a520-ac67-4551-aa43-2122272cffc0.xml" /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /S3⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "UsbCeip_ee0c3795" /F3⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "UsbCeip_ee0c3795" /XML "C:\Users\Admin\AppData\Local\Temp\5604fdca-54da-48c9-b797-47bf6ec8c310.xml" /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /S3⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "Intel PTT EK Recertification_03f43025" /F3⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "Intel PTT EK Recertification_03f43025" /XML "C:\Users\Admin\AppData\Local\Temp\523c6368-0443-4e63-b72c-dd6ad8a01968.xml" /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /S3⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_902e1622" /F3⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_902e1622" /XML "C:\Users\Admin\AppData\Local\Temp\0bc890c4-3f13-4042-9433-3a0d675da47e.xml" /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /D3⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "UsbCeip_05f02542" /F3⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /S3⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "UsbCeip_05f02542" /XML "C:\Users\Admin\AppData\Local\Temp\4d39fbc2-f7ed-42da-9c0c-5b232e93c291.xml" /F3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"3⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\antivirus.exeC:\Users\Admin\AppData\Local\Temp\antivirus.exe1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\PhoneExperienceHost.exe"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\PhoneExperienceHost.exe"1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\ShellExperienceHost.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\Application Shortcuts\ShellExperienceHost.exe"1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exeC:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Executes dropped EXE
- Registers new Windows logon scripts automatically executed at logon.
- Checks whether UAC is enabled
- Drops file in Windows directory
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" enable=yes & exit2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" enable=yes3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /S2⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete "WindowsUpdaterDefenderMicrosoft"2⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"2⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" start "WindowsUpdaterDefenderMicrosoft"2⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c schtasks /delete /F /TN "antivirus" & exit2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /delete /F /TN "antivirus"3⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc onlogon /tn "antivirus" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /tn "antivirus" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c schtasks /create /f /tn "antivirus_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /tn "antivirus_OnLock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onlock /rl highest /ru "Admin" /desc "Windows component maintenance"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c schtasks /create /f /tn "antivirus_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance" & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /tn "antivirus_OnUnlock" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onunlock /rl highest /ru "Admin" /desc "Windows component maintenance"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c schtasks /create /f /tn "antivirus_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance" & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\schtasks.exeschtasks /create /f /tn "antivirus_OnIdle" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onidle /i 5 /rl highest /ru "Admin" /desc "Windows component maintenance"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c schtasks /create /f /tn "antivirus_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance" & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\schtasks.exeschtasks /create /f /tn "antivirus_Evt4624" /tr "C:\Windows\Speech_OneCore\Engines\TTS\ru-RU\M1004NUS.exe" /sc onevent /ec Security /mo "*[System[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4624]]" /rl highest /ru "Admin" /desc "Windows component maintenance"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "SystemSoundsService_d1178305" /F2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /S2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "SystemSoundsService_d1178305" /XML "C:\Users\Admin\AppData\Local\Temp\27f4ded7-cdde-4028-8048-df1e3ad187dc.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /S2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "CCleanerSkipUAC_c6b6533c" /F2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /S2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "CCleanerSkipUAC_c6b6533c" /XML "C:\Users\Admin\AppData\Local\Temp\b373cf60-5121-480d-8621-cbfaac9ab2a9.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /S2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /S2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "SystemSoundsService_ced4b0fa" /F2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "SystemSoundsService_ced4b0fa" /XML "C:\Users\Admin\AppData\Local\Temp\662304e2-9f13-4b19-9251-e91d64b6bdbb.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" L: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" L: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" M: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" M: /D2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" N: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" N: /D2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "CCleanerSkipUAC_5ceb65de" /F2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" O: /S2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "CCleanerSkipUAC_5ceb65de" /XML "C:\Users\Admin\AppData\Local\Temp\d4f2809f-bfee-4011-a672-a2fe687db711.xml" /F2⤵
- Loads dropped DLL
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" O: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" P: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" P: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Q: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Q: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" R: /S2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "Adobe Acrobat Update Task_9b55ba7e" /F2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "Adobe Acrobat Update Task_9b55ba7e" /XML "C:\Users\Admin\AppData\Local\Temp\93333d00-1ed3-4706-ab3a-1e3aa2b9bce3.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" R: /D2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" S: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" S: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "FamilySafetyMonitor_10edf831" /F2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" T: /S2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "FamilySafetyMonitor_10edf831" /XML "C:\Users\Admin\AppData\Local\Temp\86de3ce7-d3c3-4184-9a02-ebfaed5d790b.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" T: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" U: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" U: /D2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" V: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" V: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" W: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" W: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" X: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" X: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Y: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Y: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /D2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /D2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" L: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" L: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" M: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" M: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" N: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" N: /D2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" O: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" O: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" P: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" P: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Q: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Q: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" R: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" R: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" S: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" S: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" T: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" T: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" U: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" U: /D2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" V: /S2⤵
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\PhoneExperienceHost.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\PhoneExperienceHost.exe"1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\BootFiles\BootExecutor.exeC:\Windows\System32\BootFiles\BootExecutor.exe1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- UAC bypass
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /C netsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\System32\BootFiles\BootExecutor.exe" enable=yes & exit2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="QeFpSiX4SFvaSb" dir=in action=allow program="C:\Windows\System32\BootFiles\BootExecutor.exe" enable=yes3⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
-
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /S2⤵
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" delete "WindowsUpdaterDefenderMicrosoft"2⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" create "WindowsUpdaterDefenderMicrosoft" binPath= "C:\Windows\System32\BootFiles\BootExecutor.exe" start= auto DisplayName= "WindowsUpdaterDefenderMicrosoft"2⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc.exe" start "WindowsUpdaterDefenderMicrosoft"2⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_dd4236bf" /F2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /S2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_dd4236bf" /XML "C:\Users\Admin\AppData\Local\Temp\9493fc96-fd9e-4534-8519-0039704238d2.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /D2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /D2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_6e943e5b" /F2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /S2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "NvDriverUpdateCheckDaily_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_6e943e5b" /XML "C:\Users\Admin\AppData\Local\Temp\830c5fd7-5141-40c9-94e7-d3568263e2d0.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /S2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "DropboxUpdateTaskMachineCore_81a6cd79" /F2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "DropboxUpdateTaskMachineCore_81a6cd79" /XML "C:\Users\Admin\AppData\Local\Temp\f1d43af9-1895-4901-b2b2-52077212740b.xml" /F2⤵
- Loads dropped DLL
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /D2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" L: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" L: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" M: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" M: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "SystemSoundsService_c5da8902" /F2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" N: /S2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "SystemSoundsService_c5da8902" /XML "C:\Users\Admin\AppData\Local\Temp\75883b90-2fcd-4c7b-89e7-30b7a4235223.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" N: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" O: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" O: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" P: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" P: /D2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Q: /S2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "DropboxUpdateTaskMachineCore_958816e7" /F2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Q: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "DropboxUpdateTaskMachineCore_958816e7" /XML "C:\Users\Admin\AppData\Local\Temp\4fcdac7e-e612-47f4-b588-78210c30b628.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" R: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" R: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Delete /TN "User_Feed_Synchronization-cb2a2260-c99e-47e2-913e-c46fe594f5e4" /F2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" S: /S2⤵
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /Create /TN "User_Feed_Synchronization-cb2a2260-c99e-47e2-913e-c46fe594f5e4" /XML "C:\Users\Admin\AppData\Local\Temp\22061675-8f9a-436e-9cd1-9a07cb5388f0.xml" /F2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" S: /D2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" T: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" T: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" U: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" U: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" V: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" V: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" W: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" W: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" X: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" X: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Y: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Y: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" E: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" F: /D2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" G: /D2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" H: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" I: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" J: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" K: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" L: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" L: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" M: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" M: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" N: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" N: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" O: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" O: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" P: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" P: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Q: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" Q: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" R: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" R: /D2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" S: /S2⤵
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" S: /D2⤵
- Enumerates connected drives
-
-
C:\Windows\SYSTEM32\mountvol.exe"mountvol" T: /S2⤵
-
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\BackgroundTaskHost.exe"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maintenance\BackgroundTaskHost.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\MusNotification.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\MusNotification.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\svchost.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\svchost.exe"1⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\OneDriveSetup.exe"C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\OneDriveSetup.exe"1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\Microsoft\Windows\Caches\SecurityHealthSystray.exe"C:\ProgramData\Microsoft\Windows\Caches\SecurityHealthSystray.exe"1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\MicrosoftEdgeUpdate.exe"C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\MicrosoftEdgeUpdate.exe"1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
C:\ProgramData\Microsoft\Windows\Caches\SearchUI.exe"C:\ProgramData\Microsoft\Windows\Caches\SearchUI.exe"1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
-
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\SearchApp.exe"C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\SearchApp.exe"1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Create or Modify System Process
4Windows Service
4Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Create or Modify System Process
4Windows Service
4Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Direct Volume Access
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
2Masquerading
1Match Legitimate Name or Location
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
0bc890c4-3f13-4042-9433-3a0d675da47e.xml
22061675-8f9a-436e-9cd1-9a07cb5388f0.xml
27f4ded7-cdde-4028-8048-df1e3ad187dc.xml
4d39fbc2-f7ed-42da-9c0c-5b232e93c291.xml
4d93a520-ac67-4551-aa43-2122272cffc0.xml
4fcdac7e-e612-47f4-b588-78210c30b628.xml
523c6368-0443-4e63-b72c-dd6ad8a01968.xml
5604fdca-54da-48c9-b797-47bf6ec8c310.xml
65875c7e08e34185beceb7ccf20d8dd0.dll
662304e2-9f13-4b19-9251-e91d64b6bdbb.xml
75883b90-2fcd-4c7b-89e7-30b7a4235223.xml
830c5fd7-5141-40c9-94e7-d3568263e2d0.xml
86de3ce7-d3c3-4184-9a02-ebfaed5d790b.xml
93333d00-1ed3-4706-ab3a-1e3aa2b9bce3.xml
9493fc96-fd9e-4534-8519-0039704238d2.xml
antivirus.exe
b373cf60-5121-480d-8621-cbfaac9ab2a9.xml
b40b0cd5-aae5-4cb7-b565-38fe16e9baa3.xml
d4f2809f-bfee-4011-a672-a2fe687db711.xml
f1d43af9-1895-4901-b2b2-52077212740b.xml
memory/440-157-0x00007FFD3BEE0000-0x00007FFD3BEF0000-memory.dmp
memory/980-153-0x00007FFD3BEE0000-0x00007FFD3BEF0000-memory.dmp
memory/1112-163-0x00007FFD3BEE0000-0x00007FFD3BEF0000-memory.dmp
memory/1580-124-0x00007FFD7BDA0000-0x00007FFD7C003000-memory.dmp
memory/1580-115-0x00000221A1780000-0x00000221A17AB000-memory.dmp
memory/1580-125-0x00007FFD7ABD0000-0x00007FFD7AC97000-memory.dmp
memory/1580-110-0x00000221A1780000-0x00000221A17AB000-memory.dmp
memory/1580-119-0x00007FFD3BEE0000-0x00007FFD3BEF0000-memory.dmp
memory/1580-117-0x00000221A1780000-0x00000221A17AB000-memory.dmp
memory/1580-116-0x00000221A1780000-0x00000221A17AB000-memory.dmp
memory/1580-121-0x00000221A1340000-0x00000221A13B4000-memory.dmp
memory/1580-118-0x00000221A1780000-0x00000221A17AB000-memory.dmp
memory/1580-114-0x00000221A1780000-0x00000221A17AB000-memory.dmp
memory/1580-126-0x00007FFD79870000-0x00007FFD79C11000-memory.dmp
memory/2140-181-0x00007FFD3BEE0000-0x00007FFD3BEF0000-memory.dmp
memory/2308-203-0x00007FF6A8400000-0x00007FF6A843E000-memory.dmp
memory/2308-175-0x00007FFD3BEE0000-0x00007FFD3BEF0000-memory.dmp
memory/3304-9-0x0000000000400000-0x0000000000A0A000-memory.dmp
memory/4252-41-0x0000000002A30000-0x0000000002A31000-memory.dmp
memory/4252-63-0x0000000003320000-0x0000000003321000-memory.dmp
memory/4252-26-0x00007FFD3BEE0000-0x00007FFD3BEF0000-memory.dmp
memory/4568-94-0x000001B18BDC0000-0x000001B18BE34000-memory.dmp
memory/4568-101-0x00007FFD79870000-0x00007FFD79C11000-memory.dmp
memory/4568-100-0x00007FFD7ABD0000-0x00007FFD7AC97000-memory.dmp
memory/4568-99-0x00007FFD7BDA0000-0x00007FFD7C003000-memory.dmp
memory/4568-87-0x000001B18C220000-0x000001B18C24B000-memory.dmp
memory/4568-88-0x000001B18C220000-0x000001B18C24B000-memory.dmp
memory/4568-89-0x000001B18C220000-0x000001B18C24B000-memory.dmp
memory/4568-86-0x000001B18C220000-0x000001B18C24B000-memory.dmp
memory/4568-90-0x000001B18C220000-0x000001B18C24B000-memory.dmp
memory/4568-91-0x00007FFD3BEE0000-0x00007FFD3BEF0000-memory.dmp
memory/4568-81-0x000001B18C220000-0x000001B18C24B000-memory.dmp
memory/4568-76-0x000001B18BEB0000-0x000001B18BED5000-memory.dmp
memory/4568-80-0x000001B18C220000-0x000001B18C24B000-memory.dmp
memory/4916-15-0x00007FFD58F00000-0x00007FFD598A4000-memory.dmp
memory/4916-21-0x00007FFD79870000-0x00007FFD79C11000-memory.dmp
memory/4916-64-0x00007FFD58F00000-0x00007FFD598A4000-memory.dmp
memory/4916-62-0x00007FFD58F00000-0x00007FFD598A4000-memory.dmp
memory/4916-96-0x00007FFD58F00000-0x00007FFD598A4000-memory.dmp
memory/4916-19-0x00007FFD7BDA0000-0x00007FFD7C003000-memory.dmp
memory/4916-70-0x00007FFD58F00000-0x00007FFD598A4000-memory.dmp
memory/4916-17-0x00007FFD58F00000-0x00007FFD598A4000-memory.dmp
memory/4916-57-0x00007FFD58F00000-0x00007FFD598A4000-memory.dmp
memory/4916-68-0x00007FFD58F00000-0x00007FFD598A4000-memory.dmp
memory/4916-65-0x00007FFD58F00000-0x00007FFD598A4000-memory.dmp
memory/4916-20-0x00007FFD7ABD0000-0x00007FFD7AC97000-memory.dmp
memory/4916-22-0x00007FFD58F00000-0x00007FFD598A4000-memory.dmp
memory/4916-16-0x00007FFD58F00000-0x00007FFD598A4000-memory.dmp
memory/4916-11-0x000001F5288F0000-0x000001F528964000-memory.dmp
memory/4916-18-0x00007FFD58F00000-0x00007FFD598A4000-memory.dmp
memory/4916-10-0x00007FFD5908F000-0x00007FFD59090000-memory.dmp
memory/4916-14-0x00007FFD58F00000-0x00007FFD598A4000-memory.dmp
memory/4916-13-0x00007FFD58F00000-0x00007FFD598A4000-memory.dmp
memory/4916-12-0x00007FFD58F00000-0x00007FFD598A4000-memory.dmp
memory/4920-180-0x00007FFD3BEE0000-0x00007FFD3BEF0000-memory.dmp
memory/5260-204-0x00007FF6A8400000-0x00007FF6A843E000-memory.dmp
memory/5260-168-0x00007FFD3BEE0000-0x00007FFD3BEF0000-memory.dmp