Analysis
- max time kernel
150s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
02/11/2026, 07:30
General
- Target 2026-11-01_d5643bf2da344daaff9d86a0c1cc2e74_amadey_darkgate_glassworm_icedid.exe
- Size 19.0MB
- Sample261102-jb73daas3p
- SHA256 5a6d35a355a8d82ce3754cb4b6c777eb57eee46358fd6f1d99d0ebda90e27757
Score
10/10
Malware Config
Signatures
- Family: Sheetrat, NonEuclid rat
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Detects Sheetrat Payload 3 IoCs
Sheetrat aka NonEuclid RAT is a trojan written in C#.
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 4 IoCs
- Modifies Windows Defender TamperProtection settings 3 TTPs 4 IoCs
- Modifies security service 2 TTPs 1 IoCs
- UAC bypass 3 TTPs 16 IoCs
- Detects binaries and memory artifacts referencing sandbox DLLs typically observed in sandbox evasion 3 IoCs
- Detects executables (downlaoders) containing URLs to raw contents of a paste 3 IoCs
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen 3 IoCs
- Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 39 IoCs
- Loads dropped DLL 64 IoCs
- Stops running service(s) 4 TTPs
- Windows security modification 2 TTPs 7 IoCs
- Checks whether UAC is enabled 1 TTPs 8 IoCs
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 1 TTPs 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in System32 directory 15 IoCs
- Drops file in Windows directory 1 IoCs
- Launches sc.exe 6 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Direct Volume Access: Opens a physical disk for reading 1 TTPs 4 IoCs
Opens a raw handle to a physical disk, which bypasses file system access controls and is used for disk inspection, anti-VM checks and privilege checks.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 64 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Checks SCSI registry key(s) 3 TTPs 18 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 13 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies data under HKEY_USERS 21 IoCs
- Modifies registry class 1 IoCs
- NTFS ADS 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of UnmapMainImage 1 TTPs 6 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 24 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-11-01_d5643bf2da344daaff9d86a0c1cc2e74_amadey_darkgate_glassworm_icedid.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-01_d5643bf2da344daaff9d86a0c1cc2e74_amadey_darkgate_glassworm_icedid.exe"2⤵
- Modifies WinLogon for persistence
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender TamperProtection settings
- Modifies security service
- UAC bypass
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SYSTEM32\sc.exe"sc" stop WinDefend3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /S3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol E: /S4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc" config WinDefend start= demand3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /D3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol E: /D4⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /S3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol F: /S4⤵
-
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" netsh advfirewall firewall add rule name="WindowsControl" dir=in action=allow program="C:\Users\Admin\AppData\Roaming\12.exe" enable=yes & exit3⤵
- Loads dropped DLL
-
-
C:\Windows\SYSTEM32\CMD.exe"CMD" /c schtasks /delete /F /TN "12" & exit3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /delete /F /TN "12"4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc onlogon /tn "12" /tr "C:\Users\Admin\AppData\Roaming\12.exe" & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /tn "12" /tr "C:\Users\Admin\AppData\Roaming\12.exe"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc" stop WinDefend3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc" config WinDefend start= demand3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /D3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol F: /D4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /S3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol G: /S4⤵
-
-
-
C:\Windows\SYSTEM32\sc.exe"sc" stop WinDefend3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\sc.exe"sc" config WinDefend start= demand3⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /D3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol G: /D4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /S3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol H: /S4⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc minute /mo 30 /tn "WindowsControlW" /tr "C:\Users\Admin\AppData\Roaming\WindowsControl\WindowsControlW.exe" /RL HIGHEST & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc minute /mo 30 /tn "WindowsControlW" /tr "C:\Users\Admin\AppData\Roaming\WindowsControl\WindowsControlW.exe" /RL HIGHEST4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Roaming\12.exe"C:\Users\Admin\AppData\Roaming\12.exe"3⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender TamperProtection settings
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /S4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol E: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /D4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol E: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /S4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol F: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol F: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol G: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol G: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol H: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol H: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol I: /S4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol I: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol I: /D4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol I: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol J: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol J: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol J: /D4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol J: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol K: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol K: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol K: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol K: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol L: /S4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol L: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol L: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol L: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol M: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol M: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol M: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol M: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol N: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol N: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol N: /D4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
C:\Windows\system32\mountvol.exemountvol N: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol O: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol O: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol O: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol O: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol P: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol P: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol P: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol P: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Q: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol Q: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Q: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol Q: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol R: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol R: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol R: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol R: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol S: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol S: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol S: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol S: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol T: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol T: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol T: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol T: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol U: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol U: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol U: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol U: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol V: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol V: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol V: /D4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol V: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol W: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol W: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol W: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol W: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol X: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol X: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol X: /D4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol X: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Y: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol Y: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Y: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol Y: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol E: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol E: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol E: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol F: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol F: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol F: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol G: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol G: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol G: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol H: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol H: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol H: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol I: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol I: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol I: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol I: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol J: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol J: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol J: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol J: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol K: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol K: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol K: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol K: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol L: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol L: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol L: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol L: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol M: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol M: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol M: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol M: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol N: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol N: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol N: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol N: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol O: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol O: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol O: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol O: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol P: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol P: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol P: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol P: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Q: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol Q: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Q: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol Q: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol R: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol R: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol R: /D4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol R: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol S: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol S: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol S: /D4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol S: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol T: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol T: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol T: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol T: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol U: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol U: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol U: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol U: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol V: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol V: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol V: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol V: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol W: /S4⤵
-
C:\Windows\system32\mountvol.exemountvol W: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol W: /D4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol W: /D5⤵
- Enumerates connected drives
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol X: /S4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol X: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol X: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol X: /D5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Y: /S4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol Y: /S5⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c mountvol Y: /D4⤵
-
C:\Windows\system32\mountvol.exemountvol Y: /D5⤵
- Enumerates connected drives
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\12.exeC:\Users\Admin\AppData\Roaming\12.exe1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender TamperProtection settings
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\CMD.exe"CMD" /c schtasks /delete /F /TN "12" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /delete /F /TN "12"3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol E: /S2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol E: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol E: /D2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol E: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol F: /S2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol F: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol F: /D2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol F: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol G: /S2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol G: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol G: /D2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol G: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol H: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol H: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol H: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol H: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol I: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol I: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol I: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol I: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol J: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol J: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol J: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol J: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol K: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol K: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol K: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol K: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol L: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol L: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol L: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol L: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol M: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol M: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol M: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol M: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol N: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol N: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol N: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol N: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol O: /S2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\mountvol.exemountvol O: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol O: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol O: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol P: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol P: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol P: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol P: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol Q: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol Q: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol Q: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol Q: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol R: /S2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\mountvol.exemountvol R: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol R: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\mountvol.exemountvol R: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol S: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol S: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol S: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol S: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol T: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol T: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol T: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol T: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol U: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol U: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol U: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol U: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol V: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol V: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol V: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol V: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol W: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol W: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol W: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol W: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol X: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol X: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol X: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol X: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol Y: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol Y: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol Y: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol Y: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol E: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol E: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol E: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol E: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol F: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol F: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol F: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol F: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol G: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol G: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol G: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol G: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol H: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol H: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol H: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol H: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol I: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol I: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol I: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol I: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol J: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol J: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol J: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol J: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol K: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol K: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol K: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol K: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol L: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol L: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol L: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol L: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol M: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol M: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol M: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol M: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol N: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol N: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol N: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol N: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol O: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol O: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol O: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol O: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol P: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol P: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol P: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol P: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol Q: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol Q: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol Q: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol Q: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol R: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol R: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol R: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol R: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol S: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol S: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol S: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol S: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol T: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol T: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol T: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol T: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol U: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol U: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol U: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol U: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol V: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol V: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol V: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol V: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol W: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol W: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol W: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol W: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol X: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol X: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol X: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol X: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol Y: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol Y: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol Y: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol Y: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
- Loads dropped DLL
-
C:\Windows\System32\mousocoreworker.exeC:\Windows\System32\mousocoreworker.exe -Embedding1⤵
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
-
C:\Users\Admin\AppData\Roaming\WindowsControl\WindowsControlW.exeC:\Users\Admin\AppData\Roaming\WindowsControl\WindowsControlW.exe1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender TamperProtection settings
- UAC bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Direct Volume Access: Opens a physical disk for reading
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol E: /S2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mountvol.exemountvol E: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol E: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol E: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol F: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol F: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol F: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol F: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol G: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol G: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol G: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol G: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol H: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol H: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol H: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol H: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol I: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol I: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol I: /D2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\mountvol.exemountvol I: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol J: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol J: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol J: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol J: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol K: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol K: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol K: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol K: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol L: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol L: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol L: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol L: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol M: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol M: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol M: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol M: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol N: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol N: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol N: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol N: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol O: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol O: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol O: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol O: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol P: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol P: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol P: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol P: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol Q: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\mountvol.exemountvol Q: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol Q: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol Q: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol R: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol R: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol R: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol R: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol S: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol S: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol S: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol S: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol T: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol T: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol T: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol T: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol U: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol U: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol U: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol U: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol V: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol V: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol V: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol V: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol W: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol W: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol W: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol W: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol X: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol X: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol X: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol X: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol Y: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol Y: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol Y: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol Y: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol E: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol E: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol E: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol E: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol F: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol F: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol F: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol F: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol G: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol G: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol G: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol G: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol H: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol H: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol H: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol H: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol I: /S2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\mountvol.exemountvol I: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol I: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol I: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol J: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol J: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol J: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol J: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol K: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol K: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol K: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol K: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol L: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol L: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol L: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol L: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol M: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol M: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol M: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol M: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol N: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol N: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol N: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol N: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol O: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol O: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol O: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol O: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol P: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol P: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol P: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol P: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol Q: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol Q: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol Q: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol Q: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol R: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol R: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol R: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol R: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol S: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol S: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol S: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol S: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol T: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol T: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol T: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol T: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol U: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol U: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol U: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol U: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol V: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol V: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol V: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol V: /D3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol W: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol W: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol W: /D2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol W: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol X: /S2⤵
-
C:\Windows\system32\mountvol.exemountvol X: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol X: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol X: /D3⤵
- Enumerates connected drives
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol Y: /S2⤵
- Executes a command shell one-liner
-
C:\Windows\system32\mountvol.exemountvol Y: /S3⤵
-
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c mountvol Y: /D2⤵
-
C:\Windows\system32\mountvol.exemountvol Y: /D3⤵
-
-
-
C:\Windows\system32\UsoClient.exeC:\Windows\system32\usoclient.exe1⤵
-
C:\Windows\System32\sihclient.exeC:\Windows\System32\sihclient.exe /cv 3KqW5dBv0EmiJMNVj7IsQg.0.21⤵
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
5Windows Service
5Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
5Windows Service
5Process Injection
1Process Hollowing
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Direct Volume Access
1Impair Defenses
5Disable or Modify Tools
4Modify Registry
8Pre-OS Boot
1Bootkit
1Process Injection
1Process Hollowing
1Replay Monitor
Loading Replay Monitor...
Downloads
c894cf79-07ff-4059-8430-550c5b282578.dll
12
Schedule Maintenance Work
Schedule Maintenance Work
Schedule Maintenance Work
Schedule Wake To Work
Schedule Wake To Work
Schedule Work
Schedule Work
WindowsControlW
memory/588-13-0x00007FF91DB90000-0x00007FF91DBA0000-memory.dmp
memory/660-117-0x00007FF91DB90000-0x00007FF91DBA0000-memory.dmp
memory/772-42-0x00007FF91DB90000-0x00007FF91DBA0000-memory.dmp
memory/892-199-0x000002B5CE8E0000-0x000002B5CE90B000-memory.dmp
memory/892-205-0x000002B5CE6C0000-0x000002B5CE722000-memory.dmp
memory/892-198-0x000002B5CE8E0000-0x000002B5CE90B000-memory.dmp
memory/892-200-0x000002B5CE8E0000-0x000002B5CE90B000-memory.dmp
memory/892-193-0x000002B5CE8E0000-0x000002B5CE90B000-memory.dmp
memory/892-192-0x000002B5CE8E0000-0x000002B5CE90B000-memory.dmp
memory/892-202-0x000002B5CE8E0000-0x000002B5CE90B000-memory.dmp
memory/892-191-0x000002B5CE7A0000-0x000002B5CE7C5000-memory.dmp
memory/892-203-0x00007FF91DB90000-0x00007FF91DBA0000-memory.dmp
memory/892-201-0x000002B5CE8E0000-0x000002B5CE90B000-memory.dmp
memory/928-84-0x00007FF91DB90000-0x00007FF91DBA0000-memory.dmp
memory/996-176-0x00007FF91DB90000-0x00007FF91DBA0000-memory.dmp
memory/1168-40-0x00007FF91DB90000-0x00007FF91DBA0000-memory.dmp
memory/1184-178-0x00007FF91DB90000-0x00007FF91DBA0000-memory.dmp
memory/1288-115-0x00007FF91DB90000-0x00007FF91DBA0000-memory.dmp
memory/1376-175-0x00007FF91DB90000-0x00007FF91DBA0000-memory.dmp
memory/1460-130-0x00007FF91DB90000-0x00007FF91DBA0000-memory.dmp
memory/1584-152-0x00007FF91DB90000-0x00007FF91DBA0000-memory.dmp
memory/1692-106-0x00007FF91DB90000-0x00007FF91DBA0000-memory.dmp
memory/1856-131-0x00007FF91DB90000-0x00007FF91DBA0000-memory.dmp
memory/1896-99-0x00007FF91DB90000-0x00007FF91DBA0000-memory.dmp
memory/2108-87-0x00007FF91DB90000-0x00007FF91DBA0000-memory.dmp
memory/2144-55-0x00007FF91DB90000-0x00007FF91DBA0000-memory.dmp
memory/2196-174-0x00007FF91DB90000-0x00007FF91DBA0000-memory.dmp
memory/2272-154-0x00007FF91DB90000-0x00007FF91DBA0000-memory.dmp
memory/2396-170-0x00007FF91DB90000-0x00007FF91DBA0000-memory.dmp
memory/2448-139-0x00007FF91DB90000-0x00007FF91DBA0000-memory.dmp
memory/2540-45-0x00007FF91DB90000-0x00007FF91DBA0000-memory.dmp
memory/2616-145-0x00007FF91DB90000-0x00007FF91DBA0000-memory.dmp
memory/2708-81-0x00007FF91DB90000-0x00007FF91DBA0000-memory.dmp
memory/2856-118-0x00007FF91DB90000-0x00007FF91DBA0000-memory.dmp
memory/2880-102-0x00007FF91DB90000-0x00007FF91DBA0000-memory.dmp
memory/2888-95-0x00007FF91DB90000-0x00007FF91DBA0000-memory.dmp
memory/2952-29-0x00007FF91DB90000-0x00007FF91DBA0000-memory.dmp
memory/2988-167-0x00007FF91DB90000-0x00007FF91DBA0000-memory.dmp
memory/3292-8-0x00007FF91DB90000-0x00007FF91DBA0000-memory.dmp
memory/3292-189-0x00000000028C0000-0x00000000028C1000-memory.dmp
memory/3336-38-0x00007FF91DB90000-0x00007FF91DBA0000-memory.dmp
memory/3416-142-0x00007FF91DB90000-0x00007FF91DBA0000-memory.dmp
memory/3600-0-0x0000021A3F510000-0x0000021A3F572000-memory.dmp
memory/3600-2-0x00007FF95DB10000-0x00007FF95DD05000-memory.dmp
memory/3600-4-0x00007FF95B500000-0x00007FF95B7C9000-memory.dmp
memory/3600-3-0x00007FF95C590000-0x00007FF95C64E000-memory.dmp
memory/3600-1-0x0000021A59C20000-0x0000021A59C30000-memory.dmp
memory/3752-177-0x00007FF91DB90000-0x00007FF91DBA0000-memory.dmp
memory/3848-134-0x00007FF91DB90000-0x00007FF91DBA0000-memory.dmp
memory/4056-97-0x00007FF91DB90000-0x00007FF91DBA0000-memory.dmp
memory/4128-36-0x00007FF91DB90000-0x00007FF91DBA0000-memory.dmp
memory/4204-243-0x000001C323860000-0x000001C323870000-memory.dmp
memory/4204-221-0x000001C321960000-0x000001C32198B000-memory.dmp
memory/4204-216-0x000001C321960000-0x000001C32198B000-memory.dmp
memory/4204-239-0x000001C323860000-0x000001C323870000-memory.dmp
memory/4204-240-0x000001C323860000-0x000001C323870000-memory.dmp
memory/4204-241-0x000001C323860000-0x000001C323870000-memory.dmp
memory/4204-224-0x000001C321960000-0x000001C32198B000-memory.dmp
memory/4204-242-0x000001C323860000-0x000001C323870000-memory.dmp
memory/4204-225-0x000001C321960000-0x000001C32198B000-memory.dmp
memory/4204-223-0x000001C321960000-0x000001C32198B000-memory.dmp
memory/4204-226-0x00007FF91DB90000-0x00007FF91DBA0000-memory.dmp
memory/4204-222-0x000001C321960000-0x000001C32198B000-memory.dmp
memory/4668-90-0x00007FF91DB90000-0x00007FF91DBA0000-memory.dmp
memory/4712-441-0x0000028B90520000-0x0000028B90582000-memory.dmp
memory/4744-206-0x000001F9BBA10000-0x000001F9BBA11000-memory.dmp
memory/4744-179-0x000001F9BBA00000-0x000001F9BBA01000-memory.dmp
memory/4872-148-0x00007FF91DB90000-0x00007FF91DBA0000-memory.dmp