bd0ef7bf69fa59200b6189e6ed7d7b785a065823da25166b7747b3aa2b03be52

Analysis

max time kernel
150s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 12:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
111.exe
Size 2.2MB
Sample261107-pe9chabw2t
SHA256 bd0ef7bf69fa59200b6189e6ed7d7b785a065823da25166b7747b3aa2b03be52
MD5 b7c402efac7659a89518a9a70de22f76
SHA1 02bea2a0716c0d527b942bb33ddc21c4e070d8cb
SHA512 d0a9767d242b398f04a8399f6e2e48cb1ab19610d6df037253e6167f15a3f68697bc6b57ef346aa92299ead008072442a06cf5cd75c95556b9f00e6b159786c8
SSDEEP 49152:M+KXlQJbo/bYPmgwEh5f0/x2fRsqspcw/ZnpsLRkMSz0da:exTlgzJZF2ZnGROz7
TLSH
T149B5D04756A916E2CCB5D078C8493A22FCA534C843B07FDB16E811D72BB77E44ABD34A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 30 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3108	netsh.exe
5060	netsh.exe
4548	netsh.exe
4776	netsh.exe
2020	netsh.exe
4964	netsh.exe
3348	netsh.exe
4736	netsh.exe
580	netsh.exe
2956	netsh.exe
1740	netsh.exe
4668	netsh.exe
4464	netsh.exe
3928	netsh.exe
2444	netsh.exe
912	netsh.exe
4568	netsh.exe
6000	netsh.exe
2572	netsh.exe
1068	netsh.exe
2008	netsh.exe
3208	netsh.exe
1756	netsh.exe
2200	netsh.exe
4152	netsh.exe
1452	netsh.exe
1540	netsh.exe
1176	netsh.exe
1224	netsh.exe
2472	netsh.exe

Executes dropped EXE 18 IoCs

pid	Process
4948	SpeechRuntime.exe
1484	SpeechRuntime.exe
2356	SpeechRuntime.exe
5716	SpeechRuntime.exe
5672	Process not Found
4328	464D2C75.exe
2844	SpeechRuntime.exe
1596	SpeechRuntime.exe
4888	SpeechRuntime.exe
4656	SpeechRuntime.exe
788	SpeechRuntime.exe
3348	SpeechRuntime.exe
2860	SpeechRuntime.exe
5180	SpeechRuntime.exe
4124	SpeechRuntime.exe
4388	SpeechRuntime.exe
5204	SpeechRuntime.exe
944	SpeechRuntime.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\SpeechRuntime = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\SpeechRuntime\\SpeechRuntime.exe\""	SpeechRuntime.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\SpeechRuntime = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\MicrosoftInputHost\\SpeechRuntime.exe\""	SpeechRuntime.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\SpeechRuntime = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\MicrosoftInputHost\\SpeechRuntime.exe\""	SpeechRuntime.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\SpeechRuntime = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\SpeechRuntime\\SpeechRuntime.exe\""	SpeechRuntime.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\SpeechRuntime = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\SpeechRuntime\\SpeechRuntime.exe\""	SpeechRuntime.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\SpeechRuntime = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\SpeechRuntime\\SpeechRuntime.exe\""	SpeechRuntime.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\SpeechRuntime = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\SpeechRuntime\\SpeechRuntime.exe\""	SpeechRuntime.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\SpeechRuntime = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\SpeechRuntime\\SpeechRuntime.exe\""	SpeechRuntime.exe

Maps connected drives based on registry 3 TTPs 18 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	SpeechRuntime.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	SpeechRuntime.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	SpeechRuntime.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	SpeechRuntime.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	SpeechRuntime.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	SpeechRuntime.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	111.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	SpeechRuntime.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	SpeechRuntime.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	SpeechRuntime.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	SpeechRuntime.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	SpeechRuntime.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	111.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	SpeechRuntime.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	SpeechRuntime.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	SpeechRuntime.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	SpeechRuntime.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	SpeechRuntime.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 15 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
2356	SpeechRuntime.exe
2356	SpeechRuntime.exe
2356	SpeechRuntime.exe
4888	SpeechRuntime.exe
4888	SpeechRuntime.exe
4888	SpeechRuntime.exe
788	SpeechRuntime.exe
788	SpeechRuntime.exe
788	SpeechRuntime.exe
2860	SpeechRuntime.exe
2860	SpeechRuntime.exe
2860	SpeechRuntime.exe
4124	SpeechRuntime.exe
4124	SpeechRuntime.exe
4124	SpeechRuntime.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 64 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 14 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SpeechRuntime.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SpeechRuntime.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SpeechRuntime.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SpeechRuntime.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SpeechRuntime.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SpeechRuntime.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SpeechRuntime.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SpeechRuntime.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SpeechRuntime.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SpeechRuntime.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SpeechRuntime.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SpeechRuntime.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SpeechRuntime.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SpeechRuntime.exe

System Time Discovery 1 TTPs 30 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2020	netsh.exe
3348	netsh.exe
1068	netsh.exe
4152	netsh.exe
2200	netsh.exe
912	netsh.exe
5060	netsh.exe
4548	netsh.exe
2472	netsh.exe
4568	netsh.exe
1740	netsh.exe
2956	netsh.exe
2008	netsh.exe
2572	netsh.exe
1452	netsh.exe
580	netsh.exe
4464	netsh.exe
1756	netsh.exe
4964	netsh.exe
4668	netsh.exe
4736	netsh.exe
1224	netsh.exe
1540	netsh.exe
2444	netsh.exe
3208	netsh.exe
6000	netsh.exe
1176	netsh.exe
4776	netsh.exe
3108	netsh.exe
3928	netsh.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4100	111.exe
4100	111.exe
4100	111.exe
4100	111.exe
4100	111.exe
4100	111.exe
4100	111.exe
4100	111.exe
4100	111.exe
4100	111.exe
4100	111.exe
4100	111.exe
4100	111.exe
4100	111.exe
4100	111.exe
4100	111.exe
4100	111.exe
4100	111.exe
4100	111.exe
4100	111.exe
4100	111.exe
4100	111.exe
4100	111.exe
4100	111.exe
4100	111.exe
4100	111.exe
4100	111.exe
4100	111.exe
4100	111.exe
4100	111.exe
4100	111.exe
4100	111.exe
4100	111.exe
4100	111.exe
4100	111.exe
4100	111.exe
4100	111.exe
4100	111.exe
4100	111.exe
4100	111.exe
4100	111.exe
4100	111.exe
4100	111.exe
4100	111.exe
4100	111.exe
4100	111.exe
4100	111.exe
4100	111.exe
4948	SpeechRuntime.exe
4948	SpeechRuntime.exe
4948	SpeechRuntime.exe
4948	SpeechRuntime.exe
4948	SpeechRuntime.exe
4948	SpeechRuntime.exe
4948	SpeechRuntime.exe
4948	SpeechRuntime.exe
4948	SpeechRuntime.exe
4948	SpeechRuntime.exe
4948	SpeechRuntime.exe
4948	SpeechRuntime.exe
4948	SpeechRuntime.exe
4948	SpeechRuntime.exe
4948	SpeechRuntime.exe
4948	SpeechRuntime.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5672	Process not Found

Suspicious use of AdjustPrivilegeToken 39 IoCs

description	pid	Process
Token: SeDebugPrivilege	2356	SpeechRuntime.exe
Token: SeShutdownPrivilege	5672	Process not Found
Token: SeCreatePagefilePrivilege	5672	Process not Found
Token: SeShutdownPrivilege	5672	Process not Found
Token: SeCreatePagefilePrivilege	5672	Process not Found
Token: SeShutdownPrivilege	5672	Process not Found
Token: SeCreatePagefilePrivilege	5672	Process not Found
Token: SeShutdownPrivilege	5672	Process not Found
Token: SeCreatePagefilePrivilege	5672	Process not Found
Token: SeShutdownPrivilege	5672	Process not Found
Token: SeCreatePagefilePrivilege	5672	Process not Found
Token: SeShutdownPrivilege	5672	Process not Found
Token: SeCreatePagefilePrivilege	5672	Process not Found
Token: SeShutdownPrivilege	5672	Process not Found
Token: SeCreatePagefilePrivilege	5672	Process not Found
Token: SeShutdownPrivilege	5672	Process not Found
Token: SeCreatePagefilePrivilege	5672	Process not Found
Token: SeShutdownPrivilege	5672	Process not Found
Token: SeCreatePagefilePrivilege	5672	Process not Found
Token: SeShutdownPrivilege	5672	Process not Found
Token: SeCreatePagefilePrivilege	5672	Process not Found
Token: SeShutdownPrivilege	5672	Process not Found
Token: SeCreatePagefilePrivilege	5672	Process not Found
Token: SeShutdownPrivilege	5672	Process not Found
Token: SeCreatePagefilePrivilege	5672	Process not Found
Token: SeShutdownPrivilege	5672	Process not Found
Token: SeCreatePagefilePrivilege	5672	Process not Found
Token: SeShutdownPrivilege	5672	Process not Found
Token: SeCreatePagefilePrivilege	5672	Process not Found
Token: SeShutdownPrivilege	5672	Process not Found
Token: SeCreatePagefilePrivilege	5672	Process not Found
Token: SeShutdownPrivilege	5672	Process not Found
Token: SeCreatePagefilePrivilege	5672	Process not Found
Token: SeShutdownPrivilege	5672	Process not Found
Token: SeCreatePagefilePrivilege	5672	Process not Found
Token: SeShutdownPrivilege	5672	Process not Found
Token: SeCreatePagefilePrivilege	5672	Process not Found
Token: SeShutdownPrivilege	5672	Process not Found
Token: SeCreatePagefilePrivilege	5672	Process not Found

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 4100 wrote to memory of 4392	4100	111.exe	89
PID 4100 wrote to memory of 4948	4100	111.exe	90
PID 4948 wrote to memory of 1484	4948	SpeechRuntime.exe	91
PID 2356 wrote to memory of 5716	2356	SpeechRuntime.exe	94
PID 2356 wrote to memory of 4964	2356	SpeechRuntime.exe	95
PID 2356 wrote to memory of 3348	2356	SpeechRuntime.exe	97
PID 2356 wrote to memory of 1176	2356	SpeechRuntime.exe	99
PID 2356 wrote to memory of 2200	2356	SpeechRuntime.exe	101
PID 2356 wrote to memory of 2572	2356	SpeechRuntime.exe	103
PID 2356 wrote to memory of 4668	2356	SpeechRuntime.exe	105
PID 2356 wrote to memory of 4356	2356	SpeechRuntime.exe	108
PID 2356 wrote to memory of 3924	2356	SpeechRuntime.exe	110
PID 2356 wrote to memory of 4328	2356	SpeechRuntime.exe	112
PID 2356 wrote to memory of 2844	2356	SpeechRuntime.exe	113
PID 5672 wrote to memory of 5212	5672	Process not Found
PID 2844 wrote to memory of 1596	2844	SpeechRuntime.exe	115
PID 4888 wrote to memory of 4656	4888	SpeechRuntime.exe	117
PID 4888 wrote to memory of 4464	4888	SpeechRuntime.exe	118
PID 4888 wrote to memory of 1068	4888	SpeechRuntime.exe	120
PID 4888 wrote to memory of 4736	4888	SpeechRuntime.exe	122
PID 4888 wrote to memory of 1224	4888	SpeechRuntime.exe	124
PID 4888 wrote to memory of 1756	4888	SpeechRuntime.exe	126
PID 4888 wrote to memory of 1452	4888	SpeechRuntime.exe	128
PID 4888 wrote to memory of 5784	4888	SpeechRuntime.exe	130
PID 4888 wrote to memory of 3088	4888	SpeechRuntime.exe	132
PID 4888 wrote to memory of 788	4888	SpeechRuntime.exe	134
PID 788 wrote to memory of 3348	788	SpeechRuntime.exe	135
PID 788 wrote to memory of 4776	788	SpeechRuntime.exe	136
PID 788 wrote to memory of 2020	788	SpeechRuntime.exe	138
PID 788 wrote to memory of 2956	788	SpeechRuntime.exe	140
PID 788 wrote to memory of 3108	788	SpeechRuntime.exe	142
PID 788 wrote to memory of 580	788	SpeechRuntime.exe	144
PID 788 wrote to memory of 1540	788	SpeechRuntime.exe	146
PID 788 wrote to memory of 4556	788	SpeechRuntime.exe	148
PID 788 wrote to memory of 2536	788	SpeechRuntime.exe	150
PID 788 wrote to memory of 2860	788	SpeechRuntime.exe	152
PID 2860 wrote to memory of 5180	2860	SpeechRuntime.exe	153
PID 2860 wrote to memory of 2008	2860	SpeechRuntime.exe	154
PID 2860 wrote to memory of 3928	2860	SpeechRuntime.exe	156
PID 2860 wrote to memory of 2444	2860	SpeechRuntime.exe	158
PID 2860 wrote to memory of 912	2860	SpeechRuntime.exe	160
PID 2860 wrote to memory of 5060	2860	SpeechRuntime.exe	162
PID 2860 wrote to memory of 4548	2860	SpeechRuntime.exe	164
PID 2860 wrote to memory of 4288	2860	SpeechRuntime.exe	166
PID 2860 wrote to memory of 2912	2860	SpeechRuntime.exe	168
PID 2860 wrote to memory of 4124	2860	SpeechRuntime.exe	170
PID 4124 wrote to memory of 4388	4124	SpeechRuntime.exe	171
PID 4124 wrote to memory of 3208	4124	SpeechRuntime.exe	172
PID 4124 wrote to memory of 4568	4124	SpeechRuntime.exe	174
PID 4124 wrote to memory of 6000	4124	SpeechRuntime.exe	176
PID 4124 wrote to memory of 2472	4124	SpeechRuntime.exe	178
PID 4124 wrote to memory of 1740	4124	SpeechRuntime.exe	180
PID 4124 wrote to memory of 4152	4124	SpeechRuntime.exe	182
PID 4124 wrote to memory of 4536	4124	SpeechRuntime.exe	184
PID 4124 wrote to memory of 4676	4124	SpeechRuntime.exe	186
PID 4124 wrote to memory of 5204	4124	SpeechRuntime.exe	188
PID 5204 wrote to memory of 944	5204	SpeechRuntime.exe	189

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\111.exe
"C:\Users\Admin\AppData\Local\Temp\111.exe"
1⤵
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4100
- C:\Users\Admin\AppData\Local\Temp\111.exe
  "C:\Users\Admin\AppData\Local\Temp\111.exe" /Microsof 4100
  2⤵
  PID:4392
- C:\Users\Admin\AppData\Local\Microsoft\MicrosoftInputHost\SpeechRuntime.exe
  "C:\Users\Admin\AppData\Local\Microsoft\MicrosoftInputHost\SpeechRuntime.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Maps connected drives based on registry
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4948
- - C:\Users\Admin\AppData\Local\Microsoft\MicrosoftInputHost\SpeechRuntime.exe
    "C:\Users\Admin\AppData\Local\Microsoft\MicrosoftInputHost\SpeechRuntime.exe" /Microsof 4948
    3⤵
    - Executes dropped EXE
    PID:1484

C:\Users\Admin\AppData\Local\Microsoft\MicrosoftInputHost\SpeechRuntime.exe
"C:\Users\Admin\AppData\Local\Microsoft\MicrosoftInputHost\SpeechRuntime.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2356
- C:\Users\Admin\AppData\Local\Microsoft\MicrosoftInputHost\SpeechRuntime.exe
  "C:\Users\Admin\AppData\Local\Microsoft\MicrosoftInputHost\SpeechRuntime.exe" /Microsof 2356
  2⤵
  - Executes dropped EXE
  PID:5716
- C:\Windows\SYSTEM32\netsh.exe
  netsh advfirewall firewall add rule name="Windows Speech Runtime" dir=out action=allow program="C:\Users\Admin\AppData\Local\Microsoft\MicrosoftInputHost\SpeechRuntime.exe" enable=yes profile=any
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Time Discovery
  PID:4964
- C:\Windows\SYSTEM32\netsh.exe
  netsh advfirewall firewall add rule name="Windows Speech Runtime-in" dir=in action=allow program="C:\Users\Admin\AppData\Local\Microsoft\MicrosoftInputHost\SpeechRuntime.exe" enable=yes profile=any
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Time Discovery
  PID:3348
- C:\Windows\SYSTEM32\netsh.exe
  netsh advfirewall firewall add rule name="Windows Speech Runtime Data" dir=out action=allow protocol=TCP remoteport=9997 enable=yes profile=any
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Time Discovery
  PID:1176
- C:\Windows\SYSTEM32\netsh.exe
  netsh advfirewall firewall add rule name="Windows Speech Runtime Cmd" dir=out action=allow protocol=TCP remoteport=9999 enable=yes profile=any
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Time Discovery
  PID:2200
- C:\Windows\SYSTEM32\netsh.exe
  netsh advfirewall firewall add rule name="Windows Speech Runtime Scr" dir=out action=allow protocol=TCP remoteport=10000 enable=yes profile=any
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Time Discovery
  PID:2572
- C:\Windows\SYSTEM32\netsh.exe
  netsh advfirewall firewall add rule name="Windows Speech Runtime Proxy" dir=out action=allow protocol=TCP remoteport=10001 enable=yes profile=any
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Time Discovery
  PID:4668
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Delete /F /TN "SpeechRuntime"
  2⤵
  PID:4356
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Delete /F /TN "MicrosoftEdgeUpdate"
  2⤵
  PID:3924
- C:\Users\Admin\AppData\Local\Microsoft\C2E17DEE\464D2C75.exe
  "C:\Users\Admin\AppData\Local\Microsoft\C2E17DEE\464D2C75.exe"
  2⤵
  - Executes dropped EXE
  PID:4328
- C:\Users\Admin\AppData\Local\Microsoft\SpeechRuntime\SpeechRuntime.exe
  "C:\Users\Admin\AppData\Local\Microsoft\SpeechRuntime\SpeechRuntime.exe" /speechrt 2356
  2⤵
  - Executes dropped EXE
  - Maps connected drives based on registry
  - Suspicious use of WriteProcessMemory
  PID:2844
- - C:\Users\Admin\AppData\Local\Microsoft\SpeechRuntime\SpeechRuntime.exe
    "C:\Users\Admin\AppData\Local\Microsoft\SpeechRuntime\SpeechRuntime.exe" /Microsof 2844
    3⤵
    - Executes dropped EXE
    PID:1596

C:\Users\Admin\AppData\Local\Microsoft\SpeechRuntime\SpeechRuntime.exe
"C:\Users\Admin\AppData\Local\Microsoft\SpeechRuntime\SpeechRuntime.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Users\Admin\AppData\Local\Microsoft\SpeechRuntime\SpeechRuntime.exe
  "C:\Users\Admin\AppData\Local\Microsoft\SpeechRuntime\SpeechRuntime.exe" /Microsof 4888
  2⤵
  - Executes dropped EXE
  PID:4656
- C:\Windows\SYSTEM32\netsh.exe
  netsh advfirewall firewall add rule name="Windows Speech Runtime" dir=out action=allow program="C:\Users\Admin\AppData\Local\Microsoft\SpeechRuntime\SpeechRuntime.exe" enable=yes profile=any
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Time Discovery
  PID:4464
- C:\Windows\SYSTEM32\netsh.exe
  netsh advfirewall firewall add rule name="Windows Speech Runtime-in" dir=in action=allow program="C:\Users\Admin\AppData\Local\Microsoft\SpeechRuntime\SpeechRuntime.exe" enable=yes profile=any
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Time Discovery
  PID:1068
- C:\Windows\SYSTEM32\netsh.exe
  netsh advfirewall firewall add rule name="Windows Speech Runtime Data" dir=out action=allow protocol=TCP remoteport=9997 enable=yes profile=any
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Time Discovery
  PID:4736
- C:\Windows\SYSTEM32\netsh.exe
  netsh advfirewall firewall add rule name="Windows Speech Runtime Cmd" dir=out action=allow protocol=TCP remoteport=9999 enable=yes profile=any
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Time Discovery
  PID:1224
- C:\Windows\SYSTEM32\netsh.exe
  netsh advfirewall firewall add rule name="Windows Speech Runtime Scr" dir=out action=allow protocol=TCP remoteport=10000 enable=yes profile=any
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Time Discovery
  PID:1756
- C:\Windows\SYSTEM32\netsh.exe
  netsh advfirewall firewall add rule name="Windows Speech Runtime Proxy" dir=out action=allow protocol=TCP remoteport=10001 enable=yes profile=any
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  - System Time Discovery
  PID:1452
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Delete /F /TN "SpeechRuntime"
  2⤵
  PID:5784
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Delete /F /TN "MicrosoftEdgeUpdate"
  2⤵
  PID:3088
- C:\Users\Admin\AppData\Local\Microsoft\SpeechRuntime\SpeechRuntime.exe
  "C:\Users\Admin\AppData\Local\Microsoft\SpeechRuntime\SpeechRuntime.exe" /speechrt 4888
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Maps connected drives based on registry
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of WriteProcessMemory
  PID:788
- - C:\Users\Admin\AppData\Local\Microsoft\SpeechRuntime\SpeechRuntime.exe
    "C:\Users\Admin\AppData\Local\Microsoft\SpeechRuntime\SpeechRuntime.exe" /Microsof 788
    3⤵
    - Executes dropped EXE
    PID:3348
- - C:\Windows\SYSTEM32\netsh.exe
    netsh advfirewall firewall add rule name="Windows Speech Runtime" dir=out action=allow program="C:\Users\Admin\AppData\Local\Microsoft\SpeechRuntime\SpeechRuntime.exe" enable=yes profile=any
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Time Discovery
    PID:4776
- - C:\Windows\SYSTEM32\netsh.exe
    netsh advfirewall firewall add rule name="Windows Speech Runtime-in" dir=in action=allow program="C:\Users\Admin\AppData\Local\Microsoft\SpeechRuntime\SpeechRuntime.exe" enable=yes profile=any
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Time Discovery
    PID:2020
- - C:\Windows\SYSTEM32\netsh.exe
    netsh advfirewall firewall add rule name="Windows Speech Runtime Data" dir=out action=allow protocol=TCP remoteport=9997 enable=yes profile=any
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Time Discovery
    PID:2956
- - C:\Windows\SYSTEM32\netsh.exe
    netsh advfirewall firewall add rule name="Windows Speech Runtime Cmd" dir=out action=allow protocol=TCP remoteport=9999 enable=yes profile=any
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Time Discovery
    PID:3108
- - C:\Windows\SYSTEM32\netsh.exe
    netsh advfirewall firewall add rule name="Windows Speech Runtime Scr" dir=out action=allow protocol=TCP remoteport=10000 enable=yes profile=any
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Time Discovery
    PID:580
- - C:\Windows\SYSTEM32\netsh.exe
    netsh advfirewall firewall add rule name="Windows Speech Runtime Proxy" dir=out action=allow protocol=TCP remoteport=10001 enable=yes profile=any
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Time Discovery
    PID:1540
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Delete /F /TN "SpeechRuntime"
    3⤵
    PID:4556
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Delete /F /TN "MicrosoftEdgeUpdate"
    3⤵
    PID:2536
- - C:\Users\Admin\AppData\Local\Microsoft\SpeechRuntime\SpeechRuntime.exe
    "C:\Users\Admin\AppData\Local\Microsoft\SpeechRuntime\SpeechRuntime.exe" /speechrt 788
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Maps connected drives based on registry
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of WriteProcessMemory
    PID:2860
  - - C:\Users\Admin\AppData\Local\Microsoft\SpeechRuntime\SpeechRuntime.exe
      "C:\Users\Admin\AppData\Local\Microsoft\SpeechRuntime\SpeechRuntime.exe" /Microsof 2860
      4⤵
      Executes dropped EXE
      PID:5180
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh advfirewall firewall add rule name="Windows Speech Runtime" dir=out action=allow program="C:\Users\Admin\AppData\Local\Microsoft\SpeechRuntime\SpeechRuntime.exe" enable=yes profile=any
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Time Discovery
      PID:2008
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh advfirewall firewall add rule name="Windows Speech Runtime-in" dir=in action=allow program="C:\Users\Admin\AppData\Local\Microsoft\SpeechRuntime\SpeechRuntime.exe" enable=yes profile=any
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Time Discovery
      PID:3928
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh advfirewall firewall add rule name="Windows Speech Runtime Data" dir=out action=allow protocol=TCP remoteport=9997 enable=yes profile=any
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Time Discovery
      PID:2444
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh advfirewall firewall add rule name="Windows Speech Runtime Cmd" dir=out action=allow protocol=TCP remoteport=9999 enable=yes profile=any
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Time Discovery
      PID:912
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh advfirewall firewall add rule name="Windows Speech Runtime Scr" dir=out action=allow protocol=TCP remoteport=10000 enable=yes profile=any
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Time Discovery
      PID:5060
  - - C:\Windows\SYSTEM32\netsh.exe
      netsh advfirewall firewall add rule name="Windows Speech Runtime Proxy" dir=out action=allow protocol=TCP remoteport=10001 enable=yes profile=any
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Time Discovery
      PID:4548
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /Delete /F /TN "SpeechRuntime"
      4⤵
      PID:4288
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /Delete /F /TN "MicrosoftEdgeUpdate"
      4⤵
      PID:2912
  - - C:\Users\Admin\AppData\Local\Microsoft\SpeechRuntime\SpeechRuntime.exe
      "C:\Users\Admin\AppData\Local\Microsoft\SpeechRuntime\SpeechRuntime.exe" /speechrt 2860
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Maps connected drives based on registry
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Reads the TCP/IP host and domain name from the registry
      Suspicious use of WriteProcessMemory
      PID:4124
    - - C:\Users\Admin\AppData\Local\Microsoft\SpeechRuntime\SpeechRuntime.exe
        
        "C:\Users\Admin\AppData\Local\Microsoft\SpeechRuntime\SpeechRuntime.exe" /Microsof 4124
        5⤵
        Executes dropped EXE
        
        PID:4388
    - - C:\Windows\SYSTEM32\netsh.exe
        
        netsh advfirewall firewall add rule name="Windows Speech Runtime" dir=out action=allow program="C:\Users\Admin\AppData\Local\Microsoft\SpeechRuntime\SpeechRuntime.exe" enable=yes profile=any
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Time Discovery
        
        PID:3208
    - - C:\Windows\SYSTEM32\netsh.exe
        
        netsh advfirewall firewall add rule name="Windows Speech Runtime-in" dir=in action=allow program="C:\Users\Admin\AppData\Local\Microsoft\SpeechRuntime\SpeechRuntime.exe" enable=yes profile=any
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Time Discovery
        
        PID:4568
    - - C:\Windows\SYSTEM32\netsh.exe
        
        netsh advfirewall firewall add rule name="Windows Speech Runtime Data" dir=out action=allow protocol=TCP remoteport=9997 enable=yes profile=any
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Time Discovery
        
        PID:6000
    - - C:\Windows\SYSTEM32\netsh.exe
        
        netsh advfirewall firewall add rule name="Windows Speech Runtime Cmd" dir=out action=allow protocol=TCP remoteport=9999 enable=yes profile=any
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Time Discovery
        
        PID:2472
    - - C:\Windows\SYSTEM32\netsh.exe
        
        netsh advfirewall firewall add rule name="Windows Speech Runtime Scr" dir=out action=allow protocol=TCP remoteport=10000 enable=yes profile=any
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Time Discovery
        
        PID:1740
    - - C:\Windows\SYSTEM32\netsh.exe
        
        netsh advfirewall firewall add rule name="Windows Speech Runtime Proxy" dir=out action=allow protocol=TCP remoteport=10001 enable=yes profile=any
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        System Time Discovery
        
        PID:4152
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Delete /F /TN "SpeechRuntime"
        5⤵
        
        PID:4536
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        schtasks /Delete /F /TN "MicrosoftEdgeUpdate"
        5⤵
        
        PID:4676
    - - C:\Users\Admin\AppData\Local\Microsoft\SpeechRuntime\SpeechRuntime.exe
        
        "C:\Users\Admin\AppData\Local\Microsoft\SpeechRuntime\SpeechRuntime.exe" /speechrt 4124
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Maps connected drives based on registry
        Reads the TCP/IP host and domain name from the registry
        Suspicious use of WriteProcessMemory
        
        PID:5204
      - C:\Users\Admin\AppData\Local\Microsoft\SpeechRuntime\SpeechRuntime.exe
        
        "C:\Users\Admin\AppData\Local\Microsoft\SpeechRuntime\SpeechRuntime.exe" /Microsof 5204
        6⤵
        Executes dropped EXE
        
        PID:944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Debugger Evasion

T1622

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Debugger Evasion

T1622

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

464D2C75.exe

Path C:\Users\Admin\AppData\Local\Microsoft\C2E17DEE\464D2C75.exe
Size 28KB
SHA256 594ed180d90fc0d9d1e0a39e8a10653c5210a164232381c6729907e69e5ae6cf
MD5 09269fceaa59c8b5449c30ef19c3a51e
SHA1 69cf264f06146db4e36775a3350065126f2d9a84
SHA512 b6ccc52e3f9b0fe47f0c058811173331b5e9811c93061020273282ceb1745b1b806e4f1c2b2949ec4519369d4c97834d3b1096341ad8f18d338b93b194f96e71
SSDEEP 48:inrmoDH2PJ61aofH/xIASgM93cRQiRaR8Jn06AEsgPB52bZc:9+WhYpqYH1/rey
TLSH
T1D0D23087FC5D45F5DDEF4139988FA53272BC31101312062F1464D85A0EE0E7BB5A6A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SpeechRuntime.exe

Path C:\Users\Admin\AppData\Local\Microsoft\MicrosoftInputHost\SpeechRuntime.exe
Size 2.2MB
SHA256 bd0ef7bf69fa59200b6189e6ed7d7b785a065823da25166b7747b3aa2b03be52
MD5 b7c402efac7659a89518a9a70de22f76
SHA1 02bea2a0716c0d527b942bb33ddc21c4e070d8cb
SHA512 d0a9767d242b398f04a8399f6e2e48cb1ab19610d6df037253e6167f15a3f68697bc6b57ef346aa92299ead008072442a06cf5cd75c95556b9f00e6b159786c8
SSDEEP 49152:M+KXlQJbo/bYPmgwEh5f0/x2fRsqspcw/ZnpsLRkMSz0da:exTlgzJZF2ZnGROz7
TLSH
T149B5D04756A916E2CCB5D078C8493A22FCA534C843B07FDB16E811D72BB77E44ABD34A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

webcachev01.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\webcachev01.dat
Size 46KB
SHA256 605814f49e3ac16cf7e61f160a2237318e023021fe7e75f5d13138d7a5baaaf8
MD5 7102c336dca301d4318a9044acce76c6
SHA1 b732c93f0badf810952404ec5d4fa4bf6b35ae59
SHA512 057c734fbce68dd2ee6c4ae3ca76fc0bd5201b99a9daa8d0cfe9a38027ebc6837a97809ac3aac06888b297a81ee8f23671dd933ac73ffbe9cbd9ad663dcbed00
SSDEEP 768:ngjKdC2Z/64GI9/lOqFN2671UNd5CqQElMgaXBJvAlMO:ngjKdC2Z/64GI9/pFA6h8d5MElEbAl
TLSH
T13523D855DC46D52BE75ECC74CE3AA945EA117CDA4B90A6CB6B805CF30821FE0A739282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arv_boot.txt

Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
Size 131B
SHA256 9a8d2f5443ff1dcd0a626b0e01a8dddcaca92d45e2f5ead64356be7b17eca5cf
MD5 fd9f2c300a4a26dac31b62f883a7cfaa
SHA1 9c0e9fb5e2e2a63d38f02292e1b579261c15a1e9
SHA512 6e52c08f621882d8282d41f2297daca39209395e3ce7969888c48ac24189aeaa29e1801e3d5d82a10efcff3d755bc786d6fda1a8efd16ce03835ba780a621655
TLSH
T174C0921CC03BC73C3492AF0003629DEFEB82E2C2A00A53B0074201E100BBA2CC282221
MD5 SHA1 SHA512 TLSH

Submit Download

arv_boot.txt

Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
Size 174B
SHA256 e85c43c6dc937824ad554a22347e65c264d999e0d7780f7938d59b281bde28f2
MD5 d40c8e09da78a52808d1dafdfe30c581
SHA1 09698ec7d59a4025e5941482de179a9d2a769c4b
SHA512 b6a20f8dc05fa4a94075d3a5706baa8a0b7b6ea2d879b0159c32a94b8842fce39880b52966d5e464e7b85c90f7db83de2c4f81e094af11116c611b08b9f1fcef
TLSH
T1D2C04C1CC03BC72C3492EF000362ADEEE782E2D3A00953701B4201E640BFB3CC181222
MD5 SHA1 SHA512 TLSH

Submit Download

arv_boot.txt

Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
Size 252B
SHA256 c541d07791c84b5ca445ab1b7637f8dfd7304641816cf9f97c501d9e7eb83807
MD5 ba7bf6908916e585c7da32979db1643a
SHA1 a8da500a647ac03d32dd1d20784c488941e73d5e
SHA512 37871d62e58628ef3d1011ec540fa9221d2fb8b54da2efc7011afba9a71fc53c5e6beffeae13eadc9b5fd99ef23779100ff4de2b6ab396c0d5907d357e83d156
TLSH
T1EAD0921CC03BC73C3492AF000362ADEFEBC2E2C2A00A53B0074201E100BBB2CC282221
MD5 SHA1 SHA512 TLSH

Submit Download

arv_boot.txt

Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
Size 373B
SHA256 c5cc2dc0994170cb8fafaf8cf975c5124c79f2339c3f77c78c2147b4e8b1ebe8
MD5 99dd0923c776204540fede652cc4b281
SHA1 30c3a9aa0ca050d7a7a25409a662c5d8e35fdaab
SHA512 dc88baff88cf065d046acf9c672d52a87b99ece4deceb2fb006713de04234c25ee41cb1fff339bbe3ebd39a64514b22ddb47dfcef08a73696d79993a2b2cb1f7
TLSH
T1C5E0921CC03BC73C3492AF000362ADEFEBC2E2C2A00A53B0074201E100BBB2CC282221
MD5 SHA1 SHA512 TLSH

Submit Download

arv_boot.txt

Path C:\Users\Admin\AppData\Local\Temp\arv_boot.txt
Size 494B
SHA256 024b66ab4f0889884af49c172cb611fa45c4ed95359d3cf93df30de446edab09
MD5 ebfd0fab8827d85b6affca3a3c974c36
SHA1 f4db2a3a173cfdf47ae60293d7b5e76295abb5b6
SHA512 7219ef2f997ecbcdd0ec2518eac85e4fd743c4fdcf62df6d0297c60f47f02826b1df7066f3a524fe732559cc9be50a1cdd4c551d5855af236b10e7de01c9270d
TLSH
T107F0921CC03BC73C3492AF000362ADEFEBC2E2C2A00A53B0074201E100BBB2CC282221
MD5 SHA1 SHA512 TLSH

Submit Download

memory/788-227-0x000001F205260000-0x000001F2056DB000-memory.dmp

Download

memory/788-213-0x000001F205260000-0x000001F2056DB000-memory.dmp

Download

memory/788-236-0x000001F205260000-0x000001F2056DB000-memory.dmp

Download

memory/788-232-0x00007FFF028C0000-0x00007FFF02B23000-memory.dmp

Download

memory/788-239-0x000001F205260000-0x000001F2056DB000-memory.dmp

Download

memory/788-240-0x000001F205260000-0x000001F2056DB000-memory.dmp

Download

memory/788-217-0x000001F205260000-0x000001F2056DB000-memory.dmp

Download

memory/788-245-0x000001F205260000-0x000001F2056DB000-memory.dmp

Download

memory/788-219-0x000001F205260000-0x000001F2056DB000-memory.dmp

Download

memory/788-238-0x000001F205260000-0x000001F2056DB000-memory.dmp

Download

memory/788-205-0x000001F205260000-0x000001F2056DB000-memory.dmp

Download

memory/788-201-0x000001F205260000-0x000001F2056DB000-memory.dmp

Download

memory/788-204-0x000001F205260000-0x000001F2056DB000-memory.dmp

Download

memory/788-202-0x000001F205260000-0x000001F2056DB000-memory.dmp

Download

memory/788-246-0x000001F205260000-0x000001F2056DB000-memory.dmp

Download

memory/788-200-0x000001F205260000-0x000001F2056DB000-memory.dmp

Download

memory/788-199-0x000001F205260000-0x000001F2056DB000-memory.dmp

Download

memory/788-191-0x000001F205260000-0x000001F2056DB000-memory.dmp

Download

memory/788-250-0x000001F205260000-0x000001F2056DB000-memory.dmp

Download

memory/2356-60-0x000001C3F3AC0000-0x000001C3F3F3B000-memory.dmp

Download

memory/2356-23-0x000001C3F3AC0000-0x000001C3F3F3B000-memory.dmp

Download

memory/2356-7-0x000001C3F26F0000-0x000001C3F26F3000-memory.dmp

Download

memory/2356-9-0x000001C3F3AC0000-0x000001C3F3F3B000-memory.dmp

Download

memory/2356-19-0x000001C3F3AC0000-0x000001C3F3F3B000-memory.dmp

Download

memory/2356-20-0x000001C3F3AC0000-0x000001C3F3F3B000-memory.dmp

Download

memory/2356-18-0x000001C3F3AC0000-0x000001C3F3F3B000-memory.dmp

Download

memory/2356-17-0x000001C3F3AC0000-0x000001C3F3F3B000-memory.dmp

Download

memory/2356-22-0x000001C3F3AC0000-0x000001C3F3F3B000-memory.dmp

Download

memory/2356-32-0x000001C3F3AC0000-0x000001C3F3F3B000-memory.dmp

Download

memory/2356-38-0x000001C3F3AC0000-0x000001C3F3F3B000-memory.dmp

Download

memory/2356-33-0x000001C3F3AC0000-0x000001C3F3F3B000-memory.dmp

Download

memory/2356-49-0x000001C3F3AC0000-0x000001C3F3F3B000-memory.dmp

Download

memory/2356-54-0x00007FFF028C0000-0x00007FFF02B23000-memory.dmp

Download

memory/2356-58-0x000001C3F3AC0000-0x000001C3F3F3B000-memory.dmp

Download

memory/2356-59-0x000001C3F3AC0000-0x000001C3F3F3B000-memory.dmp

Download

memory/2356-67-0x000001C3F3AC0000-0x000001C3F3F3B000-memory.dmp

Download

memory/2356-66-0x000001C3F3AC0000-0x000001C3F3F3B000-memory.dmp

Download

memory/2356-61-0x000001C3F3AC0000-0x000001C3F3F3B000-memory.dmp

Download

memory/2356-76-0x000001C3F3AC0000-0x000001C3F3F3B000-memory.dmp

Download

memory/2860-284-0x000001F346CF0000-0x000001F34716B000-memory.dmp

Download

memory/2860-283-0x000001F346CF0000-0x000001F34716B000-memory.dmp

Download

memory/2860-275-0x000001F346CF0000-0x000001F34716B000-memory.dmp

Download

memory/4100-0-0x000002685FCC0000-0x000002685FCC1000-memory.dmp

Download

memory/4888-142-0x000002A8727E0000-0x000002A872C5B000-memory.dmp

Download

memory/4888-120-0x000002A8727E0000-0x000002A872C5B000-memory.dmp

Download

memory/4888-156-0x000002A8727E0000-0x000002A872C5B000-memory.dmp

Download

memory/4888-160-0x000002A8727E0000-0x000002A872C5B000-memory.dmp

Download

memory/4888-152-0x000002A8727E0000-0x000002A872C5B000-memory.dmp

Download

memory/4888-153-0x000002A8727E0000-0x000002A872C5B000-memory.dmp

Download

memory/4888-147-0x00007FFF028C0000-0x00007FFF02B23000-memory.dmp

Download

memory/4888-146-0x000002A8727E0000-0x000002A872C5B000-memory.dmp

Download

memory/4888-117-0x000002A8727E0000-0x000002A872C5B000-memory.dmp

Download

memory/4888-106-0x000002A8727E0000-0x000002A872C5B000-memory.dmp

Download

memory/4888-115-0x000002A8727E0000-0x000002A872C5B000-memory.dmp

Download

memory/4888-161-0x000002A8727E0000-0x000002A872C5B000-memory.dmp

Download

memory/4888-128-0x000002A8727E0000-0x000002A872C5B000-memory.dmp

Download

memory/4888-135-0x000002A8727E0000-0x000002A872C5B000-memory.dmp

Download

memory/4888-119-0x000002A8727E0000-0x000002A872C5B000-memory.dmp

Download

memory/4888-114-0x000002A8727E0000-0x000002A872C5B000-memory.dmp

Download

memory/4888-165-0x000002A8727E0000-0x000002A872C5B000-memory.dmp

Download

memory/4888-154-0x000002A8727E0000-0x000002A872C5B000-memory.dmp

Download

memory/4888-116-0x000002A8727E0000-0x000002A872C5B000-memory.dmp

Download

memory/5672-97-0x0000000002B30000-0x0000000002B31000-memory.dmp

Download

memory/5672-100-0x0000000002B40000-0x0000000002B41000-memory.dmp

Download