459963495bf0c71e1d1654f51e004fc0b3b8c919fd8931571f9b94209cc7389d

Analysis

max time kernel
301s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 17:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
taskhostw.exe
Size 21.0MB
Sample261107-vybs8sdv8x
SHA256 459963495bf0c71e1d1654f51e004fc0b3b8c919fd8931571f9b94209cc7389d
MD5 9cd26569d3b447457d4b397a4eb3f937
SHA1 6105a80e89b6eada4d2f7c07fcd8ebc95ebeab58
SHA512 40d05b98ac7da24cc9b96fe18a1b0049d85796b3bd140a80242bc53140bd4f835f474b9673ce420eb96ad166dd84aca5828b94aa296d9ab41ff63f7e37829fa7
SSDEEP 393216:rJEAMQ1g/E+jmdejUVu5dn9HyLr5A8HVnlBEiFe9kAMGJn28:VEbQ1YRKIUU5CPpcA4nH
TLSH
T1452723B664778A9ED198BF31C1E88EE64CC25CBF06DD12645CBDEE27397830151B628C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution persistence themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	taskhostw.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	taskhostw.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	taskhostw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	taskhostw.exe

Executes a file named after a Windows system binary 1 TTPs 1 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\taskhostw.exe	taskhostw.exe

Modifies file permissions 1 TTPs 18 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5756	icacls.exe
5992	icacls.exe
3496	icacls.exe
4176	icacls.exe
4696	icacls.exe
1508	icacls.exe
2564	icacls.exe
2800	icacls.exe
2160	icacls.exe
4084	icacls.exe
2368	icacls.exe
1088	icacls.exe
3700	icacls.exe
264	icacls.exe
4844	icacls.exe
4948	icacls.exe
5556	icacls.exe
3132	icacls.exe

Themida packer 38 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral4/memory/4128-0-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	themida
behavioral4/memory/4128-1-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	themida
behavioral4/memory/4128-2-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	themida
behavioral4/memory/4128-3-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	themida
behavioral4/memory/4128-4-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	themida
behavioral4/memory/4128-5-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	themida
behavioral4/memory/4128-6-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	themida
behavioral4/memory/4128-7-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	themida
behavioral4/memory/4128-8-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	themida
behavioral4/memory/4128-15-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	themida
behavioral4/memory/4128-16-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	themida
behavioral4/memory/4128-28-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	themida
behavioral4/memory/4128-29-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	themida
behavioral4/memory/4128-30-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	themida
behavioral4/memory/4128-31-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	themida
behavioral4/memory/4128-32-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	themida
behavioral4/memory/4128-33-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	themida
behavioral4/memory/4128-34-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	themida
behavioral4/memory/4128-35-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	themida
behavioral4/memory/4128-36-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	themida
behavioral4/memory/4128-37-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	themida
behavioral4/memory/4128-38-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	themida
behavioral4/memory/4128-39-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	themida
behavioral4/memory/4128-40-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	themida
behavioral4/memory/4128-41-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	themida
behavioral4/memory/4128-42-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	themida
behavioral4/memory/4128-43-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	themida
behavioral4/memory/4128-44-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	themida
behavioral4/memory/4128-45-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	themida
behavioral4/memory/4128-46-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	themida
behavioral4/memory/4128-47-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	themida
behavioral4/memory/4128-48-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	themida
behavioral4/memory/4128-49-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	themida
behavioral4/memory/4128-50-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	themida
behavioral4/memory/4128-51-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	themida
behavioral4/memory/4128-52-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	themida
behavioral4/memory/4128-53-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	themida
behavioral4/memory/4128-54-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	themida

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio = "C:\\ProgramData\\ReaItekHD\\taskhostw.exe"	taskhostw.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskhostw.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

AutoIT Executable 36 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral4/memory/4128-2-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	autoit_exe
behavioral4/memory/4128-3-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	autoit_exe
behavioral4/memory/4128-4-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	autoit_exe
behavioral4/memory/4128-5-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	autoit_exe
behavioral4/memory/4128-6-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	autoit_exe
behavioral4/memory/4128-7-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	autoit_exe
behavioral4/memory/4128-8-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	autoit_exe
behavioral4/memory/4128-15-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	autoit_exe
behavioral4/memory/4128-16-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	autoit_exe
behavioral4/memory/4128-28-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	autoit_exe
behavioral4/memory/4128-29-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	autoit_exe
behavioral4/memory/4128-30-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	autoit_exe
behavioral4/memory/4128-31-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	autoit_exe
behavioral4/memory/4128-32-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	autoit_exe
behavioral4/memory/4128-33-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	autoit_exe
behavioral4/memory/4128-34-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	autoit_exe
behavioral4/memory/4128-35-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	autoit_exe
behavioral4/memory/4128-36-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	autoit_exe
behavioral4/memory/4128-37-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	autoit_exe
behavioral4/memory/4128-38-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	autoit_exe
behavioral4/memory/4128-39-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	autoit_exe
behavioral4/memory/4128-40-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	autoit_exe
behavioral4/memory/4128-41-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	autoit_exe
behavioral4/memory/4128-42-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	autoit_exe
behavioral4/memory/4128-43-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	autoit_exe
behavioral4/memory/4128-44-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	autoit_exe
behavioral4/memory/4128-45-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	autoit_exe
behavioral4/memory/4128-46-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	autoit_exe
behavioral4/memory/4128-47-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	autoit_exe
behavioral4/memory/4128-48-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	autoit_exe
behavioral4/memory/4128-49-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	autoit_exe
behavioral4/memory/4128-50-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	autoit_exe
behavioral4/memory/4128-51-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	autoit_exe
behavioral4/memory/4128-52-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	autoit_exe
behavioral4/memory/4128-53-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	autoit_exe
behavioral4/memory/4128-54-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp	autoit_exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\wsvcz	taskhostw.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
4128	taskhostw.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\updater.exe	taskhostw.exe

Executes a command shell one-liner 1 TTPs 18 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3580	cmd.exe
4284	cmd.exe
5460	cmd.exe
4432	cmd.exe
6132	cmd.exe
124	cmd.exe
2384	cmd.exe
5404	cmd.exe
4264	cmd.exe
5440	cmd.exe
2640	cmd.exe
3180	cmd.exe
5680	cmd.exe
4140	cmd.exe
5500	cmd.exe
2076	cmd.exe
1328	cmd.exe
828	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	taskhostw.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	taskhostw.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskhostw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskhostw.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\winmgmts:\	taskhostw.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\WinMgmts:\	taskhostw.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4128	taskhostw.exe
4128	taskhostw.exe
4128	taskhostw.exe
4128	taskhostw.exe
4128	taskhostw.exe
4128	taskhostw.exe
4128	taskhostw.exe
4128	taskhostw.exe
4128	taskhostw.exe
4128	taskhostw.exe
4128	taskhostw.exe
4128	taskhostw.exe
4128	taskhostw.exe
4128	taskhostw.exe
4128	taskhostw.exe
4128	taskhostw.exe
4128	taskhostw.exe
4128	taskhostw.exe
4128	taskhostw.exe
4128	taskhostw.exe
4128	taskhostw.exe
4128	taskhostw.exe
4128	taskhostw.exe
4128	taskhostw.exe
4128	taskhostw.exe
4128	taskhostw.exe
4128	taskhostw.exe
4128	taskhostw.exe
4128	taskhostw.exe
4128	taskhostw.exe
4128	taskhostw.exe
4128	taskhostw.exe
4128	taskhostw.exe
4128	taskhostw.exe
4128	taskhostw.exe
4128	taskhostw.exe
4128	taskhostw.exe
4128	taskhostw.exe
4128	taskhostw.exe
4128	taskhostw.exe
4128	taskhostw.exe
4128	taskhostw.exe
4128	taskhostw.exe
4128	taskhostw.exe
4128	taskhostw.exe
4128	taskhostw.exe
4128	taskhostw.exe
4128	taskhostw.exe
4128	taskhostw.exe
4128	taskhostw.exe
4128	taskhostw.exe
4128	taskhostw.exe
4128	taskhostw.exe
4128	taskhostw.exe
4128	taskhostw.exe
4128	taskhostw.exe
4128	taskhostw.exe
4128	taskhostw.exe
4128	taskhostw.exe
4128	taskhostw.exe
4128	taskhostw.exe
4128	taskhostw.exe
4128	taskhostw.exe
4128	taskhostw.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4128	taskhostw.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 5440	4128	taskhostw.exe	89
PID 5440 wrote to memory of 1508	5440	cmd.exe	91
PID 4128 wrote to memory of 5500	4128	taskhostw.exe	92
PID 5500 wrote to memory of 5756	5500	cmd.exe	94
PID 4128 wrote to memory of 6132	4128	taskhostw.exe	95
PID 6132 wrote to memory of 1088	6132	cmd.exe	97
PID 4128 wrote to memory of 2640	4128	taskhostw.exe	98
PID 2640 wrote to memory of 2564	2640	cmd.exe	100
PID 4128 wrote to memory of 3180	4128	taskhostw.exe	101
PID 3180 wrote to memory of 5992	3180	cmd.exe	103
PID 4128 wrote to memory of 2076	4128	taskhostw.exe	104
PID 2076 wrote to memory of 2800	2076	cmd.exe	106
PID 4128 wrote to memory of 5680	4128	taskhostw.exe	107
PID 5680 wrote to memory of 3700	5680	cmd.exe	109
PID 4128 wrote to memory of 1328	4128	taskhostw.exe	110
PID 1328 wrote to memory of 3496	1328	cmd.exe	112
PID 4128 wrote to memory of 828	4128	taskhostw.exe	113
PID 828 wrote to memory of 2160	828	cmd.exe	115
PID 4128 wrote to memory of 3580	4128	taskhostw.exe	116
PID 3580 wrote to memory of 264	3580	cmd.exe	118
PID 4128 wrote to memory of 124	4128	taskhostw.exe	119
PID 124 wrote to memory of 4844	124	cmd.exe	121
PID 4128 wrote to memory of 5460	4128	taskhostw.exe	122
PID 5460 wrote to memory of 4176	5460	cmd.exe	124
PID 4128 wrote to memory of 4284	4128	taskhostw.exe	125
PID 4284 wrote to memory of 4084	4284	cmd.exe	127
PID 4128 wrote to memory of 4432	4128	taskhostw.exe	128
PID 4432 wrote to memory of 2368	4432	cmd.exe	130
PID 4128 wrote to memory of 2384	4128	taskhostw.exe	131
PID 2384 wrote to memory of 4948	2384	cmd.exe	133
PID 4128 wrote to memory of 5404	4128	taskhostw.exe	134
PID 5404 wrote to memory of 5556	5404	cmd.exe	136
PID 4128 wrote to memory of 4264	4128	taskhostw.exe	137
PID 4264 wrote to memory of 4696	4264	cmd.exe	139
PID 4128 wrote to memory of 4140	4128	taskhostw.exe	140
PID 4140 wrote to memory of 3132	4140	cmd.exe	142

C:\Users\Admin\AppData\Local\Temp\taskhostw.exe
"C:\Users\Admin\AppData\Local\Temp\taskhostw.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes a file named after a Windows system binary
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "c:\programdata\tfkxupgodbpx" /deny "*S-1-5-32-544":(OI)(CI)(F)
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5440
- - C:\Windows\system32\icacls.exe
    icacls "c:\programdata\tfkxupgodbpx" /deny "*S-1-5-32-544":(OI)(CI)(F)
    3⤵
    - Modifies file permissions
    PID:1508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "c:\programdata\dmnxhvzbkpku" /deny "*S-1-5-32-544":(OI)(CI)(F)
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5500
- - C:\Windows\system32\icacls.exe
    icacls "c:\programdata\dmnxhvzbkpku" /deny "*S-1-5-32-544":(OI)(CI)(F)
    3⤵
    - Modifies file permissions
    PID:5756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "c:\programdata\czyuzabpfprl" /deny "*S-1-5-32-544":(OI)(CI)(F)
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6132
- - C:\Windows\system32\icacls.exe
    icacls "c:\programdata\czyuzabpfprl" /deny "*S-1-5-32-544":(OI)(CI)(F)
    3⤵
    - Modifies file permissions
    PID:1088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "c:\programdata\ztbhbqffszlu" /deny "*S-1-5-32-544":(OI)(CI)(F)
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2640
- - C:\Windows\system32\icacls.exe
    icacls "c:\programdata\ztbhbqffszlu" /deny "*S-1-5-32-544":(OI)(CI)(F)
    3⤵
    - Modifies file permissions
    PID:2564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "c:\programdata\qhpxndiguijf" /deny "*S-1-5-32-544":(OI)(CI)(F)
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3180
- - C:\Windows\system32\icacls.exe
    icacls "c:\programdata\qhpxndiguijf" /deny "*S-1-5-32-544":(OI)(CI)(F)
    3⤵
    - Modifies file permissions
    PID:5992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "c:\programdata\jbteoxfgouip" /deny "*S-1-5-32-544":(OI)(CI)(F)
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2076
- - C:\Windows\system32\icacls.exe
    icacls "c:\programdata\jbteoxfgouip" /deny "*S-1-5-32-544":(OI)(CI)(F)
    3⤵
    - Modifies file permissions
    PID:2800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "c:\programdata\dnbelrbqlcud" /deny "*S-1-5-32-544":(OI)(CI)(F)
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5680
- - C:\Windows\system32\icacls.exe
    icacls "c:\programdata\dnbelrbqlcud" /deny "*S-1-5-32-544":(OI)(CI)(F)
    3⤵
    - Modifies file permissions
    PID:3700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "c:\programdata\yzksdkbakpnl" /deny "*S-1-5-32-544":(OI)(CI)(F)
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1328
- - C:\Windows\system32\icacls.exe
    icacls "c:\programdata\yzksdkbakpnl" /deny "*S-1-5-32-544":(OI)(CI)(F)
    3⤵
    - Modifies file permissions
    PID:3496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "c:\programdata\vgodrqhybann" /deny "*S-1-5-32-544":(OI)(CI)(F)
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:828
- - C:\Windows\system32\icacls.exe
    icacls "c:\programdata\vgodrqhybann" /deny "*S-1-5-32-544":(OI)(CI)(F)
    3⤵
    - Modifies file permissions
    PID:2160
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "c:\programdata\txcxjqisprgo" /deny "*S-1-5-32-544":(OI)(CI)(F)
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3580
- - C:\Windows\system32\icacls.exe
    icacls "c:\programdata\txcxjqisprgo" /deny "*S-1-5-32-544":(OI)(CI)(F)
    3⤵
    - Modifies file permissions
    PID:264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "c:\programdata\knifdidgrtye" /deny "*S-1-5-32-544":(OI)(CI)(F)
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:124
- - C:\Windows\system32\icacls.exe
    icacls "c:\programdata\knifdidgrtye" /deny "*S-1-5-32-544":(OI)(CI)(F)
    3⤵
    - Modifies file permissions
    PID:4844
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "c:\programdata\bfdbhehxpjxd" /deny "*S-1-5-32-544":(OI)(CI)(F)
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5460
- - C:\Windows\system32\icacls.exe
    icacls "c:\programdata\bfdbhehxpjxd" /deny "*S-1-5-32-544":(OI)(CI)(F)
    3⤵
    - Modifies file permissions
    PID:4176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "c:\programdata\oaocofwmfjha" /deny "*S-1-5-32-544":(OI)(CI)(F)
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4284
- - C:\Windows\system32\icacls.exe
    icacls "c:\programdata\oaocofwmfjha" /deny "*S-1-5-32-544":(OI)(CI)(F)
    3⤵
    - Modifies file permissions
    PID:4084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "c:\programdata\deafrqsiaenk" /deny "*S-1-5-32-544":(OI)(CI)(F)
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4432
- - C:\Windows\system32\icacls.exe
    icacls "c:\programdata\deafrqsiaenk" /deny "*S-1-5-32-544":(OI)(CI)(F)
    3⤵
    - Modifies file permissions
    PID:2368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "c:\programdata\nalfdgwigwyg" /deny "*S-1-5-32-544":(OI)(CI)(F)
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2384
- - C:\Windows\system32\icacls.exe
    icacls "c:\programdata\nalfdgwigwyg" /deny "*S-1-5-32-544":(OI)(CI)(F)
    3⤵
    - Modifies file permissions
    PID:4948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "c:\windows\system32\wsvcz" /deny "*S-1-5-32-544":(OI)(CI)(F)
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5404
- - C:\Windows\system32\icacls.exe
    icacls "c:\windows\system32\wsvcz" /deny "*S-1-5-32-544":(OI)(CI)(F)
    3⤵
    - Modifies file permissions
    PID:5556
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "C:\Program Files\Google\Chrome\updater.exe" /deny "*S-1-5-32-544":(F)
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4264
- - C:\Windows\system32\icacls.exe
    icacls "C:\Program Files\Google\Chrome\updater.exe" /deny "*S-1-5-32-544":(F)
    3⤵
    - Modifies file permissions
    PID:4696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c icacls "C:\ProgramData\Google\Chrome\updater.exe" /deny "*S-1-5-32-544":(F)
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4140
- - C:\Windows\system32\icacls.exe
    icacls "C:\ProgramData\Google\Chrome\updater.exe" /deny "*S-1-5-32-544":(F)
    3⤵
    - Modifies file permissions
    PID:3132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Debugger Evasion

T1622

File and Directory Permissions Modification

T1222

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Debugger Evasion

T1622

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bip39.txt

Path C:\ProgramData\Setup\bip39.txt
Size 14KB
SHA256 d2bd2aeb50ac5df60c1eb10afcec2b680d5a8a9f2bbc74a15c45bf3525528334
MD5 51ca2264f5b3ad532a4d6dae175e1750
SHA1 3dc996beb38928c70fca66658c46b00092ae6532
SHA512 6c169854acd97daf85ebfbefb78ae9b1ce249e8c6a79c7eaa42bcf6c546e6e14bae25bbe989b2e2d07d9ba92a69908b320534b0b97e5ba305bd783273e8d1e55
SSDEEP 384:p05yXB6/x5qa8cmytcR8D6a0meg4bkTc3Nx:p05Vx5qa/mytcR8D6Geg4bkT2
TLSH
T1D462843E928290DA9EAE6BC5C0043097F22D50525F47350966CB6AED304EE7CFB09F72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4128-35-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp

Download

memory/4128-36-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp

Download

memory/4128-4-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp

Download

memory/4128-5-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp

Download

memory/4128-6-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp

Download

memory/4128-7-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp

Download

memory/4128-8-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp

Download

memory/4128-2-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp

Download

memory/4128-15-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp

Download

memory/4128-37-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp

Download

memory/4128-1-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp

Download

memory/4128-28-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp

Download

memory/4128-29-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp

Download

memory/4128-30-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp

Download

memory/4128-31-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp

Download

memory/4128-32-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp

Download

memory/4128-33-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp

Download

memory/4128-34-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp

Download

memory/4128-3-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp

Download

memory/4128-0-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp

Download

memory/4128-16-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp

Download

memory/4128-38-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp

Download

memory/4128-39-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp

Download

memory/4128-40-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp

Download

memory/4128-41-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp

Download

memory/4128-42-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp

Download

memory/4128-43-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp

Download

memory/4128-44-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp

Download

memory/4128-45-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp

Download

memory/4128-46-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp

Download

memory/4128-47-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp

Download

memory/4128-48-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp

Download

memory/4128-49-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp

Download

memory/4128-50-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp

Download

memory/4128-51-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp

Download

memory/4128-52-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp

Download

memory/4128-53-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp

Download

memory/4128-54-0x00007FF7F98A0000-0x00007FF7FB1DE000-memory.dmp

Download