0516f838fb75e5d6c51b13c51046c9755ac11ef82ad6baf3cd8b8af685a1ba59

Analysis

max time kernel
899s
max time network
901s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/11/2026, 19:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Client.exe
Size 9.2MB
Sample261110-xpcqaacz4w
SHA256 0516f838fb75e5d6c51b13c51046c9755ac11ef82ad6baf3cd8b8af685a1ba59
MD5 9d2413ec3c83dead047a40b1430cca98
SHA1 79ac0ae265437b554b4aaaadb66c1fa738cf8702
SHA512 c5757b61d50eb736e43b459c715c5cee078dcfab32d1f1e4c2c5b1720e53600f7b2609e2c25b5b235a9c8cc60c8193d79486cf0b53e25ed913e31efd1f40de6a
SSDEEP 196608:NFjcCiso0nuzjGbYjdp2xghHZgbcIp5BgZZGlV31UVIfyV0d6S9:NFjcfsYRp2xgh5gnMZGlV3WN0H
TLSH
T17BA612134B4E325B134AF711AC90D4F8AC4D36866AC431F6A453E31DDC262D6E6B8DEB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

adware defense_evasion discovery execution persistence ransomware spyware

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 15 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	app.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo	app.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	app.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	app.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService	app.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	SecurityHealthService.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	app.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__	app.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	app.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	SecurityHealthService.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 3 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	app.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Looks for VMWare Tools registry key 2 TTPs 3 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	app.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	SecurityHealthService.exe

Looks for VMWare services registry key. 1 TTPs 15 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	app.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMMEMCTL	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmmouse	app.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmtools	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmmouse	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmx86	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmtools	app.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMMEMCTL	app.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMMEMCTL	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmtools	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmx86	app.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmci	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmmouse	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmx86	SecurityHealthService.exe

Executes a file named after a Windows system binary 1 TTPs 2 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\SecurityHealthService.exe	SecurityHealthService.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\SecurityHealthService.exe	SecurityHealthService.exe

Executes dropped EXE 3 IoCs

pid	Process
4844	app.exe
6056	SecurityHealthService.exe
1508	SecurityHealthService.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthService = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\SecurityHealthService.exe"	app.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppReadinessService = "wscript.exe //B //Nologo \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\AppReadiness\\AppReadinessService.vbs\""	app.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthService = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\SecurityHealthService.exe"	SecurityHealthService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppReadinessService = "wscript.exe //B //Nologo \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\AppReadiness\\AppReadinessService.vbs\""	SecurityHealthService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\SecurityHealthService = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\SecurityHealthService.exe"	SecurityHealthService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Windows\CurrentVersion\Run\AppReadinessService = "wscript.exe //B //Nologo \"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\AppReadiness\\AppReadinessService.vbs\""	SecurityHealthService.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
5332	wscript.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 64 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
4844	app.exe
4844	app.exe
4844	app.exe
4844	app.exe
6056	SecurityHealthService.exe
1508	SecurityHealthService.exe
6056	SecurityHealthService.exe
6056	SecurityHealthService.exe
6056	SecurityHealthService.exe
1508	SecurityHealthService.exe
1508	SecurityHealthService.exe
1508	SecurityHealthService.exe
4844	app.exe
6056	SecurityHealthService.exe
4844	app.exe
1508	SecurityHealthService.exe
6056	SecurityHealthService.exe
1508	SecurityHealthService.exe
4844	app.exe
4844	app.exe
6056	SecurityHealthService.exe
1508	SecurityHealthService.exe
6056	SecurityHealthService.exe
6056	SecurityHealthService.exe
1508	SecurityHealthService.exe
1508	SecurityHealthService.exe
4844	app.exe
4844	app.exe
6056	SecurityHealthService.exe
1508	SecurityHealthService.exe
6056	SecurityHealthService.exe
4844	app.exe
4844	app.exe
4844	app.exe
1508	SecurityHealthService.exe
6056	SecurityHealthService.exe
1508	SecurityHealthService.exe
6056	SecurityHealthService.exe
6056	SecurityHealthService.exe
1508	SecurityHealthService.exe
1508	SecurityHealthService.exe
4844	app.exe
4844	app.exe
1508	SecurityHealthService.exe
1508	SecurityHealthService.exe
6056	SecurityHealthService.exe
4844	app.exe
4844	app.exe
1508	SecurityHealthService.exe
6056	SecurityHealthService.exe
1508	SecurityHealthService.exe
6056	SecurityHealthService.exe
4844	app.exe
1508	SecurityHealthService.exe
6056	SecurityHealthService.exe
4844	app.exe
4844	app.exe
6056	SecurityHealthService.exe
6056	SecurityHealthService.exe
1508	SecurityHealthService.exe
4844	app.exe
6056	SecurityHealthService.exe
1508	SecurityHealthService.exe
4844	app.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SecurityHealthService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SecurityHealthService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	app.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	app.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SecurityHealthService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SecurityHealthService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wscript.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SecurityHealthService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\BIOS	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\BIOS	SecurityHealthService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	app.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\BIOS	app.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	SecurityHealthService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	app.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SecurityHealthService.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies registry class 38 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-560646293-820748483-2532804640-1000\{D5632BA0-7D1D-41DD-833D-D81F573A6C72}	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-560646293-820748483-2532804640-1000\{7D9FBECE-2A76-4B1E-B676-37C6F968E684}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4864	schtasks.exe
352	schtasks.exe
2836	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4844	app.exe
4844	app.exe
4844	app.exe
4844	app.exe
4844	app.exe
4844	app.exe
4844	app.exe
4844	app.exe
6056	SecurityHealthService.exe
6056	SecurityHealthService.exe
1508	SecurityHealthService.exe
1508	SecurityHealthService.exe
6056	SecurityHealthService.exe
6056	SecurityHealthService.exe
6056	SecurityHealthService.exe
6056	SecurityHealthService.exe
1508	SecurityHealthService.exe
1508	SecurityHealthService.exe
1508	SecurityHealthService.exe
1508	SecurityHealthService.exe
6056	SecurityHealthService.exe
6056	SecurityHealthService.exe
1508	SecurityHealthService.exe
1508	SecurityHealthService.exe
6056	SecurityHealthService.exe
6056	SecurityHealthService.exe
4844	app.exe
4844	app.exe
6056	SecurityHealthService.exe
6056	SecurityHealthService.exe
1508	SecurityHealthService.exe
1508	SecurityHealthService.exe
1508	SecurityHealthService.exe
1508	SecurityHealthService.exe
4844	app.exe
4844	app.exe
1508	SecurityHealthService.exe
1508	SecurityHealthService.exe
6056	SecurityHealthService.exe
6056	SecurityHealthService.exe
6056	SecurityHealthService.exe
6056	SecurityHealthService.exe
4844	app.exe
4844	app.exe
4844	app.exe
4844	app.exe
4844	app.exe
4844	app.exe
1508	SecurityHealthService.exe
1508	SecurityHealthService.exe
6056	SecurityHealthService.exe
6056	SecurityHealthService.exe
4844	app.exe
4844	app.exe
6056	SecurityHealthService.exe
6056	SecurityHealthService.exe
4844	app.exe
4844	app.exe
1508	SecurityHealthService.exe
1508	SecurityHealthService.exe
6056	SecurityHealthService.exe
6056	SecurityHealthService.exe
6056	SecurityHealthService.exe
6056	SecurityHealthService.exe

Suspicious use of AdjustPrivilegeToken 53 IoCs

description	pid	Process
Token: SeDebugPrivilege	4844	app.exe
Token: SeDebugPrivilege	6056	SecurityHealthService.exe
Token: SeDebugPrivilege	1508	SecurityHealthService.exe
Token: SeShutdownPrivilege	444	explorer.exe
Token: SeCreatePagefilePrivilege	444	explorer.exe
Token: SeShutdownPrivilege	444	explorer.exe
Token: SeCreatePagefilePrivilege	444	explorer.exe
Token: SeShutdownPrivilege	444	explorer.exe
Token: SeCreatePagefilePrivilege	444	explorer.exe
Token: SeShutdownPrivilege	444	explorer.exe
Token: SeCreatePagefilePrivilege	444	explorer.exe
Token: SeShutdownPrivilege	444	explorer.exe
Token: SeCreatePagefilePrivilege	444	explorer.exe
Token: SeShutdownPrivilege	444	explorer.exe
Token: SeCreatePagefilePrivilege	444	explorer.exe
Token: SeShutdownPrivilege	444	explorer.exe
Token: SeCreatePagefilePrivilege	444	explorer.exe
Token: SeShutdownPrivilege	444	explorer.exe
Token: SeCreatePagefilePrivilege	444	explorer.exe
Token: SeShutdownPrivilege	444	explorer.exe
Token: SeCreatePagefilePrivilege	444	explorer.exe
Token: SeShutdownPrivilege	444	explorer.exe
Token: SeCreatePagefilePrivilege	444	explorer.exe
Token: SeShutdownPrivilege	444	explorer.exe
Token: SeCreatePagefilePrivilege	444	explorer.exe
Token: SeShutdownPrivilege	444	explorer.exe
Token: SeCreatePagefilePrivilege	444	explorer.exe
Token: SeShutdownPrivilege	444	explorer.exe
Token: SeCreatePagefilePrivilege	444	explorer.exe
Token: SeShutdownPrivilege	444	explorer.exe
Token: SeCreatePagefilePrivilege	444	explorer.exe
Token: SeShutdownPrivilege	444	explorer.exe
Token: SeCreatePagefilePrivilege	444	explorer.exe
Token: SeShutdownPrivilege	444	explorer.exe
Token: SeCreatePagefilePrivilege	444	explorer.exe
Token: SeShutdownPrivilege	444	explorer.exe
Token: SeCreatePagefilePrivilege	444	explorer.exe
Token: SeShutdownPrivilege	444	explorer.exe
Token: SeCreatePagefilePrivilege	444	explorer.exe
Token: SeShutdownPrivilege	444	explorer.exe
Token: SeCreatePagefilePrivilege	444	explorer.exe
Token: SeShutdownPrivilege	444	explorer.exe
Token: SeCreatePagefilePrivilege	444	explorer.exe
Token: SeShutdownPrivilege	444	explorer.exe
Token: SeCreatePagefilePrivilege	444	explorer.exe
Token: SeShutdownPrivilege	444	explorer.exe
Token: SeCreatePagefilePrivilege	444	explorer.exe
Token: SeShutdownPrivilege	444	explorer.exe
Token: SeCreatePagefilePrivilege	444	explorer.exe
Token: SeShutdownPrivilege	444	explorer.exe
Token: SeCreatePagefilePrivilege	444	explorer.exe
Token: SeShutdownPrivilege	444	explorer.exe
Token: SeCreatePagefilePrivilege	444	explorer.exe

Suspicious use of FindShellTrayWindow 53 IoCs

pid	Process
4592	sihost.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe

Suspicious use of SendNotifyMessage 42 IoCs

pid	Process
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe
444	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3972	StartMenuExperienceHost.exe
3980	SearchHost.exe
444	explorer.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5796 wrote to memory of 4844	5796	Client.exe	89
PID 4844 wrote to memory of 4864	4844	app.exe	91
PID 4844 wrote to memory of 5332	4844	app.exe	93
PID 6056 wrote to memory of 352	6056	SecurityHealthService.exe	99
PID 1508 wrote to memory of 2836	1508	SecurityHealthService.exe	101
PID 4592 wrote to memory of 444	4592	sihost.exe	110

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Client.exe
"C:\Users\Admin\AppData\Local\Temp\Client.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5796
- C:\Users\Admin\AppData\Local\Temp\420727CE\app.exe
  "C:\Users\Admin\AppData\Local\Temp\420727CE\app.exe"
  2⤵
  - Enumerates VirtualBox registry keys
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Looks for VMWare services registry key.
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Reads the TCP/IP host and domain name from the registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4844
- - C:\Windows\SYSTEM32\schtasks.exe
    schtasks /Create /F /SC ONLOGON /TN "\Microsoft\Windows\Security\SecurityHealthService" /TR "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\SecurityHealthService.exe\"" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4864
- - C:\Windows\SYSTEM32\wscript.exe
    wscript.exe //B //Nologo "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AppReadiness\AppReadinessService.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    - Reads the TCP/IP host and domain name from the registry
    PID:5332

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\SecurityHealthService.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\SecurityHealthService.exe"
1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Reads the TCP/IP host and domain name from the registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1508
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Create /F /SC ONLOGON /TN "\Microsoft\Windows\Security\SecurityHealthService" /TR "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\SecurityHealthService.exe\"" /RL HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2836

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\SecurityHealthService.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\SecurityHealthService.exe
1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Looks for VMWare services registry key.
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Reads the TCP/IP host and domain name from the registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6056
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /Create /F /SC ONLOGON /TN "\Microsoft\Windows\Security\SecurityHealthService" /TR "\"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\SecurityHealthService.exe\"" /RL HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4620

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:444

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3980

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3972

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:1476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Debugger Evasion

T1622

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Debugger Evasion

T1622

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 595B
SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
MD5 4454c8e578515db43fadd90604ae7675
SHA1 3912ffa00c3a5c86fae6500a0074284d9f668976
SHA512 b17559d466cb6954554c4f879b396ff8431c730f837205547ab46329c6517cd35a719378efa55d78c01b739414dd320157f120feb12e28e1ae90ce7c53a0c75c
TLSH
T117F0DC47E7B15216C926123CC89724E1B730F5917DD1162341056F5D2C373101F17CB8
MD5 SHA1 SHA512 TLSH

Submit Download

app.exe

Path C:\Users\Admin\AppData\Local\Temp\420727CE\app.exe
Size 9.1MB
SHA256 677f57f18122373a989c907c7af06f052ac4d3db70669d6be7c3ecf38ee9fd8e
MD5 7b5ce8d78cbb35424c01e519d7dbad1a
SHA1 0125d53b6591d07806d182ad40a31f7bdd3c1df9
SHA512 5326669a6643f0b14ea610c9fe777b9182cd566c710b861dde468fbbd4d3885ede5eea216dad8807c405623c792a7a6211a5e167b1faf67faf977177727f263f
SSDEEP 98304:8SaeGoNTDOlBeg/UT4A3pmyhSRraGvmfe+4vTlTpWoPXYe+pBiIbt9L4Y+E23Ja8:8SNYmHYIfdeIvLRD2Zt
TLSH
T10BA65A27E1B710ECC56BC174826BA372BA31B85801347E7F5A54DBB02F61E605F6EB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppReadinessService.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AppReadiness\AppReadinessService.exe
Size 128KB
SHA256 8a07315346d5844bde287536561d4d6e1e93c182d1c40e388bfbbd9f576b1b76
MD5 0b70fed2dc1e852c321345080666af02
SHA1 2e3058cf7ec2ec3a212abb2d5b28a496b22b084d
SHA512 2e0a69fe31a23ae497c469e74acd09f2aafa19faeccba50945fd7a0ad56129b6044f672a90caccdd8a77fca44ad564033e4ea1b90383d136a96ae9bcd8a97dab
SSDEEP 3072:GMimfPHOzU2fAOxoPgSnjd2zxfWHnXRDVndl7Or:GMimXHV2fA6bSnj7XRXB+
TLSH
T10BD3C61BE27311ACC56BC038972BA672A97178594234BE7F4A50DB706FB1F71922CF24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppReadinessService.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AppReadiness\AppReadinessService.vbs
Size 1KB
SHA256 7957976040f8cf9913010fe1f06419ff71b7a26aaf8c69d7b1dfc264d32a90fd
MD5 a30b3d84d46dc5563f93551d2fe325c7
SHA1 adf9e590935fff9161388f95a3d960c5898b8bbc
SHA512 40b4bc69bdd1bb606b20bd306828fe0af223515d8e0bd8b4c6b39f0fcf4b4b95dccb8db8c6532a716d175ffccf668fdfacba57bfb227c4cb7984ed3e92b2512e
TLSH
T1E4213206E624CE35D471D85834B9F10ADC6615226632C1BAFC4C808DDF7037EE5540CB
MD5 SHA1 SHA512 TLSH

Submit Download

AppReadinessService.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AppReadiness\AppReadinessService.vbs
Size 1KB
SHA256 532d176ceeb5b9f45845fb650eea01caed94edd93f72c9a547d67dd4338c4fe7
MD5 edc6b8ab7bf2e16da919819dcc68a8fd
SHA1 0531224d0e556609bd790c99655df3e8d6938f89
SHA512 54c2a0053f5b7c22b3595f54002a607768b35abf054716e773cc29dc5ed22f0379acaf8d71885756bea48a4b95bbad8e94ed0048bea39515baf74be4b680af19
TLSH
T113211006E624CA35D471D85434B9F10ADC661522662685BBFD8C808DEF7037EE6540CB
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1508-33-0x00007FF678DA0000-0x00007FF6796CB000-memory.dmp

Download

memory/1508-66-0x00007FF678DA0000-0x00007FF6796CB000-memory.dmp

Download

memory/1508-84-0x00007FF678DA0000-0x00007FF6796CB000-memory.dmp

Download

memory/1508-81-0x00007FF678DA0000-0x00007FF6796CB000-memory.dmp

Download

memory/1508-30-0x00007FF678DA0000-0x00007FF6796CB000-memory.dmp

Download

memory/1508-78-0x00007FF678DA0000-0x00007FF6796CB000-memory.dmp

Download

memory/1508-75-0x00007FF678DA0000-0x00007FF6796CB000-memory.dmp

Download

memory/1508-48-0x00007FF678DA0000-0x00007FF6796CB000-memory.dmp

Download

memory/1508-72-0x00007FF678DA0000-0x00007FF6796CB000-memory.dmp

Download

memory/1508-69-0x00007FF678DA0000-0x00007FF6796CB000-memory.dmp

Download

memory/1508-36-0x00007FF678DA0000-0x00007FF6796CB000-memory.dmp

Download

memory/1508-27-0x00007FF678DA0000-0x00007FF6796CB000-memory.dmp

Download

memory/1508-63-0x00007FF678DA0000-0x00007FF6796CB000-memory.dmp

Download

memory/1508-39-0x00007FF678DA0000-0x00007FF6796CB000-memory.dmp

Download

memory/1508-60-0x00007FF678DA0000-0x00007FF6796CB000-memory.dmp

Download

memory/1508-57-0x00007FF678DA0000-0x00007FF6796CB000-memory.dmp

Download

memory/1508-42-0x00007FF678DA0000-0x00007FF6796CB000-memory.dmp

Download

memory/1508-87-0x00007FF678DA0000-0x00007FF6796CB000-memory.dmp

Download

memory/1508-54-0x00007FF678DA0000-0x00007FF6796CB000-memory.dmp

Download

memory/1508-45-0x00007FF678DA0000-0x00007FF6796CB000-memory.dmp

Download

memory/1508-51-0x00007FF678DA0000-0x00007FF6796CB000-memory.dmp

Download

memory/4844-56-0x00007FF7EAE90000-0x00007FF7EB7BB000-memory.dmp

Download

memory/4844-47-0x00007FF7EAE90000-0x00007FF7EB7BB000-memory.dmp

Download

memory/4844-68-0x00007FF7EAE90000-0x00007FF7EB7BB000-memory.dmp

Download

memory/4844-50-0x00007FF7EAE90000-0x00007FF7EB7BB000-memory.dmp

Download

memory/4844-26-0x00007FF7EAE90000-0x00007FF7EB7BB000-memory.dmp

Download

memory/4844-86-0x00007FF7EAE90000-0x00007FF7EB7BB000-memory.dmp

Download

memory/4844-53-0x00007FF7EAE90000-0x00007FF7EB7BB000-memory.dmp

Download

memory/4844-44-0x00007FF7EAE90000-0x00007FF7EB7BB000-memory.dmp

Download

memory/4844-83-0x00007FF7EAE90000-0x00007FF7EB7BB000-memory.dmp

Download

memory/4844-29-0x00007FF7EAE90000-0x00007FF7EB7BB000-memory.dmp

Download

memory/4844-41-0x00007FF7EAE90000-0x00007FF7EB7BB000-memory.dmp

Download

memory/4844-35-0x00007FF7EAE90000-0x00007FF7EB7BB000-memory.dmp

Download

memory/4844-59-0x00007FF7EAE90000-0x00007FF7EB7BB000-memory.dmp

Download

memory/4844-80-0x00007FF7EAE90000-0x00007FF7EB7BB000-memory.dmp

Download

memory/4844-77-0x00007FF7EAE90000-0x00007FF7EB7BB000-memory.dmp

Download

memory/4844-62-0x00007FF7EAE90000-0x00007FF7EB7BB000-memory.dmp

Download

memory/4844-38-0x00007FF7EAE90000-0x00007FF7EB7BB000-memory.dmp

Download

memory/4844-32-0x00007FF7EAE90000-0x00007FF7EB7BB000-memory.dmp

Download

memory/4844-65-0x00007FF7EAE90000-0x00007FF7EB7BB000-memory.dmp

Download

memory/4844-74-0x00007FF7EAE90000-0x00007FF7EB7BB000-memory.dmp

Download

memory/4844-71-0x00007FF7EAE90000-0x00007FF7EB7BB000-memory.dmp

Download

memory/5796-3-0x00007FF713340000-0x00007FF713C64000-memory.dmp

Download

memory/6056-58-0x00007FF678DA0000-0x00007FF6796CB000-memory.dmp

Download

memory/6056-70-0x00007FF678DA0000-0x00007FF6796CB000-memory.dmp

Download

memory/6056-67-0x00007FF678DA0000-0x00007FF6796CB000-memory.dmp

Download

memory/6056-34-0x00007FF678DA0000-0x00007FF6796CB000-memory.dmp

Download

memory/6056-73-0x00007FF678DA0000-0x00007FF6796CB000-memory.dmp

Download

memory/6056-37-0x00007FF678DA0000-0x00007FF6796CB000-memory.dmp

Download

memory/6056-64-0x00007FF678DA0000-0x00007FF6796CB000-memory.dmp

Download

memory/6056-76-0x00007FF678DA0000-0x00007FF6796CB000-memory.dmp

Download

memory/6056-61-0x00007FF678DA0000-0x00007FF6796CB000-memory.dmp

Download

memory/6056-31-0x00007FF678DA0000-0x00007FF6796CB000-memory.dmp

Download

memory/6056-79-0x00007FF678DA0000-0x00007FF6796CB000-memory.dmp

Download

memory/6056-40-0x00007FF678DA0000-0x00007FF6796CB000-memory.dmp

Download

memory/6056-43-0x00007FF678DA0000-0x00007FF6796CB000-memory.dmp

Download

memory/6056-82-0x00007FF678DA0000-0x00007FF6796CB000-memory.dmp

Download

memory/6056-55-0x00007FF678DA0000-0x00007FF6796CB000-memory.dmp

Download

memory/6056-28-0x00007FF678DA0000-0x00007FF6796CB000-memory.dmp

Download

memory/6056-85-0x00007FF678DA0000-0x00007FF6796CB000-memory.dmp

Download

memory/6056-52-0x00007FF678DA0000-0x00007FF6796CB000-memory.dmp

Download

memory/6056-46-0x00007FF678DA0000-0x00007FF6796CB000-memory.dmp

Download

memory/6056-88-0x00007FF678DA0000-0x00007FF6796CB000-memory.dmp

Download

memory/6056-49-0x00007FF678DA0000-0x00007FF6796CB000-memory.dmp

Download