Analysis

  • max time kernel
    150s
  • max time network
    141s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    31/10/2022, 22:05

General

  • Target

    file.exe

  • Size

    7.3MB

  • MD5

    a75ccd9681b2073ff1bf782d3a285592

  • SHA1

    0cc720ea0d98bccc8a3807f9288e2bd05fc815fb

  • SHA256

    7c74576432c1d96de5ab6f00f0027b2e4565743dc1362423e5370a5fc56ee191

  • SHA512

    9e6d5ca17bf4916f7bd05b2e3709b1d58a728f33ae27de335cd979795507f9b5746b42fbef52149868a53ecd438a270c638bfbd2e1bf6ab37203478b49e9708f

  • SSDEEP

    196608:91O1gxD17+PqlqyIIZH9MjTCuFwwO125FdW0:3O1iD1a2ZdMjTCYusFdn

Score
10/10

Malware Config

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs
  • Windows security bypass 2 TTPs 34 IoCs
  • Executes dropped EXE 3 IoCs
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Loads dropped DLL 8 IoCs
  • Drops file in System32 directory 7 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies data under HKEY_USERS 9 IoCs
  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1380
    • C:\Users\Admin\AppData\Local\Temp\7zS166E.tmp\Install.exe
      .\Install.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:824
      • C:\Users\Admin\AppData\Local\Temp\7zS254D.tmp\Install.exe
        .\Install.exe /S /site_id "525403"
        3⤵
        • Executes dropped EXE
        • Checks BIOS information in registry
        • Loads dropped DLL
        • Drops file in System32 directory
        • Enumerates system info in registry
        • Suspicious use of WriteProcessMemory
        PID:936
        • C:\Windows\SysWOW64\forfiles.exe
          "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2028
          • C:\Windows\SysWOW64\cmd.exe
            /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1376
            • \??\c:\windows\SysWOW64\reg.exe
              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
              6⤵
                PID:288
              • \??\c:\windows\SysWOW64\reg.exe
                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
                6⤵
                  PID:1580
            • C:\Windows\SysWOW64\forfiles.exe
              "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:1328
              • C:\Windows\SysWOW64\cmd.exe
                /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:1440
                • \??\c:\windows\SysWOW64\reg.exe
                  REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
                  6⤵
                    PID:960
                  • \??\c:\windows\SysWOW64\reg.exe
                    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
                    6⤵
                      PID:592
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /CREATE /TN "gEhzvxrPb" /SC once /ST 09:41:20 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                  4⤵
                  • Creates scheduled task(s)
                  PID:780
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /run /I /tn "gEhzvxrPb"
                  4⤵
                    PID:1600
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /DELETE /F /TN "gEhzvxrPb"
                    4⤵
                      PID:848
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /CREATE /TN "bWLKrWFeqGsUKIPSIT" /SC once /ST 22:07:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\aFevMsDBlqIRbqTyh\IZVHwqqvKwOqTrb\rdCtdiR.exe\" KP /site_id 525403 /S" /V1 /F
                      4⤵
                      • Drops file in Windows directory
                      • Creates scheduled task(s)
                      PID:1956
              • C:\Windows\system32\taskeng.exe
                taskeng.exe {9A6228B2-40B6-4D89-A88A-102951D5FBBE} S-1-5-21-4063495947-34355257-727531523-1000:RYNKSFQE\Admin:Interactive:[1]
                1⤵
                  PID:524
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                    2⤵
                    • Drops file in System32 directory
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:396
                    • C:\Windows\system32\gpupdate.exe
                      "C:\Windows\system32\gpupdate.exe" /force
                      3⤵
                        PID:964
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                      2⤵
                      • Drops file in System32 directory
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:780
                      • C:\Windows\system32\gpupdate.exe
                        "C:\Windows\system32\gpupdate.exe" /force
                        3⤵
                          PID:1276
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                        2⤵
                        • Drops file in System32 directory
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:2040
                        • C:\Windows\system32\gpupdate.exe
                          "C:\Windows\system32\gpupdate.exe" /force
                          3⤵
                            PID:1092
                      • C:\Windows\system32\gpscript.exe
                        gpscript.exe /RefreshSystemParam
                        1⤵
                          PID:1124
                        • C:\Windows\system32\taskeng.exe
                          taskeng.exe {1B3DA9EC-DE32-43E4-AFF8-296227E6196C} S-1-5-18:NT AUTHORITY\System:Service:
                          1⤵
                            PID:1596
                            • C:\Users\Admin\AppData\Local\Temp\aFevMsDBlqIRbqTyh\IZVHwqqvKwOqTrb\rdCtdiR.exe
                              C:\Users\Admin\AppData\Local\Temp\aFevMsDBlqIRbqTyh\IZVHwqqvKwOqTrb\rdCtdiR.exe KP /site_id 525403 /S
                              2⤵
                              • Executes dropped EXE
                              • Drops file in System32 directory
                              PID:852
                              • C:\Windows\SysWOW64\schtasks.exe
                                schtasks /CREATE /TN "gLdoXkBXq" /SC once /ST 17:46:01 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                3⤵
                                • Creates scheduled task(s)
                                PID:1728
                              • C:\Windows\SysWOW64\schtasks.exe
                                schtasks /run /I /tn "gLdoXkBXq"
                                3⤵
                                  PID:880
                                • C:\Windows\SysWOW64\schtasks.exe
                                  schtasks /DELETE /F /TN "gLdoXkBXq"
                                  3⤵
                                    PID:1136
                                  • C:\Windows\SysWOW64\cmd.exe
                                    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
                                    3⤵
                                      PID:1780
                                      • C:\Windows\SysWOW64\reg.exe
                                        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
                                        4⤵
                                        • Modifies Windows Defender Real-time Protection settings
                                        PID:2032
                                    • C:\Windows\SysWOW64\cmd.exe
                                      cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
                                      3⤵
                                        PID:1956
                                        • C:\Windows\SysWOW64\reg.exe
                                          REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
                                          4⤵
                                          • Modifies Windows Defender Real-time Protection settings
                                          PID:1696
                                      • C:\Windows\SysWOW64\schtasks.exe
                                        schtasks /CREATE /TN "gPZLeWFxT" /SC once /ST 01:42:36 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                        3⤵
                                        • Creates scheduled task(s)
                                        PID:2008
                                      • C:\Windows\SysWOW64\schtasks.exe
                                        schtasks /run /I /tn "gPZLeWFxT"
                                        3⤵
                                          PID:820
                                        • C:\Windows\SysWOW64\schtasks.exe
                                          schtasks /DELETE /F /TN "gPZLeWFxT"
                                          3⤵
                                            PID:912
                                          • C:\Windows\SysWOW64\cmd.exe
                                            cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\grMXAHIUMHIHAuvw" /t REG_DWORD /d 0 /reg:32
                                            3⤵
                                              PID:1916
                                              • C:\Windows\SysWOW64\reg.exe
                                                REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\grMXAHIUMHIHAuvw" /t REG_DWORD /d 0 /reg:32
                                                4⤵
                                                • Windows security bypass
                                                PID:1620
                                            • C:\Windows\SysWOW64\cmd.exe
                                              cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\grMXAHIUMHIHAuvw" /t REG_DWORD /d 0 /reg:64
                                              3⤵
                                                PID:992
                                                • C:\Windows\SysWOW64\reg.exe
                                                  REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\grMXAHIUMHIHAuvw" /t REG_DWORD /d 0 /reg:64
                                                  4⤵
                                                  • Windows security bypass
                                                  PID:1368
                                              • C:\Windows\SysWOW64\cmd.exe
                                                cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\grMXAHIUMHIHAuvw" /t REG_DWORD /d 0 /reg:32
                                                3⤵
                                                  PID:1948
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\grMXAHIUMHIHAuvw" /t REG_DWORD /d 0 /reg:32
                                                    4⤵
                                                      PID:1276
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\grMXAHIUMHIHAuvw" /t REG_DWORD /d 0 /reg:64
                                                    3⤵
                                                      PID:1768
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\grMXAHIUMHIHAuvw" /t REG_DWORD /d 0 /reg:64
                                                        4⤵
                                                          PID:700
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        cmd /C copy nul "C:\Windows\Temp\grMXAHIUMHIHAuvw\tlGPTreK\nLZuwYiwYzzlmmqI.wsf"
                                                        3⤵
                                                          PID:548
                                                        • C:\Windows\SysWOW64\wscript.exe
                                                          wscript "C:\Windows\Temp\grMXAHIUMHIHAuvw\tlGPTreK\nLZuwYiwYzzlmmqI.wsf"
                                                          3⤵
                                                          • Modifies data under HKEY_USERS
                                                          PID:1780
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\SvbbHukzU" /t REG_DWORD /d 0 /reg:32
                                                            4⤵
                                                            • Windows security bypass
                                                            PID:1188
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\SvbbHukzU" /t REG_DWORD /d 0 /reg:64
                                                            4⤵
                                                            • Windows security bypass
                                                            PID:544
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\XYDCXZXPsTrrC" /t REG_DWORD /d 0 /reg:32
                                                            4⤵
                                                            • Windows security bypass
                                                            PID:1056
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\XYDCXZXPsTrrC" /t REG_DWORD /d 0 /reg:64
                                                            4⤵
                                                            • Windows security bypass
                                                            PID:1440
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dVbwgRbTSJJLORWiduR" /t REG_DWORD /d 0 /reg:32
                                                            4⤵
                                                            • Windows security bypass
                                                            PID:1376
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dVbwgRbTSJJLORWiduR" /t REG_DWORD /d 0 /reg:64
                                                            4⤵
                                                            • Windows security bypass
                                                            PID:2040
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nolBHjueEzUn" /t REG_DWORD /d 0 /reg:32
                                                            4⤵
                                                            • Windows security bypass
                                                            PID:1124
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nolBHjueEzUn" /t REG_DWORD /d 0 /reg:64
                                                            4⤵
                                                            • Windows security bypass
                                                            PID:1908
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yOvDRBMJNKKU2" /t REG_DWORD /d 0 /reg:32
                                                            4⤵
                                                            • Windows security bypass
                                                            PID:1652
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yOvDRBMJNKKU2" /t REG_DWORD /d 0 /reg:64
                                                            4⤵
                                                            • Windows security bypass
                                                            PID:1700
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\YVKeAuHUOaLCRzVB" /t REG_DWORD /d 0 /reg:32
                                                            4⤵
                                                            • Windows security bypass
                                                            PID:1972
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\YVKeAuHUOaLCRzVB" /t REG_DWORD /d 0 /reg:64
                                                            4⤵
                                                            • Windows security bypass
                                                            PID:1472
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\aFevMsDBlqIRbqTyh" /t REG_DWORD /d 0 /reg:32
                                                            4⤵
                                                            • Windows security bypass
                                                            PID:1648
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\aFevMsDBlqIRbqTyh" /t REG_DWORD /d 0 /reg:64
                                                            4⤵
                                                            • Windows security bypass
                                                            PID:812
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\grMXAHIUMHIHAuvw" /t REG_DWORD /d 0 /reg:32
                                                            4⤵
                                                            • Windows security bypass
                                                            PID:276
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\grMXAHIUMHIHAuvw" /t REG_DWORD /d 0 /reg:64
                                                            4⤵
                                                              PID:1720
                                                      • C:\Windows\system32\gpscript.exe
                                                        gpscript.exe /RefreshSystemParam
                                                        1⤵
                                                          PID:1624
                                                        • C:\Windows\system32\gpscript.exe
                                                          gpscript.exe /RefreshSystemParam
                                                          1⤵
                                                            PID:1340

                                                          Network

                                                                MITRE ATT&CK Enterprise v6

                                                                Replay Monitor

                                                                Loading Replay Monitor...

                                                                Downloads

                                                                • C:\Users\Admin\AppData\Local\Temp\7zS166E.tmp\Install.exe

                                                                  Filesize

                                                                  6.3MB

                                                                  MD5

                                                                  bd35df49cacc0d3f9c3db5d688438580

                                                                  SHA1

                                                                  364ac175e546fe6db9d7b07f52b1901b3b8f0ee8

                                                                  SHA256

                                                                  d5030b6c215b8e54b9dcc25a3da215475abfd4323d8cbb8bc9912d363f4f6b63

                                                                  SHA512

                                                                  7f62e948af40698e4859aa2e10735a02f8cb7df6810594cada99549db0f6f119feed99960e1b2990ac70197d712486e3c70c6947c8b8ba293ea83a657a06c901

                                                                • C:\Users\Admin\AppData\Local\Temp\7zS166E.tmp\Install.exe

                                                                  Filesize

                                                                  6.3MB

                                                                  MD5

                                                                  bd35df49cacc0d3f9c3db5d688438580

                                                                  SHA1

                                                                  364ac175e546fe6db9d7b07f52b1901b3b8f0ee8

                                                                  SHA256

                                                                  d5030b6c215b8e54b9dcc25a3da215475abfd4323d8cbb8bc9912d363f4f6b63

                                                                  SHA512

                                                                  7f62e948af40698e4859aa2e10735a02f8cb7df6810594cada99549db0f6f119feed99960e1b2990ac70197d712486e3c70c6947c8b8ba293ea83a657a06c901

                                                                • C:\Users\Admin\AppData\Local\Temp\7zS254D.tmp\Install.exe

                                                                  Filesize

                                                                  6.8MB

                                                                  MD5

                                                                  6772e7af138504e782c6e77d79080a21

                                                                  SHA1

                                                                  f1d34996df460e49dad43a5e14c27d01db59c2a4

                                                                  SHA256

                                                                  4ad4db7017f6c5f587cac7c735c91e20a879ad6aa7c6f3a2188cb8ec173a797d

                                                                  SHA512

                                                                  07b6119f299b3d396395b249526d3564b58d553e7889659988233260f04b8a425b07762761e9e9631ad3bd06f2ed0688623cc1342a497f60b02ddd3394489180

                                                                • C:\Users\Admin\AppData\Local\Temp\7zS254D.tmp\Install.exe

                                                                  Filesize

                                                                  6.8MB

                                                                  MD5

                                                                  6772e7af138504e782c6e77d79080a21

                                                                  SHA1

                                                                  f1d34996df460e49dad43a5e14c27d01db59c2a4

                                                                  SHA256

                                                                  4ad4db7017f6c5f587cac7c735c91e20a879ad6aa7c6f3a2188cb8ec173a797d

                                                                  SHA512

                                                                  07b6119f299b3d396395b249526d3564b58d553e7889659988233260f04b8a425b07762761e9e9631ad3bd06f2ed0688623cc1342a497f60b02ddd3394489180

                                                                • C:\Users\Admin\AppData\Local\Temp\aFevMsDBlqIRbqTyh\IZVHwqqvKwOqTrb\rdCtdiR.exe

                                                                  Filesize

                                                                  6.8MB

                                                                  MD5

                                                                  6772e7af138504e782c6e77d79080a21

                                                                  SHA1

                                                                  f1d34996df460e49dad43a5e14c27d01db59c2a4

                                                                  SHA256

                                                                  4ad4db7017f6c5f587cac7c735c91e20a879ad6aa7c6f3a2188cb8ec173a797d

                                                                  SHA512

                                                                  07b6119f299b3d396395b249526d3564b58d553e7889659988233260f04b8a425b07762761e9e9631ad3bd06f2ed0688623cc1342a497f60b02ddd3394489180

                                                                • C:\Users\Admin\AppData\Local\Temp\aFevMsDBlqIRbqTyh\IZVHwqqvKwOqTrb\rdCtdiR.exe

                                                                  Filesize

                                                                  6.8MB

                                                                  MD5

                                                                  6772e7af138504e782c6e77d79080a21

                                                                  SHA1

                                                                  f1d34996df460e49dad43a5e14c27d01db59c2a4

                                                                  SHA256

                                                                  4ad4db7017f6c5f587cac7c735c91e20a879ad6aa7c6f3a2188cb8ec173a797d

                                                                  SHA512

                                                                  07b6119f299b3d396395b249526d3564b58d553e7889659988233260f04b8a425b07762761e9e9631ad3bd06f2ed0688623cc1342a497f60b02ddd3394489180

                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                                                  Filesize

                                                                  7KB

                                                                  MD5

                                                                  9c77d8d247582bde507e5eda19a4c85b

                                                                  SHA1

                                                                  15d02d823170cd49647e30d7c2ed0750d02eda6a

                                                                  SHA256

                                                                  b44cdeea23015a0120aa1880f81f24fc64edcd841d49dbe112739e3b6d52c482

                                                                  SHA512

                                                                  52acb02f85ae54e28905aab40981f18d1948d3ba8467bf4d39c9963414b7547529abf7753cb31fabeb8c8126f6ceea4eb4fde4f3a3838dd7284b381cf21dcba1

                                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                                                  Filesize

                                                                  7KB

                                                                  MD5

                                                                  e4e81e7383459810e5f9e82ddcca41bc

                                                                  SHA1

                                                                  b000cad6a086d689094a8c868399e1cff283b5e5

                                                                  SHA256

                                                                  6ea7933650b6818d2994dcd12103b1e908b8bd9c60f9add973ad1cdc8e31deb7

                                                                  SHA512

                                                                  5847469a675bd63818ca9cc29690aac80b3324d86070b8cd48b79bc72dfccb3206c3285da9166b76958d0ed0f931e028bcea319d6c622f95787fcd50c2a58b6c

                                                                • C:\Windows\Temp\grMXAHIUMHIHAuvw\tlGPTreK\nLZuwYiwYzzlmmqI.wsf

                                                                  Filesize

                                                                  8KB

                                                                  MD5

                                                                  0b1e51c9a8b95b9209826b2be06ff26f

                                                                  SHA1

                                                                  986bea32d6107f964de3a5f8525ee4cb522780b8

                                                                  SHA256

                                                                  80a1b9947818cfece8b24e8458bff8f3a85feb235849315f21be745c2d24cf5b

                                                                  SHA512

                                                                  4d0600c981e1cce2479cd6e56025bae003a817fd0f5bda20a9f93b0846d94b269dbd319809ac125e71fdd116ff7ad576ddc7e6d5c197a0c4b3124297c2029e76

                                                                • C:\Windows\system32\GroupPolicy\gpt.ini

                                                                  Filesize

                                                                  268B

                                                                  MD5

                                                                  a62ce44a33f1c05fc2d340ea0ca118a4

                                                                  SHA1

                                                                  1f03eb4716015528f3de7f7674532c1345b2717d

                                                                  SHA256

                                                                  9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

                                                                  SHA512

                                                                  9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

                                                                • \Users\Admin\AppData\Local\Temp\7zS166E.tmp\Install.exe

                                                                  Filesize

                                                                  6.3MB

                                                                  MD5

                                                                  bd35df49cacc0d3f9c3db5d688438580

                                                                  SHA1

                                                                  364ac175e546fe6db9d7b07f52b1901b3b8f0ee8

                                                                  SHA256

                                                                  d5030b6c215b8e54b9dcc25a3da215475abfd4323d8cbb8bc9912d363f4f6b63

                                                                  SHA512

                                                                  7f62e948af40698e4859aa2e10735a02f8cb7df6810594cada99549db0f6f119feed99960e1b2990ac70197d712486e3c70c6947c8b8ba293ea83a657a06c901

                                                                • \Users\Admin\AppData\Local\Temp\7zS166E.tmp\Install.exe

                                                                  Filesize

                                                                  6.3MB

                                                                  MD5

                                                                  bd35df49cacc0d3f9c3db5d688438580

                                                                  SHA1

                                                                  364ac175e546fe6db9d7b07f52b1901b3b8f0ee8

                                                                  SHA256

                                                                  d5030b6c215b8e54b9dcc25a3da215475abfd4323d8cbb8bc9912d363f4f6b63

                                                                  SHA512

                                                                  7f62e948af40698e4859aa2e10735a02f8cb7df6810594cada99549db0f6f119feed99960e1b2990ac70197d712486e3c70c6947c8b8ba293ea83a657a06c901

                                                                • \Users\Admin\AppData\Local\Temp\7zS166E.tmp\Install.exe

                                                                  Filesize

                                                                  6.3MB

                                                                  MD5

                                                                  bd35df49cacc0d3f9c3db5d688438580

                                                                  SHA1

                                                                  364ac175e546fe6db9d7b07f52b1901b3b8f0ee8

                                                                  SHA256

                                                                  d5030b6c215b8e54b9dcc25a3da215475abfd4323d8cbb8bc9912d363f4f6b63

                                                                  SHA512

                                                                  7f62e948af40698e4859aa2e10735a02f8cb7df6810594cada99549db0f6f119feed99960e1b2990ac70197d712486e3c70c6947c8b8ba293ea83a657a06c901

                                                                • \Users\Admin\AppData\Local\Temp\7zS166E.tmp\Install.exe

                                                                  Filesize

                                                                  6.3MB

                                                                  MD5

                                                                  bd35df49cacc0d3f9c3db5d688438580

                                                                  SHA1

                                                                  364ac175e546fe6db9d7b07f52b1901b3b8f0ee8

                                                                  SHA256

                                                                  d5030b6c215b8e54b9dcc25a3da215475abfd4323d8cbb8bc9912d363f4f6b63

                                                                  SHA512

                                                                  7f62e948af40698e4859aa2e10735a02f8cb7df6810594cada99549db0f6f119feed99960e1b2990ac70197d712486e3c70c6947c8b8ba293ea83a657a06c901

                                                                • \Users\Admin\AppData\Local\Temp\7zS254D.tmp\Install.exe

                                                                  Filesize

                                                                  6.8MB

                                                                  MD5

                                                                  6772e7af138504e782c6e77d79080a21

                                                                  SHA1

                                                                  f1d34996df460e49dad43a5e14c27d01db59c2a4

                                                                  SHA256

                                                                  4ad4db7017f6c5f587cac7c735c91e20a879ad6aa7c6f3a2188cb8ec173a797d

                                                                  SHA512

                                                                  07b6119f299b3d396395b249526d3564b58d553e7889659988233260f04b8a425b07762761e9e9631ad3bd06f2ed0688623cc1342a497f60b02ddd3394489180

                                                                • \Users\Admin\AppData\Local\Temp\7zS254D.tmp\Install.exe

                                                                  Filesize

                                                                  6.8MB

                                                                  MD5

                                                                  6772e7af138504e782c6e77d79080a21

                                                                  SHA1

                                                                  f1d34996df460e49dad43a5e14c27d01db59c2a4

                                                                  SHA256

                                                                  4ad4db7017f6c5f587cac7c735c91e20a879ad6aa7c6f3a2188cb8ec173a797d

                                                                  SHA512

                                                                  07b6119f299b3d396395b249526d3564b58d553e7889659988233260f04b8a425b07762761e9e9631ad3bd06f2ed0688623cc1342a497f60b02ddd3394489180

                                                                • \Users\Admin\AppData\Local\Temp\7zS254D.tmp\Install.exe

                                                                  Filesize

                                                                  6.8MB

                                                                  MD5

                                                                  6772e7af138504e782c6e77d79080a21

                                                                  SHA1

                                                                  f1d34996df460e49dad43a5e14c27d01db59c2a4

                                                                  SHA256

                                                                  4ad4db7017f6c5f587cac7c735c91e20a879ad6aa7c6f3a2188cb8ec173a797d

                                                                  SHA512

                                                                  07b6119f299b3d396395b249526d3564b58d553e7889659988233260f04b8a425b07762761e9e9631ad3bd06f2ed0688623cc1342a497f60b02ddd3394489180

                                                                • \Users\Admin\AppData\Local\Temp\7zS254D.tmp\Install.exe

                                                                  Filesize

                                                                  6.8MB

                                                                  MD5

                                                                  6772e7af138504e782c6e77d79080a21

                                                                  SHA1

                                                                  f1d34996df460e49dad43a5e14c27d01db59c2a4

                                                                  SHA256

                                                                  4ad4db7017f6c5f587cac7c735c91e20a879ad6aa7c6f3a2188cb8ec173a797d

                                                                  SHA512

                                                                  07b6119f299b3d396395b249526d3564b58d553e7889659988233260f04b8a425b07762761e9e9631ad3bd06f2ed0688623cc1342a497f60b02ddd3394489180

                                                                • memory/396-98-0x0000000002564000-0x0000000002567000-memory.dmp

                                                                  Filesize

                                                                  12KB

                                                                • memory/396-100-0x0000000002564000-0x0000000002567000-memory.dmp

                                                                  Filesize

                                                                  12KB

                                                                • memory/396-101-0x000000000256B000-0x000000000258A000-memory.dmp

                                                                  Filesize

                                                                  124KB

                                                                • memory/396-96-0x000007FEF4680000-0x000007FEF50A3000-memory.dmp

                                                                  Filesize

                                                                  10.1MB

                                                                • memory/396-97-0x000007FEF3B20000-0x000007FEF467D000-memory.dmp

                                                                  Filesize

                                                                  11.4MB

                                                                • memory/396-95-0x000007FEFB8B1000-0x000007FEFB8B3000-memory.dmp

                                                                  Filesize

                                                                  8KB

                                                                • memory/780-123-0x000000000244B000-0x000000000246A000-memory.dmp

                                                                  Filesize

                                                                  124KB

                                                                • memory/780-122-0x0000000002444000-0x0000000002447000-memory.dmp

                                                                  Filesize

                                                                  12KB

                                                                • memory/780-124-0x000000000244B000-0x000000000246A000-memory.dmp

                                                                  Filesize

                                                                  124KB

                                                                • memory/780-120-0x000007FEF3180000-0x000007FEF3CDD000-memory.dmp

                                                                  Filesize

                                                                  11.4MB

                                                                • memory/780-119-0x000007FEF3CE0000-0x000007FEF4703000-memory.dmp

                                                                  Filesize

                                                                  10.1MB

                                                                • memory/936-71-0x0000000010000000-0x0000000011000000-memory.dmp

                                                                  Filesize

                                                                  16.0MB

                                                                • memory/1380-54-0x00000000757A1000-0x00000000757A3000-memory.dmp

                                                                  Filesize

                                                                  8KB

                                                                • memory/2040-138-0x0000000002514000-0x0000000002517000-memory.dmp

                                                                  Filesize

                                                                  12KB

                                                                • memory/2040-141-0x0000000002514000-0x0000000002517000-memory.dmp

                                                                  Filesize

                                                                  12KB

                                                                • memory/2040-139-0x000000000251B000-0x000000000253A000-memory.dmp

                                                                  Filesize

                                                                  124KB

                                                                • memory/2040-137-0x000007FEF3B20000-0x000007FEF467D000-memory.dmp

                                                                  Filesize

                                                                  11.4MB

                                                                • memory/2040-136-0x000007FEF4680000-0x000007FEF50A3000-memory.dmp

                                                                  Filesize

                                                                  10.1MB

                                                                • memory/2040-142-0x000000000251B000-0x000000000253A000-memory.dmp

                                                                  Filesize

                                                                  124KB