9a7c87d58a7ab1f2d99c5390d04c3875e41587b46f0632518e6108286ca45e2c

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/04/2026, 12:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
525252_x64.exe
Size 761KB
Sample260415-pyhc5aev9r
SHA256 9a7c87d58a7ab1f2d99c5390d04c3875e41587b46f0632518e6108286ca45e2c
MD5 1ceea849fcc870aba59694a78f2369d2
SHA1 c5d93d4c5715ac89be95b067266d0f9804796dbf
SHA512 7bb73418f5a914a2718557137ace426b544abf55b44f8598864f262bfcc9338dbe05fe68efbf7e84dbb58a1b51463db1e77fa154d6bac1328fc7a203d8f4e732
SSDEEP 12288:JzvOznjd7Dkqya3OJXJyZzNP8GTop8mWC88yxBlDetAqxSva:8XOqyzJXIPkEWRbvybS
TLSH
T179F48C1BE7A602F9D1B7C274CA424957E772B8065370978F03E14AA61F376909F3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 25 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5492	powershell.exe
5096	powershell.exe
5352	powershell.exe
4100	powershell.exe
4580	powershell.exe
1684	powershell.exe
3680	powershell.exe
1140	powershell.exe
6096	powershell.exe
4260	powershell.exe
5352	powershell.exe
3324	powershell.exe
5492	powershell.exe
1856	powershell.exe
4260	powershell.exe
4952	powershell.exe
1684	powershell.exe
404	powershell.exe
4100	powershell.exe
6096	powershell.exe
4580	powershell.exe
3680	powershell.exe
3972	powershell.exe
5096	powershell.exe
1140	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
46	4692	525252_x64.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation	525252_x64.exe

Executes dropped EXE 3 IoCs

pid	Process
1700	PjzrFx4rv3X5.exe
804	PjzrFx4rv3X5.exe
4476	PjzrFx4rv3X5.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSecurityHealthService = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SecurityHealth\\PjzrFx4rv3X5.exe"	PjzrFx4rv3X5.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
38	raw.githubusercontent.com
46	raw.githubusercontent.com

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
51	ip-api.com
53	api.ipify.org
54	api.ipify.org

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	525252_x64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	525252_x64.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	PjzrFx4rv3X5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	PjzrFx4rv3X5.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2904	schtasks.exe
5156	schtasks.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
4692	525252_x64.exe
4692	525252_x64.exe
4580	powershell.exe
5492	powershell.exe
4580	powershell.exe
5492	powershell.exe
1856	powershell.exe
1856	powershell.exe
1856	powershell.exe
1700	PjzrFx4rv3X5.exe
1700	PjzrFx4rv3X5.exe
3680	powershell.exe
3680	powershell.exe
1684	powershell.exe
1684	powershell.exe
3680	powershell.exe
1684	powershell.exe
3972	powershell.exe
3972	powershell.exe
3972	powershell.exe
5096	powershell.exe
5352	powershell.exe
5096	powershell.exe
5352	powershell.exe
404	powershell.exe
404	powershell.exe
4100	powershell.exe
1140	powershell.exe
4100	powershell.exe
1140	powershell.exe
3324	powershell.exe
3324	powershell.exe
6096	powershell.exe
4260	powershell.exe
6096	powershell.exe
4260	powershell.exe
4952	powershell.exe
4952	powershell.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	4580	powershell.exe
Token: SeDebugPrivilege	5492	powershell.exe
Token: SeDebugPrivilege	1856	powershell.exe
Token: SeDebugPrivilege	1684	powershell.exe
Token: SeDebugPrivilege	3680	powershell.exe
Token: SeDebugPrivilege	3972	powershell.exe
Token: SeDebugPrivilege	5096	powershell.exe
Token: SeDebugPrivilege	5352	powershell.exe
Token: SeDebugPrivilege	404	powershell.exe
Token: SeDebugPrivilege	4100	powershell.exe
Token: SeDebugPrivilege	1140	powershell.exe
Token: SeDebugPrivilege	3324	powershell.exe
Token: SeDebugPrivilege	6096	powershell.exe
Token: SeDebugPrivilege	4260	powershell.exe
Token: SeDebugPrivilege	4952	powershell.exe

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 4692 wrote to memory of 1808	4692	525252_x64.exe	94
PID 4692 wrote to memory of 1808	4692	525252_x64.exe	94
PID 4692 wrote to memory of 5924	4692	525252_x64.exe	100
PID 4692 wrote to memory of 5924	4692	525252_x64.exe	100
PID 4692 wrote to memory of 1700	4692	525252_x64.exe	108
PID 1700 wrote to memory of 5492	1700	PjzrFx4rv3X5.exe	113
PID 1700 wrote to memory of 4580	1700	PjzrFx4rv3X5.exe	114
PID 1700 wrote to memory of 5328	1700	PjzrFx4rv3X5.exe	115
PID 5328 wrote to memory of 224	5328	cmd.exe	119
PID 1700 wrote to memory of 1184	1700	PjzrFx4rv3X5.exe	120
PID 1184 wrote to memory of 3936	1184	cmd.exe	122
PID 1700 wrote to memory of 6072	1700	PjzrFx4rv3X5.exe	123
PID 6072 wrote to memory of 5012	6072	cmd.exe	125
PID 1700 wrote to memory of 1856	1700	PjzrFx4rv3X5.exe	126
PID 1700 wrote to memory of 1296	1700	PjzrFx4rv3X5.exe	127
PID 1296 wrote to memory of 4296	1296	cmd.exe	130
PID 1700 wrote to memory of 2904	1700	PjzrFx4rv3X5.exe	131
PID 1700 wrote to memory of 5156	1700	PjzrFx4rv3X5.exe	133
PID 1700 wrote to memory of 3680	1700	PjzrFx4rv3X5.exe	135
PID 1700 wrote to memory of 1684	1700	PjzrFx4rv3X5.exe	136
PID 1700 wrote to memory of 1248	1700	PjzrFx4rv3X5.exe	137
PID 1248 wrote to memory of 4456	1248	cmd.exe	141
PID 1700 wrote to memory of 4528	1700	PjzrFx4rv3X5.exe	142
PID 4528 wrote to memory of 6096	4528	cmd.exe	144
PID 1700 wrote to memory of 4684	1700	PjzrFx4rv3X5.exe	145
PID 4684 wrote to memory of 4980	4684	cmd.exe	147
PID 1700 wrote to memory of 3972	1700	PjzrFx4rv3X5.exe	148
PID 1700 wrote to memory of 4884	1700	PjzrFx4rv3X5.exe	149
PID 4884 wrote to memory of 5624	4884	cmd.exe	152
PID 1700 wrote to memory of 5352	1700	PjzrFx4rv3X5.exe	157
PID 1700 wrote to memory of 5096	1700	PjzrFx4rv3X5.exe	158
PID 1700 wrote to memory of 5504	1700	PjzrFx4rv3X5.exe	160
PID 5504 wrote to memory of 2356	5504	cmd.exe	163
PID 1700 wrote to memory of 412	1700	PjzrFx4rv3X5.exe	164
PID 412 wrote to memory of 2984	412	cmd.exe	166
PID 1700 wrote to memory of 3980	1700	PjzrFx4rv3X5.exe	167
PID 3980 wrote to memory of 516	3980	cmd.exe	169
PID 1700 wrote to memory of 404	1700	PjzrFx4rv3X5.exe	170
PID 1700 wrote to memory of 1292	1700	PjzrFx4rv3X5.exe	171
PID 1292 wrote to memory of 1992	1292	cmd.exe	174
PID 1700 wrote to memory of 1140	1700	PjzrFx4rv3X5.exe	175
PID 1700 wrote to memory of 4100	1700	PjzrFx4rv3X5.exe	176
PID 1700 wrote to memory of 4184	1700	PjzrFx4rv3X5.exe	178
PID 4184 wrote to memory of 5596	4184	cmd.exe	181
PID 1700 wrote to memory of 1260	1700	PjzrFx4rv3X5.exe	182
PID 1260 wrote to memory of 6104	1260	cmd.exe	184
PID 1700 wrote to memory of 1092	1700	PjzrFx4rv3X5.exe	185
PID 1092 wrote to memory of 3984	1092	cmd.exe	187
PID 1700 wrote to memory of 3324	1700	PjzrFx4rv3X5.exe	188
PID 1700 wrote to memory of 1812	1700	PjzrFx4rv3X5.exe	189
PID 1812 wrote to memory of 3480	1812	cmd.exe	192
PID 1700 wrote to memory of 6096	1700	PjzrFx4rv3X5.exe	193
PID 1700 wrote to memory of 4260	1700	PjzrFx4rv3X5.exe	194
PID 1700 wrote to memory of 4516	1700	PjzrFx4rv3X5.exe	196
PID 1700 wrote to memory of 2272	1700	PjzrFx4rv3X5.exe	200
PID 2272 wrote to memory of 804	2272	cmd.exe	202
PID 1700 wrote to memory of 4744	1700	PjzrFx4rv3X5.exe	203
PID 4744 wrote to memory of 4492	4744	cmd.exe	205
PID 1700 wrote to memory of 4952	1700	PjzrFx4rv3X5.exe	206
PID 1700 wrote to memory of 2664	1700	PjzrFx4rv3X5.exe	207
PID 2664 wrote to memory of 3276	2664	cmd.exe	210

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\525252_x64.exe
"C:\Users\Admin\AppData\Local\Temp\525252_x64.exe"
1⤵
- Downloads MZ/PE file
- Checks computer location settings
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:5924
- C:\Users\Admin\AppData\Local\PjzrFx4rv3X5.exe
  "C:\Users\Admin\AppData\Local\PjzrFx4rv3X5.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1700
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\SecurityHealth' -ExclusionProcess 'svchost.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5492
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionExtension '*.json' -ExclusionProcess 'conhost.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4580
- - C:\Windows\system32\cmd.exe
    "cmd" /c "reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\AppData\Roaming\Microsoft\SecurityHealth\" /t REG_DWORD /d 0 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5328
  - - C:\Windows\system32\reg.exe
      reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\AppData\Roaming\Microsoft\SecurityHealth\" /t REG_DWORD /d 0 /f
      4⤵
      PID:224
- - C:\Windows\system32\cmd.exe
    "cmd" /c "reg add \"HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\AppData\Roaming\Microsoft\SecurityHealth\" /t REG_DWORD /d 0 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1184
  - - C:\Windows\system32\reg.exe
      reg add \"HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\AppData\Roaming\Microsoft\SecurityHealth\" /t REG_DWORD /d 0 /f
      4⤵
      PID:3936
- - C:\Windows\system32\cmd.exe
    "cmd" /c "reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\" /v \"svchost.exe\" /t REG_DWORD /d 0 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6072
  - - C:\Windows\system32\reg.exe
      reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\" /v \"svchost.exe\" /t REG_DWORD /d 0 /f
      4⤵
      PID:5012
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -WindowStyle Hidden -Command "Set-MpPreference -DisableRealtimeMonitoring $false"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1856
- - C:\Windows\system32\cmd.exe
    "cmd" /c "reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\" /v \"DisableRealtimeMonitoring\" /t REG_DWORD /d 1 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1296
  - - C:\Windows\system32\reg.exe
      reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\" /v \"DisableRealtimeMonitoring\" /t REG_DWORD /d 1 /f
      4⤵
      PID:4296
- - C:\Windows\system32\schtasks.exe
    "schtasks" /create /tn WindowsSecurityHealthService /tr \"C:\Users\Admin\AppData\Roaming\Microsoft\SecurityHealth\PjzrFx4rv3X5.exe\" /sc onlogon /rl highest /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2904
- - C:\Windows\system32\schtasks.exe
    "schtasks" /create /tn WindowsSecurityHealthServiceMonitor /xml C:\Users\Admin\AppData\Local\Temp\WindowsSecurityHealthServiceMonitor.xml /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5156
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\SecurityHealth' -ExclusionProcess 'svchost.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3680
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionExtension '*.json' -ExclusionProcess 'conhost.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1684
- - C:\Windows\system32\cmd.exe
    "cmd" /c "reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\AppData\Roaming\Microsoft\SecurityHealth\" /t REG_DWORD /d 0 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1248
  - - C:\Windows\system32\reg.exe
      reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\AppData\Roaming\Microsoft\SecurityHealth\" /t REG_DWORD /d 0 /f
      4⤵
      PID:4456
- - C:\Windows\system32\cmd.exe
    "cmd" /c "reg add \"HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\AppData\Roaming\Microsoft\SecurityHealth\" /t REG_DWORD /d 0 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4528
  - - C:\Windows\system32\reg.exe
      reg add \"HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\AppData\Roaming\Microsoft\SecurityHealth\" /t REG_DWORD /d 0 /f
      4⤵
      PID:6096
- - C:\Windows\system32\cmd.exe
    "cmd" /c "reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\" /v \"svchost.exe\" /t REG_DWORD /d 0 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4684
  - - C:\Windows\system32\reg.exe
      reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\" /v \"svchost.exe\" /t REG_DWORD /d 0 /f
      4⤵
      PID:4980
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -WindowStyle Hidden -Command "Set-MpPreference -DisableRealtimeMonitoring $false"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3972
- - C:\Windows\system32\cmd.exe
    "cmd" /c "reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\" /v \"DisableRealtimeMonitoring\" /t REG_DWORD /d 1 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4884
  - - C:\Windows\system32\reg.exe
      reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\" /v \"DisableRealtimeMonitoring\" /t REG_DWORD /d 1 /f
      4⤵
      PID:5624
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\SecurityHealth' -ExclusionProcess 'svchost.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5352
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionExtension '*.json' -ExclusionProcess 'conhost.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5096
- - C:\Windows\system32\cmd.exe
    "cmd" /c "reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\AppData\Roaming\Microsoft\SecurityHealth\" /t REG_DWORD /d 0 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5504
  - - C:\Windows\system32\reg.exe
      reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\AppData\Roaming\Microsoft\SecurityHealth\" /t REG_DWORD /d 0 /f
      4⤵
      PID:2356
- - C:\Windows\system32\cmd.exe
    "cmd" /c "reg add \"HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\AppData\Roaming\Microsoft\SecurityHealth\" /t REG_DWORD /d 0 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:412
  - - C:\Windows\system32\reg.exe
      reg add \"HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\AppData\Roaming\Microsoft\SecurityHealth\" /t REG_DWORD /d 0 /f
      4⤵
      PID:2984
- - C:\Windows\system32\cmd.exe
    "cmd" /c "reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\" /v \"svchost.exe\" /t REG_DWORD /d 0 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3980
  - - C:\Windows\system32\reg.exe
      reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\" /v \"svchost.exe\" /t REG_DWORD /d 0 /f
      4⤵
      PID:516
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -WindowStyle Hidden -Command "Set-MpPreference -DisableRealtimeMonitoring $false"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:404
- - C:\Windows\system32\cmd.exe
    "cmd" /c "reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\" /v \"DisableRealtimeMonitoring\" /t REG_DWORD /d 1 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1292
  - - C:\Windows\system32\reg.exe
      reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\" /v \"DisableRealtimeMonitoring\" /t REG_DWORD /d 1 /f
      4⤵
      PID:1992
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\SecurityHealth' -ExclusionProcess 'svchost.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1140
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionExtension '*.json' -ExclusionProcess 'conhost.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4100
- - C:\Windows\system32\cmd.exe
    "cmd" /c "reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\AppData\Roaming\Microsoft\SecurityHealth\" /t REG_DWORD /d 0 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4184
  - - C:\Windows\system32\reg.exe
      reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\AppData\Roaming\Microsoft\SecurityHealth\" /t REG_DWORD /d 0 /f
      4⤵
      PID:5596
- - C:\Windows\system32\cmd.exe
    "cmd" /c "reg add \"HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\AppData\Roaming\Microsoft\SecurityHealth\" /t REG_DWORD /d 0 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1260
  - - C:\Windows\system32\reg.exe
      reg add \"HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\AppData\Roaming\Microsoft\SecurityHealth\" /t REG_DWORD /d 0 /f
      4⤵
      PID:6104
- - C:\Windows\system32\cmd.exe
    "cmd" /c "reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\" /v \"svchost.exe\" /t REG_DWORD /d 0 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1092
  - - C:\Windows\system32\reg.exe
      reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\" /v \"svchost.exe\" /t REG_DWORD /d 0 /f
      4⤵
      PID:3984
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -WindowStyle Hidden -Command "Set-MpPreference -DisableRealtimeMonitoring $false"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3324
- - C:\Windows\system32\cmd.exe
    "cmd" /c "reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\" /v \"DisableRealtimeMonitoring\" /t REG_DWORD /d 1 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1812
  - - C:\Windows\system32\reg.exe
      reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\" /v \"DisableRealtimeMonitoring\" /t REG_DWORD /d 1 /f
      4⤵
      PID:3480
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\SecurityHealth' -ExclusionProcess 'svchost.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6096
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionExtension '*.json' -ExclusionProcess 'conhost.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4260
- - C:\Windows\system32\cmd.exe
    "cmd" /c "reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\AppData\Roaming\Microsoft\SecurityHealth\" /t REG_DWORD /d 0 /f"
    3⤵
    PID:4516
  - - C:\Windows\system32\reg.exe
      reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\AppData\Roaming\Microsoft\SecurityHealth\" /t REG_DWORD /d 0 /f
      4⤵
      PID:4992
- - C:\Windows\system32\cmd.exe
    "cmd" /c "reg add \"HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\AppData\Roaming\Microsoft\SecurityHealth\" /t REG_DWORD /d 0 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2272
  - - C:\Windows\system32\reg.exe
      reg add \"HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\AppData\Roaming\Microsoft\SecurityHealth\" /t REG_DWORD /d 0 /f
      4⤵
      PID:804
- - C:\Windows\system32\cmd.exe
    "cmd" /c "reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\" /v \"svchost.exe\" /t REG_DWORD /d 0 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4744
  - - C:\Windows\system32\reg.exe
      reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\" /v \"svchost.exe\" /t REG_DWORD /d 0 /f
      4⤵
      PID:4492
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -WindowStyle Hidden -Command "Set-MpPreference -DisableRealtimeMonitoring $false"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4952
- - C:\Windows\system32\cmd.exe
    "cmd" /c "reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\" /v \"DisableRealtimeMonitoring\" /t REG_DWORD /d 1 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2664
  - - C:\Windows\system32\reg.exe
      reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\" /v \"DisableRealtimeMonitoring\" /t REG_DWORD /d 1 /f
      4⤵
      PID:3276

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:468

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5276

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:976

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2896

C:\Users\Admin\AppData\Roaming\Microsoft\SecurityHealth\PjzrFx4rv3X5.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\SecurityHealth\PjzrFx4rv3X5.exe"
1⤵
- Executes dropped EXE
PID:804

C:\Users\Admin\AppData\Roaming\Microsoft\SecurityHealth\PjzrFx4rv3X5.exe
C:\Users\Admin\AppData\Roaming\Microsoft\SecurityHealth\PjzrFx4rv3X5.exe
1⤵
- Executes dropped EXE
PID:4476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C1096902-53C5-9326-512A-7D0E49D2B576.txt

Path C:\ProgramData\C1096902-53C5-9326-512A-7D0E49D2B576.txt
Size 64B
SHA256 1824f5f30657a0f2d775399941bcdcd5fe263e1f6769a38807c85ff76aaede1c
MD5 3eedb5187bc5b277ac13d37c89a56f9b
SHA1 92b838b4606fccf1e5f1b221f25589acd9d37990
SHA512 eb1e7e9c7e1110e7d3ec390da162ee6eaef982a5a04e0b0e8cc7e6dfe26b7682300feeff5908b0672daf54b42f5f22a24d5ec2c3a30c2d0e6116cf14c19a64f3
TLSH
T193A0228F002002A220882E82F802CBB323000B2C080E02E30803FAB3200300F2A33CA0
MD5 SHA1 SHA512 TLSH

Submit Download

C1096902-53C5-9326-512A-7D0E49D2B576.txt

Path C:\ProgramData\C1096902-53C5-9326-512A-7D0E49D2B576.txt
Size 64B
SHA256 1a84de31cf5ab7d9674f9b45029f313421e4f7ee89169d06e648b649baa62dd2
MD5 006a9e72b97853447fd80e87d109256b
SHA1 03688622fa60461940ee07bea0f712226ae580e6
SHA512 6a09219fd9acacf9132bfcbbf4a743e1634af9da2fda77c057c54c7caacf1c50a033c4540d6eb84a4257ff30df0d2ef7a53e73c7bb86f98c9aa9b010f7eace5a
TLSH
T1F3A02238202822C0002830032CE0202C0A2B0002808FCA22F08032000F08CC0802A238
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download