0b8af1ec6cb1fd6a7b51b61582ef75ae9fd513551658a6acd871573f3e908efb

Analysis

max time kernel
151s
max time network
161s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 18:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_549fc3bf1494b969bcdd6b470c5b585f_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
Size 61.7MB
Sample260805-w75cksdd63
SHA256 0b8af1ec6cb1fd6a7b51b61582ef75ae9fd513551658a6acd871573f3e908efb
MD5 549fc3bf1494b969bcdd6b470c5b585f
SHA1 31e622a6c5eb3c80c5df665ba38b6c9ae3043f12
SHA512 54b41ed03dc5e63c22d7d0d07f3d76dbb21e9e3cb615624fd8208aefdd57e1f264c9b0d19a9337d977f845e40f4a2739811aecc1515556690e859b020d3ecbf1
SSDEEP 98304:tuj9nmW2eUAAq4gm4mNSh6q+luaePvl8/bbJtF0gofLzXQQ7QfM3rM:cRnmW2s/m3xq9a2l8/QX9EfM3rM
TLSH
T199E78216B74289CEE076A238944B8F51E336E9704A71933723B5735D1FFE38C8EA6149
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 6 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\EiaPNU = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2416	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
5560	hYZLV9.exe
4108	hYZLV9.exe

Loads dropped DLL 2 IoCs

pid	Process
5560	hYZLV9.exe
4108	hYZLV9.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\EiaPNU\\hYZLV9.exe\""	hYZLV9.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
3032	cmd.exe
240	cmd.exe
4296	cmd.exe
972	cmd.exe
4344	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	hYZLV9.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\XbSdkW	hYZLV9.exe
File created	C:\Program Files (x86)\XbSdkW\XbSdkW.exe	hYZLV9.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5136	cmd.exe
1600	cmd.exe
4732	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1476	schtasks.exe
3528	schtasks.exe
948	schtasks.exe
1376	schtasks.exe
4948	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4924	2026-08-05_549fc3bf1494b969bcdd6b470c5b585f_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
4924	2026-08-05_549fc3bf1494b969bcdd6b470c5b585f_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
4924	2026-08-05_549fc3bf1494b969bcdd6b470c5b585f_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
4924	2026-08-05_549fc3bf1494b969bcdd6b470c5b585f_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
4924	2026-08-05_549fc3bf1494b969bcdd6b470c5b585f_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
4924	2026-08-05_549fc3bf1494b969bcdd6b470c5b585f_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
4924	2026-08-05_549fc3bf1494b969bcdd6b470c5b585f_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
4924	2026-08-05_549fc3bf1494b969bcdd6b470c5b585f_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
4924	2026-08-05_549fc3bf1494b969bcdd6b470c5b585f_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
4924	2026-08-05_549fc3bf1494b969bcdd6b470c5b585f_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
4924	2026-08-05_549fc3bf1494b969bcdd6b470c5b585f_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
4924	2026-08-05_549fc3bf1494b969bcdd6b470c5b585f_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
4924	2026-08-05_549fc3bf1494b969bcdd6b470c5b585f_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
4924	2026-08-05_549fc3bf1494b969bcdd6b470c5b585f_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
4924	2026-08-05_549fc3bf1494b969bcdd6b470c5b585f_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
4924	2026-08-05_549fc3bf1494b969bcdd6b470c5b585f_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
4924	2026-08-05_549fc3bf1494b969bcdd6b470c5b585f_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
4924	2026-08-05_549fc3bf1494b969bcdd6b470c5b585f_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
4924	2026-08-05_549fc3bf1494b969bcdd6b470c5b585f_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
4924	2026-08-05_549fc3bf1494b969bcdd6b470c5b585f_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
4924	2026-08-05_549fc3bf1494b969bcdd6b470c5b585f_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
4924	2026-08-05_549fc3bf1494b969bcdd6b470c5b585f_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
4924	2026-08-05_549fc3bf1494b969bcdd6b470c5b585f_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
4924	2026-08-05_549fc3bf1494b969bcdd6b470c5b585f_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
4924	2026-08-05_549fc3bf1494b969bcdd6b470c5b585f_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
4924	2026-08-05_549fc3bf1494b969bcdd6b470c5b585f_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
4924	2026-08-05_549fc3bf1494b969bcdd6b470c5b585f_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
4924	2026-08-05_549fc3bf1494b969bcdd6b470c5b585f_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
4924	2026-08-05_549fc3bf1494b969bcdd6b470c5b585f_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
4924	2026-08-05_549fc3bf1494b969bcdd6b470c5b585f_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
4924	2026-08-05_549fc3bf1494b969bcdd6b470c5b585f_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
4924	2026-08-05_549fc3bf1494b969bcdd6b470c5b585f_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
5560	hYZLV9.exe
5560	hYZLV9.exe
5560	hYZLV9.exe
5560	hYZLV9.exe
5560	hYZLV9.exe
5560	hYZLV9.exe
5560	hYZLV9.exe
5560	hYZLV9.exe
5560	hYZLV9.exe
5560	hYZLV9.exe
5560	hYZLV9.exe
5560	hYZLV9.exe
5560	hYZLV9.exe
5560	hYZLV9.exe
5560	hYZLV9.exe
5560	hYZLV9.exe
5560	hYZLV9.exe
5560	hYZLV9.exe
5560	hYZLV9.exe
5560	hYZLV9.exe
5560	hYZLV9.exe
5560	hYZLV9.exe
5560	hYZLV9.exe
5560	hYZLV9.exe
5560	hYZLV9.exe
5560	hYZLV9.exe
5560	hYZLV9.exe
5560	hYZLV9.exe
5560	hYZLV9.exe
5560	hYZLV9.exe
5560	hYZLV9.exe
5560	hYZLV9.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	2416	powershell.exe
Token: SeIncreaseQuotaPrivilege	2416	powershell.exe
Token: SeSecurityPrivilege	2416	powershell.exe
Token: SeTakeOwnershipPrivilege	2416	powershell.exe
Token: SeLoadDriverPrivilege	2416	powershell.exe
Token: SeSystemProfilePrivilege	2416	powershell.exe
Token: SeSystemtimePrivilege	2416	powershell.exe
Token: SeProfSingleProcessPrivilege	2416	powershell.exe
Token: SeIncBasePriorityPrivilege	2416	powershell.exe
Token: SeCreatePagefilePrivilege	2416	powershell.exe
Token: SeBackupPrivilege	2416	powershell.exe
Token: SeRestorePrivilege	2416	powershell.exe
Token: SeShutdownPrivilege	2416	powershell.exe
Token: SeDebugPrivilege	2416	powershell.exe
Token: SeSystemEnvironmentPrivilege	2416	powershell.exe
Token: SeRemoteShutdownPrivilege	2416	powershell.exe
Token: SeUndockPrivilege	2416	powershell.exe
Token: SeManageVolumePrivilege	2416	powershell.exe
Token: 33	2416	powershell.exe
Token: 34	2416	powershell.exe
Token: 35	2416	powershell.exe
Token: 36	2416	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 5560 wrote to memory of 2416	5560	hYZLV9.exe	90
PID 5560 wrote to memory of 4344	5560	hYZLV9.exe	92
PID 4344 wrote to memory of 1476	4344	cmd.exe	94
PID 4344 wrote to memory of 2052	4344	cmd.exe	95
PID 4344 wrote to memory of 2852	4344	cmd.exe	99
PID 5560 wrote to memory of 3032	5560	hYZLV9.exe	101
PID 3032 wrote to memory of 3528	3032	cmd.exe	104
PID 5560 wrote to memory of 240	5560	hYZLV9.exe	105
PID 240 wrote to memory of 948	240	cmd.exe	107
PID 3032 wrote to memory of 4656	3032	cmd.exe	108
PID 5560 wrote to memory of 4296	5560	hYZLV9.exe	110
PID 3032 wrote to memory of 4872	3032	cmd.exe	111
PID 240 wrote to memory of 3136	240	cmd.exe	113
PID 4296 wrote to memory of 1376	4296	cmd.exe	114
PID 240 wrote to memory of 3708	240	cmd.exe	115
PID 4296 wrote to memory of 4792	4296	cmd.exe	116
PID 4296 wrote to memory of 4640	4296	cmd.exe	117
PID 5560 wrote to memory of 972	5560	hYZLV9.exe	118
PID 972 wrote to memory of 4948	972	cmd.exe	120
PID 972 wrote to memory of 3012	972	cmd.exe	123
PID 972 wrote to memory of 5652	972	cmd.exe	125
PID 5136 wrote to memory of 5576	5136	cmd.exe	128
PID 4732 wrote to memory of 5820	4732	cmd.exe	129
PID 1600 wrote to memory of 5624	1600	cmd.exe	130

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-05_549fc3bf1494b969bcdd6b470c5b585f_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_549fc3bf1494b969bcdd6b470c5b585f_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4924

C:\Users\Public\EiaPNU\hYZLV9.exe
"C:\Users\Public\EiaPNU\hYZLV9.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5560
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2416
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\EiaPNU\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4344
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\EiaPNU\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1476
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2052
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2852
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3032
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3528
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4656
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4872
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:240
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:948
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3136
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3708
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4296
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1376
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4792
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4640
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:972
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4948
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3012
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5652

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\EiaPNU" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5136
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\EiaPNU" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5576

C:\Users\Public\EiaPNU\hYZLV9.exe
"C:\Users\Public\EiaPNU\hYZLV9.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4108

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:4160

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5624

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4732
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1BA79029EC3FFD076F5DAC2F70A18685

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1BA79029EC3FFD076F5DAC2F70A18685
Size 1KB
SHA256 63b14543360f5e89942ea8d5113526e64fbc71c1207328f0136b3a495d921dd0
MD5 adac67e1d2da2d706db151c2db316b2d
SHA1 5f6e301d23e33132209707945d0e740d5bcb8996
SHA512 9371b62ac25c6ea8fb6fca19ac47b873ced9b3d0cb45ce4de5ea974b93c12684c65aa23c7d83331c77502853258a08dff73ce5e3fb6170bd3ab1c5b3283a86a9
TLSH
T1DE31AD4EA2153027D5427F72D8CEBE83CEB1364667CAD46B18046E4229AAFC25FC80C9
MD5 SHA1 SHA512 TLSH

Submit Download

1BA79029EC3FFD076F5DAC2F70A18685

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1BA79029EC3FFD076F5DAC2F70A18685
Size 186B
SHA256 ac6f6ba8c716b825b94bcacb4376c77d4e8600dcfac4a337bbb6e23b65e17c17
MD5 83595309d98f44e511a82ddb41051df9
SHA1 c6a18a7cfce1c618d42e873daa27108ff8b1e2bf
SHA512 c1bebe9d8680c739d592dcf367034665eb9c572b70b119efdea83ef8bdcb64c81a194dc66b4f4bb417916bdb8daf7463be54725068edaa8628f1a92f46709630
TLSH
T15DC04C5063B54254F1318D7E2F5116B297765D55A912C3540B65425DC47CA405862E16
MD5 SHA1 SHA512 TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\EiaPNU\UxEnhance64.dll
Size 3.1MB
SHA256 5010128089307a8f01b6d37a0fa33b83f88a7e10c598bf61504e24893e5cf8a9
MD5 aeeb4a2fa460388c779d1a7035936cb0
SHA1 3fd55d1224d8e13da3718032ca05fe98de841203
SHA512 5f981b007730d60d2c54100f906b6c11fb89017127fc3172c9bf11f579b70ba18ee614f97d005a097eb20685216363277d081b248fb149c39cb8aa5e807f32a9
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+J:P9m29xx3Tiqt06ox6+z2rNNrKoJ
TLSH
T194E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\EiaPNU\adoresd.dat
Size 4.7MB
SHA256 4f96ac71690bd48758ff977833bae2168617329341decb38370805decbb491f6
MD5 61a5f296940094e03190d09b239afb8c
SHA1 7a1cbed7e2d070511a07070785f4119e346c5258
SHA512 320cd07dec028e1077c290129657d3de2775aeecceb9807ebec3fd95e1d88113a0c4e17a2740c341449f91685d314fab55fa543e46f98e23707b3e9e7b780b92
SSDEEP 98304:3mu1SwODpRGIRdXEMZYe6rFLoTTpMk6ZGvQv0Ss2i+XZXea1v5WZd8uCp:Wu1SwOflfZPF6Ma0bsoa5+qd
TLSH
T1133633368AE6F5C7E35B2A0AF36888DD12B0B7AD6E9D75C24AF070145DB30CE9015BC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hYZLV9.exe

Path C:\Users\Public\EiaPNU\hYZLV9.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\EiaPNU\msadox.tb
Size 8KB
SHA256 2b70f08fd177e851241e8fdf61a15ffbd65522c930fa77384f843fef972f86da
MD5 b5f4613d4621fb78e0477a40a255bf64
SHA1 c23fdc10bf7439cee63db2628f8fc8de7197db03
SHA512 ffa4cb1e3f91a48e3bd1e1c9131e336ca5805e541a98fcc01904041935fdca2fa518365b2b87ff6eede00531e4994c73f168846192223e527af50994d0900a5f
SSDEEP 192:MqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:MsZqZOXQ3uqvR2Kfzp
TLSH
T1B9029E05D7A20CC7D6016C71CD9EB2F5AB23A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2416-596-0x000002A2AF920000-0x000002A2AF942000-memory.dmp

Download

memory/2416-599-0x000002A2AFB70000-0x000002A2AFB8E000-memory.dmp

Download

memory/2416-600-0x000002A2AFB90000-0x000002A2AFC42000-memory.dmp

Download

memory/2416-601-0x000002A2AFB50000-0x000002A2AFB5A000-memory.dmp

Download

memory/4108-592-0x00007FFFC1C70000-0x00007FFFC1C72000-memory.dmp

Download

memory/4108-584-0x0000028943F30000-0x00000289447C1000-memory.dmp

Download

memory/4108-578-0x00007FFFA0EC0000-0x00007FFFA13DE000-memory.dmp

Download

memory/4108-582-0x0000028943F30000-0x00000289447C1000-memory.dmp

Download

memory/4108-583-0x00007FFFC1C80000-0x00007FFFC1C82000-memory.dmp

Download

memory/4108-588-0x0000028943F30000-0x00000289447C1000-memory.dmp

Download

memory/4108-590-0x0000028943F30000-0x00000289447C1000-memory.dmp

Download

memory/4108-591-0x0000028943F30000-0x00000289447C1000-memory.dmp

Download

memory/4108-589-0x0000028943F30000-0x00000289447C1000-memory.dmp

Download

memory/4924-2-0x0000000000590000-0x000000000059B000-memory.dmp

Download

memory/4924-0-0x0000000000570000-0x000000000057D000-memory.dmp

Download

memory/4924-504-0x00007FFFB2430000-0x00007FFFB2442000-memory.dmp

Download

memory/4924-524-0x00007FFFB2430000-0x00007FFFB2442000-memory.dmp

Download

memory/4924-526-0x0000000000570000-0x000000000057D000-memory.dmp

Download

memory/4924-527-0x00007FFFB2430000-0x00007FFFB2442000-memory.dmp

Download

memory/4924-1-0x0000000000570000-0x000000000057D000-memory.dmp

Download

memory/5560-533-0x00007FFFA0EC0000-0x00007FFFA13DE000-memory.dmp

Download

memory/5560-567-0x000002CC4D020000-0x000002CC4D8B1000-memory.dmp

Download

memory/5560-565-0x000002CC4D020000-0x000002CC4D8B1000-memory.dmp

Download

memory/5560-558-0x000002CC4ACA0000-0x000002CC4ACEE000-memory.dmp

Download

memory/5560-559-0x000002CC4C560000-0x000002CC4C5EA000-memory.dmp

Download

memory/5560-562-0x000002CC4C560000-0x000002CC4C5EA000-memory.dmp

Download

memory/5560-561-0x000002CC4C560000-0x000002CC4C5EA000-memory.dmp

Download

memory/5560-560-0x000002CC4C560000-0x000002CC4C5EA000-memory.dmp

Download

memory/5560-552-0x000002CC4D020000-0x000002CC4D8B1000-memory.dmp

Download

memory/5560-548-0x000002CC4D020000-0x000002CC4D8B1000-memory.dmp

Download

memory/5560-547-0x000002CC4D020000-0x000002CC4D8B1000-memory.dmp

Download

memory/5560-546-0x000002CC4D020000-0x000002CC4D8B1000-memory.dmp

Download

memory/5560-545-0x000002CC4D020000-0x000002CC4D8B1000-memory.dmp

Download

memory/5560-541-0x000002CC4D020000-0x000002CC4D8B1000-memory.dmp

Download

memory/5560-540-0x00007FFFC1C80000-0x00007FFFC1C82000-memory.dmp

Download

memory/5560-538-0x000002CC4D020000-0x000002CC4D8B1000-memory.dmp

Download

memory/5560-532-0x00007FFFC1C70000-0x00007FFFC1C72000-memory.dmp

Download