13d7179581beb7b362ea491ed34a5a378059b4b06d1b02ac291c8eaa82db8a9f

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/08/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
insoft_v10.0.03.exe
Size 35.0MB
Sample260816-e2fctszcjd
SHA256 13d7179581beb7b362ea491ed34a5a378059b4b06d1b02ac291c8eaa82db8a9f
MD5 0429acd09df486b6d57303a479cb635d
SHA1 50ab36864cb2b4c1ef4a5282099bc96406681dac
SHA512 e2e0007181c2c4606e6031c0578fb170e118b701920447c68a97fdce917d36e24d1b2a15f92c05950832d51a58efe31b8d4f5fa1df73ae1846cc83b130f0b0cc
SSDEEP 196608:xQnmE+fMeDKqTnrT+B7A6Z6dSBqtiEPFNPL12V5pvUFgA1:iKJnGBr4Xu7vUn
TLSH
T13387074ABB40CEE6E11A85B098A77B1163FEFD6147E1C30321C83B15DF1B29D4EA7598
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Lr696Y.exe

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\ZQHU79 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	AgnU0y.exe

Executes dropped EXE 4 IoCs

pid	Process
2904	AgnU0y.exe
2360	AgnU0y.exe
2440	Lr696Y.exe
2096	Lr696Y.exe

Loads dropped DLL 4 IoCs

pid	Process
2904	AgnU0y.exe
2360	AgnU0y.exe
2440	Lr696Y.exe
2096	Lr696Y.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4396	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\ZQHU79\\AgnU0y.exe\""	AgnU0y.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Alibaba SecurityHealtha = "\"C:\\Program Files (x86)\\Lr696Y\\Lr696Y.exe\""	Lr696Y.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
4908	cmd.exe
4992	cmd.exe
176	cmd.exe
2752	cmd.exe
4224	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	AgnU0y.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Lr696Y\Lr696Y.exe	AgnU0y.exe
File created	C:\Program Files (x86)\Lr696Y\image.png	AgnU0y.exe
File opened for modification	C:\Program Files (x86)\Lr696Y\image.png	AgnU0y.exe
File created	C:\Program Files (x86)\Lr696Y\XPSPLOG.dll	AgnU0y.exe
File created	C:\Program Files (x86)\Lr696Y\thumbs.db	AgnU0y.exe
File opened for modification	C:\Program Files (x86)\Lr696Y\Lr696Y.exe	AgnU0y.exe
File opened for modification	C:\Program Files (x86)\Lr696Y\XPSPLOG.dll	AgnU0y.exe
File opened for modification	C:\Program Files (x86)\Lr696Y\thumbs.db	AgnU0y.exe
File opened for modification	C:\Program Files (x86)\Lr696Y	AgnU0y.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2360	cmd.exe
4128	cmd.exe
2300	cmd.exe
2112	cmd.exe
2384	cmd.exe
4408	cmd.exe
3828	cmd.exe
2620	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lr696Y.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Lr696Y.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	AgnU0y.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2572	schtasks.exe
2744	schtasks.exe
660	schtasks.exe
3180	schtasks.exe
4840	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4620	insoft_v10.0.03.exe
4620	insoft_v10.0.03.exe
4620	insoft_v10.0.03.exe
4620	insoft_v10.0.03.exe
4620	insoft_v10.0.03.exe
4620	insoft_v10.0.03.exe
4620	insoft_v10.0.03.exe
4620	insoft_v10.0.03.exe
4620	insoft_v10.0.03.exe
4620	insoft_v10.0.03.exe
4620	insoft_v10.0.03.exe
4620	insoft_v10.0.03.exe
4620	insoft_v10.0.03.exe
4620	insoft_v10.0.03.exe
4620	insoft_v10.0.03.exe
4620	insoft_v10.0.03.exe
4620	insoft_v10.0.03.exe
4620	insoft_v10.0.03.exe
4620	insoft_v10.0.03.exe
4620	insoft_v10.0.03.exe
4620	insoft_v10.0.03.exe
4620	insoft_v10.0.03.exe
4620	insoft_v10.0.03.exe
4620	insoft_v10.0.03.exe
4620	insoft_v10.0.03.exe
4620	insoft_v10.0.03.exe
4620	insoft_v10.0.03.exe
4620	insoft_v10.0.03.exe
4620	insoft_v10.0.03.exe
4620	insoft_v10.0.03.exe
4620	insoft_v10.0.03.exe
4620	insoft_v10.0.03.exe
2904	AgnU0y.exe
2904	AgnU0y.exe
2904	AgnU0y.exe
2904	AgnU0y.exe
2904	AgnU0y.exe
2904	AgnU0y.exe
2904	AgnU0y.exe
2904	AgnU0y.exe
2904	AgnU0y.exe
2904	AgnU0y.exe
2904	AgnU0y.exe
2904	AgnU0y.exe
2904	AgnU0y.exe
2904	AgnU0y.exe
2904	AgnU0y.exe
2904	AgnU0y.exe
2904	AgnU0y.exe
2904	AgnU0y.exe
2904	AgnU0y.exe
2904	AgnU0y.exe
2904	AgnU0y.exe
2904	AgnU0y.exe
2904	AgnU0y.exe
2904	AgnU0y.exe
2904	AgnU0y.exe
2904	AgnU0y.exe
2904	AgnU0y.exe
2904	AgnU0y.exe
2904	AgnU0y.exe
2904	AgnU0y.exe
2904	AgnU0y.exe
2904	AgnU0y.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 4908	2904	AgnU0y.exe	107
PID 4908 wrote to memory of 2572	4908	cmd.exe	109
PID 4908 wrote to memory of 3640	4908	cmd.exe	110
PID 4908 wrote to memory of 4664	4908	cmd.exe	112
PID 2904 wrote to memory of 4992	2904	AgnU0y.exe	115
PID 4128 wrote to memory of 912	4128	cmd.exe	119
PID 2904 wrote to memory of 176	2904	AgnU0y.exe	120
PID 4992 wrote to memory of 2744	4992	cmd.exe	122
PID 176 wrote to memory of 660	176	cmd.exe	125
PID 4992 wrote to memory of 3568	4992	cmd.exe	126
PID 176 wrote to memory of 4936	176	cmd.exe	127
PID 2904 wrote to memory of 2752	2904	AgnU0y.exe	129
PID 4992 wrote to memory of 2664	4992	cmd.exe	131
PID 176 wrote to memory of 1108	176	cmd.exe	132
PID 2752 wrote to memory of 3180	2752	cmd.exe	133
PID 2752 wrote to memory of 3532	2752	cmd.exe	134
PID 2904 wrote to memory of 4224	2904	AgnU0y.exe	136
PID 2752 wrote to memory of 732	2752	cmd.exe	139
PID 4224 wrote to memory of 4840	4224	cmd.exe	140
PID 4224 wrote to memory of 684	4224	cmd.exe	141
PID 4224 wrote to memory of 1572	4224	cmd.exe	143
PID 2300 wrote to memory of 3756	2300	cmd.exe	146
PID 2384 wrote to memory of 2104	2384	cmd.exe	147
PID 2112 wrote to memory of 1752	2112	cmd.exe	148
PID 2904 wrote to memory of 2440	2904	AgnU0y.exe	149
PID 2440 wrote to memory of 4408	2440	Lr696Y.exe	151
PID 2440 wrote to memory of 3828	2440	Lr696Y.exe	154

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Lr696Y.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\insoft_v10.0.03.exe
"C:\Users\Admin\AppData\Local\Temp\insoft_v10.0.03.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4620

C:\Users\Public\ZQHU79\AgnU0y.exe
C:\Users\Public\ZQHU79\AgnU0y.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\ZQHU79\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4908
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\ZQHU79\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2572
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3640
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4664
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4992
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2744
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3568
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2664
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:176
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:660
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4936
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1108
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2752
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3180
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3532
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:732
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4224
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4840
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:684
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1572
- C:\Program Files (x86)\Lr696Y\Lr696Y.exe
  "C:\Program Files (x86)\Lr696Y\Lr696Y.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2440
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4408
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\Lr696Y" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:3828
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\Lr696Y" /inheritance:r
      4⤵
      Modifies file permissions
      PID:4396
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:2620
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:2360

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\ZQHU79" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\ZQHU79" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:912

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:2172

C:\Users\Public\ZQHU79\AgnU0y.exe
"C:\Users\Public\ZQHU79\AgnU0y.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2360

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3756

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1752

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2104

C:\Program Files (x86)\Lr696Y\Lr696Y.exe
"C:\Program Files (x86)\Lr696Y\Lr696Y.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2096

C:\Program Files (x86)\PgPPxuh\cetP0.exe
"C:\Program Files (x86)\PgPPxuh\cetP0.exe"
1⤵
PID:3800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Lr696Y.exe

Path C:\Program Files (x86)\Lr696Y\Lr696Y.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\Lr696Y\XPSPLOG.dll
Size 4.6MB
SHA256 eba1de8507d10ad026ef8a4573be4c4c5499fc886fbc6d982464b4a53f8a39df
MD5 3fca40bf1c20828907d67ba7b66bcd25
SHA1 89141f07805b98adf2e9a162d437df33c2e6ffc6
SHA512 c675dc73105ccd7d0817589be932923cde90b76c45fe1391de13b52a526818c9f0f773b2287098c9203abdb55c6a7532d9ff7961191fd182154f16ede168a392
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyV:BMWKfU+BcUTHCCCfqCiUffnV
TLSH
T1EA263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\Lr696Y\image.png
Size 5.0MB
SHA256 8fe10033ddfc2f78bb02e976409c4a8d6a28d7b28fc47c26b37ca66eceda0a54
MD5 e542de94634346eb498c8710f1f54c94
SHA1 5d3037f9d3240d24dc99a153513ad0299a379170
SHA512 20cbe10fa9590377b94e71bc31975991b95ea6fcc285ad58ea28b4977cb87adea7edb8820637149baa87e3ff9c6ac6f7cae3972317f844b7c87fa655d3014038
SSDEEP 98304:1FYrZdgzrNWII7jT4piZg5mNmtgJ+N2T4+C0l7ETp1qM/a6kX6aVmtK:SRIUjDgAk+jkn/IXhVaK
TLSH
T1EA3633605F0EE7EA8F3B6FEAA22B74C974895BDDC99C44054D76DC6D4DB8240B4208EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\Lr696Y\thumbs.db
Size 358KB
SHA256 737c3468cd61a31b19f66df22b02dd4cf613586604d9f4546bcc3d5a88609148
MD5 03d5953957ab98b7278f171991c27da0
SHA1 68d53abc9169867cda6439a564f35d2ccdd89022
SHA512 f22ed26d76cf1269559bab044ad04b3bfe21931c934fc01a73cfd7d6cb3b730f4ef3fd75d8045b87c48b114ccb67ea1bf130988b1f57ead31ce305573e0472f2
SSDEEP 6144:RiACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:g8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T18E74F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\PgPPxuh\XPSPLOG.dll
Size 4.6MB
SHA256 17ce6d9fce9f4e086246eda568cf67365ce466017be66f1b706f75ac6be0ffac
MD5 9c413cd5c440b7408b36b55f79b5a432
SHA1 b2e34953dddbe2b97813c8f787c93a3759dbbe1b
SHA512 eea821e56ce6d540af9cdb1c6ccf05d961a43264196eb61d8def2e42d59d48194d0e0b45c97c5f2bf3b07418d1868638d079477c2ddc9012deff2b512366933b
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyU:BMWKfU+BcUTHCCCfqCiUffnU
TLSH
T15D263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

AgnU0y.exe

Path C:\Users\Public\ZQHU79\AgnU0y.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\ZQHU79\UxEnhance64.dll
Size 3.1MB
SHA256 aa2a8b290c17dcba41e62b0d89c96223a2f371ee16b0eb39f0c041485e9d19b3
MD5 02fec28cf56bafac4744740575eb043b
SHA1 6da3c0d0e2539e69192080f99225fe218f3ac9b1
SHA512 5a9751cf06ea4829182b0552add7b2dabad1889051712978b8e2129431cd50095dfd2c34ba2e3e7d2f29ca9e89196365eb2c930a9040aabc1dcd1ef862cc107b
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+k:P9m29xx3Tiqt06ox6+z2rNNrKok
TLSH
T120E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\ZQHU79\adoresd.dat
Size 4.7MB
SHA256 eef544634063a51ec4ca7b046e5dfd984b8a46f2086a1c6a29c11d85bfce5fd2
MD5 0781ce4e6e61c1c8584402089a96dfcc
SHA1 52f1a970e31ae7d08840b23aef5cc5531d4f503d
SHA512 7b861078e6632729c2f3f0edb96593d609b54c86a27ba2c174fb4ec0f817dc387faee1ae333e140905aefbb4c71bf2971319014ea0f788e5a798838914ba8571
SSDEEP 98304:JKC/XwuPMlcCGQtZspbohHC0CYxm5YrKjaHhIVyU8zU9VQIr6K:JKClqhi0Cv54K2IVS0VQg
TLSH
T1733633C90DC0ED7D61810A8478A91192F6713147E2F1E6E8FD6C7E0AB87FD52E1A3B58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\ZQHU79\msadox.tb
Size 8KB
SHA256 8036d5b2af08e87e609f4283e151eab593ed021865246577c7b9d76c45989d92
MD5 a1a0179cee3fb9a2aa82caa75c3ff56b
SHA1 6f6c2ab7776d3fc3f5af08cbd17bb6893c9c0298
SHA512 608bc18b06bd2b8948caa8a595c84767e9c3adceb7eaf6c862338d25d4559f4d71a5984f4d258c7ff5cfd8b49f4651927569ca77922f7d8e6f390ccab7e7aba3
SSDEEP 192:lqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:lsZqZOXQ3uqvR2Kfzp
TLSH
T103029E05D7A20CC3D6016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DE2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2096-723-0x0000000074AD0000-0x000000007521A000-memory.dmp

Download

memory/2096-722-0x0000000000B90000-0x0000000000B91000-memory.dmp

Download

memory/2096-726-0x0000000003190000-0x0000000003993000-memory.dmp

Download

memory/2360-578-0x00007FF9F0E70000-0x00007FF9F138E000-memory.dmp

Download

memory/2360-585-0x00007FFA0FB80000-0x00007FFA0FB82000-memory.dmp

Download

memory/2360-591-0x00000241C9150000-0x00000241C99D7000-memory.dmp

Download

memory/2360-593-0x00000241C9150000-0x00000241C99D7000-memory.dmp

Download

memory/2360-594-0x00007FFA0FB70000-0x00007FFA0FB72000-memory.dmp

Download

memory/2360-592-0x00000241C9150000-0x00000241C99D7000-memory.dmp

Download

memory/2360-590-0x00000241C9150000-0x00000241C99D7000-memory.dmp

Download

memory/2360-586-0x00000241C9150000-0x00000241C99D7000-memory.dmp

Download

memory/2360-581-0x00000241C9150000-0x00000241C99D7000-memory.dmp

Download

memory/2440-666-0x0000000074AD0000-0x000000007521A000-memory.dmp

Download

memory/2440-674-0x0000000002F40000-0x0000000003743000-memory.dmp

Download

memory/2440-713-0x0000000002F40000-0x0000000003743000-memory.dmp

Download

memory/2440-689-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/2440-686-0x0000000002F40000-0x0000000003743000-memory.dmp

Download

memory/2440-684-0x0000000004940000-0x0000000004954000-memory.dmp

Download

memory/2440-677-0x0000000002F40000-0x0000000003743000-memory.dmp

Download

memory/2440-672-0x0000000000890000-0x0000000000891000-memory.dmp

Download

memory/2440-670-0x0000000002F40000-0x0000000003743000-memory.dmp

Download

memory/2440-665-0x0000000000860000-0x0000000000861000-memory.dmp

Download

memory/2904-535-0x000002A632970000-0x000002A6331F7000-memory.dmp

Download

memory/2904-557-0x000002A633660000-0x000002A6336EA000-memory.dmp

Download

memory/2904-543-0x000002A632970000-0x000002A6331F7000-memory.dmp

Download

memory/2904-544-0x000002A632970000-0x000002A6331F7000-memory.dmp

Download

memory/2904-542-0x000002A632970000-0x000002A6331F7000-memory.dmp

Download

memory/2904-538-0x000002A632970000-0x000002A6331F7000-memory.dmp

Download

memory/2904-529-0x00007FFA0FB70000-0x00007FFA0FB72000-memory.dmp

Download

memory/2904-564-0x000002A632970000-0x000002A6331F7000-memory.dmp

Download

memory/2904-549-0x000002A632970000-0x000002A6331F7000-memory.dmp

Download

memory/2904-554-0x000002A633200000-0x000002A63324E000-memory.dmp

Download

memory/2904-545-0x000002A632970000-0x000002A6331F7000-memory.dmp

Download

memory/2904-537-0x00007FFA0FB80000-0x00007FFA0FB82000-memory.dmp

Download

memory/2904-558-0x000002A633660000-0x000002A6336EA000-memory.dmp

Download

memory/2904-556-0x000002A633660000-0x000002A6336EA000-memory.dmp

Download

memory/2904-530-0x00007FF9F0E70000-0x00007FF9F138E000-memory.dmp

Download

memory/2904-555-0x000002A633660000-0x000002A6336EA000-memory.dmp

Download

memory/2904-563-0x000002A632970000-0x000002A6331F7000-memory.dmp

Download

memory/4620-0-0x00000000001F0000-0x00000000001FE000-memory.dmp

Download

memory/4620-523-0x00000000001F0000-0x00000000001FE000-memory.dmp

Download

memory/4620-524-0x00007FFA00EE0000-0x00007FFA00EF0000-memory.dmp

Download

memory/4620-503-0x00007FFA00EE0000-0x00007FFA00EF0000-memory.dmp

Download

memory/4620-1-0x0000000000510000-0x000000000051C000-memory.dmp

Download