e22010842a51902bb93a3f08a9318177335e839177b590515fda2575d7eec15c

Analysis

max time kernel
151s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/10/2026, 14:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.2.0.11.exe
Size 31.2MB
Sample261017-ra7dfsf14l
SHA256 e22010842a51902bb93a3f08a9318177335e839177b590515fda2575d7eec15c
MD5 dcbdeaab1a4f3357b80be1d6c56c890d
SHA1 2fdd3af8c07537118453f4d3e7f779f1606555d9
SHA512 1c1cd349d65c2664ac9c363f1fca44188c287a6e16d9272dd735251bf280be71286ae1877d60907972d4398dfacb2470be6073e1d4603fdf695cf98c7607ade4
SSDEEP 98304:qSY9ZWA9GfUIV3mr0XTOvdYmYVTuQ2dC1Imc/:RY9YA0x3y0qVOTn2Zmc/
TLSH
T1D877938BBF40CDC2F1168570E8A69BE06376ED758A71931731153F29BFBE1898DE1098
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence privilege_escalation trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	JXEytR.exe

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\vsdnBm = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2700	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	JXEytR.exe

Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1021.001

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	JXEytR.exe

Executes dropped EXE 7 IoCs

pid	Process
2828	q6QqFV.exe
4796	q6QqFV.exe
4292	JXEytR.exe
52	JXEytR.exe
2240	L0Fa2Fv.exe
2888	JXEytR.exe
1536	L0Fa2Fv.exe

Loads dropped DLL 7 IoCs

pid	Process
2828	q6QqFV.exe
4796	q6QqFV.exe
4292	JXEytR.exe
52	JXEytR.exe
2240	L0Fa2Fv.exe
2888	JXEytR.exe
1536	L0Fa2Fv.exe

Modifies file permissions 1 TTPs 15 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3208	icacls.exe
1552	icacls.exe
5976	icacls.exe
4524	icacls.exe
3160	icacls.exe
6088	icacls.exe
5060	icacls.exe
5876	icacls.exe
5400	icacls.exe
4092	icacls.exe
3876	icacls.exe
1928	icacls.exe
3552	icacls.exe
1740	icacls.exe
2396	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\vsdnBm\\q6QqFV.exe\""	q6QqFV.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Alibaba SecurityHealtha = "\"C:\\Program Files (x86)\\29yBEZ\\JXEytR.exe\""	JXEytR.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
2524	cmd.exe
4204	cmd.exe
2904	cmd.exe
4344	cmd.exe
5436	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	q6QqFV.exe

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\17qhl\image.png	JXEytR.exe
File created	C:\Program Files (x86)\17qhl\L0Fa2Fv.exe	JXEytR.exe
File created	C:\Program Files (x86)\29yBEZ\image.png	q6QqFV.exe
File opened for modification	C:\Program Files (x86)\29yBEZ\JXEytR.exe	q6QqFV.exe
File opened for modification	C:\Program Files (x86)\29yBEZ\XPSPLOG.dll	q6QqFV.exe
File opened for modification	C:\Program Files (x86)\17qhl\thumbs.db	JXEytR.exe
File opened for modification	C:\Program Files (x86)\29yBEZ	q6QqFV.exe
File opened for modification	C:\Program Files (x86)\29yBEZ\image.png	q6QqFV.exe
File opened for modification	C:\Program Files (x86)\17qhl\L0Fa2Fv.exe	JXEytR.exe
File created	C:\Program Files (x86)\17qhl\XPSPLOG.dll	JXEytR.exe
File created	C:\Program Files (x86)\29yBEZ\JXEytR.exe	q6QqFV.exe
File created	C:\Program Files (x86)\29yBEZ\thumbs.db	q6QqFV.exe
File opened for modification	C:\Program Files (x86)\17qhl	JXEytR.exe
File created	C:\Program Files (x86)\17qhl\image.png	JXEytR.exe
File created	C:\Program Files (x86)\17qhl\thumbs.db	JXEytR.exe
File opened for modification	C:\Program Files (x86)\17qhl\XPSPLOG.dll	JXEytR.exe
File created	C:\Program Files (x86)\29yBEZ\XPSPLOG.dll	q6QqFV.exe
File opened for modification	C:\Program Files (x86)\29yBEZ\thumbs.db	q6QqFV.exe

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	JXEytR.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Screensaver 1 TTPs 3 IoCs

Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.

persistence privilege_escalation

Screensaver

T1546.002

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Control Panel\Desktop\ScreenSaveActive = "0"	JXEytR.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	JXEytR.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Control Panel\Desktop\SCRNSAVE.EXE	JXEytR.exe

Executes a command shell one-liner 1 TTPs 21 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5640	cmd.exe
5768	cmd.exe
5336	cmd.exe
4944	cmd.exe
4072	cmd.exe
4580	cmd.exe
3336	cmd.exe
4172	cmd.exe
2312	cmd.exe
2928	cmd.exe
4740	cmd.exe
4756	cmd.exe
3088	cmd.exe
1100	cmd.exe
2572	cmd.exe
3664	cmd.exe
5160	cmd.exe
4332	cmd.exe
3728	cmd.exe
4224	cmd.exe
4400	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	JXEytR.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	JXEytR.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.2.0.11.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.2.0.11.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	q6QqFV.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	q6QqFV.exe

System Location Discovery: System Language Discovery 1 TTPs 37 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JXEytR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JXEytR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JXEytR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	L0Fa2Fv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	L0Fa2Fv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	JXEytR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	JXEytR.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Control Panel\Desktop\SCRNSAVE.EXE	JXEytR.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Control Panel\Desktop\ScreenSaveActive = "0"	JXEytR.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	JXEytR.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-560646293-820748483-2532804640-1000\Control Panel\Desktop\ScreenSaveTimeOut = "0"	JXEytR.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2512	schtasks.exe
3588	schtasks.exe
3876	schtasks.exe
4264	schtasks.exe
5996	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5392	install.2.0.11.exe
5392	install.2.0.11.exe
5392	install.2.0.11.exe
5392	install.2.0.11.exe
5392	install.2.0.11.exe
5392	install.2.0.11.exe
5392	install.2.0.11.exe
5392	install.2.0.11.exe
5392	install.2.0.11.exe
5392	install.2.0.11.exe
5392	install.2.0.11.exe
5392	install.2.0.11.exe
5392	install.2.0.11.exe
5392	install.2.0.11.exe
5392	install.2.0.11.exe
5392	install.2.0.11.exe
5392	install.2.0.11.exe
5392	install.2.0.11.exe
5392	install.2.0.11.exe
5392	install.2.0.11.exe
5392	install.2.0.11.exe
5392	install.2.0.11.exe
5392	install.2.0.11.exe
5392	install.2.0.11.exe
5392	install.2.0.11.exe
5392	install.2.0.11.exe
5392	install.2.0.11.exe
5392	install.2.0.11.exe
5392	install.2.0.11.exe
5392	install.2.0.11.exe
5392	install.2.0.11.exe
5392	install.2.0.11.exe
2828	q6QqFV.exe
2828	q6QqFV.exe
2828	q6QqFV.exe
2828	q6QqFV.exe
2828	q6QqFV.exe
2828	q6QqFV.exe
2828	q6QqFV.exe
2828	q6QqFV.exe
2828	q6QqFV.exe
2828	q6QqFV.exe
2828	q6QqFV.exe
2828	q6QqFV.exe
2828	q6QqFV.exe
2828	q6QqFV.exe
2828	q6QqFV.exe
2828	q6QqFV.exe
2828	q6QqFV.exe
2828	q6QqFV.exe
2828	q6QqFV.exe
2828	q6QqFV.exe
2828	q6QqFV.exe
2828	q6QqFV.exe
2828	q6QqFV.exe
2828	q6QqFV.exe
2828	q6QqFV.exe
2828	q6QqFV.exe
2828	q6QqFV.exe
2828	q6QqFV.exe
2828	q6QqFV.exe
2828	q6QqFV.exe
2828	q6QqFV.exe
2828	q6QqFV.exe

Suspicious behavior: LoadsDriver 8 IoCs

pid	Process
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	2700	powershell.exe
Token: SeIncreaseQuotaPrivilege	2700	powershell.exe
Token: SeSecurityPrivilege	2700	powershell.exe
Token: SeTakeOwnershipPrivilege	2700	powershell.exe
Token: SeLoadDriverPrivilege	2700	powershell.exe
Token: SeSystemProfilePrivilege	2700	powershell.exe
Token: SeSystemtimePrivilege	2700	powershell.exe
Token: SeProfSingleProcessPrivilege	2700	powershell.exe
Token: SeIncBasePriorityPrivilege	2700	powershell.exe
Token: SeCreatePagefilePrivilege	2700	powershell.exe
Token: SeBackupPrivilege	2700	powershell.exe
Token: SeRestorePrivilege	2700	powershell.exe
Token: SeShutdownPrivilege	2700	powershell.exe
Token: SeDebugPrivilege	2700	powershell.exe
Token: SeSystemEnvironmentPrivilege	2700	powershell.exe
Token: SeRemoteShutdownPrivilege	2700	powershell.exe
Token: SeUndockPrivilege	2700	powershell.exe
Token: SeManageVolumePrivilege	2700	powershell.exe
Token: 33	2700	powershell.exe
Token: 34	2700	powershell.exe
Token: 35	2700	powershell.exe
Token: 36	2700	powershell.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 2700	2828	q6QqFV.exe	92
PID 2828 wrote to memory of 2904	2828	q6QqFV.exe	95
PID 2904 wrote to memory of 2512	2904	cmd.exe	97
PID 2828 wrote to memory of 4344	2828	q6QqFV.exe	98
PID 2904 wrote to memory of 5048	2904	cmd.exe	99
PID 2828 wrote to memory of 5436	2828	q6QqFV.exe	103
PID 4344 wrote to memory of 3588	4344	cmd.exe	104
PID 2904 wrote to memory of 1548	2904	cmd.exe	107
PID 5436 wrote to memory of 3876	5436	cmd.exe	108
PID 4344 wrote to memory of 4840	4344	cmd.exe	109
PID 5436 wrote to memory of 4324	5436	cmd.exe	111
PID 4344 wrote to memory of 5468	4344	cmd.exe	112
PID 2828 wrote to memory of 2524	2828	q6QqFV.exe	113
PID 5436 wrote to memory of 4540	5436	cmd.exe	115
PID 2524 wrote to memory of 4264	2524	cmd.exe	116
PID 2524 wrote to memory of 3488	2524	cmd.exe	117
PID 2524 wrote to memory of 1712	2524	cmd.exe	119
PID 2828 wrote to memory of 4204	2828	q6QqFV.exe	120
PID 4204 wrote to memory of 5996	4204	cmd.exe	122
PID 4204 wrote to memory of 4652	4204	cmd.exe	123
PID 4204 wrote to memory of 1536	4204	cmd.exe	125
PID 5640 wrote to memory of 6008	5640	cmd.exe	131
PID 4072 wrote to memory of 4636	4072	cmd.exe	132
PID 4944 wrote to memory of 472	4944	cmd.exe	133
PID 4332 wrote to memory of 3956	4332	cmd.exe	134
PID 2828 wrote to memory of 4292	2828	q6QqFV.exe	135
PID 4292 wrote to memory of 5768	4292	JXEytR.exe	139
PID 4292 wrote to memory of 4580	4292	JXEytR.exe	138
PID 4292 wrote to memory of 5336	4292	JXEytR.exe	142
PID 5768 wrote to memory of 3208	5768	cmd.exe	145
PID 4292 wrote to memory of 5160	4292	JXEytR.exe	146
PID 5160 wrote to memory of 3552	5160	cmd.exe	148
PID 4292 wrote to memory of 4756	4292	JXEytR.exe	149
PID 4756 wrote to memory of 5060	4756	cmd.exe	151
PID 4292 wrote to memory of 3728	4292	JXEytR.exe	152
PID 3728 wrote to memory of 1740	3728	cmd.exe	154
PID 4292 wrote to memory of 3336	4292	JXEytR.exe	155
PID 3336 wrote to memory of 5876	3336	cmd.exe	157
PID 4292 wrote to memory of 4400	4292	JXEytR.exe	158
PID 4400 wrote to memory of 4524	4400	cmd.exe	160
PID 4292 wrote to memory of 4740	4292	JXEytR.exe	161
PID 4740 wrote to memory of 5400	4740	cmd.exe	163
PID 4292 wrote to memory of 3088	4292	JXEytR.exe	164
PID 3088 wrote to memory of 2396	3088	cmd.exe	166
PID 4292 wrote to memory of 3664	4292	JXEytR.exe	167
PID 3664 wrote to memory of 1552	3664	cmd.exe	169
PID 4292 wrote to memory of 2928	4292	JXEytR.exe	170
PID 2928 wrote to memory of 4092	2928	cmd.exe	172
PID 4292 wrote to memory of 1100	4292	JXEytR.exe	173
PID 1100 wrote to memory of 3876	1100	cmd.exe	175
PID 4292 wrote to memory of 2572	4292	JXEytR.exe	176
PID 2572 wrote to memory of 1928	2572	cmd.exe	178
PID 4292 wrote to memory of 2312	4292	JXEytR.exe	179
PID 2312 wrote to memory of 3160	2312	cmd.exe	181
PID 4292 wrote to memory of 4172	4292	JXEytR.exe	182
PID 4172 wrote to memory of 6088	4172	cmd.exe	184
PID 4292 wrote to memory of 4224	4292	JXEytR.exe	185
PID 4224 wrote to memory of 5976	4224	cmd.exe	187

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	JXEytR.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.2.0.11.exe
"C:\Users\Admin\AppData\Local\Temp\install.2.0.11.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:5392

C:\Users\Public\vsdnBm\q6QqFV.exe
"C:\Users\Public\vsdnBm\q6QqFV.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2700
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\vsdnBm\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2904
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\vsdnBm\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2512
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5048
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1548
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4344
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3588
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4840
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5468
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5436
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3876
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4324
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4540
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2524
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4264
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3488
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1712
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4204
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5996
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4652
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1536
- C:\Program Files (x86)\29yBEZ\JXEytR.exe
  "C:\Program Files (x86)\29yBEZ\JXEytR.exe"
  2⤵
  - UAC bypass
  - Drops file in Drivers directory
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Enumerates video capture drivers
  - Event Triggered Execution: Screensaver
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies Control Panel
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4292
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4580
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\29yBEZ" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5768
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\29yBEZ" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3208
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5336
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\29yBEZ" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5160
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\29yBEZ" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3552
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\29yBEZ" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4756
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\29yBEZ" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5060
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\29yBEZ\JXEytR.exe" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3728
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\29yBEZ\JXEytR.exe" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1740
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\29yBEZ\JXEytR.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3336
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\29yBEZ\JXEytR.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5876
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\29yBEZ\JXEytR.exe" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4400
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\29yBEZ\JXEytR.exe" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4524
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\29yBEZ\image.png" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4740
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\29yBEZ\image.png" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5400
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\29yBEZ\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3088
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\29yBEZ\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2396
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\29yBEZ\image.png" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3664
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\29yBEZ\image.png" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1552
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\29yBEZ\thumbs.db" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2928
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\29yBEZ\thumbs.db" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4092
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\29yBEZ\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1100
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\29yBEZ\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3876
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\29yBEZ\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2572
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\29yBEZ\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1928
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\29yBEZ\XPSPLOG.dll" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2312
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\29yBEZ\XPSPLOG.dll" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3160
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\29yBEZ\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4172
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\29yBEZ\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:6088
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\29yBEZ\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4224
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\29yBEZ\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5976

C:\Users\Public\vsdnBm\q6QqFV.exe
"C:\Users\Public\vsdnBm\q6QqFV.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4796

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\vsdnBm" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4944
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\vsdnBm" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:472

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:1272

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4072
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4636

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5640
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:6008

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4332
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3956

C:\Program Files (x86)\29yBEZ\JXEytR.exe
"C:\Program Files (x86)\29yBEZ\JXEytR.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:52

C:\Program Files (x86)\17qhl\L0Fa2Fv.exe
"C:\Program Files (x86)\17qhl\L0Fa2Fv.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2240

C:\Program Files (x86)\29yBEZ\JXEytR.exe
"C:\Program Files (x86)\29yBEZ\JXEytR.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2888

C:\Program Files (x86)\17qhl\L0Fa2Fv.exe
"C:\Program Files (x86)\17qhl\L0Fa2Fv.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Remote Services

T1021

Remote Desktop Protocol

T1021.001

Collection

Video Capture

T1125

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

XPSPLOG.dll

Path C:\Program Files (x86)\17qhl\XPSPLOG.dll
Size 4.6MB
SHA256 0aff57bef43b0746266131d00618495b5c43d9edd4244439439856201cc1220c
MD5 57e2a1c966fdaa37d0902c0905944d15
SHA1 bae67c4924c07e06df57cf0c38e1f774c92ccd0b
SHA512 1de52ead5b5a9ba537f85862da74f1780fe0c2872293d031105d64385be9c9905e4ee1e23cc0fe8701dd37afbc12c62768206529be30048b3d5d7ae939a92d05
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyc:BMWKfU+BcUTHCCCfqCiUffnc
TLSH
T12F263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\17qhl\image.png
Size 4.8MB
SHA256 2e668f560ead128e6c64d6e9da62e24789b6e5f3770ebacbade55c02b13cd4e4
MD5 f23a7bc1580ebd6e7ed386ba61dc1538
SHA1 42562cdbbbf1d7a2fd73bbc69a7d030cf8b0ff7c
SHA512 0298976dd11a6c00c892c1a0db6aa6ff54caccb5fe892fe629fb0f06b89d5047c41314e72953cfc68b383e3d66205ee403abf818fec87617d830a97e7e59268b
SSDEEP 98304:J/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:JMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T1EC36334FE6EFBED9C39CF7EA71098A30D63A4FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JXEytR.exe

Path C:\Program Files (x86)\29yBEZ\JXEytR.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\29yBEZ\XPSPLOG.dll
Size 4.6MB
SHA256 a61755298e7773b54c961332595ea184e7a17e75b606233d2d026279fc800eb8
MD5 f3dc52089e8b772009c8535062f7df27
SHA1 0341c5aae9602bba03fc11bf06dfff587a0e9770
SHA512 a8ce693a37b03e5fe058934978abdcc401ac9275b7ebdba1129cef10852cb3db796851b628772bd72fe06d281a033341a49f5a5f7a75af3ade132e45e4558a37
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmy7:BMWKfU+BcUTHCCCfqCiUffn7
TLSH
T14D263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\29yBEZ\image.png
Size 4.8MB
SHA256 0b5fa38c5243c49628c29e70f4c84462c80e888b264292321bcc54ae5845d1d9
MD5 3f539e436b5e2b48f00f56c2a0b52c86
SHA1 4b5a98ca94eb8b780ed64c787e9aa756e0072d93
SHA512 61f0273183e380c52e796b57209b6d08bd4dd7212a1ece2a11bc083b769e6bf0286187e11dfc801afac00e860bc0b42721778b5a07958d2b0111fde3c78ea80d
SSDEEP 98304:H/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:HMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T1B136334FE6EFBED9C39CF7EA71098A30D63A8FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\29yBEZ\thumbs.db
Size 358KB
SHA256 3a7d285d23e3e208f20ec58e84763d804d2a4f3654b5d1df37eb23b33a4ed7c0
MD5 9f51af666ff26603b5ec8f24fd041262
SHA1 6e12839370c60152f9776f360365a9e3ce9b609b
SHA512 d3c3233319a1dfc2a31e5fee3c1abb030e9fb30e9b3f8046282feba7e3bee91c7dba99c504d15ed6cd6e3bdf1aa66fdf7b41732737400e4f62c587e5ae02f87b
SSDEEP 6144:6iACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:l8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T10274F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 b3c24fbce118ce6c131f97b93163c0436c0e9b3271f84711cf1100aa7501bdcb
MD5 65c9b50bc8b07b6840e570907c041c20
SHA1 0eb395d81afd70cccfe12e785c6a0d91d191f57a
SHA512 1a06a33dec942e0c6502754f09a5a09c35f1712fbe4f85c64646ae3c07ab9f141d5428d363672bd2cde014348a3cf81e9772e42fc883484ffdd069224f408710
TLSH
T1D23174BB6F6968829F758DA414CEF5322DF4F1806CC9519A6112D8589F0C3F12E0E91D
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 a81d86cf4810115a1125c2f3009ac381281099d7c0d466a4d0a510a2cc5a7928
MD5 44fbd063850a8a61c88389ec2a7b9103
SHA1 dc35a0505f39c4f04ca7498ee4d128bf8591ca0b
SHA512 bd588cd1076f98be1c404ee14f38b12d77ef48e5da55e0d019cfea3243838ecfacdd3e7733fede7ba36729a7cdec76a0ee28bf354dc0e06b57dd9f4f3f51429a
TLSH
T14431D4978E394046CF085BB867D5D13BBCF15068ACEC4842763EC1AB6649B739F86400
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 c5976947d4d0907925fab06adac47d6bf39388addf21c763997d87f1a7d0caee
MD5 674aeb3f75aaa2cd122a4ad9c384efdf
SHA1 a7b1dc0525de883c7df562e9a1648c8a4ac884ba
SHA512 cd1fa1e41d48244201a6875485fc540ab7c023d460712581fdcef7dd7092189019517af94035b43fd1b4666e16bc9e9d0730b56e9cb589bf14a54b5c5cb3ec2a
TLSH
T147F05C14587C513DF433DE3C8ACF39660A6BFA091403C1A447B18B09A552E562D5177E
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 c884b36745d59eeeaf806ca739fc113a68f2dc90cb2e0195b4e3ef8ff5ef3e9b
MD5 5c73de9ea5eb965a61a0f2a48f0f5f9c
SHA1 c0666bde360200beeaf713f6e52b0807c448de55
SHA512 63ee26c657ad176f6d30112dd7af52050c9dcd4c5210319e83c9a12b2f14891db2a0a609d686dee854a13aad71d7fc9bc5061adad07b4d56c2ea81f65eecc0b1
TLSH
T1C2F0A33506D9811FF0BBA2FCC7CB76F24F36F5220406527D0EBA43445A51D050C4226D
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_4bgbpsls.1mx.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4bgbpsls.1mx.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

UxEnhance64.dll

Path C:\Users\Public\vsdnBm\UxEnhance64.dll
Size 3.1MB
SHA256 b0d3973dd15b5c2a01686ac690b212a240fcee6d40bd8f73190e5f09aee62dab
MD5 d8012b01cc4963c6b1d099756ba40e5c
SHA1 dd4c4f074f0730e327a323ec4792eef09bcffb4c
SHA512 8dfc534954358d151762274ee0df535d349d7773aa0149e90db60f65105b1479288491fb46afef40141787d76877c1cc09fc8c87e0f8609f8a050ba3286b94e0
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+s:P9m29xx3Tiqt06ox6+z2rNNrKos
TLSH
T1E3E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\vsdnBm\adoresd.dat
Size 4.7MB
SHA256 1862f9d28846cdb7632050591dbb8490bda35d8c12e5a35f664b532feb0b3563
MD5 a2a59689185e6dfa22eb4587db4b4f17
SHA1 513b1cd6aebc667d28aad4f0b2d5f5e7a4050ca1
SHA512 ffcb69d24b334c8ee7e0427a329c359ec2a307e2541cd32a699f904c168de38cb6aefcdc1bb7a2e9c53ff31e010165a74caf5f35edc625fbff8eec1ab19e8436
SSDEEP 98304:VKC/XwuPMlcCGQtZspbohHC0CYxm5YrKjaHhIVyU8zU9VQIr6K:VKClqhi0Cv54K2IVS0VQg
TLSH
T1853633C90DC0ED7D61810A8478A91192F6713147E2F1E6E8FD6C7E0AB87FD52E1A3B58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\vsdnBm\msadox.tb
Size 8KB
SHA256 17a2bc8c33f843c55748339aac91495e36bef2c08679a2d887b6e419bb3719ee
MD5 3d44c97caa6da2e710939afaf270dd37
SHA1 e88daf888b24da2994176f1845048f01bfb5c510
SHA512 230dc028098b170bb8268e53fcdd1e01e7e80ac6eff643c23cdb9da165be33b25cc68e5ec14ef5d460f71505a9cbd161cc96e16271b53d10c688fc93142fb2c0
SSDEEP 192:tqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:tsZqZOXQ3uqvR2Kfzp
TLSH
T1CC029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

q6QqFV.exe

Path C:\Users\Public\vsdnBm\q6QqFV.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/52-728-0x0000000074F00000-0x000000007564A000-memory.dmp

Download

memory/52-727-0x0000000002210000-0x0000000002211000-memory.dmp

Download

memory/1536-762-0x0000000000E30000-0x0000000000E31000-memory.dmp

Download

memory/1536-764-0x0000000073B20000-0x000000007426A000-memory.dmp

Download

memory/1536-767-0x00000000037A0000-0x0000000003F7D000-memory.dmp

Download

memory/1536-774-0x0000000000E50000-0x0000000000E51000-memory.dmp

Download

memory/1536-775-0x00000000037A0000-0x0000000003F7D000-memory.dmp

Download

memory/1536-778-0x0000000000E30000-0x0000000000E31000-memory.dmp

Download

memory/2240-736-0x0000000002340000-0x0000000002341000-memory.dmp

Download

memory/2240-744-0x0000000002EA0000-0x000000000367D000-memory.dmp

Download

memory/2240-737-0x0000000073B20000-0x000000007426A000-memory.dmp

Download

memory/2240-747-0x0000000002340000-0x0000000002341000-memory.dmp

Download

memory/2240-741-0x0000000002EA0000-0x000000000367D000-memory.dmp

Download

memory/2240-743-0x0000000002370000-0x0000000002371000-memory.dmp

Download

memory/2700-604-0x0000020A352E0000-0x0000020A352FE000-memory.dmp

Download

memory/2700-601-0x0000020A350B0000-0x0000020A350D2000-memory.dmp

Download

memory/2700-606-0x0000020A353C0000-0x0000020A353CA000-memory.dmp

Download

memory/2700-605-0x0000020A35300000-0x0000020A353B2000-memory.dmp

Download

memory/2828-559-0x000001E8A9630000-0x000001E8A96BA000-memory.dmp

Download

memory/2828-539-0x000001E8AA110000-0x000001E8AA997000-memory.dmp

Download

memory/2828-561-0x000001E8A9630000-0x000001E8A96BA000-memory.dmp

Download

memory/2828-546-0x000001E8AA110000-0x000001E8AA997000-memory.dmp

Download

memory/2828-545-0x000001E8AA110000-0x000001E8AA997000-memory.dmp

Download

memory/2828-530-0x00007FF9BC610000-0x00007FF9BC612000-memory.dmp

Download

memory/2828-560-0x000001E8A9630000-0x000001E8A96BA000-memory.dmp

Download

memory/2828-566-0x000001E8AA110000-0x000001E8AA997000-memory.dmp

Download

memory/2828-544-0x000001E8AA110000-0x000001E8AA997000-memory.dmp

Download

memory/2828-543-0x000001E8AA110000-0x000001E8AA997000-memory.dmp

Download

memory/2828-531-0x00007FF999E40000-0x00007FF99A35E000-memory.dmp

Download

memory/2828-563-0x000001E8AA110000-0x000001E8AA997000-memory.dmp

Download

memory/2828-556-0x000001E8A7DA0000-0x000001E8A7DEE000-memory.dmp

Download

memory/2828-536-0x000001E8AA110000-0x000001E8AA997000-memory.dmp

Download

memory/2828-558-0x000001E8A9630000-0x000001E8A96BA000-memory.dmp

Download

memory/2828-538-0x00007FF9BC620000-0x00007FF9BC622000-memory.dmp

Download

memory/2828-551-0x000001E8AA110000-0x000001E8AA997000-memory.dmp

Download

memory/2888-757-0x0000000000C10000-0x0000000000C11000-memory.dmp

Download

memory/2888-758-0x0000000074F00000-0x000000007564A000-memory.dmp

Download

memory/2888-761-0x00000000033F0000-0x0000000003BCD000-memory.dmp

Download

memory/2888-770-0x00000000033F0000-0x0000000003BCD000-memory.dmp

Download

memory/2888-769-0x0000000000C30000-0x0000000000C31000-memory.dmp

Download

memory/2888-773-0x0000000000C10000-0x0000000000C11000-memory.dmp

Download

memory/4292-749-0x0000000005260000-0x0000000005299000-memory.dmp

Download

memory/4292-709-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/4292-673-0x0000000000CE0000-0x0000000000CE1000-memory.dmp

Download

memory/4292-712-0x0000000003260000-0x0000000003A3D000-memory.dmp

Download

memory/4292-704-0x0000000003260000-0x0000000003A3D000-memory.dmp

Download

memory/4292-692-0x00000000027C0000-0x00000000027D4000-memory.dmp

Download

memory/4292-734-0x0000000003260000-0x0000000003A3D000-memory.dmp

Download

memory/4292-685-0x0000000003260000-0x0000000003A3D000-memory.dmp

Download

memory/4292-681-0x0000000003260000-0x0000000003A3D000-memory.dmp

Download

memory/4292-680-0x0000000000D00000-0x0000000000D01000-memory.dmp

Download

memory/4292-678-0x0000000003260000-0x0000000003A3D000-memory.dmp

Download

memory/4292-674-0x0000000074F00000-0x000000007564A000-memory.dmp

Download

memory/4796-591-0x00007FF9BC610000-0x00007FF9BC612000-memory.dmp

Download

memory/4796-587-0x00000227EE090000-0x00000227EE917000-memory.dmp

Download

memory/4796-574-0x00007FF999E40000-0x00007FF99A35E000-memory.dmp

Download

memory/4796-582-0x00007FF9BC620000-0x00007FF9BC622000-memory.dmp

Download

memory/4796-588-0x00000227EE090000-0x00000227EE917000-memory.dmp

Download

memory/4796-583-0x00000227EE090000-0x00000227EE917000-memory.dmp

Download

memory/4796-580-0x00000227EE090000-0x00000227EE917000-memory.dmp

Download

memory/4796-589-0x00000227EE090000-0x00000227EE917000-memory.dmp

Download

memory/4796-590-0x00000227EE090000-0x00000227EE917000-memory.dmp

Download

memory/5392-525-0x00007FF9B08B0000-0x00007FF9B08C2000-memory.dmp

Download

memory/5392-524-0x00000000008A0000-0x00000000008AE000-memory.dmp

Download

memory/5392-0-0x00000000008A0000-0x00000000008AE000-memory.dmp

Download

memory/5392-504-0x00007FF9B08B0000-0x00007FF9B08C2000-memory.dmp

Download

memory/5392-2-0x00000000008B0000-0x00000000008BC000-memory.dmp

Download

memory/5392-1-0x00000000008A0000-0x00000000008AE000-memory.dmp

Download