1a9329e07432690ecc88836f85f2aaff45cc845d3a126a6090b336764aedf690

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 10:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.2.0.04.exe
Size 30.5MB
Sample261023-ma3ytacf38
SHA256 1a9329e07432690ecc88836f85f2aaff45cc845d3a126a6090b336764aedf690
MD5 2ebca74e9502b1df7849ca33ee5eaf63
SHA1 9640c81926ff2d089128c0dfb9e451577d542fdf
SHA512 67312c5af5ccf0832662f83825548aa1c125cd6eed867e56e2bc93d9394d6353f83440dbc6e2132890b128c76ab60fe19782afd247bf01199f7d48768d95d5cc
SSDEEP 196608:sZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYt:TC/p+HuPOc4c
TLSH
T1AD67181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence privilege_escalation trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	zrNbgs.exe

Windows security bypass 2 TTPs 6 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\bgJbOb = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1572	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	zrNbgs.exe

Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1021.001

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	zrNbgs.exe

Executes dropped EXE 8 IoCs

pid	Process
3608	oS8jO3.exe
4252	oS8jO3.exe
4600	zrNbgs.exe
5480	zrNbgs.exe
3344	zrNbgs.exe
2948	ukswK6.exe
1552	ukswK6.exe
5464	zrNbgs.exe

Loads dropped DLL 8 IoCs

pid	Process
3608	oS8jO3.exe
4252	oS8jO3.exe
4600	zrNbgs.exe
5480	zrNbgs.exe
3344	zrNbgs.exe
2948	ukswK6.exe
1552	ukswK6.exe
5464	zrNbgs.exe

Modifies file permissions 1 TTPs 15 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3404	icacls.exe
2624	icacls.exe
5636	icacls.exe
4468	icacls.exe
5988	icacls.exe
5212	icacls.exe
4252	icacls.exe
5648	icacls.exe
6008	icacls.exe
5076	icacls.exe
6080	icacls.exe
3224	icacls.exe
1228	icacls.exe
2252	icacls.exe
2836	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\bgJbOb\\oS8jO3.exe\""	oS8jO3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Alibaba SecurityHealtha = "\"C:\\Program Files (x86)\\zrNbgs\\zrNbgs.exe\""	zrNbgs.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
4604	cmd.exe
5764	cmd.exe
5916	cmd.exe
5124	cmd.exe
1512	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	oS8jO3.exe

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\BJ2f2Geo\XPSPLOG.dll	zrNbgs.exe
File created	C:\Program Files (x86)\zrNbgs\zrNbgs.exe	oS8jO3.exe
File opened for modification	C:\Program Files (x86)\zrNbgs\XPSPLOG.dll	oS8jO3.exe
File opened for modification	C:\Program Files (x86)\zrNbgs\image.png	oS8jO3.exe
File opened for modification	C:\Program Files (x86)\BJ2f2Geo\image.png	zrNbgs.exe
File opened for modification	C:\Program Files (x86)\BJ2f2Geo\thumbs.db	zrNbgs.exe
File created	C:\Program Files (x86)\zrNbgs\XPSPLOG.dll	oS8jO3.exe
File created	C:\Program Files (x86)\zrNbgs\thumbs.db	oS8jO3.exe
File opened for modification	C:\Program Files (x86)\zrNbgs\zrNbgs.exe	oS8jO3.exe
File created	C:\Program Files (x86)\BJ2f2Geo\image.png	zrNbgs.exe
File created	C:\Program Files (x86)\BJ2f2Geo\thumbs.db	zrNbgs.exe
File created	C:\Program Files (x86)\BJ2f2Geo\ukswK6.exe	zrNbgs.exe
File opened for modification	C:\Program Files (x86)\zrNbgs	oS8jO3.exe
File created	C:\Program Files (x86)\zrNbgs\image.png	oS8jO3.exe
File opened for modification	C:\Program Files (x86)\BJ2f2Geo\ukswK6.exe	zrNbgs.exe
File opened for modification	C:\Program Files (x86)\zrNbgs\thumbs.db	oS8jO3.exe
File opened for modification	C:\Program Files (x86)\BJ2f2Geo	zrNbgs.exe
File created	C:\Program Files (x86)\BJ2f2Geo\XPSPLOG.dll	zrNbgs.exe

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	zrNbgs.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Screensaver 1 TTPs 3 IoCs

Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.

persistence privilege_escalation

Screensaver

T1546.002

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Control Panel\Desktop\ScreenSaveActive = "0"	zrNbgs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	zrNbgs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Control Panel\Desktop\SCRNSAVE.EXE	zrNbgs.exe

Executes a command shell one-liner 1 TTPs 20 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2184	cmd.exe
4304	cmd.exe
2680	cmd.exe
5440	cmd.exe
4856	cmd.exe
4152	cmd.exe
816	cmd.exe
2648	cmd.exe
800	cmd.exe
1316	cmd.exe
3532	cmd.exe
2708	cmd.exe
2920	cmd.exe
3416	cmd.exe
3560	cmd.exe
1892	cmd.exe
2320	cmd.exe
52	cmd.exe
2860	cmd.exe
5932	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.2.0.04.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.2.0.04.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	oS8jO3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	oS8jO3.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	zrNbgs.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	zrNbgs.exe

System Location Discovery: System Language Discovery 1 TTPs 38 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zrNbgs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zrNbgs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ukswK6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zrNbgs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zrNbgs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ukswK6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	zrNbgs.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	zrNbgs.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Control Panel\Desktop\SCRNSAVE.EXE	zrNbgs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Control Panel\Desktop\ScreenSaveActive = "0"	zrNbgs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	zrNbgs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Control Panel\Desktop\ScreenSaveTimeOut = "0"	zrNbgs.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2996	schtasks.exe
5176	schtasks.exe
5600	schtasks.exe
3224	schtasks.exe
3280	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5696	install.2.0.04.exe
5696	install.2.0.04.exe
5696	install.2.0.04.exe
5696	install.2.0.04.exe
5696	install.2.0.04.exe
5696	install.2.0.04.exe
5696	install.2.0.04.exe
5696	install.2.0.04.exe
5696	install.2.0.04.exe
5696	install.2.0.04.exe
5696	install.2.0.04.exe
5696	install.2.0.04.exe
5696	install.2.0.04.exe
5696	install.2.0.04.exe
5696	install.2.0.04.exe
5696	install.2.0.04.exe
5696	install.2.0.04.exe
5696	install.2.0.04.exe
5696	install.2.0.04.exe
5696	install.2.0.04.exe
5696	install.2.0.04.exe
5696	install.2.0.04.exe
5696	install.2.0.04.exe
5696	install.2.0.04.exe
5696	install.2.0.04.exe
5696	install.2.0.04.exe
5696	install.2.0.04.exe
5696	install.2.0.04.exe
5696	install.2.0.04.exe
5696	install.2.0.04.exe
5696	install.2.0.04.exe
5696	install.2.0.04.exe
3608	oS8jO3.exe
3608	oS8jO3.exe
3608	oS8jO3.exe
3608	oS8jO3.exe
3608	oS8jO3.exe
3608	oS8jO3.exe
3608	oS8jO3.exe
3608	oS8jO3.exe
3608	oS8jO3.exe
3608	oS8jO3.exe
3608	oS8jO3.exe
3608	oS8jO3.exe
3608	oS8jO3.exe
3608	oS8jO3.exe
3608	oS8jO3.exe
3608	oS8jO3.exe
3608	oS8jO3.exe
3608	oS8jO3.exe
3608	oS8jO3.exe
3608	oS8jO3.exe
3608	oS8jO3.exe
3608	oS8jO3.exe
3608	oS8jO3.exe
3608	oS8jO3.exe
3608	oS8jO3.exe
3608	oS8jO3.exe
3608	oS8jO3.exe
3608	oS8jO3.exe
3608	oS8jO3.exe
3608	oS8jO3.exe
3608	oS8jO3.exe
3608	oS8jO3.exe

Suspicious behavior: LoadsDriver 8 IoCs

pid	Process
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	1572	powershell.exe
Token: SeIncreaseQuotaPrivilege	1572	powershell.exe
Token: SeSecurityPrivilege	1572	powershell.exe
Token: SeTakeOwnershipPrivilege	1572	powershell.exe
Token: SeLoadDriverPrivilege	1572	powershell.exe
Token: SeSystemProfilePrivilege	1572	powershell.exe
Token: SeSystemtimePrivilege	1572	powershell.exe
Token: SeProfSingleProcessPrivilege	1572	powershell.exe
Token: SeIncBasePriorityPrivilege	1572	powershell.exe
Token: SeCreatePagefilePrivilege	1572	powershell.exe
Token: SeBackupPrivilege	1572	powershell.exe
Token: SeRestorePrivilege	1572	powershell.exe
Token: SeShutdownPrivilege	1572	powershell.exe
Token: SeDebugPrivilege	1572	powershell.exe
Token: SeSystemEnvironmentPrivilege	1572	powershell.exe
Token: SeRemoteShutdownPrivilege	1572	powershell.exe
Token: SeUndockPrivilege	1572	powershell.exe
Token: SeManageVolumePrivilege	1572	powershell.exe
Token: 33	1572	powershell.exe
Token: 34	1572	powershell.exe
Token: 35	1572	powershell.exe
Token: 36	1572	powershell.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 3608 wrote to memory of 1572	3608	oS8jO3.exe	91
PID 3608 wrote to memory of 4604	3608	oS8jO3.exe	93
PID 4604 wrote to memory of 2996	4604	cmd.exe	96
PID 4604 wrote to memory of 4760	4604	cmd.exe	97
PID 3608 wrote to memory of 5764	3608	oS8jO3.exe	100
PID 4604 wrote to memory of 3732	4604	cmd.exe	102
PID 3608 wrote to memory of 5916	3608	oS8jO3.exe	104
PID 5764 wrote to memory of 5176	5764	cmd.exe	106
PID 5916 wrote to memory of 5600	5916	cmd.exe	107
PID 3608 wrote to memory of 5124	3608	oS8jO3.exe	108
PID 5764 wrote to memory of 3456	5764	cmd.exe	110
PID 5916 wrote to memory of 5824	5916	cmd.exe	111
PID 5124 wrote to memory of 3224	5124	cmd.exe	112
PID 5764 wrote to memory of 2680	5764	cmd.exe	114
PID 5916 wrote to memory of 2896	5916	cmd.exe	115
PID 5124 wrote to memory of 1880	5124	cmd.exe	116
PID 5124 wrote to memory of 1228	5124	cmd.exe	117
PID 3608 wrote to memory of 1512	3608	oS8jO3.exe	118
PID 1512 wrote to memory of 3280	1512	cmd.exe	120
PID 1512 wrote to memory of 3524	1512	cmd.exe	121
PID 1512 wrote to memory of 4404	1512	cmd.exe	123
PID 1316 wrote to memory of 1552	1316	cmd.exe	127
PID 800 wrote to memory of 1908	800	cmd.exe	129
PID 1892 wrote to memory of 1172	1892	cmd.exe	128
PID 3608 wrote to memory of 4600	3608	oS8jO3.exe	131
PID 4600 wrote to memory of 2320	4600	zrNbgs.exe	134
PID 4600 wrote to memory of 3532	4600	zrNbgs.exe	133
PID 4600 wrote to memory of 816	4600	zrNbgs.exe	137
PID 2320 wrote to memory of 2836	2320	cmd.exe	141
PID 4600 wrote to memory of 52	4600	zrNbgs.exe	143
PID 52 wrote to memory of 6080	52	cmd.exe	145
PID 4600 wrote to memory of 5932	4600	zrNbgs.exe	146
PID 5932 wrote to memory of 5988	5932	cmd.exe	148
PID 4600 wrote to memory of 2648	4600	zrNbgs.exe	149
PID 2648 wrote to memory of 6008	2648	cmd.exe	151
PID 4600 wrote to memory of 4152	4600	zrNbgs.exe	152
PID 4152 wrote to memory of 5212	4152	cmd.exe	154
PID 4600 wrote to memory of 4856	4600	zrNbgs.exe	155
PID 4856 wrote to memory of 4252	4856	cmd.exe	157
PID 4600 wrote to memory of 3560	4600	zrNbgs.exe	158
PID 3560 wrote to memory of 5076	3560	cmd.exe	160
PID 4600 wrote to memory of 2708	4600	zrNbgs.exe	161
PID 2708 wrote to memory of 4468	2708	cmd.exe	163
PID 4600 wrote to memory of 5440	4600	zrNbgs.exe	164
PID 5440 wrote to memory of 2252	5440	cmd.exe	166
PID 4600 wrote to memory of 2184	4600	zrNbgs.exe	167
PID 2184 wrote to memory of 3404	2184	cmd.exe	169
PID 4600 wrote to memory of 4304	4600	zrNbgs.exe	170
PID 4304 wrote to memory of 3224	4304	cmd.exe	172
PID 4600 wrote to memory of 2680	4600	zrNbgs.exe	173
PID 2680 wrote to memory of 2624	2680	cmd.exe	175
PID 4600 wrote to memory of 3416	4600	zrNbgs.exe	176
PID 3416 wrote to memory of 5648	3416	cmd.exe	178
PID 4600 wrote to memory of 2920	4600	zrNbgs.exe	179
PID 2920 wrote to memory of 1228	2920	cmd.exe	181
PID 4600 wrote to memory of 2860	4600	zrNbgs.exe	182
PID 2860 wrote to memory of 5636	2860	cmd.exe	184

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	zrNbgs.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.2.0.04.exe
"C:\Users\Admin\AppData\Local\Temp\install.2.0.04.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:5696

C:\Users\Public\bgJbOb\oS8jO3.exe
"C:\Users\Public\bgJbOb\oS8jO3.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3608
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1572
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\bgJbOb\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4604
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\bgJbOb\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2996
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4760
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3732
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5764
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5176
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3456
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2680
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5916
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5600
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5824
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2896
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5124
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3224
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1880
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1228
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1512
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3280
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3524
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4404
- C:\Program Files (x86)\zrNbgs\zrNbgs.exe
  "C:\Program Files (x86)\zrNbgs\zrNbgs.exe"
  2⤵
  - UAC bypass
  - Drops file in Drivers directory
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Enumerates video capture drivers
  - Event Triggered Execution: Screensaver
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies Control Panel
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4600
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3532
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\zrNbgs" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2320
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\zrNbgs" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2836
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:816
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\zrNbgs" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:52
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\zrNbgs" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:6080
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\zrNbgs" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5932
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\zrNbgs" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5988
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\zrNbgs\zrNbgs.exe" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2648
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\zrNbgs\zrNbgs.exe" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:6008
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\zrNbgs\zrNbgs.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4152
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\zrNbgs\zrNbgs.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5212
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\zrNbgs\zrNbgs.exe" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4856
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\zrNbgs\zrNbgs.exe" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4252
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\zrNbgs\image.png" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3560
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\zrNbgs\image.png" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5076
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\zrNbgs\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2708
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\zrNbgs\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4468
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\zrNbgs\image.png" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5440
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\zrNbgs\image.png" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2252
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\zrNbgs\thumbs.db" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2184
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\zrNbgs\thumbs.db" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3404
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\zrNbgs\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4304
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\zrNbgs\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3224
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\zrNbgs\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2680
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\zrNbgs\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2624
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\zrNbgs\XPSPLOG.dll" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3416
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\zrNbgs\XPSPLOG.dll" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5648
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\zrNbgs\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2920
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\zrNbgs\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1228
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\zrNbgs\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2860
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\zrNbgs\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5636

C:\Users\Public\bgJbOb\oS8jO3.exe
"C:\Users\Public\bgJbOb\oS8jO3.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4252

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\bgJbOb" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\bgJbOb" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1172

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:1800

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:800
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1908

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1552

C:\Program Files (x86)\zrNbgs\zrNbgs.exe
"C:\Program Files (x86)\zrNbgs\zrNbgs.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5480

C:\Program Files (x86)\zrNbgs\zrNbgs.exe
"C:\Program Files (x86)\zrNbgs\zrNbgs.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3344

C:\Program Files (x86)\BJ2f2Geo\ukswK6.exe
"C:\Program Files (x86)\BJ2f2Geo\ukswK6.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2948

C:\Program Files (x86)\BJ2f2Geo\ukswK6.exe
"C:\Program Files (x86)\BJ2f2Geo\ukswK6.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1552

C:\Program Files (x86)\zrNbgs\zrNbgs.exe
"C:\Program Files (x86)\zrNbgs\zrNbgs.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Remote Services

T1021

Remote Desktop Protocol

T1021.001

Collection

Video Capture

T1125

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

XPSPLOG.dll

Path C:\Program Files (x86)\BJ2f2Geo\XPSPLOG.dll
Size 4.6MB
SHA256 9b7616351e7bcb215662a880a128e2ecf2d744868f87b1b221d6b965ad97448f
MD5 20c4369a58549439755ff029ac2c5a46
SHA1 34a16be2838d56c160e5403314609b87fc86f3cf
SHA512 6cd36c2479444945c55842873f637afc9b20f513b2270b34d0114decc0702823c122236631d3dcc9fc1e9cd25cc0dbab805d3f6c7738460432bc2e08c3fbfed8
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyw:BMWKfU+BcUTHCCCfqCiUffnw
TLSH
T11B263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\BJ2f2Geo\image.png
Size 4.8MB
SHA256 ef4d5d672c09508d5ac0a9e188b76e2aee6ac1a47f7f4497fa0223c065cc1a4b
MD5 f7b9c77fb6e34e4d9993d17107d2db7c
SHA1 9a4fbae70203d6717b3da83763c1fe16e77608fb
SHA512 a4308a14e81ccdbae4f7bee700e8f5b843553772c7dc8ad4be79c14f1f8469e959efa0a108cb4c2a9840b46a261c70757b40ee7be826d99afeb717a1d643921d
SSDEEP 98304:A/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:AMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T1E736334FE6EFBED9C39CF7EA71098A30D63A4FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\zrNbgs\XPSPLOG.dll
Size 4.6MB
SHA256 7e035c960d16c16a98e3e45bb5be7582538f59a741cbdc7de1360ceb8ab95271
MD5 4644061a3d152bc41b47ed85362fc258
SHA1 2cc4f94b2c00360bb17c273e5c7585a0e49b5685
SHA512 62d2df9e872ea8d89f7d5bb36e4a694bcfe06a7a2bca786d54c1d01c09d5652b6bd47def6b6edbdc789391c5b48d906c4b9197230e4ac49186886178525814b0
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyn:BMWKfU+BcUTHCCCfqCiUffnn
TLSH
T18E263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\zrNbgs\image.png
Size 4.8MB
SHA256 b62eb60c7197d82af230b6c129f10422a45a381e3fe491f45c07979769cc8aeb
MD5 e1e5cb48a191aa0666d16b6d2d053da3
SHA1 922b7b06d21104f0000ce8e38eeea1c39da2e8db
SHA512 5ffce5bea6d6a615e869ef56a793941928854931f5643d0153699c5654cb8a7abeb66b60a2c53f56b9859c66b47f1b840b6ca89ff1ce207a695e4bbb462bcad5
SSDEEP 98304:s/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:sMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T1C536334FE6EFBED9C39CF7EA71098A30D63A8FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\zrNbgs\thumbs.db
Size 358KB
SHA256 98b9a2acab89b64afa4822884dc9d16c0a32b14ce3aef8915c33019966c2bb96
MD5 6bf64aa65c4d7fcc7c8c1fc2351f1c41
SHA1 ac439da7fffcdb91c023dacc2511893dec5dad1d
SHA512 e0955f1e866b2e1a5b57db66920c01563184eabc2331373a47db0e53475ac8476cdfd419343bf241ec6da2a87401979fa6ccf8b22f24b51c311f70eb9fea4c90
SSDEEP 6144:ZiACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:48u69CghoQxoMTFQqtKFCz7mb/
TLSH
T19974F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zrNbgs.exe

Path C:\Program Files (x86)\zrNbgs\zrNbgs.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 e5fc748f458bd2c1a2887408b19210d35470e1372cdf5d5a31a23ef8a268aa9f
MD5 69593c79e8fc2ff932be02764e496c1d
SHA1 5f775fce96933262a818ec794b0820112225b8d7
SHA512 821ccdfad0fc44e7a9feac2d2a3d52aa3b2ff82fe2a24e49911d9c59272cacc5143f91b850aec6bc00986209429dde9bd6ba890dd658531cbed23cd5af4c8e3a
TLSH
T1F93196FB1FBD6EC29F3A4E5614CAF1366CE492C06999549A6105C0A46F083B32E9A50D
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 bb7a3269c725e38c3215e82bf87bb7c612cbe0142420357d0f6ad61c69678660
MD5 0795e8f3a9b96af8d6012adb47fa0c30
SHA1 ee1e0a1ddaae83b22dfbbd88b228a6fd3dc3f183
SHA512 c1195d5ab6ab96fa5251debfbde7e671a6f47b4ed6c3e469a9321f82b230e0ee1b93f6d660dd4ba1e29816a838d81ceeaafa84c09bad701b5874dc8a49e790b9
TLSH
T14031D8865E391042EB5C0F3562D0D13FADF2D6B44DA84445623ED5AE4A0AFB75FC9411
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 efe276b3bda94740298a218be6ffec6b9efbfccd8a6125919345ad0f767f5e08
MD5 62c5b2bfbc5e4320036563eb4ed66b58
SHA1 33455837085c3f2b4bba06c2f53c658c8058792e
SHA512 353696209eb7f4ff78e875fd7680da55419a4906fcef18e27b3198e19047089f04bd6b85af208933301a460c02e63d798e02dda4d7241cbcbcda0feb3700f47e
TLSH
T13CF0DC1C087D423CF172DA38C2C93556166EFB17280641A807E0170C612B9127E9153A
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 91e33f3a474eb6f565af19256fa8f6472921de91c4696d198f8f52db3100a427
MD5 684243c1f19226295260b6c5ebd94564
SHA1 d10a5ad80e06e923c1c64e2845ef3619c1689bff
SHA512 813014d100069b8b789ecd6c1ab24a9479e10c5e6aaae44b0c233ac5d5dde696e3b96de9dac90944f800bfc9812234c62e9c468bbcf7f32eb5f0a25813a2c742
TLSH
T144F05C3C66ED500BF03BD2F487D73AB11A39F527614666AE0FB503441F569026C41229
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_zbqmgdtb.i0x.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zbqmgdtb.i0x.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

UxEnhance64.dll

Path C:\Users\Public\bgJbOb\UxEnhance64.dll
Size 3.1MB
SHA256 120e7a583b61ef54c081456e371eb43458f117ed8679026cf964cf22af3638b5
MD5 303f6babc9beb50cbe25e8c9d891f015
SHA1 7e1514b1fa883e21e6463d62e5710539553fbac7
SHA512 2c062879f6f85678cd2766dee4b670670e007bd1f4830c48edacbc0ed341264bed1b412227aacfd7c23b1d84fb216d61ef988b43362e6ec0ef2178b256951c15
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+/:P9m29xx3Tiqt06ox6+z2rNNrKo/
TLSH
T1DFE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\bgJbOb\adoresd.dat
Size 4.8MB
SHA256 fe5b62291cbdac05439c610fe317186f2a306e268756e42b62f1df3ea1188bcd
MD5 b6d036d12aed9a1b3550f419b5623f89
SHA1 10adb9068b50113bab28d041d359db40eec45ef8
SHA512 1d524af68780702e512968c8366a8a1518ceb4047d9c0f9ee5d9b3efb3f8f760ebf23e944b3d0a249d264b4d650f78bdd4e626abd2a291e99ef0a0a9161222f1
SSDEEP 98304:RWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:RWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T1683633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\bgJbOb\msadox.tb
Size 8KB
SHA256 8bc4fb4a9c2007e726b4ac9c10866384dcca4095b34dd56360ed5a89cb627d7d
MD5 10727378fe6e51dbc44496bf75a6cf99
SHA1 fa396308d6b0eb888b6001e2a1f712ccf3e1734e
SHA512 daed56ae10e46cb779bd2b314534664874cb88a92abea5d95813e6ca42c43574dd48f081ad0af6d6d55e811945feee6106a8fdbaee15aad5920e42934a696e25
SSDEEP 192:jqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:jsZqZOXQ3uqvR2Kfzp
TLSH
T196029E05D7A20CC3D3016C71CD9EB2F5AB23A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oS8jO3.exe

Path C:\Users\Public\bgJbOb\oS8jO3.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1552-764-0x00000000735D0000-0x0000000073D1A000-memory.dmp

Download

memory/1552-763-0x00000000006D0000-0x00000000006D1000-memory.dmp

Download

memory/1552-775-0x0000000000740000-0x0000000000741000-memory.dmp

Download

memory/1552-779-0x00000000006D0000-0x00000000006D1000-memory.dmp

Download

memory/1552-776-0x0000000003020000-0x00000000037FD000-memory.dmp

Download

memory/1552-767-0x0000000003020000-0x00000000037FD000-memory.dmp

Download

memory/1572-599-0x000002919FB00000-0x000002919FB22000-memory.dmp

Download

memory/1572-605-0x000002919FB40000-0x000002919FB4A000-memory.dmp

Download

memory/1572-604-0x000002919FD90000-0x000002919FE42000-memory.dmp

Download

memory/1572-603-0x000002919FB60000-0x000002919FB7E000-memory.dmp

Download

memory/2948-755-0x0000000003AF0000-0x00000000042CD000-memory.dmp

Download

memory/2948-758-0x0000000001720000-0x0000000001721000-memory.dmp

Download

memory/2948-742-0x0000000001720000-0x0000000001721000-memory.dmp

Download

memory/2948-754-0x0000000001740000-0x0000000001741000-memory.dmp

Download

memory/2948-747-0x0000000003AF0000-0x00000000042CD000-memory.dmp

Download

memory/2948-743-0x00000000735D0000-0x0000000073D1A000-memory.dmp

Download

memory/3344-734-0x00000000011A0000-0x00000000011A1000-memory.dmp

Download

memory/3344-735-0x0000000074A50000-0x000000007519A000-memory.dmp

Download

memory/3608-561-0x000001DAC8AC0000-0x000001DAC8B4A000-memory.dmp

Download

memory/3608-542-0x000001DAC95B0000-0x000001DAC9E87000-memory.dmp

Download

memory/3608-549-0x000001DAC95B0000-0x000001DAC9E87000-memory.dmp

Download

memory/3608-560-0x000001DAC8AC0000-0x000001DAC8B4A000-memory.dmp

Download

memory/3608-543-0x000001DAC95B0000-0x000001DAC9E87000-memory.dmp

Download

memory/3608-545-0x000001DAC95B0000-0x000001DAC9E87000-memory.dmp

Download

memory/3608-544-0x000001DAC95B0000-0x000001DAC9E87000-memory.dmp

Download

memory/3608-557-0x000001DAC8990000-0x000001DAC89DE000-memory.dmp

Download

memory/3608-538-0x000001DAC95B0000-0x000001DAC9E87000-memory.dmp

Download

memory/3608-537-0x00007FFC03AE0000-0x00007FFC03AE2000-memory.dmp

Download

memory/3608-566-0x000001DAC95B0000-0x000001DAC9E87000-memory.dmp

Download

memory/3608-565-0x000001DAC95B0000-0x000001DAC9E87000-memory.dmp

Download

memory/3608-555-0x000001DAC95B0000-0x000001DAC9E87000-memory.dmp

Download

memory/3608-559-0x000001DAC8AC0000-0x000001DAC8B4A000-memory.dmp

Download

memory/3608-529-0x00007FFC03AD0000-0x00007FFC03AD2000-memory.dmp

Download

memory/3608-558-0x000001DAC8AC0000-0x000001DAC8B4A000-memory.dmp

Download

memory/3608-530-0x00007FFBE1200000-0x00007FFBE171E000-memory.dmp

Download

memory/3608-535-0x000001DAC95B0000-0x000001DAC9E87000-memory.dmp

Download

memory/4252-581-0x00007FFC03AE0000-0x00007FFC03AE2000-memory.dmp

Download

memory/4252-587-0x000001C77EC20000-0x000001C77F4F7000-memory.dmp

Download

memory/4252-576-0x00007FFBE1200000-0x00007FFBE171E000-memory.dmp

Download

memory/4252-579-0x000001C77EC20000-0x000001C77F4F7000-memory.dmp

Download

memory/4252-586-0x000001C77EC20000-0x000001C77F4F7000-memory.dmp

Download

memory/4252-582-0x000001C77EC20000-0x000001C77F4F7000-memory.dmp

Download

memory/4252-590-0x00007FFC03AD0000-0x00007FFC03AD2000-memory.dmp

Download

memory/4252-589-0x000001C77EC20000-0x000001C77F4F7000-memory.dmp

Download

memory/4252-588-0x000001C77EC20000-0x000001C77F4F7000-memory.dmp

Download

memory/4600-674-0x0000000074A50000-0x000000007519A000-memory.dmp

Download

memory/4600-750-0x0000000005810000-0x000000000584A000-memory.dmp

Download

memory/4600-740-0x00000000039C0000-0x000000000419D000-memory.dmp

Download

memory/4600-673-0x00000000014F0000-0x00000000014F1000-memory.dmp

Download

memory/4600-678-0x00000000039C0000-0x000000000419D000-memory.dmp

Download

memory/4600-698-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/4600-693-0x00000000039C0000-0x000000000419D000-memory.dmp

Download

memory/4600-724-0x00000000039C0000-0x000000000419D000-memory.dmp

Download

memory/4600-692-0x0000000001630000-0x0000000001644000-memory.dmp

Download

memory/4600-680-0x0000000001510000-0x0000000001511000-memory.dmp

Download

memory/4600-685-0x00000000039C0000-0x000000000419D000-memory.dmp

Download

memory/4600-681-0x00000000039C0000-0x000000000419D000-memory.dmp

Download

memory/5464-780-0x0000000002880000-0x0000000002881000-memory.dmp

Download

memory/5464-781-0x00000000033F0000-0x0000000003BCD000-memory.dmp

Download

memory/5464-769-0x0000000002860000-0x0000000002861000-memory.dmp

Download

memory/5464-770-0x0000000074A50000-0x000000007519A000-memory.dmp

Download

memory/5464-773-0x00000000033F0000-0x0000000003BCD000-memory.dmp

Download

memory/5464-784-0x0000000002860000-0x0000000002861000-memory.dmp

Download

memory/5480-731-0x00000000017A0000-0x00000000017A1000-memory.dmp

Download

memory/5480-732-0x0000000074A50000-0x000000007519A000-memory.dmp

Download

memory/5696-0-0x00000000004D0000-0x00000000004DE000-memory.dmp

Download

memory/5696-1-0x00000000004E0000-0x00000000004EC000-memory.dmp

Download

memory/5696-503-0x00007FFBFB170000-0x00007FFBFB182000-memory.dmp

Download

memory/5696-524-0x00007FFBFB170000-0x00007FFBFB182000-memory.dmp

Download

memory/5696-523-0x00000000004D0000-0x00000000004DE000-memory.dmp

Download