3f05927effb25a78091f875222f43310c3490099c67c346a24286b3343c3ccf9

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.2.0.08.exe
Size 30.5MB
Sample261024-e4rhwaw16k
SHA256 3f05927effb25a78091f875222f43310c3490099c67c346a24286b3343c3ccf9
MD5 96f05dccf70b7ec58248357d47f1758c
SHA1 ff2bd5e3df63db7ece1046599004a0e72b16f70d
SHA512 025f56118d8fe180a1ddc3b1f046ca5745334f0c2157991a2f64c79bbd93f52cdc8518b8fead263b9ca1c0b30d71b4bb4a9d65795817a72f672be431bec01dec
SSDEEP 196608:8ZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYb:DC/p+HuPOc4m
TLSH
T19267181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	BXJhbg.exe

Windows security bypass 2 TTPs 4 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\NbxtWo = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	oBdtPP.exe

Executes dropped EXE 4 IoCs

pid	Process
728	oBdtPP.exe
4220	oBdtPP.exe
928	BXJhbg.exe
3340	BXJhbg.exe

Loads dropped DLL 4 IoCs

pid	Process
728	oBdtPP.exe
4220	oBdtPP.exe
928	BXJhbg.exe
3340	BXJhbg.exe

Modifies file permissions 1 TTPs 3 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4792	icacls.exe
3636	icacls.exe
964	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\NbxtWo\\oBdtPP.exe\""	oBdtPP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Alibaba SecurityHealtha = "\"C:\\Program Files (x86)\\BXJhbg\\BXJhbg.exe\""	BXJhbg.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
3720	cmd.exe
2312	cmd.exe
5048	cmd.exe
1660	cmd.exe
4016	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	oBdtPP.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\BXJhbg	oBdtPP.exe
File created	C:\Program Files (x86)\BXJhbg\BXJhbg.exe	oBdtPP.exe
File created	C:\Program Files (x86)\BXJhbg\thumbs.db	oBdtPP.exe
File opened for modification	C:\Program Files (x86)\BXJhbg\BXJhbg.exe	oBdtPP.exe
File opened for modification	C:\Program Files (x86)\BXJhbg\thumbs.db	oBdtPP.exe
File created	C:\Program Files (x86)\BXJhbg\XPSPLOG.dll	oBdtPP.exe
File created	C:\Program Files (x86)\BXJhbg\image.png	oBdtPP.exe
File opened for modification	C:\Program Files (x86)\BXJhbg\XPSPLOG.dll	oBdtPP.exe
File opened for modification	C:\Program Files (x86)\BXJhbg\image.png	oBdtPP.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4800	cmd.exe
1172	cmd.exe
2920	cmd.exe
1768	cmd.exe
4772	cmd.exe
2664	cmd.exe
1496	cmd.exe
1888	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.2.0.08.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.2.0.08.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	oBdtPP.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	oBdtPP.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BXJhbg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BXJhbg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2376	schtasks.exe
216	schtasks.exe
4224	schtasks.exe
3304	schtasks.exe
1712	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4508	install.2.0.08.exe
4508	install.2.0.08.exe
4508	install.2.0.08.exe
4508	install.2.0.08.exe
4508	install.2.0.08.exe
4508	install.2.0.08.exe
4508	install.2.0.08.exe
4508	install.2.0.08.exe
4508	install.2.0.08.exe
4508	install.2.0.08.exe
4508	install.2.0.08.exe
4508	install.2.0.08.exe
4508	install.2.0.08.exe
4508	install.2.0.08.exe
4508	install.2.0.08.exe
4508	install.2.0.08.exe
4508	install.2.0.08.exe
4508	install.2.0.08.exe
4508	install.2.0.08.exe
4508	install.2.0.08.exe
4508	install.2.0.08.exe
4508	install.2.0.08.exe
4508	install.2.0.08.exe
4508	install.2.0.08.exe
4508	install.2.0.08.exe
4508	install.2.0.08.exe
4508	install.2.0.08.exe
4508	install.2.0.08.exe
4508	install.2.0.08.exe
4508	install.2.0.08.exe
4508	install.2.0.08.exe
4508	install.2.0.08.exe
728	oBdtPP.exe
728	oBdtPP.exe
728	oBdtPP.exe
728	oBdtPP.exe
728	oBdtPP.exe
728	oBdtPP.exe
728	oBdtPP.exe
728	oBdtPP.exe
728	oBdtPP.exe
728	oBdtPP.exe
728	oBdtPP.exe
728	oBdtPP.exe
728	oBdtPP.exe
728	oBdtPP.exe
728	oBdtPP.exe
728	oBdtPP.exe
728	oBdtPP.exe
728	oBdtPP.exe
728	oBdtPP.exe
728	oBdtPP.exe
728	oBdtPP.exe
728	oBdtPP.exe
728	oBdtPP.exe
728	oBdtPP.exe
728	oBdtPP.exe
728	oBdtPP.exe
728	oBdtPP.exe
728	oBdtPP.exe
728	oBdtPP.exe
728	oBdtPP.exe
728	oBdtPP.exe
728	oBdtPP.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 728 wrote to memory of 1660	728	oBdtPP.exe	94
PID 1660 wrote to memory of 2376	1660	cmd.exe	97
PID 728 wrote to memory of 4016	728	oBdtPP.exe	98
PID 1660 wrote to memory of 392	1660	cmd.exe	100
PID 4016 wrote to memory of 216	4016	cmd.exe	103
PID 1660 wrote to memory of 2864	1660	cmd.exe	105
PID 4016 wrote to memory of 4516	4016	cmd.exe	107
PID 728 wrote to memory of 3720	728	oBdtPP.exe	108
PID 3720 wrote to memory of 4224	3720	cmd.exe	111
PID 4016 wrote to memory of 2076	4016	cmd.exe	112
PID 3720 wrote to memory of 4932	3720	cmd.exe	113
PID 728 wrote to memory of 2312	728	oBdtPP.exe	115
PID 1172 wrote to memory of 2336	1172	cmd.exe	114
PID 3720 wrote to memory of 3528	3720	cmd.exe	116
PID 2312 wrote to memory of 3304	2312	cmd.exe	118
PID 2312 wrote to memory of 956	2312	cmd.exe	119
PID 2920 wrote to memory of 3320	2920	cmd.exe	122
PID 728 wrote to memory of 5048	728	oBdtPP.exe	123
PID 2312 wrote to memory of 4716	2312	cmd.exe	125
PID 5048 wrote to memory of 1712	5048	cmd.exe	126
PID 5048 wrote to memory of 3372	5048	cmd.exe	127
PID 5048 wrote to memory of 3456	5048	cmd.exe	128
PID 728 wrote to memory of 928	728	oBdtPP.exe	129
PID 928 wrote to memory of 1768	928	BXJhbg.exe	132

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	BXJhbg.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.2.0.08.exe
"C:\Users\Admin\AppData\Local\Temp\install.2.0.08.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:4508

C:\Users\Public\NbxtWo\oBdtPP.exe
C:\Users\Public\NbxtWo\oBdtPP.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:728
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\NbxtWo\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1660
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\NbxtWo\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2376
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:392
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2864
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4016
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:216
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4516
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2076
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3720
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4224
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4932
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3528
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2312
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3304
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:956
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4716
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5048
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1712
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3372
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3456
- C:\Program Files (x86)\BXJhbg\BXJhbg.exe
  "C:\Program Files (x86)\BXJhbg\BXJhbg.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:928
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    PID:1768
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\BXJhbg" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:4772
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\BXJhbg" /inheritance:r
      4⤵
      Modifies file permissions
      PID:4792
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:2664
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:1496
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:1888
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\BXJhbg" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:4800
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\BXJhbg" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      PID:3636

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\NbxtWo" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\NbxtWo" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2336

C:\Users\Public\NbxtWo\oBdtPP.exe
"C:\Users\Public\NbxtWo\oBdtPP.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4220

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:3620

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3320

C:\Program Files (x86)\BXJhbg\BXJhbg.exe
"C:\Program Files (x86)\BXJhbg\BXJhbg.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3340

C:\Program Files (x86)\GYIUQ1rQ8\6s1RqTBSm.exe
"C:\Program Files (x86)\GYIUQ1rQ8\6s1RqTBSm.exe"
1⤵
PID:4048

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Program Files (x86)\BXJhbg\BXJhbg.exe" /inheritance:r
1⤵
- Modifies file permissions
PID:964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BXJhbg.exe

Path C:\Program Files (x86)\BXJhbg\BXJhbg.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\BXJhbg\XPSPLOG.dll
Size 4.6MB
SHA256 0d777ac830051edda59a7c43272450d1a3375ea9eb4aa6074373443ff254f4f8
MD5 afb63f83f63429947984c36719f1ddc2
SHA1 5f5a5244a08ff03724ee67bb4eb1657cc9158835
SHA512 2cc3cc7571c302fa48c4f884c2ec8f245a4bb953acc83a3256a5389aebb4048eebc3123b1d9f9ea9b45e94d1036df50bc5b4fc38ab8ff2933897ebbf38419f93
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyN:BMWKfU+BcUTHCCCfqCiUffnN
TLSH
T182263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\BXJhbg\image.png
Size 4.8MB
SHA256 a342d80003c6f03b00d40bbac06e92214e3cf64665c3d9bc2ac8994f91bf1cc3
MD5 1fd012edb27ab41d3d4e76df16ed02c8
SHA1 806fb12c532a495ca2b52565866ce98c33ab3505
SHA512 30473a6ab75d520c17be8cfd3182fcd23b0ec9a105034c153949f8ab5ede470ff73264fb8984c3416af6b2d3f52fd47f6523c45a36ff05288915926019572476
SSDEEP 98304:c/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:cMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T10A36334FE6EFBED9C39CF7EA71098A30D63A8FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\BXJhbg\thumbs.db
Size 358KB
SHA256 e90b7837121b3eba98965066191916305b52e91f128d300c670b89cad0e07711
MD5 0e225c202ef8e995bd0a6ecf24935cae
SHA1 ed3e7e62174f1119725e093df5a4836f74595d52
SHA512 b82b39fd597182288bc92d38d13e6dbd8cbfa62432500c2050e9879d74249775f32a93602dfb225644fed8cf82ea6d28238e1f8d30fb219a6ec7f12b40de28cf
SSDEEP 6144:MiACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:r8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T12674F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\GYIUQ1rQ8\XPSPLOG.dll
Size 3.7MB
SHA256 db2da8797e9d323c6345949b22629dcb93f8781870ae3ef7bdaa86c43d83e6dd
MD5 a98cad8ca23d189dfd2ef12705b00b76
SHA1 d27825c885e26882034e47a975fd5a23cf710a6e
SHA512 441a3e00a700726ac1241a9b688d78830ff0bae923b81e9026aa1d914453bbac4b9c4883d4effd9dbb90e1642c952ef88696825e9590d345cf039fb9713f85e2
SSDEEP 49152:3KLKP3cCMWmRqKJ1JNST5Z/nvsNBcVwNefYhOY+nEXOnqaiOKZCUqyn78eT1581C:yCMWmcKfST5t+BceThTHfaCCUqmJPCYF
TLSH
T19C063309BBDB561EE85672B85F2DFC3EB77928CC4308EC88D499748B9072B79603950D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\GYIUQ1rQ8\XPSPLOG.dll
Size 2.6MB
SHA256 1a8adcf8b9ef42d20951eab91adb17ad3a0d42a8e5ab2f5f466c424e66b79897
MD5 8b7536b6b037bec74c7db1131c527870
SHA1 0feea4f0bdeb8e9e908542c679482446eb23f8e6
SHA512 0378a7e5c339d1f4253f15fcadde6078c4cd35462307b0818ef65bd56b52b947fcccbe8c3b74d50c4d4eebe808f4abb20d8d22268665dc469935f8215cfe4b91
SSDEEP 49152:3KLKP3cCMWmRqKJ1JNST5Z/nvsNBcVwNefYhOY+nEXOnqaiOp:yCMWmcKfST5t+BceThTHfaj
TLSH
T14CD533DBFA8B451EE66177752F7DECADB6BC49C4821DE544D4A2314F0004BAE903EA8C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\GYIUQ1rQ8\XPSPLOG.dll
Size 1.8MB
SHA256 9399df8f44b88f2add9cc4d2849df9da04e59ed9f5c27ba2b1308647242b3f45
MD5 1935040c63dd61dd397bfa5ee35291f3
SHA1 1ad90e1d8e02a166c3379872909de3d5b6c604b6
SHA512 28a5549df511546dfa13d409b408aeda6e98307445f1d6b01c783e81da3eb5575e20c74ae5150b9599c81040b4a4df4a5f2db750c87a0d650833efc2acca8290
SSDEEP 24576:RTOuWhLK5RyoT9xcjWByWfymm5LQMqKJoyPhNuTXT5tpB1JA6nvsNBFGGLncDYje:3KLKP3cCMWmRqKJ1JNST5Z/nvsNBcVwo
TLSH
T1B395338BB2DB412EF59073B52F9CED1DB17E58C881BDC46598E6724B2030BAE503A74D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\GYIUQ1rQ8\image.png
Size 1.2MB
SHA256 bfcfb6c2eb613e571d4f638b54e86cb678fa5b2288120fa5dcfcc9df37b45bd8
MD5 cae8e4069155276d6bc0ae9d11e663cf
SHA1 b65717083146acd819587e790824ca1a629c14dd
SHA512 ffab2a88b7b256a9926542a9932b82d4d8daea47d5f65bce24c0a7f878c3e9a69426505d56d8b58c5b23b85822196f70cccc9fa7840110c2b358c9d6b5d0f1c9
SSDEEP 24576:c2dSOuL/aJtWPUH+HHKt1DJLojtJvJlqb+RFcRuHMyWY9c0Q9zBnJ:DSOu2FbbJMzxe+fJk3zBnJ
TLSH
T15A45334AD7E9796582F1F13AB50B6C507B3E3BA280821575B063BE00FB1C35F725B529
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 164ef2f06813f577119a7e8c22a59c59f72b023ab67f531a2c517e6f12236b47
MD5 655b068972cbfdfb12ef8b24c145eab7
SHA1 1773a64a43e57d52d9046d90de641cf5fc5e6925
SHA512 87b8a3ab847425bb4d23024590a26b7556a2cb0d78ffe5bf4ed77e0d45e97fb6d0f731c6a1f8f342e7970588007738cf5e281e3968033bf9b5d792fc92527b0c
TLSH
T16F3174BB6F6C38929F3F8E4411CAB1212CA5A2805CD5099A6254C0A88B443F26F4D90C
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 8d385c0931a5bafea01a056869b2d80bec56a60dfd585c6644c5ad5298764d80
MD5 e71db57207f6e8a1eff97d2a0281cc7a
SHA1 0951feee76b7b089621ff57a6ceaf06d55df5c4d
SHA512 795d4cf8c981401fe1f5b2fb51b63efa34c5fec3e8989b8c7920b218a083a61729aa22483381a9e2465f90d3b75471881b3be9c1531944ea13457696927226cb
TLSH
T1B431D8925E3D50129B088F345BD0D53BACF1B4654CA85812627ED2AA8719BB75F86004
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 a670281154242c027c5081896cc1c77327ead9b2c6f7b0cf9a29c3b02288a73d
MD5 c4f04e4255857565e401baa58549f11f
SHA1 b61809b3fb372c3c370f3203da17eae02f05a7fa
SHA512 ed6846b729adfc877e657b1934aad7fd2c77a9817700bfcbbbfb70272e9841cadb3a44242db1a2021a8cb7f6f17d7828ba42d740a08e427e0d9911bdbd70c91d
TLSH
T1D5F0540845F8412FF133E93C07CC3416676BF201200544A403F60309A101E013D42178
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 b61951f06c465e4a2fb4f0de25521366fcde01c74d2851c695fce65a62c611dc
MD5 50c77ff55706678a86bb5d85a08a1e60
SHA1 ee00612ab526af9384ea8719a0b06dde38cd0b78
SHA512 25d744fa933c9b150d9cb692f01afa65ed2be8ddb3d0edeb7d2ea6f8a03fe66214c1e22377ef900a157486e94208cf6fabae9b70ff7245f1b269e1f4684861ab
TLSH
T140F0D43A11DD005BF07BD1B407D5FA72DA69E631101BA37D0EF603052F61D400C8126C
MD5 SHA1 SHA512 TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

UxEnhance64.dll

Path C:\Users\Public\NbxtWo\UxEnhance64.dll
Size 3.1MB
SHA256 c9eabd98284506054295f5fd0dfcff2131e29406b29828ef99d33f77f2c32b7d
MD5 a04b8cadce596a8fbe68ec64d8720eee
SHA1 88b44be383f64394a95bc4cd94b94e2f0298a14d
SHA512 7c420b98f7582d2f6e6f2aa8f0c433a93463f9ebe763581f050ed9a90b4b240c12009b86231013921b74f3f519d795894fc6a6e92c20a2019da9fd9cea09c83f
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+J:P9m29xx3Tiqt06ox6+z2rNNrKoJ
TLSH
T1BBE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\NbxtWo\adoresd.dat
Size 4.8MB
SHA256 1b0ae398a12a53b1d0af8d1eb1383db8acea46488805a03c0a27c4fb78ca223c
MD5 07479451ea9b4726bdc8b6b7ff483b6e
SHA1 422cc294de38d4c59eac21756051bf03df87a2ff
SHA512 ee724ae9a8eb10621c7e13c6eb856670b7e5008dea7b9e54252ef7c1f2f40b839e406d09f28a20638d50e9e6e1a46fdbc4794b4f252a3887d990825471b5eeac
SSDEEP 98304:DWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:DWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T1EA3633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\NbxtWo\msadox.tb
Size 8KB
SHA256 ad0f617d10279192bc459939b67e1c61a13909314a19ff3c3d15667657f4841a
MD5 d58d424aed437a23450fd15bacd12b6f
SHA1 7d62fd3b0332ed6f14ea0e70288bf46ada4f139e
SHA512 0ba39bce7e685d62cfbfce996886fd6eabb24eebe1957b05a27646c33696f0c5bff6d58195eaed237325e4fbd52347690da288edcc84447296ab9148d720b947
SSDEEP 192:xqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:xsZqZOXQ3uqvR2Kfzp
TLSH
T1E5029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DE2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oBdtPP.exe

Path C:\Users\Public\NbxtWo\oBdtPP.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xxxx.ini

Path \??\c:\xxxx.ini
Size 2B
SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
MD5 81051bcc2cf1bedf378224b0a93e2877
SHA1 ba8ab5a0280b953aa97435ff8946cbcbb2755a27
SHA512 1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
MD5 SHA1 SHA512

Submit Download

memory/728-543-0x000001F03ECF0000-0x000001F03F5C7000-memory.dmp

Download

memory/728-550-0x000001F03ECF0000-0x000001F03F5C7000-memory.dmp

Download

memory/728-555-0x000001F03ECF0000-0x000001F03F5C7000-memory.dmp

Download

memory/728-560-0x000001F03FB40000-0x000001F03FBCA000-memory.dmp

Download

memory/728-563-0x000001F03FB40000-0x000001F03FBCA000-memory.dmp

Download

memory/728-562-0x000001F03FB40000-0x000001F03FBCA000-memory.dmp

Download

memory/728-561-0x000001F03FB40000-0x000001F03FBCA000-memory.dmp

Download

memory/728-559-0x000001F03F6A0000-0x000001F03F6EE000-memory.dmp

Download

memory/728-558-0x000001F03ECF0000-0x000001F03F5C7000-memory.dmp

Download

memory/728-545-0x000001F03ECF0000-0x000001F03F5C7000-memory.dmp

Download

memory/728-546-0x000001F03ECF0000-0x000001F03F5C7000-memory.dmp

Download

memory/728-538-0x00007FF8984E0000-0x00007FF8984E2000-memory.dmp

Download

memory/728-544-0x000001F03ECF0000-0x000001F03F5C7000-memory.dmp

Download

memory/728-539-0x000001F03ECF0000-0x000001F03F5C7000-memory.dmp

Download

memory/728-536-0x000001F03ECF0000-0x000001F03F5C7000-memory.dmp

Download

memory/728-530-0x00007FF8984D0000-0x00007FF8984D2000-memory.dmp

Download

memory/728-531-0x00007FF87BF20000-0x00007FF87C43E000-memory.dmp

Download

memory/928-677-0x0000000003AE0000-0x00000000042BD000-memory.dmp

Download

memory/928-670-0x0000000003AE0000-0x00000000042BD000-memory.dmp

Download

memory/928-684-0x0000000000FD0000-0x0000000000FE4000-memory.dmp

Download

memory/928-672-0x0000000000FB0000-0x0000000000FB1000-memory.dmp

Download

memory/928-700-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/928-703-0x0000000003AE0000-0x00000000042BD000-memory.dmp

Download

memory/928-673-0x0000000003AE0000-0x00000000042BD000-memory.dmp

Download

memory/928-665-0x0000000000F90000-0x0000000000F91000-memory.dmp

Download

memory/928-704-0x0000000003AE0000-0x00000000042BD000-memory.dmp

Download

memory/928-666-0x0000000074A00000-0x000000007514A000-memory.dmp

Download

memory/928-685-0x0000000003AE0000-0x00000000042BD000-memory.dmp

Download

memory/3340-719-0x0000000000B90000-0x0000000000B91000-memory.dmp

Download

memory/3340-720-0x0000000074A00000-0x000000007514A000-memory.dmp

Download

memory/4048-725-0x00000000734E0000-0x0000000073C2A000-memory.dmp

Download

memory/4048-730-0x0000000003510000-0x0000000003CED000-memory.dmp

Download

memory/4048-724-0x0000000001170000-0x0000000001171000-memory.dmp

Download

memory/4220-583-0x000002C3553E0000-0x000002C355CB7000-memory.dmp

Download

memory/4220-587-0x000002C3553E0000-0x000002C355CB7000-memory.dmp

Download

memory/4220-577-0x000002C3553E0000-0x000002C355CB7000-memory.dmp

Download

memory/4220-591-0x00007FF8984D0000-0x00007FF8984D2000-memory.dmp

Download

memory/4220-589-0x000002C3553E0000-0x000002C355CB7000-memory.dmp

Download

memory/4220-590-0x000002C3553E0000-0x000002C355CB7000-memory.dmp

Download

memory/4220-588-0x000002C3553E0000-0x000002C355CB7000-memory.dmp

Download

memory/4220-574-0x00007FF87BF20000-0x00007FF87C43E000-memory.dmp

Download

memory/4220-582-0x00007FF8984E0000-0x00007FF8984E2000-memory.dmp

Download

memory/4508-504-0x00007FF8894F0000-0x00007FF889500000-memory.dmp

Download

memory/4508-2-0x0000000000500000-0x000000000050C000-memory.dmp

Download

memory/4508-524-0x00000000004F0000-0x00000000004FE000-memory.dmp

Download

memory/4508-0-0x00000000004F0000-0x00000000004FE000-memory.dmp

Download

memory/4508-525-0x00007FF8894F0000-0x00007FF889500000-memory.dmp

Download

memory/4508-1-0x00000000004F0000-0x00000000004FE000-memory.dmp

Download