30f99725a93c776b5564f09660d4b5d8f906a17418fbf3a30f032e5e73ff78d0

Analysis

max time kernel
146s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.2.0.08.exe
Size 30.5MB
Sample261024-e5dy6shx5m
SHA256 30f99725a93c776b5564f09660d4b5d8f906a17418fbf3a30f032e5e73ff78d0
MD5 c0755b8179106b323c6257760e29ba46
SHA1 02551b52f5c5bd68171ea3d9b7b920869f533bd2
SHA512 551f65dc081ad2da1e72d9b5283872127e4bdaeb198b70ffc9ac55316e9423334f994c281f9b8965a31c5175226b4ac65ee1ec5ca8c6a3b59173f7768e1b3e49
SSDEEP 196608:8ZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYm:DC/p+HuPOc4b
TLSH
T11E67181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\A26qbu = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4776	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
3660	YJ8glq.exe
924	YJ8glq.exe

Loads dropped DLL 2 IoCs

pid	Process
3660	YJ8glq.exe
924	YJ8glq.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\A26qbu\\YJ8glq.exe\""	YJ8glq.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
3324	cmd.exe
2480	cmd.exe
5416	cmd.exe
1272	cmd.exe
5552	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	YJ8glq.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\p6VnZH\LuYlnD.exe	YJ8glq.exe
File created	C:\Program Files (x86)\p6VnZH\thumbs.db	YJ8glq.exe
File opened for modification	C:\Program Files (x86)\p6VnZH\XPSPLOG.dll	YJ8glq.exe
File opened for modification	C:\Program Files (x86)\p6VnZH\thumbs.db	YJ8glq.exe
File opened for modification	C:\Program Files (x86)\p6VnZH	YJ8glq.exe
File created	C:\Program Files (x86)\p6VnZH\XPSPLOG.dll	YJ8glq.exe
File created	C:\Program Files (x86)\p6VnZH\image.png	YJ8glq.exe
File opened for modification	C:\Program Files (x86)\p6VnZH\LuYlnD.exe	YJ8glq.exe
File opened for modification	C:\Program Files (x86)\p6VnZH\image.png	YJ8glq.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4308	cmd.exe
968	cmd.exe
5520	cmd.exe
4108	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.2.0.08.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.2.0.08.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	YJ8glq.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	YJ8glq.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5700	schtasks.exe
2544	schtasks.exe
1212	schtasks.exe
3628	schtasks.exe
692	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1172	install.2.0.08.exe
1172	install.2.0.08.exe
1172	install.2.0.08.exe
1172	install.2.0.08.exe
1172	install.2.0.08.exe
1172	install.2.0.08.exe
1172	install.2.0.08.exe
1172	install.2.0.08.exe
1172	install.2.0.08.exe
1172	install.2.0.08.exe
1172	install.2.0.08.exe
1172	install.2.0.08.exe
1172	install.2.0.08.exe
1172	install.2.0.08.exe
1172	install.2.0.08.exe
1172	install.2.0.08.exe
1172	install.2.0.08.exe
1172	install.2.0.08.exe
1172	install.2.0.08.exe
1172	install.2.0.08.exe
1172	install.2.0.08.exe
1172	install.2.0.08.exe
1172	install.2.0.08.exe
1172	install.2.0.08.exe
1172	install.2.0.08.exe
1172	install.2.0.08.exe
1172	install.2.0.08.exe
1172	install.2.0.08.exe
1172	install.2.0.08.exe
1172	install.2.0.08.exe
1172	install.2.0.08.exe
1172	install.2.0.08.exe
3660	YJ8glq.exe
3660	YJ8glq.exe
3660	YJ8glq.exe
3660	YJ8glq.exe
3660	YJ8glq.exe
3660	YJ8glq.exe
3660	YJ8glq.exe
3660	YJ8glq.exe
3660	YJ8glq.exe
3660	YJ8glq.exe
3660	YJ8glq.exe
3660	YJ8glq.exe
3660	YJ8glq.exe
3660	YJ8glq.exe
3660	YJ8glq.exe
3660	YJ8glq.exe
3660	YJ8glq.exe
3660	YJ8glq.exe
3660	YJ8glq.exe
3660	YJ8glq.exe
3660	YJ8glq.exe
3660	YJ8glq.exe
3660	YJ8glq.exe
3660	YJ8glq.exe
3660	YJ8glq.exe
3660	YJ8glq.exe
3660	YJ8glq.exe
3660	YJ8glq.exe
3660	YJ8glq.exe
3660	YJ8glq.exe
3660	YJ8glq.exe
3660	YJ8glq.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	4776	powershell.exe
Token: SeIncreaseQuotaPrivilege	4776	powershell.exe
Token: SeSecurityPrivilege	4776	powershell.exe
Token: SeTakeOwnershipPrivilege	4776	powershell.exe
Token: SeLoadDriverPrivilege	4776	powershell.exe
Token: SeSystemProfilePrivilege	4776	powershell.exe
Token: SeSystemtimePrivilege	4776	powershell.exe
Token: SeProfSingleProcessPrivilege	4776	powershell.exe
Token: SeIncBasePriorityPrivilege	4776	powershell.exe
Token: SeCreatePagefilePrivilege	4776	powershell.exe
Token: SeBackupPrivilege	4776	powershell.exe
Token: SeRestorePrivilege	4776	powershell.exe
Token: SeShutdownPrivilege	4776	powershell.exe
Token: SeDebugPrivilege	4776	powershell.exe
Token: SeSystemEnvironmentPrivilege	4776	powershell.exe
Token: SeRemoteShutdownPrivilege	4776	powershell.exe
Token: SeUndockPrivilege	4776	powershell.exe
Token: SeManageVolumePrivilege	4776	powershell.exe
Token: 33	4776	powershell.exe
Token: 34	4776	powershell.exe
Token: 35	4776	powershell.exe
Token: 36	4776	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3660 wrote to memory of 4776	3660	YJ8glq.exe	91
PID 3660 wrote to memory of 3324	3660	YJ8glq.exe	94
PID 3324 wrote to memory of 5700	3324	cmd.exe	96
PID 3324 wrote to memory of 2580	3324	cmd.exe	97
PID 3660 wrote to memory of 2480	3660	YJ8glq.exe	100
PID 3324 wrote to memory of 3508	3324	cmd.exe	103
PID 2480 wrote to memory of 2544	2480	cmd.exe	104
PID 3660 wrote to memory of 5416	3660	YJ8glq.exe	105
PID 5416 wrote to memory of 1212	5416	cmd.exe	107
PID 2480 wrote to memory of 1888	2480	cmd.exe	108
PID 5416 wrote to memory of 1304	5416	cmd.exe	110
PID 2480 wrote to memory of 4912	2480	cmd.exe	111
PID 3660 wrote to memory of 1272	3660	YJ8glq.exe	112
PID 5416 wrote to memory of 2452	5416	cmd.exe	114
PID 1272 wrote to memory of 3628	1272	cmd.exe	115
PID 1272 wrote to memory of 3524	1272	cmd.exe	118
PID 3660 wrote to memory of 5552	3660	YJ8glq.exe	120
PID 1272 wrote to memory of 3340	1272	cmd.exe	122
PID 5552 wrote to memory of 692	5552	cmd.exe	123
PID 5552 wrote to memory of 1356	5552	cmd.exe	124
PID 5552 wrote to memory of 4756	5552	cmd.exe	126
PID 968 wrote to memory of 1364	968	cmd.exe	129
PID 4308 wrote to memory of 5020	4308	cmd.exe	130
PID 4108 wrote to memory of 1968	4108	cmd.exe	131
PID 5520 wrote to memory of 4196	5520	cmd.exe	132

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.2.0.08.exe
"C:\Users\Admin\AppData\Local\Temp\install.2.0.08.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:1172

C:\Users\Public\A26qbu\YJ8glq.exe
"C:\Users\Public\A26qbu\YJ8glq.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3660
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4776
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\A26qbu\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3324
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\A26qbu\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5700
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2580
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3508
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2480
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2544
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1888
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4912
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5416
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1212
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1304
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2452
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1272
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3628
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3524
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3340
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5552
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:692
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1356
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4756
- C:\Program Files (x86)\p6VnZH\LuYlnD.exe
  "C:\Program Files (x86)\p6VnZH\LuYlnD.exe"
  2⤵
  PID:1172

C:\Users\Public\A26qbu\YJ8glq.exe
"C:\Users\Public\A26qbu\YJ8glq.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:924

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\A26qbu" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4308
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\A26qbu" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5020

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:4760

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:968
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1364

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5520
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4196

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1968

C:\Program Files (x86)\p6VnZH\LuYlnD.exe
"C:\Program Files (x86)\p6VnZH\LuYlnD.exe"
1⤵
PID:1116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LuYlnD.exe

Path C:\Program Files (x86)\p6VnZH\LuYlnD.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\p6VnZH\XPSPLOG.dll
Size 4.6MB
SHA256 6e64597b9f0f1bfa6912844d135f7ae119adc60a7d092f316266a6fb355dffba
MD5 cbe54747c1cf5d39ccc587c2a0e6b8b7
SHA1 0d4e7dea0f91662e29971238b7a32ecf95ff740d
SHA512 0579d51748733907072b6b3cb44ab2f2da26304d47c679b7da94b0d1f0ffa8dd07c50db7171a03cac3d3ee1fbbd5b3d516d311e8e20f11c44dbddf022a0e63b8
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyG:BMWKfU+BcUTHCCCfqCiUffnG
TLSH
T10E263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\p6VnZH\XPSPLOG.dll
Size 3.0MB
SHA256 ec52cf36a238a14a2e3dd31890576c8c04bdba5841cd4f0f5dff50e3d0691846
MD5 2bd4a4710d5065d2a525b7148d103a88
SHA1 33ad59df58311eaddd9745e63b935e2600b64250
SHA512 cad11a4646754b74483132b51869e9079ade670fe0a47791ef23022cdd60a49975ac02d999a2ded0406adde531b317917cf63fcd9394c8d6622527d791bfb18d
SSDEEP 49152:3KLKP3cCMWmRqKJ1JNST5Z/nvsNBcVwNefYhOY+nEXOnqaiOKZCU0:yCMWmcKfST5t+BceThTHfaCCU0
TLSH
T1D4E533CAAA8B511AF62132B95F7DEC7DB6BC4AC4431CFC45D8A6314F4054BAE903CA4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\p6VnZH\image.png
Size 4.8MB
SHA256 8afcc2032aaef46f0191027ae2ebb2e97cbbd682d22ed891fe51513324f7a2cf
MD5 d21acb934e9b04b80f158fd077d659b8
SHA1 e51c9f87c2cc1ef05afc87e3cdfa9b3a24ced332
SHA512 eda84fa4b5b4d56c00f464156f3eded172e88b99eb520cf4b7ee3868d4322e65853beaf2ef3ded374f0919ddbd055986475d4f9926068f6b480acfec9a3404e2
SSDEEP 98304:q/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:qMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T1E336334FE6EFBED9C39CF7EA71098A30D63A8FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\p6VnZH\thumbs.db
Size 358KB
SHA256 ab03d1287388e8fcf7328d444f6a031e89115d7b76981149d52109fdf78622be
MD5 4d58dc9ee8cafe2b758793bc6f3fa5b6
SHA1 09c086ca2f52699769208e2c3252d939a08533d0
SHA512 a2c43f3a3fe017bd636fd59d2ca532c5f5f89be011ae4c06dc982ea355a703eb5afcad2aa68caf1224c79ecadc1ac5a5109c14bd6243f08de7ac43c034115760
SSDEEP 6144:liACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:M8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T11174F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\tAg8J6\XPSPLOG.dll
Size 2.9MB
SHA256 c3470d959260d0a487608c9a1a7399998b0c3777157b9e54c44ab13304e06c85
MD5 e6c568281bbf2d245486547a96f9df20
SHA1 bbc7c676f2122b142d6f1f2e3687c43373b47e5b
SHA512 574a362e80daed71981bb4375969dd4dfad1d255ea8d36a2c50592d5c0f4286efd3f79942073bf2cf2e5680ac9ac735befeac95275a8171ea87f9445207c2f88
SSDEEP 49152:3KLKP3cCMWmRqKJ1JNST5Z/nvsNBcVwNefYhOY+nEXOnqaiOKZCUo:yCMWmcKfST5t+BceThTHfaCCUo
TLSH
T1C6E533CEAA9B562EF62122B91F7DEC7DB6BC4AC4431DF845D4A6314F4054BAE803C64C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 164ef2f06813f577119a7e8c22a59c59f72b023ab67f531a2c517e6f12236b47
MD5 655b068972cbfdfb12ef8b24c145eab7
SHA1 1773a64a43e57d52d9046d90de641cf5fc5e6925
SHA512 87b8a3ab847425bb4d23024590a26b7556a2cb0d78ffe5bf4ed77e0d45e97fb6d0f731c6a1f8f342e7970588007738cf5e281e3968033bf9b5d792fc92527b0c
TLSH
T16F3174BB6F6C38929F3F8E4411CAB1212CA5A2805CD5099A6254C0A88B443F26F4D90C
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 8d385c0931a5bafea01a056869b2d80bec56a60dfd585c6644c5ad5298764d80
MD5 e71db57207f6e8a1eff97d2a0281cc7a
SHA1 0951feee76b7b089621ff57a6ceaf06d55df5c4d
SHA512 795d4cf8c981401fe1f5b2fb51b63efa34c5fec3e8989b8c7920b218a083a61729aa22483381a9e2465f90d3b75471881b3be9c1531944ea13457696927226cb
TLSH
T1B431D8925E3D50129B088F345BD0D53BACF1B4654CA85812627ED2AA8719BB75F86004
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 b73975fcd92531dd043a78916c98544b06a71ff7a55c57193f2e9fabdd9fd677
MD5 f4c462e69bc75be37bfd9df9680ed515
SHA1 e896f01c5c0f80ad2a52440a3f8c9c59bbc544f9
SHA512 4adb7378af8f349a60db29a6e975ca4c5817f9d6c5259ae2995a3cbd1608aa6f22f688761affb8cfed884616f0c2386cb274cbbee095c3b2ab384ca42ef766f8
TLSH
T1C1F05C0C4AF8422FF033FA3C0BCC342A2B6BF201200284E803F6030EA201E023E82178
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 9f44d2d50a1d672b063302a0d2f57025d22fe27b27b00e390d8b8ad039ba8dad
MD5 26c7a4b74a211b8fbeceeec7ea2f26a0
SHA1 1ae93febcac71f4aec57d29b582a7887f830a846
SHA512 38eb0043a11bf9515cea75b84a428fb33dcff7f4d7adc9d931629530b82650de6203079efe596e276fb9504587b4d0c73fa4ed6744ee15c088ffc92ce6578a4e
TLSH
T12CF0D43D11DD005BF07BD1B40BD1FA72D969E6311017A37D0AE603052F61D411CC116C
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_5hpdzc2t.o5i.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5hpdzc2t.o5i.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\A26qbu\UxEnhance64.dll
Size 3.1MB
SHA256 4245784e04933de976140acdadcd039b4787323be669f3fed666c1ef06dbe4af
MD5 4c7b44248163db881007d1487d6773a1
SHA1 3370b5127799c7a31009dea190d5422c85f7866c
SHA512 775e5ef65d28dc54d2f3ff1666827a79e14b9c0a33da3b4ad9c31af1ac84c749686f97669fdccff4f03d4196f19b72c0292cacacefa8171a76c473dfad83153c
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+u:P9m29xx3Tiqt06ox6+z2rNNrKou
TLSH
T1D2E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

YJ8glq.exe

Path C:\Users\Public\A26qbu\YJ8glq.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\A26qbu\adoresd.dat
Size 4.8MB
SHA256 b58cc282f6dd16f21ed6ef0668c8eb6a9dd58beb58c3a0846274f1122b53052d
MD5 ef39e1d9d2b828bd17d34d789e0afdf4
SHA1 ed6eb8f700047665daa9ad447a2d95d0ebe8f0cc
SHA512 7e9301df6058030b21a3e845e5400e79e047515637813411900832dc7e5ececce99ec7daf93efd03888b40a6e1da1738c152fa0e1222f6aab83044ad1cc156ce
SSDEEP 98304:zWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:zWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T1C73633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\A26qbu\msadox.tb
Size 8KB
SHA256 d6cd925071e1b11d7b074db7dec6ce096617108d7f123de42f980ff655b16d13
MD5 43165f9a011db0068cf98a79c114df9f
SHA1 b320a2b614218fd1555e0e7d46bf31d3b4284c70
SHA512 bab688103a53de300470db179986d0dc301525734aa5220b709a6823c050e472c6db77fd70604004cbb80a96b8ed329d7c96cd253a7f3bc35cf1897f9b1523e2
SSDEEP 192:4qbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:4sZqZOXQ3uqvR2Kfzp
TLSH
T1A6029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/924-589-0x00000280349D0000-0x00000280352A7000-memory.dmp

Download

memory/924-588-0x00000280349D0000-0x00000280352A7000-memory.dmp

Download

memory/924-583-0x00000280349D0000-0x00000280352A7000-memory.dmp

Download

memory/924-587-0x00000280349D0000-0x00000280352A7000-memory.dmp

Download

memory/924-582-0x00007FFC95E60000-0x00007FFC95E62000-memory.dmp

Download

memory/924-575-0x00000280349D0000-0x00000280352A7000-memory.dmp

Download

memory/924-572-0x00007FFC73160000-0x00007FFC7367E000-memory.dmp

Download

memory/924-590-0x00000280349D0000-0x00000280352A7000-memory.dmp

Download

memory/924-591-0x00007FFC95E50000-0x00007FFC95E52000-memory.dmp

Download

memory/1172-682-0x00000000010E0000-0x00000000010E1000-memory.dmp

Download

memory/1172-525-0x00007FFC8B640000-0x00007FFC8B652000-memory.dmp

Download

memory/1172-701-0x0000000003E90000-0x0000000003EA4000-memory.dmp

Download

memory/1172-694-0x00000000035B0000-0x0000000003D8D000-memory.dmp

Download

memory/1172-690-0x00000000035B0000-0x0000000003D8D000-memory.dmp

Download

memory/1172-684-0x0000000074840000-0x0000000074F8A000-memory.dmp

Download

memory/1172-524-0x00000000005C0000-0x00000000005CE000-memory.dmp

Download

memory/1172-504-0x00007FFC8B640000-0x00007FFC8B652000-memory.dmp

Download

memory/1172-2-0x00000000005D0000-0x00000000005DC000-memory.dmp

Download

memory/1172-1-0x00000000005C0000-0x00000000005CE000-memory.dmp

Download

memory/1172-0-0x00000000005C0000-0x00000000005CE000-memory.dmp

Download

memory/1172-687-0x00000000035B0000-0x0000000003D8D000-memory.dmp

Download

memory/1172-689-0x0000000001100000-0x0000000001101000-memory.dmp

Download

memory/3660-539-0x000002628F0D0000-0x000002628F9A7000-memory.dmp

Download

memory/3660-544-0x000002628F0D0000-0x000002628F9A7000-memory.dmp

Download

memory/3660-564-0x000002628F0D0000-0x000002628F9A7000-memory.dmp

Download

memory/3660-558-0x000002628E540000-0x000002628E58E000-memory.dmp

Download

memory/3660-559-0x000002628E640000-0x000002628E6CA000-memory.dmp

Download

memory/3660-530-0x00007FFC95E50000-0x00007FFC95E52000-memory.dmp

Download

memory/3660-531-0x00007FFC73160000-0x00007FFC7367E000-memory.dmp

Download

memory/3660-536-0x000002628F0D0000-0x000002628F9A7000-memory.dmp

Download

memory/3660-538-0x00007FFC95E60000-0x00007FFC95E62000-memory.dmp

Download

memory/3660-560-0x000002628E640000-0x000002628E6CA000-memory.dmp

Download

memory/3660-561-0x000002628E640000-0x000002628E6CA000-memory.dmp

Download

memory/3660-556-0x000002628F0D0000-0x000002628F9A7000-memory.dmp

Download

memory/3660-562-0x000002628E640000-0x000002628E6CA000-memory.dmp

Download

memory/3660-550-0x000002628F0D0000-0x000002628F9A7000-memory.dmp

Download

memory/3660-546-0x000002628F0D0000-0x000002628F9A7000-memory.dmp

Download

memory/3660-545-0x000002628F0D0000-0x000002628F9A7000-memory.dmp

Download

memory/3660-565-0x000002628F0D0000-0x000002628F9A7000-memory.dmp

Download

memory/3660-543-0x000002628F0D0000-0x000002628F9A7000-memory.dmp

Download

memory/4776-613-0x0000019B5E7F0000-0x0000019B5E7FA000-memory.dmp

Download

memory/4776-612-0x0000019B5E890000-0x0000019B5E942000-memory.dmp

Download

memory/4776-611-0x0000019B5E870000-0x0000019B5E88E000-memory.dmp

Download

memory/4776-601-0x0000019B5E800000-0x0000019B5E822000-memory.dmp

Download