bde6eabb5032ff97f8578e806c856f032190f94fa9f1012fd6a093f2f6f67508

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 17:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.2.0.02.exe
Size 38.9MB
Sample261024-vx29ssv1cy
SHA256 bde6eabb5032ff97f8578e806c856f032190f94fa9f1012fd6a093f2f6f67508
MD5 0739d90a1ab8af5a2111fd0676dd2b53
SHA1 e780cbded59f8a0759caeb406fccfce38ff11214
SHA512 e57427c8ae163f495568bf2992ef538aa28bdf028546616bb99fd473b109bbbb38d3adbabb3f330a921acdf64a6d6cf8245dc140adf064c4276fbfaa866ded15
SSDEEP 49152:qPnycXVTyTyg5tJyNZ/W/hNbo1iTl8ZFPnMBwbePbgF+VS5sb5m+cZ2lyn0wgsXz:q6chqTShW/hNbSiQfMJPLmrUlsz
TLSH
T1B097D69FBF81DE82F957D23498A75B602336D9B40BF1C307125427206F9F2998EE25D8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	FVKPMh.exe

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\wdPv7h = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	EbbcAK.exe

Executes dropped EXE 4 IoCs

pid	Process
5780	EbbcAK.exe
2356	EbbcAK.exe
3388	FVKPMh.exe
4364	FVKPMh.exe

Loads dropped DLL 4 IoCs

pid	Process
5780	EbbcAK.exe
2356	EbbcAK.exe
3388	FVKPMh.exe
4364	FVKPMh.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5280	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\wdPv7h\\EbbcAK.exe\""	EbbcAK.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Alibaba SecurityHealtha = "\"C:\\Program Files (x86)\\FVKPMh\\FVKPMh.exe\""	FVKPMh.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
6048	cmd.exe
2044	cmd.exe
1744	cmd.exe
3948	cmd.exe
852	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	EbbcAK.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\FVKPMh\FVKPMh.exe	EbbcAK.exe
File created	C:\Program Files (x86)\FVKPMh\XPSPLOG.dll	EbbcAK.exe
File created	C:\Program Files (x86)\FVKPMh\image.png	EbbcAK.exe
File opened for modification	C:\Program Files (x86)\FVKPMh\XPSPLOG.dll	EbbcAK.exe
File opened for modification	C:\Program Files (x86)\FVKPMh\thumbs.db	EbbcAK.exe
File opened for modification	C:\Program Files (x86)\FVKPMh	EbbcAK.exe
File created	C:\Program Files (x86)\FVKPMh\thumbs.db	EbbcAK.exe
File opened for modification	C:\Program Files (x86)\FVKPMh\FVKPMh.exe	EbbcAK.exe
File opened for modification	C:\Program Files (x86)\FVKPMh\image.png	EbbcAK.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 9 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5324	cmd.exe
2648	cmd.exe
5208	cmd.exe
4652	cmd.exe
6140	cmd.exe
4260	cmd.exe
4756	cmd.exe
4500	cmd.exe
5560	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.2.0.02.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.2.0.02.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	EbbcAK.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	EbbcAK.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FVKPMh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FVKPMh.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6092	schtasks.exe
4056	schtasks.exe
876	schtasks.exe
3120	schtasks.exe
4336	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
912	install.2.0.02.exe
912	install.2.0.02.exe
912	install.2.0.02.exe
912	install.2.0.02.exe
912	install.2.0.02.exe
912	install.2.0.02.exe
912	install.2.0.02.exe
912	install.2.0.02.exe
912	install.2.0.02.exe
912	install.2.0.02.exe
912	install.2.0.02.exe
912	install.2.0.02.exe
912	install.2.0.02.exe
912	install.2.0.02.exe
912	install.2.0.02.exe
912	install.2.0.02.exe
912	install.2.0.02.exe
912	install.2.0.02.exe
912	install.2.0.02.exe
912	install.2.0.02.exe
912	install.2.0.02.exe
912	install.2.0.02.exe
912	install.2.0.02.exe
912	install.2.0.02.exe
912	install.2.0.02.exe
912	install.2.0.02.exe
912	install.2.0.02.exe
912	install.2.0.02.exe
912	install.2.0.02.exe
912	install.2.0.02.exe
912	install.2.0.02.exe
912	install.2.0.02.exe
5780	EbbcAK.exe
5780	EbbcAK.exe
5780	EbbcAK.exe
5780	EbbcAK.exe
5780	EbbcAK.exe
5780	EbbcAK.exe
5780	EbbcAK.exe
5780	EbbcAK.exe
5780	EbbcAK.exe
5780	EbbcAK.exe
5780	EbbcAK.exe
5780	EbbcAK.exe
5780	EbbcAK.exe
5780	EbbcAK.exe
5780	EbbcAK.exe
5780	EbbcAK.exe
5780	EbbcAK.exe
5780	EbbcAK.exe
5780	EbbcAK.exe
5780	EbbcAK.exe
5780	EbbcAK.exe
5780	EbbcAK.exe
5780	EbbcAK.exe
5780	EbbcAK.exe
5780	EbbcAK.exe
5780	EbbcAK.exe
5780	EbbcAK.exe
5780	EbbcAK.exe
5780	EbbcAK.exe
5780	EbbcAK.exe
5780	EbbcAK.exe
5780	EbbcAK.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
648	Process not Found
648	Process not Found
648	Process not Found
648	Process not Found

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 5780 wrote to memory of 6048	5780	EbbcAK.exe	95
PID 6048 wrote to memory of 6092	6048	cmd.exe	97
PID 6048 wrote to memory of 6112	6048	cmd.exe	98
PID 6048 wrote to memory of 1796	6048	cmd.exe	100
PID 6140 wrote to memory of 1804	6140	cmd.exe	104
PID 5780 wrote to memory of 2044	5780	EbbcAK.exe	105
PID 2044 wrote to memory of 4056	2044	cmd.exe	108
PID 2044 wrote to memory of 1028	2044	cmd.exe	109
PID 2044 wrote to memory of 3012	2044	cmd.exe	113
PID 2648 wrote to memory of 4256	2648	cmd.exe	114
PID 5780 wrote to memory of 1744	5780	EbbcAK.exe	115
PID 1744 wrote to memory of 876	1744	cmd.exe	117
PID 1744 wrote to memory of 4304	1744	cmd.exe	118
PID 4260 wrote to memory of 4172	4260	cmd.exe	121
PID 5780 wrote to memory of 3948	5780	EbbcAK.exe	122
PID 5780 wrote to memory of 852	5780	EbbcAK.exe	124
PID 1744 wrote to memory of 4684	1744	cmd.exe	125
PID 3948 wrote to memory of 4336	3948	cmd.exe	127
PID 852 wrote to memory of 3120	852	cmd.exe	128
PID 3948 wrote to memory of 4384	3948	cmd.exe	129
PID 852 wrote to memory of 2816	852	cmd.exe	131
PID 3948 wrote to memory of 616	3948	cmd.exe	132
PID 852 wrote to memory of 4324	852	cmd.exe	133
PID 4756 wrote to memory of 2128	4756	cmd.exe	135
PID 5780 wrote to memory of 3388	5780	EbbcAK.exe	136

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	FVKPMh.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.2.0.02.exe
"C:\Users\Admin\AppData\Local\Temp\install.2.0.02.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:912

C:\Users\Public\wdPv7h\EbbcAK.exe
C:\Users\Public\wdPv7h\EbbcAK.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5780
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\wdPv7h\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:6048
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\wdPv7h\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6092
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:6112
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1796
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2044
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4056
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1028
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3012
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1744
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:876
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4304
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4684
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3948
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4336
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4384
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:616
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:852
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3120
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2816
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4324
- C:\Program Files (x86)\FVKPMh\FVKPMh.exe
  "C:\Program Files (x86)\FVKPMh\FVKPMh.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - System policy modification
  PID:3388
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    PID:5208
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\FVKPMh" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:4500
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\FVKPMh" /inheritance:r
      4⤵
      Modifies file permissions
      PID:5280
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:4652
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:5560
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:5324

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\wdPv7h" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6140
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\wdPv7h" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1804

C:\Users\Public\wdPv7h\EbbcAK.exe
"C:\Users\Public\wdPv7h\EbbcAK.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2356

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4256

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:4800

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4260
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4172

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4756
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2128

C:\Program Files (x86)\FVKPMh\FVKPMh.exe
"C:\Program Files (x86)\FVKPMh\FVKPMh.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4364

C:\Program Files (x86)\FVKPMh\FVKPMh.exe
"C:\Program Files (x86)\FVKPMh\FVKPMh.exe"
1⤵
PID:3600

C:\Program Files (x86)\DHh13xHxN\2GAN0tiR.exe
"C:\Program Files (x86)\DHh13xHxN\2GAN0tiR.exe"
1⤵
PID:3192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

XPSPLOG.dll

Path C:\Program Files (x86)\DHh13xHxN\XPSPLOG.dll
Size 4.6MB
SHA256 75574658e96621f0a3f3a2ba1d0eee379244f551c2461fb61f33d82cf5ea26bc
MD5 8a70a3289fa15050c89b8ef0eb76dab1
SHA1 027c78c0d0f7506b55625c17d845cc9eee81d724
SHA512 19d5b148b88147dd292559a90e243189e25be5f1d52b58663b348e971bbd31383fd986253c8e83d2b671bb2032b785ca005bc195508dcf1c067ca52a1a78961f
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyF:BMWKfU+BcUTHCCCfqCiUffnF
TLSH
T173263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\DHh13xHxN\XPSPLOG.dll
Size 3.2MB
SHA256 601368742ce2ad1e3f87e015160ffe8f45c4f2bc8a4297f3baa8a48e6aaf5e79
MD5 500c4d85df6b00d754abbd978e1b8f2d
SHA1 15ed5e7218c0cbdab2b35b254044139cee7df1f0
SHA512 23f0f91ddaeaa2d63804de11947f5f58e1f0923bb5f25ff970ac30c8665e7dc5ad055a006cec647c621064ed53e6345632ef07aafcb5020f77e7f6b0ad8343a3
SSDEEP 49152:3KLKP3cCMWmRqKJ1JNST5Z/nvsNBcVwNefYhOY+nEXOnqaiOKZCUqyn78eT1d:yCMWmcKfST5t+BceThTHfaCCUqmJb
TLSH
T1D8F5334ABBCB921EE55272B84F3DFC7E76B859C8430CEC84D4A5314B90A6B6D503DA0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\DHh13xHxN\XPSPLOG.dll
Size 3.1MB
SHA256 6c22142b54d54a675cef8b2b07b78a030ac0de1db4770f3a4186e9fccdd574ae
MD5 1cf95dea96e1bc37d87e72436080f3ad
SHA1 3296b992f3c301df7f0b5cf74ca426d927235374
SHA512 4c2ac276a0df74fbd55490e4d57845525ea601cd61c0d1f868de22bb446a3d0cd4924c79bedb087a6d5463067315a843733cc40fa6c8092634b8647f47227533
SSDEEP 49152:3KLKP3cCMWmRqKJ1JNST5Z/nvsNBcVwNefYhOY+nEXOnqaiOKZCUqyv:yCMWmcKfST5t+BceThTHfaCCUqM
TLSH
T100E5338AAA9B050FE55172795F7DFC7D72BC5AC8431CFC48D8A6318B90A0B6D903CA4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FVKPMh.exe

Path C:\Program Files (x86)\FVKPMh\FVKPMh.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\FVKPMh\XPSPLOG.dll
Size 4.6MB
SHA256 547a8b573f93270e3d7c2f2a097c4b4f0318f592f9bb0ae539eef754c738cab1
MD5 3764e71e0265fa5875e134482bb1ecee
SHA1 66215b4466ef20314a72d032159b4c9f1833f6e0
SHA512 8b76ec15d024ad8bd23eeac3b4769046e9341269de398710711d16deac1782354c96f32594c4f3d8e367b05393cb719c4a628cb518eb7513620718ce444088d7
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyN:BMWKfU+BcUTHCCCfqCiUffnN
TLSH
T16E263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\FVKPMh\image.png
Size 4.8MB
SHA256 822ccd988284389e0bf1ce7b18c0537c2ee640fe394b16ee32799cd4cb952ff9
MD5 dcc5d53fbdb2c05da144c7ffc3e9bce7
SHA1 6ec64da28dbafb11a0e207c98308579fdd8f22ba
SHA512 0293573a1b19c5680898ab807c1b5418bea6dc0b87685babcd278e9b8441847a802305d1a0da7270f0c47318d1024ad73f3b33d4782676f0d24e7ffcd1ff295f
SSDEEP 98304:Q/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:QMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T11F36334FE6EFBED9C39CF7EA71098A30D63A8FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\FVKPMh\thumbs.db
Size 358KB
SHA256 507d0168070a6a6fd5faa34fbcb09746f0128511b4b0067cad746669457c3770
MD5 3f921daa13b1df8f24f5e479172f4717
SHA1 c8cddff2333ac436098d7efcab5b3a1056ea0b17
SHA512 a0d483cdc74571579b40d40e1550db216bda54d11295908be59ccf130cfc8f2c15d0e6fc3d7853543685147960d267ac3c03998889254d08b755323ad55d792d
SSDEEP 6144:HiACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:C8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T15E74F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 1536b2dc03501b4e6d1b9ea7b2714772fd68095cf038537ebdb7abfd26d72177
MD5 471967270f0025b2e8622092bc02937d
SHA1 0ec1a9602f8d1a9c61e8073ec28ad8c4b9c8e825
SHA512 7f2e69d198576f591cebff94c74787da6dec133255187ff91acc3fa3c50aa1899ea3bffdf1cff85717fcdcca54461c05da69da72360666958e60c69a1ba44074
TLSH
T1DC3177BF5F6975868F394E4115CDB2226DE5D1806CDF509A6111C8549F043616F8A908
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 9c95859992125703b840ead5dcae4d6db746509ef3d9289dda663e60b5bbc8a4
MD5 09590ce0ccef7bc23e46820269889a60
SHA1 dd5a97ee51f8c4911c8f390dd865834ad1fc25ad
SHA512 08aba2e923a96574be46dcf3c561309784533f1a34242179db2ed869a1c29c5282def78d36881f420b80e1fc67403e17a0a93bcbed606f8b467899dbcc037a58
TLSH
T10631F682DE3804519F0C0F3852C4D23FBCF4912858E44846723EC26B4D05F7B6FC6004
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 8e93681074ec83db7779c475f2e1ff173b6050c0b5f363d8211306d72286a178
MD5 7d5339edfaa258da9608ae5cec8baedf
SHA1 eaa37e910067dc24a66df1d4279641ba02d999b4
SHA512 c4b038db8787515164e7359eea0d5c220547b971717d2bc58700e26a28430dacb6742b8951cedc2490e264fd741da6407657b0efad5817daebce165054d0cc16
TLSH
T14FF09E184EFC412DF132DD3CC6C535562E2AF6011506459816F40B095647E423E22575
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 2a0dde3e00752b86d4d9bf55cf8f668e915fbda0fd14fd1abafea0262ed2549b
MD5 5abeb55fe5243402c4593647a9b83ab7
SHA1 8125ebad1c76a86312d682584208d949941dc53d
SHA512 7c8f0fdb090f1b3fa04b1bf1b77581df2bfde0db0709d382dd4c18e7e681371215903eca36def8883bb7dc5b8820d09d798badb7f035e0a3672b45ddecabc888
TLSH
T1D6F05C2557DA002FF03FE6B88AD67EB29A29F6330006256F0AE652842F51F435C5366C
MD5 SHA1 SHA512 TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

EbbcAK.exe

Path C:\Users\Public\wdPv7h\EbbcAK.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\wdPv7h\UxEnhance64.dll
Size 3.1MB
SHA256 aab605bb26fbd44966d29c1568301279ef2c163360cd6d4d070854e4579cdd95
MD5 37f99a626e89e40df135229bdb1b84a8
SHA1 9077fee627c589e4f4f78d1f809f9cbec447600c
SHA512 311cb3f35958bd475feef79c057b0ca34b3c6c55dab1b7f21bb0878b24d89614b0e9ce3dfb066e4baccdb43cd917f3a09dc6894093e759b2ac23376907b31559
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+3:P9m29xx3Tiqt06ox6+z2rNNrKo3
TLSH
T1DAE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\wdPv7h\adoresd.dat
Size 4.8MB
SHA256 6e1665e64bb741a8baf22fe765427af3ecf2f6b25bd79e9dc651c356f0e21aa2
MD5 903d3fc67e7ac98ddacb1e5e9de46a11
SHA1 e77a599b56ddb3873f7dec6b679c9d74d1ba4b8a
SHA512 90f5b3449874782e2eeb83e05d56baaa9693eb8a94c5ff5750b4f4015ada319c9c0874c34e0eb4420aa2afd4b62214cbdbfb809db450404151d69702276cdd87
SSDEEP 98304:kWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:kWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T16A3633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\wdPv7h\msadox.tb
Size 8KB
SHA256 6127ad967b9401163f0e1b0c3de05aa8ec28cabeceae90374c752afc80c056cc
MD5 dfec764677836fa27091fbb7a35d501f
SHA1 f041adf19a909ef49dddc00fbd52638812b1ef9b
SHA512 f1d92530c9a8706e9eb765e05a9bdfa54e82f30c81b812a1a691e1493dd9061fe50ad07744166c9407e02895eba0bcb9cc5d8517705402e942262a45d45781aa
SSDEEP 192:nqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:nsZqZOXQ3uqvR2Kfzp
TLSH
T134029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xxxx.ini

Path \??\c:\xxxx.ini
Size 2B
SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
MD5 81051bcc2cf1bedf378224b0a93e2877
SHA1 ba8ab5a0280b953aa97435ff8946cbcbb2755a27
SHA512 1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
MD5 SHA1 SHA512

Submit Download

memory/912-524-0x00000000001D0000-0x00000000001DE000-memory.dmp

Download

memory/912-525-0x00007FFFC81F0000-0x00007FFFC8200000-memory.dmp

Download

memory/912-0-0x00000000001D0000-0x00000000001DE000-memory.dmp

Download

memory/912-504-0x00007FFFC81F0000-0x00007FFFC8200000-memory.dmp

Download

memory/912-2-0x00000000001E0000-0x00000000001EC000-memory.dmp

Download

memory/912-1-0x00000000001D0000-0x00000000001DE000-memory.dmp

Download

memory/2356-593-0x00007FFFD6D90000-0x00007FFFD6D92000-memory.dmp

Download

memory/2356-582-0x0000029824950000-0x0000029825227000-memory.dmp

Download

memory/2356-584-0x00007FFFD6DA0000-0x00007FFFD6DA2000-memory.dmp

Download

memory/2356-589-0x0000029824950000-0x0000029825227000-memory.dmp

Download

memory/2356-585-0x0000029824950000-0x0000029825227000-memory.dmp

Download

memory/2356-591-0x0000029824950000-0x0000029825227000-memory.dmp

Download

memory/2356-590-0x0000029824950000-0x0000029825227000-memory.dmp

Download

memory/2356-592-0x0000029824950000-0x0000029825227000-memory.dmp

Download

memory/2356-579-0x00007FFFB8660000-0x00007FFFB8B7E000-memory.dmp

Download

memory/3388-672-0x0000000000930000-0x0000000000931000-memory.dmp

Download

memory/3388-670-0x00000000031C0000-0x000000000399D000-memory.dmp

Download

memory/3388-684-0x0000000000E10000-0x0000000000E24000-memory.dmp

Download

memory/3388-706-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/3388-677-0x00000000031C0000-0x000000000399D000-memory.dmp

Download

memory/3388-709-0x00000000031C0000-0x000000000399D000-memory.dmp

Download

memory/3388-674-0x00000000031C0000-0x000000000399D000-memory.dmp

Download

memory/3388-698-0x00000000031C0000-0x000000000399D000-memory.dmp

Download

memory/3388-666-0x0000000074B40000-0x000000007528A000-memory.dmp

Download

memory/3388-665-0x0000000000910000-0x0000000000911000-memory.dmp

Download

memory/3600-727-0x00000000035B0000-0x0000000003D8D000-memory.dmp

Download

memory/3600-720-0x0000000074B40000-0x000000007528A000-memory.dmp

Download

memory/3600-719-0x0000000000E90000-0x0000000000E91000-memory.dmp

Download

memory/3600-734-0x00000000035B0000-0x0000000003D8D000-memory.dmp

Download

memory/3600-737-0x0000000000E90000-0x0000000000E91000-memory.dmp

Download

memory/3600-733-0x0000000000FC0000-0x0000000000FC1000-memory.dmp

Download

memory/4364-729-0x0000000002EB0000-0x000000000368D000-memory.dmp

Download

memory/4364-724-0x0000000074B40000-0x000000007528A000-memory.dmp

Download

memory/4364-723-0x0000000000810000-0x0000000000811000-memory.dmp

Download

memory/5780-546-0x0000022FAA8B0000-0x0000022FAB187000-memory.dmp

Download

memory/5780-539-0x0000022FAA8B0000-0x0000022FAB187000-memory.dmp

Download

memory/5780-543-0x0000022FAA8B0000-0x0000022FAB187000-memory.dmp

Download

memory/5780-544-0x0000022FAA8B0000-0x0000022FAB187000-memory.dmp

Download

memory/5780-562-0x0000022FAB5B0000-0x0000022FAB63A000-memory.dmp

Download

memory/5780-545-0x0000022FAA8B0000-0x0000022FAB187000-memory.dmp

Download

memory/5780-555-0x0000022FAA8B0000-0x0000022FAB187000-memory.dmp

Download

memory/5780-538-0x00007FFFD6DA0000-0x00007FFFD6DA2000-memory.dmp

Download

memory/5780-561-0x0000022FAB5B0000-0x0000022FAB63A000-memory.dmp

Download

memory/5780-536-0x0000022FAA8B0000-0x0000022FAB187000-memory.dmp

Download

memory/5780-560-0x0000022FAB4D0000-0x0000022FAB51E000-memory.dmp

Download

memory/5780-564-0x0000022FAB5B0000-0x0000022FAB63A000-memory.dmp

Download

memory/5780-531-0x00007FFFB8660000-0x00007FFFB8B7E000-memory.dmp

Download

memory/5780-563-0x0000022FAB5B0000-0x0000022FAB63A000-memory.dmp

Download

memory/5780-556-0x0000022FAA8B0000-0x0000022FAB187000-memory.dmp

Download

memory/5780-530-0x00007FFFD6D90000-0x00007FFFD6D92000-memory.dmp

Download

memory/5780-550-0x0000022FAA8B0000-0x0000022FAB187000-memory.dmp

Download