a8ac0868cc830320460852eb50690e21008aa412ba06b4c734058698c006219d

Analysis

max time kernel
151s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 13:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.3.1.05.exe
Size 32.4MB
Sample261027-qjdxtsdt3s
SHA256 a8ac0868cc830320460852eb50690e21008aa412ba06b4c734058698c006219d
MD5 063b70815ee26f964c177b063b819dbb
SHA1 61235d893f52bfdf6ae95e14563bc85706ec8ca3
SHA512 79197f4b33f96daa6ab01fb0244b0eb6bb10b9c10ea4a09af006ed62e69d8a80dd2cb4d87790647148d4a4b78dbbe64db992747ea44940e46bd3acc62b176832
SSDEEP 196608:zqEfM3r4vGOgAVAiZfFK0SBqtiEPFNPT2:z6qp6
TLSH
T137770646FA414DD2F85846F588ABB7A023FEBD7582D1C30721D87325AFAF29C0E93195
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

SilverFox-style Panasonic/Sauron loader chain targeting the staged Panasonic wrapper, image-named Al 17 IoCs

SilverFox-style Panasonic/Sauron loader chain with staged loader, Alibaba OSS carrier grammar, side-loaded UxEnhance64.dll, RPC Task Scheduler payload, adoresd bridge, and Sauron Edge stage.

resource	yara_rule
behavioral2/files/0x000d00000001c44e-535.dat	SilverFox_Panasonic_Sauron_Loader
behavioral2/memory/4240-540-0x00000162D1000000-0x00000162D18D7000-memory.dmp	SilverFox_Panasonic_Sauron_Loader
behavioral2/memory/4240-544-0x00000162D1000000-0x00000162D18D7000-memory.dmp	SilverFox_Panasonic_Sauron_Loader
behavioral2/memory/4240-545-0x00000162D1000000-0x00000162D18D7000-memory.dmp	SilverFox_Panasonic_Sauron_Loader
behavioral2/memory/4240-546-0x00000162D1000000-0x00000162D18D7000-memory.dmp	SilverFox_Panasonic_Sauron_Loader
behavioral2/memory/4240-547-0x00000162D1000000-0x00000162D18D7000-memory.dmp	SilverFox_Panasonic_Sauron_Loader
behavioral2/memory/4240-552-0x00000162D1000000-0x00000162D18D7000-memory.dmp	SilverFox_Panasonic_Sauron_Loader
behavioral2/memory/4240-558-0x00000162D1000000-0x00000162D18D7000-memory.dmp	SilverFox_Panasonic_Sauron_Loader
behavioral2/memory/4240-566-0x00000162D1000000-0x00000162D18D7000-memory.dmp	SilverFox_Panasonic_Sauron_Loader
behavioral2/memory/4240-568-0x00000162D1000000-0x00000162D18D7000-memory.dmp	SilverFox_Panasonic_Sauron_Loader
behavioral2/memory/4240-569-0x00000162D1000000-0x00000162D18D7000-memory.dmp	SilverFox_Panasonic_Sauron_Loader
behavioral2/memory/1212-587-0x000002D2A0770000-0x000002D2A1047000-memory.dmp	SilverFox_Panasonic_Sauron_Loader
behavioral2/memory/1212-591-0x000002D2A0770000-0x000002D2A1047000-memory.dmp	SilverFox_Panasonic_Sauron_Loader
behavioral2/memory/1212-592-0x000002D2A0770000-0x000002D2A1047000-memory.dmp	SilverFox_Panasonic_Sauron_Loader
behavioral2/memory/1212-594-0x000002D2A0770000-0x000002D2A1047000-memory.dmp	SilverFox_Panasonic_Sauron_Loader
behavioral2/memory/1212-593-0x000002D2A0770000-0x000002D2A1047000-memory.dmp	SilverFox_Panasonic_Sauron_Loader
behavioral2/memory/1736-715-0x0000000010000000-0x0000000010061000-memory.dmp	SilverFox_Panasonic_Sauron_Loader

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\iRycVo = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5868	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
4240	FyB57k.exe
1212	FyB57k.exe

Loads dropped DLL 4 IoCs

pid	Process
4240	FyB57k.exe
4240	FyB57k.exe
1212	FyB57k.exe
1212	FyB57k.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\iRycVo\\FyB57k.exe\""	FyB57k.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
5520	cmd.exe
5388	cmd.exe
2780	cmd.exe
2236	cmd.exe
5068	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	FyB57k.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\3vq9E5\Jkw7tY.exe	FyB57k.exe
File created	C:\Program Files (x86)\3vq9E5\XPSPLOG.dll	FyB57k.exe
File created	C:\Program Files (x86)\3vq9E5\image.png	FyB57k.exe
File opened for modification	C:\Program Files (x86)\3vq9E5\XPSPLOG.dll	FyB57k.exe
File opened for modification	C:\Program Files (x86)\3vq9E5\thumbs.db	FyB57k.exe
File opened for modification	C:\Program Files (x86)\3vq9E5	FyB57k.exe
File created	C:\Program Files (x86)\3vq9E5\thumbs.db	FyB57k.exe
File opened for modification	C:\Program Files (x86)\3vq9E5\Jkw7tY.exe	FyB57k.exe
File opened for modification	C:\Program Files (x86)\3vq9E5\image.png	FyB57k.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 7 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
248	cmd.exe
5488	cmd.exe
5272	cmd.exe
1028	cmd.exe
2960	cmd.exe
4728	cmd.exe
4108	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	FyB57k.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	FyB57k.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.3.1.05.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.3.1.05.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1204	schtasks.exe
480	schtasks.exe
2056	schtasks.exe
3372	schtasks.exe
5696	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3252	install.3.1.05.exe
3252	install.3.1.05.exe
3252	install.3.1.05.exe
3252	install.3.1.05.exe
3252	install.3.1.05.exe
3252	install.3.1.05.exe
3252	install.3.1.05.exe
3252	install.3.1.05.exe
3252	install.3.1.05.exe
3252	install.3.1.05.exe
3252	install.3.1.05.exe
3252	install.3.1.05.exe
3252	install.3.1.05.exe
3252	install.3.1.05.exe
3252	install.3.1.05.exe
3252	install.3.1.05.exe
3252	install.3.1.05.exe
3252	install.3.1.05.exe
3252	install.3.1.05.exe
3252	install.3.1.05.exe
3252	install.3.1.05.exe
3252	install.3.1.05.exe
3252	install.3.1.05.exe
3252	install.3.1.05.exe
3252	install.3.1.05.exe
3252	install.3.1.05.exe
3252	install.3.1.05.exe
3252	install.3.1.05.exe
3252	install.3.1.05.exe
3252	install.3.1.05.exe
3252	install.3.1.05.exe
3252	install.3.1.05.exe
4240	FyB57k.exe
4240	FyB57k.exe
4240	FyB57k.exe
4240	FyB57k.exe
4240	FyB57k.exe
4240	FyB57k.exe
4240	FyB57k.exe
4240	FyB57k.exe
4240	FyB57k.exe
4240	FyB57k.exe
4240	FyB57k.exe
4240	FyB57k.exe
4240	FyB57k.exe
4240	FyB57k.exe
4240	FyB57k.exe
4240	FyB57k.exe
4240	FyB57k.exe
4240	FyB57k.exe
4240	FyB57k.exe
4240	FyB57k.exe
4240	FyB57k.exe
4240	FyB57k.exe
4240	FyB57k.exe
4240	FyB57k.exe
4240	FyB57k.exe
4240	FyB57k.exe
4240	FyB57k.exe
4240	FyB57k.exe
4240	FyB57k.exe
4240	FyB57k.exe
4240	FyB57k.exe
4240	FyB57k.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	5868	powershell.exe
Token: SeIncreaseQuotaPrivilege	5868	powershell.exe
Token: SeSecurityPrivilege	5868	powershell.exe
Token: SeTakeOwnershipPrivilege	5868	powershell.exe
Token: SeLoadDriverPrivilege	5868	powershell.exe
Token: SeSystemProfilePrivilege	5868	powershell.exe
Token: SeSystemtimePrivilege	5868	powershell.exe
Token: SeProfSingleProcessPrivilege	5868	powershell.exe
Token: SeIncBasePriorityPrivilege	5868	powershell.exe
Token: SeCreatePagefilePrivilege	5868	powershell.exe
Token: SeBackupPrivilege	5868	powershell.exe
Token: SeRestorePrivilege	5868	powershell.exe
Token: SeShutdownPrivilege	5868	powershell.exe
Token: SeDebugPrivilege	5868	powershell.exe
Token: SeSystemEnvironmentPrivilege	5868	powershell.exe
Token: SeRemoteShutdownPrivilege	5868	powershell.exe
Token: SeUndockPrivilege	5868	powershell.exe
Token: SeManageVolumePrivilege	5868	powershell.exe
Token: 33	5868	powershell.exe
Token: 34	5868	powershell.exe
Token: 35	5868	powershell.exe
Token: 36	5868	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4240 wrote to memory of 5868	4240	FyB57k.exe	93
PID 4240 wrote to memory of 5520	4240	FyB57k.exe	95
PID 5520 wrote to memory of 2056	5520	cmd.exe	97
PID 5520 wrote to memory of 4628	5520	cmd.exe	99
PID 4240 wrote to memory of 5388	4240	FyB57k.exe	101
PID 5520 wrote to memory of 4816	5520	cmd.exe	103
PID 5388 wrote to memory of 3372	5388	cmd.exe	105
PID 4240 wrote to memory of 2780	4240	FyB57k.exe	106
PID 5388 wrote to memory of 2920	5388	cmd.exe	108
PID 5388 wrote to memory of 4496	5388	cmd.exe	110
PID 2780 wrote to memory of 5696	2780	cmd.exe	111
PID 2780 wrote to memory of 704	2780	cmd.exe	112
PID 4240 wrote to memory of 2236	4240	FyB57k.exe	113
PID 2780 wrote to memory of 2276	2780	cmd.exe	115
PID 2236 wrote to memory of 1204	2236	cmd.exe	116
PID 4240 wrote to memory of 5068	4240	FyB57k.exe	119
PID 2236 wrote to memory of 4836	2236	cmd.exe	120
PID 2236 wrote to memory of 4944	2236	cmd.exe	123
PID 5068 wrote to memory of 480	5068	cmd.exe	124
PID 5068 wrote to memory of 1096	5068	cmd.exe	125
PID 5068 wrote to memory of 5092	5068	cmd.exe	127
PID 4108 wrote to memory of 1976	4108	cmd.exe	130
PID 1028 wrote to memory of 5340	1028	cmd.exe	131
PID 2960 wrote to memory of 5424	2960	cmd.exe	132
PID 4728 wrote to memory of 4244	4728	cmd.exe	134

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.3.1.05.exe
"C:\Users\Admin\AppData\Local\Temp\install.3.1.05.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:3252

C:\Users\Public\iRycVo\FyB57k.exe
"C:\Users\Public\iRycVo\FyB57k.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4240
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:5868
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\iRycVo\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5520
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\iRycVo\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2056
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4628
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4816
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5388
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3372
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2920
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4496
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5696
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:704
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2276
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2236
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1204
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4836
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4944
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5068
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:480
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1096
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5092
- C:\Program Files (x86)\3vq9E5\Jkw7tY.exe
  "C:\Program Files (x86)\3vq9E5\Jkw7tY.exe"
  2⤵
  PID:1736
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    PID:248
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\3vq9E5" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:5488
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:5272

C:\Users\Public\iRycVo\FyB57k.exe
"C:\Users\Public\iRycVo\FyB57k.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1212

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\iRycVo" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\iRycVo" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5340

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:1240

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5424

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4244

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1976

C:\Program Files (x86)\3vq9E5\Jkw7tY.exe
"C:\Program Files (x86)\3vq9E5\Jkw7tY.exe"
1⤵
PID:4152

C:\Program Files (x86)\3vq9E5\Jkw7tY.exe
"C:\Program Files (x86)\3vq9E5\Jkw7tY.exe"
1⤵
PID:2488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Jkw7tY.exe

Path C:\Program Files (x86)\3vq9E5\Jkw7tY.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Jkw7tY.exe

Path C:\Program Files (x86)\3vq9E5\Jkw7tY.exe
Size 128KB
SHA256 aaf06558ccf7fe6c2b109c9f4b7c7cf441168a12f2bc455837dfbd14da2bf244
MD5 55119cfc241590e439ce73c8734eaead
SHA1 c7aa8f9849ecbcb998666c5707bf388602c8b14c
SHA512 4cdb74e438aa69ecbc8e40fa27acb699295816b7a6dac6b2668bd5de201fc1a2a0f6d2fc1c9a44aee2d24a4a2dc9a213102325098ae7c4092b72644fcc4c5648
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaq:Yz8upLGaPQDnFzaq
TLSH
T159D3E652B6818464F76A0B311865F9E04A6EED3C19E0E95FF2787E3A1E311C38A3355F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\3vq9E5\XPSPLOG.dll
Size 4.6MB
SHA256 e78bf1e38d2da8ec7fe9ff6632b0df574b1db00b21df49724a8f539b82aca041
MD5 449d49036162969a8fc932115c137b24
SHA1 2be0850fe4899a1f4b2bddb341dedb2ac2030e2f
SHA512 99c6916a0f20c3a816191dae0411dc1dfdec98d4516d33dd45f3ca3b8575ff0cd57d79579fc6f4c611f8248c2bb0faec7392f9934b435c2a6ad689fbb346c08f
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyp:BMWKfU+BcUTHCCCfqCiUffnp
TLSH
T10E263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\3vq9E5\XPSPLOG.dll
Size 1.1MB
SHA256 185c77206b4ed79b2af4946a18ac11546a07b3d24e856ed393ce66d9e37fc268
MD5 00169bcebc037dc7efc60f3c0ed22873
SHA1 e57a6729b30891eb15f2d07df13189b92946719d
SHA512 6632737b3e0dcc5245af120eb86c3ac87f45186d67624c63ebf33f253792d64488c96fe49052d43d7a3e239eb2bd86b3754017fc70a77eac94a8bee391621ffa
SSDEEP 24576:RTOuWhLK5RyoT9xcjWByWfymm5LQMqKJoyPhNuTXL:3KLKP3cCMWmRqKJ1JNSL
TLSH
T1A94523C661CBA129EA5573716F8DFD6CB4BD58C401B9DC1DE8D5718B0036AFB503828E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\3vq9E5\image.png
Size 4.8MB
SHA256 f7c0b8fc8b2575298ba8e995717580e1e788e66de7ba8257d650c83fe9fae5f8
MD5 c601cf5816e33e6fe24c36b4746a78e8
SHA1 9262a7eb41e654389a6816daa0625181906a2a84
SHA512 3f41544610a4ed26994e09ebfdd9a38014c593679d91fa8d3e5e2037a3ea8375d47024b6473f95755b16872111976591196e2c0ad06a44c6e27a9acebb4b2e5a
SSDEEP 98304:K/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:KMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T1F136334FE6EFBED9C39CF7EA71098A30D63A8FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\3vq9E5\thumbs.db
Size 358KB
SHA256 0ca7ba5eabc19e8e21f11caf7ed9117c044e3bec6fa3dd15d050bcf93b5d2d00
MD5 ec38b0a5034992f76be28d0f9b680f7a
SHA1 a4d92da5cefe75943b82c1d33dfee41b977daa25
SHA512 ac3b0e61d30000f9dbeb3354f77fc8be7389746ebfdaa8ad2fade9eee20668df24332342dfb509d88d1a89cfb4dfbb8899e2d0015f0996809784e3cab22549b5
SSDEEP 6144:tiACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:k8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T15874F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 fcd673e16b3351e431be978d08cfbadd9185c6bef12608c2f2f0564f11be165b
MD5 32648c8e88e9b6a8ce5499eb20149b8c
SHA1 76d8d5b41da61fa7c058146038351bff3d0a0bb8
SHA512 705c55664e25aca620c671e30bc7496c6d7f8c27cda8f8683064e09d2906cdc710e4bf959bf2b2348a42c1d7e47531b0f7155d7db423eee17bd5f5a3d4ff4cd3
TLSH
T1B731C67B1FEE3987DBAE8D4824CBA5231CE9E1802CDA404E1024C49D9F083B22F1D90D
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 8a5f2300aaef3aa8cb97713071fe9bdb4a73c9862e743ad900e4a29ed4a648e9
MD5 2c834c295fd1c395276d500a728e3f7b
SHA1 a41656ceba6f8f8130280e9fa4ba2aef71ddf593
SHA512 d860e54270066df2f194e039545fd14478aec309c827fb6c44200dbc4da97653cc0d44eb13ecb475a1d81c22afdce687c5a1e95d573284f5ee60752c2475f5fe
TLSH
T13531B6939D750002DF0C8F69A6C1C53B7CF1A6249CEC5881723EC26A4A5ABBB9FC5441
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 044aa59bfe024b708aa6ad709415c1043295c72c7ef6ef50d75d9024cecaa8f8
MD5 d18e882819bd5deaedd15e1fd3804829
SHA1 4258b2086f9fe13e9909e8643b8dcca30b217dd9
SHA512 3ffbe8930e821f45d4c629daa0ee0968568056101fad73697857b8ee05f0bb6c78784a4efd4981dfb88e9147923ca362b13fe84835d2829b50b4685d1b10cf41
TLSH
T1A6F05C18447C512DF073DA3C87CA79E726FFE60734054A9007F58708E957B032D526B9
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 5b475902e849f9d17b80e5dc0822f698dcfd220af734863a4ab6666b90ad18ce
MD5 c139d00757c4e103a920c34d7206eeab
SHA1 e3842d39db282e6ca72cf5e516b5b5e2a4fb46fe
SHA512 dfce1d366cbb2625c54541c9d21d5c8218a9ed4eb78c51c4802e63f3a6ff9293658bff91e762ab71df769976e254bab9f98f0a71477d444b051b75239cd9226e
TLSH
T10BF05C2985EE022FF07FA1B846D67EA1A96AF627101A51AD0AF502441A918001C41768
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_o2pgxckq.r2z.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_o2pgxckq.r2z.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

FyB57k.exe

Path C:\Users\Public\iRycVo\FyB57k.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\iRycVo\UxEnhance64.dll
Size 3.1MB
SHA256 182c551b61bf33d5df757946068f237aa319d93f4c56e258efd86192637da249
MD5 6da58854ea662456c00bd4576c3ffc9e
SHA1 947547cdd20124ef45a7e7bf3b92bef90d935f81
SHA512 e8bcaf5c4ab6c61925f4af6f7c8c5a72e8144ac71b58bee16155a8e1bc92d31f87036808c46d5c69622d124d8237e50a41d82ab5331609e3c3494c01f9556656
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+w:P9m29xx3Tiqt06ox6+z2rNNrKow
TLSH
T19CE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\iRycVo\adoresd.dat
Size 4.8MB
SHA256 512d1a444e7c2a9c1f2dd6e5c5751643d62bd1216311fb348632a0cef1885849
MD5 eae32a95af70b39ae30b99a7af92646c
SHA1 7e7860512eb43949cff35072e8588f94ef51c9ad
SHA512 d68a9a1a94061d95362aa54e2409814b994881d0bd4a3c5bc9ee88e995e49677456720d1a4823a90793aff98df4a07ed489585e9aa86268fdc5e227e3c335999
SSDEEP 98304:3Wjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:3Wj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T1D33633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\iRycVo\msadox.tb
Size 8KB
SHA256 42ac2e61b500cb7726a1116033a505b34516dc85664c4ac6e3e135de596cfd56
MD5 6b42fc2b36f9f69bb0fb8535258d1ab7
SHA1 b18d9624a9f980c2a6e7da3092b1c14ea9e8b11c
SHA512 423a1d52b9234e4982e663ac25f37b21b77cfbe0c50c0c7913413cbf676f657a75d5838274db3c502ed8388a4e0937c2fdf51f2477a78e34e6b43d70654890a6
SSDEEP 192:aqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:asZqZOXQ3uqvR2Kfzp
TLSH
T184029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DE2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1212-593-0x000002D2A0770000-0x000002D2A1047000-memory.dmp

Download

memory/1212-595-0x00007FF9942D0000-0x00007FF9942D2000-memory.dmp

Download

memory/1212-594-0x000002D2A0770000-0x000002D2A1047000-memory.dmp

Download

memory/1212-592-0x000002D2A0770000-0x000002D2A1047000-memory.dmp

Download

memory/1212-591-0x000002D2A0770000-0x000002D2A1047000-memory.dmp

Download

memory/1212-587-0x000002D2A0770000-0x000002D2A1047000-memory.dmp

Download

memory/1212-586-0x00007FF9942E0000-0x00007FF9942E2000-memory.dmp

Download

memory/1212-575-0x00007FF9942D0000-0x00007FF9942D2000-memory.dmp

Download

memory/1212-596-0x000002D29DF70000-0x000002D29E48E000-memory.dmp

Download

memory/1212-580-0x000002D2A0770000-0x000002D2A1047000-memory.dmp

Download

memory/1212-576-0x000002D29DF70000-0x000002D29E48E000-memory.dmp

Download

memory/1736-683-0x0000000074C00000-0x000000007534A000-memory.dmp

Download

memory/1736-691-0x0000000003640000-0x0000000003E1D000-memory.dmp

Download

memory/1736-682-0x0000000001220000-0x0000000001221000-memory.dmp

Download

memory/1736-687-0x0000000003640000-0x0000000003E1D000-memory.dmp

Download

memory/1736-724-0x0000000003640000-0x0000000003E1D000-memory.dmp

Download

memory/1736-715-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/1736-689-0x0000000001240000-0x0000000001241000-memory.dmp

Download

memory/1736-694-0x0000000003640000-0x0000000003E1D000-memory.dmp

Download

memory/1736-706-0x0000000003640000-0x0000000003E1D000-memory.dmp

Download

memory/1736-701-0x0000000002C40000-0x0000000002C54000-memory.dmp

Download

memory/3252-525-0x00007FF983EB0000-0x00007FF983EC2000-memory.dmp

Download

memory/3252-504-0x00007FF983EB0000-0x00007FF983EC2000-memory.dmp

Download

memory/3252-524-0x0000000002010000-0x000000000201E000-memory.dmp

Download

memory/3252-0-0x0000000002010000-0x000000000201E000-memory.dmp

Download

memory/3252-2-0x0000000002060000-0x000000000206C000-memory.dmp

Download

memory/3252-1-0x0000000002010000-0x000000000201E000-memory.dmp

Download

memory/4240-558-0x00000162D1000000-0x00000162D18D7000-memory.dmp

Download

memory/4240-550-0x00000162CE810000-0x00000162CED2E000-memory.dmp

Download

memory/4240-544-0x00000162D1000000-0x00000162D18D7000-memory.dmp

Download

memory/4240-568-0x00000162D1000000-0x00000162D18D7000-memory.dmp

Download

memory/4240-566-0x00000162D1000000-0x00000162D18D7000-memory.dmp

Download

memory/4240-560-0x00000162D05E0000-0x00000162D062E000-memory.dmp

Download

memory/4240-531-0x00007FF9942D0000-0x00007FF9942D2000-memory.dmp

Download

memory/4240-540-0x00000162D1000000-0x00000162D18D7000-memory.dmp

Download

memory/4240-539-0x00007FF9942E0000-0x00007FF9942E2000-memory.dmp

Download

memory/4240-545-0x00000162D1000000-0x00000162D18D7000-memory.dmp

Download

memory/4240-546-0x00000162D1000000-0x00000162D18D7000-memory.dmp

Download

memory/4240-537-0x00000162D1000000-0x00000162D18D7000-memory.dmp

Download

memory/4240-547-0x00000162D1000000-0x00000162D18D7000-memory.dmp

Download

memory/4240-561-0x00000162D1D10000-0x00000162D1D9A000-memory.dmp

Download

memory/4240-552-0x00000162D1000000-0x00000162D18D7000-memory.dmp

Download

memory/4240-569-0x00000162D1000000-0x00000162D18D7000-memory.dmp

Download

memory/4240-564-0x00000162D1D10000-0x00000162D1D9A000-memory.dmp

Download

memory/4240-563-0x00000162D1D10000-0x00000162D1D9A000-memory.dmp

Download

memory/4240-532-0x00000162CE810000-0x00000162CED2E000-memory.dmp

Download

memory/4240-562-0x00000162D1D10000-0x00000162D1D9A000-memory.dmp

Download

memory/5868-602-0x000001FBC0830000-0x000001FBC0852000-memory.dmp

Download

memory/5868-613-0x000001FBA79F0000-0x000001FBA8394000-memory.dmp

Download

memory/5868-611-0x000001FBC0820000-0x000001FBC082A000-memory.dmp

Download

memory/5868-610-0x000001FBC09B0000-0x000001FBC0A62000-memory.dmp

Download

memory/5868-609-0x000001FBC0860000-0x000001FBC087E000-memory.dmp

Download