9a90ad26de14459ec65dae68f2fbf30da72536126d54d0233f822ecec4db6c75

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/10/2026, 03:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-28_e68af92a62ced2860eceb8c3a46a0f9c_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
Size 38.9MB
Sample261029-d7s1faab55
SHA256 9a90ad26de14459ec65dae68f2fbf30da72536126d54d0233f822ecec4db6c75
MD5 e68af92a62ced2860eceb8c3a46a0f9c
SHA1 067c4f0bf41697452d6e9f715da1b6fc49aaccd5
SHA512 5846e05096786e3b0cec812281cae2b2cfd744b27160b2fbcb9a0c9ef833dda8418c05af6aea63c36eb26c6519782487cf2514ad6edb24407f66a1682e2b1294
SSDEEP 49152:qPnycXVTyTyg5tJyNZ/W/hNbo1iTl8ZFPnMBwbePbgF+VS5sb5m+cZ2lyn0wgsXJ:q6chqTShW/hNbSiQfMJPLmrUlsJ
TLSH
T1A597D69FBF81DE82F957D23498A75B602336D9B40BF1C307125427206F9F2998EE25D8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\i1ylRX = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\International\Geo\Nation	fShjai.exe

Executes dropped EXE 2 IoCs

pid	Process
3976	fShjai.exe
2252	fShjai.exe

Loads dropped DLL 2 IoCs

pid	Process
3976	fShjai.exe
2252	fShjai.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\i1ylRX\\fShjai.exe\""	fShjai.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
1096	cmd.exe
2064	cmd.exe
5004	cmd.exe
3008	cmd.exe
4792	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	fShjai.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1936	cmd.exe
4352	cmd.exe
1092	cmd.exe
4356	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-28_e68af92a62ced2860eceb8c3a46a0f9c_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-28_e68af92a62ced2860eceb8c3a46a0f9c_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	fShjai.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	fShjai.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2232	schtasks.exe
3268	schtasks.exe
1984	schtasks.exe
4840	schtasks.exe
4944	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
564	2026-10-28_e68af92a62ced2860eceb8c3a46a0f9c_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
564	2026-10-28_e68af92a62ced2860eceb8c3a46a0f9c_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
564	2026-10-28_e68af92a62ced2860eceb8c3a46a0f9c_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
564	2026-10-28_e68af92a62ced2860eceb8c3a46a0f9c_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
564	2026-10-28_e68af92a62ced2860eceb8c3a46a0f9c_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
564	2026-10-28_e68af92a62ced2860eceb8c3a46a0f9c_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
564	2026-10-28_e68af92a62ced2860eceb8c3a46a0f9c_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
564	2026-10-28_e68af92a62ced2860eceb8c3a46a0f9c_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
564	2026-10-28_e68af92a62ced2860eceb8c3a46a0f9c_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
564	2026-10-28_e68af92a62ced2860eceb8c3a46a0f9c_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
564	2026-10-28_e68af92a62ced2860eceb8c3a46a0f9c_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
564	2026-10-28_e68af92a62ced2860eceb8c3a46a0f9c_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
564	2026-10-28_e68af92a62ced2860eceb8c3a46a0f9c_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
564	2026-10-28_e68af92a62ced2860eceb8c3a46a0f9c_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
564	2026-10-28_e68af92a62ced2860eceb8c3a46a0f9c_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
564	2026-10-28_e68af92a62ced2860eceb8c3a46a0f9c_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
564	2026-10-28_e68af92a62ced2860eceb8c3a46a0f9c_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
564	2026-10-28_e68af92a62ced2860eceb8c3a46a0f9c_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
564	2026-10-28_e68af92a62ced2860eceb8c3a46a0f9c_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
564	2026-10-28_e68af92a62ced2860eceb8c3a46a0f9c_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
564	2026-10-28_e68af92a62ced2860eceb8c3a46a0f9c_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
564	2026-10-28_e68af92a62ced2860eceb8c3a46a0f9c_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
564	2026-10-28_e68af92a62ced2860eceb8c3a46a0f9c_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
564	2026-10-28_e68af92a62ced2860eceb8c3a46a0f9c_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
564	2026-10-28_e68af92a62ced2860eceb8c3a46a0f9c_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
564	2026-10-28_e68af92a62ced2860eceb8c3a46a0f9c_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
564	2026-10-28_e68af92a62ced2860eceb8c3a46a0f9c_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
564	2026-10-28_e68af92a62ced2860eceb8c3a46a0f9c_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
564	2026-10-28_e68af92a62ced2860eceb8c3a46a0f9c_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
564	2026-10-28_e68af92a62ced2860eceb8c3a46a0f9c_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
564	2026-10-28_e68af92a62ced2860eceb8c3a46a0f9c_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
564	2026-10-28_e68af92a62ced2860eceb8c3a46a0f9c_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
3976	fShjai.exe
3976	fShjai.exe
3976	fShjai.exe
3976	fShjai.exe
3976	fShjai.exe
3976	fShjai.exe
3976	fShjai.exe
3976	fShjai.exe
3976	fShjai.exe
3976	fShjai.exe
3976	fShjai.exe
3976	fShjai.exe
3976	fShjai.exe
3976	fShjai.exe
3976	fShjai.exe
3976	fShjai.exe
3976	fShjai.exe
3976	fShjai.exe
3976	fShjai.exe
3976	fShjai.exe
3976	fShjai.exe
3976	fShjai.exe
3976	fShjai.exe
3976	fShjai.exe
3976	fShjai.exe
3976	fShjai.exe
3976	fShjai.exe
3976	fShjai.exe
3976	fShjai.exe
3976	fShjai.exe
3976	fShjai.exe
3976	fShjai.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3976 wrote to memory of 5004	3976	fShjai.exe	99
PID 5004 wrote to memory of 3268	5004	cmd.exe	101
PID 5004 wrote to memory of 4204	5004	cmd.exe	103
PID 5004 wrote to memory of 4004	5004	cmd.exe	106
PID 3976 wrote to memory of 3008	3976	fShjai.exe	108
PID 3008 wrote to memory of 1984	3008	cmd.exe	111
PID 1936 wrote to memory of 3424	1936	cmd.exe	112
PID 3976 wrote to memory of 4792	3976	fShjai.exe	113
PID 3008 wrote to memory of 4224	3008	cmd.exe	115
PID 4792 wrote to memory of 4840	4792	cmd.exe	118
PID 3008 wrote to memory of 1900	3008	cmd.exe	119
PID 4792 wrote to memory of 4976	4792	cmd.exe	120
PID 4792 wrote to memory of 1184	4792	cmd.exe	121
PID 4352 wrote to memory of 3540	4352	cmd.exe	122
PID 3976 wrote to memory of 1096	3976	fShjai.exe	123
PID 1096 wrote to memory of 4944	1096	cmd.exe	125
PID 1096 wrote to memory of 376	1096	cmd.exe	126
PID 1096 wrote to memory of 3620	1096	cmd.exe	129
PID 1092 wrote to memory of 760	1092	cmd.exe	130
PID 3976 wrote to memory of 2064	3976	fShjai.exe	131
PID 2064 wrote to memory of 2232	2064	cmd.exe	133
PID 2064 wrote to memory of 2152	2064	cmd.exe	134
PID 2064 wrote to memory of 4424	2064	cmd.exe	137
PID 4356 wrote to memory of 4400	4356	cmd.exe	138

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-10-28_e68af92a62ced2860eceb8c3a46a0f9c_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-28_e68af92a62ced2860eceb8c3a46a0f9c_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:564

C:\Users\Public\i1ylRX\fShjai.exe
C:\Users\Public\i1ylRX\fShjai.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3976
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\i1ylRX\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5004
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\i1ylRX\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3268
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4204
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4004
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3008
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1984
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4224
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1900
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4792
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4840
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4976
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1184
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1096
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4944
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:376
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3620
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2064
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2232
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2152
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4424

C:\Users\Public\i1ylRX\fShjai.exe
"C:\Users\Public\i1ylRX\fShjai.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2252

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\i1ylRX" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\i1ylRX" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3424

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:3800

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4352
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3540

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:760

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4356
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 b286ac81a5df4e15c27358de17bca2770d15e090e9f2a928d82637d93bc2dee2
MD5 565ecc1f7f3cb4ca1664ca9e4b00460d
SHA1 5cb7189b4d6af705c15dcea79ba3126137894b9d
SHA512 0fbee8143d6bfe12a3ed0d03f612d975d7814b6e92248d2495f9a5d4787323479ef421ab62ac5f551ca7f6a74a1b0198bc5f509afe2ec47bf3d4cd7c177a3e48
TLSH
T1CB31A4EB1F7D3D4ACF6D4F4512C9A0352CEAF1809CE6409E6265D4A85F043B12F0E40D
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 97d1b361fd1ca5d253e4c7c8495b9cb1e66b62ab5816e610dcbbbeb3f8224140
MD5 50fe6c3f233958eff6fbd422096946d3
SHA1 05039871fc1d16da54cf20d222fc4d3fc0a255d6
SHA512 00a09383f80916f95a726a6ffcdd2d98d26cbc0b9b9dd776dc12bc05d55f703785ad1b3c5870076ae804f4b5646cfe01468c8c6b2cd45a5fd43e0cc0a23d2328
TLSH
T16531F6A28B3A1012CB0C4F6922C4D43F6DF9A1205CF40C08323EE12F5A047B35F86406
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 b5c71e20d88fa7ab4878f6a6d051a7891e7a0e675bc2d8ae0cf76ca27e6db8d1
MD5 e7b452cfbadaca177d5df5d827e2660b
SHA1 2b03151776d7d978192bee283d1c0dd272a5e382
SHA512 e4125eb9ebb2338e6ac39d984e5efffe5b571c5ffe49a2156bde0d3e808e60128edbdd711661098d2f436df1a97336ea99bab65da66715365fa3c4fc57c6cb18
TLSH
T1D6F0DC244C7C413CF073EA3C8ACAB8DD0BBBF201340745A442A0470CB842A072C9257E
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 335d562b4108cd80cdadd4ca4d60b6ce02e60baca6c8fcd76f7833ef168fc43f
MD5 bb9de9f9d830ca1b671dc8bc97ce4867
SHA1 2c326155c1a576b364bb9183d93dc284171b2110
SHA512 e6e153937f2c805f6cf688ccf2e589b862e077d4a6bae7c3eb55703b62c93668f84fc9b08f1d62a5ba8bc7fd79feb117e3bc2daa364c1c1a052420fcddbaa732
TLSH
T1ABF0DC2C41ED411BF23BC2B88AC67A324D26FB26104621BE09EA43406E31D002C4067F
MD5 SHA1 SHA512 TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\i1ylRX\UxEnhance64.dll
Size 3.1MB
SHA256 ffd3787138177873af753420915f3fab1e932c02fb4c0c0a8980a6c5e7f958ce
MD5 16c5ffb9e0e01b863d36aa1ff16b35a8
SHA1 9ab9e449098b2848ed99c1c5bd29371f9d1d1423
SHA512 da6c460042bd064bd428de83f0e0a5f84b6f11cb7fa188727da6a06de5d5a4375e233a5b422f40066bd1a9366c0986def403b26375811e19325a5740eca88496
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB++:P9m29xx3Tiqt06ox6+z2rNNrKo+
TLSH
T171E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\i1ylRX\adoresd.dat
Size 4.8MB
SHA256 63bf833d3d7ce93fbcfbb49e039bed41167816abc22ba243ac062c33bec574b3
MD5 2b45597428bde37de04c06a376ffd6c9
SHA1 da5aba066d53395c7d6986bab93aa6fa9eb49585
SHA512 15c9a739aa075002c4c805819b9983e751aedba7d48a97afc4d4dc50c46e3fecbedd04da8b216a2cab3799da1e1da712f252a4f2d886d15b2fbc1a2baab80ede
SSDEEP 98304:OWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:OWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T13B3633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fShjai.exe

Path C:\Users\Public\i1ylRX\fShjai.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\i1ylRX\msadox.tb
Size 8KB
SHA256 886750ec24426462030cbb9f6a4ff21c61a68cc1f0b7a9cdcf3916acea5bec4a
MD5 46270a66dabac0fcee25417cb146f1bb
SHA1 bc8ddb6f97493106fe17d4706a103133c41d5caf
SHA512 c90092ac26595e8e2601b481e7de99679c994e04cc30b479a64bad5b2b5c0cb2ae332f95410f574a1dfb8b26a6c74215bae6c9d413f164fbe5092bd80b3836e6
SSDEEP 192:XqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:XsZqZOXQ3uqvR2Kfzp
TLSH
T11C029E05D7A20CC3D2116C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/564-0-0x00000000001E0000-0x00000000001EE000-memory.dmp

Download

memory/564-524-0x00000000001E0000-0x00000000001EE000-memory.dmp

Download

memory/564-1-0x00000000001E0000-0x00000000001EE000-memory.dmp

Download

memory/564-2-0x00000000001F0000-0x00000000001FC000-memory.dmp

Download

memory/564-525-0x00007FF92E5F0000-0x00007FF92E600000-memory.dmp

Download

memory/564-504-0x00007FF92E5F0000-0x00007FF92E600000-memory.dmp

Download

memory/2252-587-0x000001E2EEE30000-0x000001E2EF707000-memory.dmp

Download

memory/2252-588-0x00007FF93E0F0000-0x00007FF93E0F2000-memory.dmp

Download

memory/2252-579-0x00007FF93E100000-0x00007FF93E102000-memory.dmp

Download

memory/2252-580-0x000001E2EEE30000-0x000001E2EF707000-memory.dmp

Download

memory/2252-586-0x000001E2EEE30000-0x000001E2EF707000-memory.dmp

Download

memory/2252-585-0x000001E2EEE30000-0x000001E2EF707000-memory.dmp

Download

memory/2252-584-0x000001E2EEE30000-0x000001E2EF707000-memory.dmp

Download

memory/2252-570-0x00007FF921840000-0x00007FF921D5E000-memory.dmp

Download

memory/2252-573-0x000001E2EEE30000-0x000001E2EF707000-memory.dmp

Download

memory/3976-536-0x000002103DBF0000-0x000002103E4C7000-memory.dmp

Download

memory/3976-560-0x000002103EAD0000-0x000002103EB5A000-memory.dmp

Download

memory/3976-558-0x000002103E9F0000-0x000002103EA3E000-memory.dmp

Download

memory/3976-555-0x000002103DBF0000-0x000002103E4C7000-memory.dmp

Download

memory/3976-561-0x000002103EAD0000-0x000002103EB5A000-memory.dmp

Download

memory/3976-563-0x000002103EAD0000-0x000002103EB5A000-memory.dmp

Download

memory/3976-562-0x000002103DBF0000-0x000002103E4C7000-memory.dmp

Download

memory/3976-559-0x000002103EAD0000-0x000002103EB5A000-memory.dmp

Download

memory/3976-550-0x000002103DBF0000-0x000002103E4C7000-memory.dmp

Download

memory/3976-546-0x000002103DBF0000-0x000002103E4C7000-memory.dmp

Download

memory/3976-538-0x00007FF93E100000-0x00007FF93E102000-memory.dmp

Download

memory/3976-544-0x000002103DBF0000-0x000002103E4C7000-memory.dmp

Download

memory/3976-545-0x000002103DBF0000-0x000002103E4C7000-memory.dmp

Download

memory/3976-539-0x000002103DBF0000-0x000002103E4C7000-memory.dmp

Download

memory/3976-543-0x000002103DBF0000-0x000002103E4C7000-memory.dmp

Download

memory/3976-530-0x00007FF93E0F0000-0x00007FF93E0F2000-memory.dmp

Download

memory/3976-531-0x00007FF921840000-0x00007FF921D5E000-memory.dmp

Download

memory/3976-596-0x000002103DBF0000-0x000002103E4C7000-memory.dmp

Download