Malware analysis https://icedrive.net/s/uyg1C5Q3WBh7wPhPBDaT8kD3jj9R Malicious activity

Add for printing

URL:	https://icedrive.net/s/uyg1C5Q3WBh7wPhPBDaT8kD3jj9R
Full analysis:	https://app.any.run/tasks/75944081-abbb-4cb8-a5a3-8f890395b202
Verdict:	Malicious activity
Threats:	Crypto mining malware is a resource-intensive threat that infiltrates computers with the purpose of mining cryptocurrencies. This type of threat can be deployed either on an infected machine or a compromised website. In both cases the miner will utilize the computing power of the device and its network bandwidth. Malware Trends Tracker >>>
Analysis date:	August 18, 2024, 01:01:46
OS:	Windows 10 Professional (build: 19045, 64 bit)
Tags:	miner pyinstaller upx crypto-regex
Indicators:
MD5:	31C953A25F5E4E858FBBC9DC22A6C3EC
SHA1:	286B2F84BDE94B492AD08E3A373B8A96B73D9B3D
SHA256:	5CB911164613221FA41C6E0AD5DAD7E385D49196F39FFECEC0571190B3A2AEF4
SSDEEP:	3:N82LHGV:2bV

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 300 seconds
Heavy Evasion option:
Network geolocation:: off
Additional time used:: 240 seconds
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (122.0.6261.70)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (122.0.2365.59)
Microsoft Edge Update (1.3.185.17)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (123.0)
Mozilla Maintenance Service (123.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Skype version 8.104 (8.104)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
- Starts NET.EXE for service management
  - net.exe (PID: 7884)
  - cmd.exe (PID: 6012)
  - net.exe (PID: 5028)
  - net.exe (PID: 8184)
  - net.exe (PID: 7228)
  - net.exe (PID: 7856)
  - net.exe (PID: 1748)
  - net.exe (PID: 5624)
  - net.exe (PID: 4192)
  - net.exe (PID: 7520)
  - net.exe (PID: 3876)
  - net.exe (PID: 7672)
  - net.exe (PID: 7400)
  - net.exe (PID: 4280)
  - net.exe (PID: 8096)
  - net.exe (PID: 5116)
  - net.exe (PID: 2136)
  - net.exe (PID: 7828)
  - net.exe (PID: 1116)
  - net.exe (PID: 5484)
  - net.exe (PID: 6608)
  - net.exe (PID: 7740)
  - net.exe (PID: 7096)
  - net.exe (PID: 5408)
  - net.exe (PID: 5172)
  - net.exe (PID: 7720)
  - net.exe (PID: 4316)
  - net.exe (PID: 7884)
  - net.exe (PID: 5992)
  - net.exe (PID: 5028)
  - net.exe (PID: 8184)
  - net.exe (PID: 6124)
  - net.exe (PID: 7988)
  - net.exe (PID: 3164)
  - net.exe (PID: 6276)
  - net.exe (PID: 7060)
  - net.exe (PID: 3672)
  - net.exe (PID: 7172)
  - net.exe (PID: 188)
  - net.exe (PID: 1692)
  - net.exe (PID: 5744)
  - net.exe (PID: 8124)
  - net.exe (PID: 876)
  - net.exe (PID: 6080)
  - net.exe (PID: 2628)
  - net.exe (PID: 5152)
  - net.exe (PID: 5988)
  - net.exe (PID: 360)
  - net.exe (PID: 3864)
  - net.exe (PID: 2080)
  - net.exe (PID: 5060)
  - net.exe (PID: 2088)
  - net.exe (PID: 2152)
  - net.exe (PID: 2632)
  - net.exe (PID: 7396)
  - net.exe (PID: 8008)
  - net.exe (PID: 6156)
  - net.exe (PID: 4192)
  - net.exe (PID: 7064)
  - net.exe (PID: 7960)
  - net.exe (PID: 2272)
  - net.exe (PID: 4316)
  - net.exe (PID: 7332)
  - net.exe (PID: 2960)
  - net.exe (PID: 3660)
  - net.exe (PID: 7368)
  - net.exe (PID: 1344)
  - net.exe (PID: 1692)
  - net.exe (PID: 4064)
  - net.exe (PID: 7512)
  - net.exe (PID: 2872)
  - net.exe (PID: 8124)
  - net.exe (PID: 4088)
  - net.exe (PID: 6224)
  - net.exe (PID: 1116)
  - net.exe (PID: 2720)
  - net.exe (PID: 2064)
  - net.exe (PID: 7756)
  - net.exe (PID: 7904)
  - net.exe (PID: 7924)
  - net.exe (PID: 1488)
  - net.exe (PID: 1128)
  - net.exe (PID: 6372)
  - net.exe (PID: 5924)
  - net.exe (PID: 6188)
  - net.exe (PID: 7228)
  - net.exe (PID: 208)
  - net.exe (PID: 7212)
  - net.exe (PID: 7712)
  - net.exe (PID: 5084)
  - net.exe (PID: 2472)
  - net.exe (PID: 7896)
  - net.exe (PID: 6260)
  - net.exe (PID: 7608)
  - net.exe (PID: 4280)
  - net.exe (PID: 8016)
  - net.exe (PID: 5284)
  - net.exe (PID: 4088)
  - net.exe (PID: 8124)
  - net.exe (PID: 2872)
  - net.exe (PID: 2272)
  - net.exe (PID: 6224)
  - net.exe (PID: 7512)
  - net.exe (PID: 7948)
  - net.exe (PID: 6180)
  - net.exe (PID: 5172)
  - net.exe (PID: 1108)
  - net.exe (PID: 2080)
  - net.exe (PID: 7872)
  - net.exe (PID: 2340)
  - net.exe (PID: 7692)
  - net.exe (PID: 1608)
  - net.exe (PID: 5140)
  - net.exe (PID: 4308)
  - net.exe (PID: 5052)
  - net.exe (PID: 7440)
  - net.exe (PID: 2472)
  - net.exe (PID: 2572)
  - net.exe (PID: 7632)
  - net.exe (PID: 6936)
  - net.exe (PID: 2136)
  - net.exe (PID: 2572)
  - net.exe (PID: 5060)
  - net.exe (PID: 5904)
  - net.exe (PID: 6176)
  - net.exe (PID: 7232)
  - net.exe (PID: 2768)
  - net.exe (PID: 2872)
  - net.exe (PID: 7512)
  - net.exe (PID: 7908)
  - net.exe (PID: 7156)
  - net.exe (PID: 7328)
  - net.exe (PID: 8020)
  - net.exe (PID: 3372)
  - net.exe (PID: 1184)
  - net.exe (PID: 1132)
  - net.exe (PID: 7312)
  - net.exe (PID: 4308)
  - net.exe (PID: 4788)
  - net.exe (PID: 460)
  - net.exe (PID: 3844)
  - net.exe (PID: 7548)
  - net.exe (PID: 7064)
  - net.exe (PID: 4784)
  - net.exe (PID: 7608)
  - net.exe (PID: 2136)
  - net.exe (PID: 2396)
  - net.exe (PID: 7556)
  - net.exe (PID: 2400)
  - net.exe (PID: 7876)
  - net.exe (PID: 4692)
  - net.exe (PID: 936)
  - net.exe (PID: 3880)
  - net.exe (PID: 5304)
  - net.exe (PID: 6332)
  - net.exe (PID: 752)
  - net.exe (PID: 7196)
  - net.exe (PID: 1108)
  - net.exe (PID: 7480)
  - net.exe (PID: 7148)
  - net.exe (PID: 5552)
  - net.exe (PID: 4544)
  - net.exe (PID: 7564)
  - net.exe (PID: 3876)
  - net.exe (PID: 6948)
  - net.exe (PID: 1716)
  - net.exe (PID: 1168)
  - net.exe (PID: 5904)
  - net.exe (PID: 7956)
  - net.exe (PID: 7228)
  - net.exe (PID: 2132)
  - net.exe (PID: 3540)
  - net.exe (PID: 2796)
  - net.exe (PID: 1128)
  - net.exe (PID: 7600)
  - net.exe (PID: 1656)
  - net.exe (PID: 7248)
  - net.exe (PID: 7224)
  - net.exe (PID: 7556)
  - net.exe (PID: 7304)
  - net.exe (PID: 2632)
  - net.exe (PID: 7368)
  - net.exe (PID: 7836)
  - net.exe (PID: 6316)
  - net.exe (PID: 400)
  - net.exe (PID: 2128)
  - net.exe (PID: 2580)
  - net.exe (PID: 7320)
  - net.exe (PID: 4544)
  - net.exe (PID: 1716)
  - net.exe (PID: 6516)
  - net.exe (PID: 1884)
  - net.exe (PID: 7656)
  - net.exe (PID: 7532)
  - net.exe (PID: 7520)
  - net.exe (PID: 7368)
  - net.exe (PID: 6948)
  - net.exe (PID: 5032)
  - net.exe (PID: 6372)
  - net.exe (PID: 1048)
  - net.exe (PID: 3256)
  - net.exe (PID: 7904)
- Uses NET.EXE to stop Windows Security Center service
  - net.exe (PID: 5028)
  - cmd.exe (PID: 6012)
- Uses NET.EXE to stop Windows Defender service
  - cmd.exe (PID: 6012)
  - net.exe (PID: 8184)
- Uses NET.EXE to stop Windows Update service
  - cmd.exe (PID: 6012)
  - net.exe (PID: 7228)
- Uses Task Scheduler to run other applications
  - clipper.exe (PID: 7644)
- Create files in the Startup directory
  - clipper.exe (PID: 7644)
- Adds extension to the Windows Defender exclusion list
  - BidenSucks.exe (PID: 7236)
  - lrxaytgrgkta.exe (PID: 5144)
- Application was injected by another process
  - svchost.exe (PID: 476)
  - svchost.exe (PID: 1036)
  - lsass.exe (PID: 768)
  - winlogon.exe (PID: 684)
  - svchost.exe (PID: 1364)
  - dwm.exe (PID: 852)
  - svchost.exe (PID: 1316)
  - svchost.exe (PID: 1272)
  - svchost.exe (PID: 1408)
  - svchost.exe (PID: 1600)
  - svchost.exe (PID: 1588)
  - svchost.exe (PID: 1796)
  - svchost.exe (PID: 1620)
  - svchost.exe (PID: 1628)
  - svchost.exe (PID: 1508)
  - svchost.exe (PID: 1472)
  - svchost.exe (PID: 2072)
  - svchost.exe (PID: 1872)
  - svchost.exe (PID: 1816)
  - svchost.exe (PID: 1864)
  - svchost.exe (PID: 2000)
  - svchost.exe (PID: 2344)
  - svchost.exe (PID: 2412)
  - svchost.exe (PID: 1200)
  - svchost.exe (PID: 1208)
  - svchost.exe (PID: 2304)
  - svchost.exe (PID: 2312)
  - svchost.exe (PID: 2256)
  - svchost.exe (PID: 2496)
  - svchost.exe (PID: 2184)
  - spoolsv.exe (PID: 2592)
  - svchost.exe (PID: 3020)
  - OfficeClickToRun.exe (PID: 2656)
  - svchost.exe (PID: 2692)
  - svchost.exe (PID: 2788)
  - svchost.exe (PID: 2996)
  - svchost.exe (PID: 3012)
  - svchost.exe (PID: 2968)
  - svchost.exe (PID: 3056)
  - svchost.exe (PID: 3084)
  - svchost.exe (PID: 3340)
  - svchost.exe (PID: 2160)
  - svchost.exe (PID: 3220)
  - svchost.exe (PID: 3200)
  - svchost.exe (PID: 4184)
  - explorer.exe (PID: 4552)
  - svchost.exe (PID: 4300)
  - sihost.exe (PID: 4112)
  - svchost.exe (PID: 3888)
  - svchost.exe (PID: 3408)
  - svchost.exe (PID: 4140)
  - ctfmon.exe (PID: 4356)
  - svchost.exe (PID: 4808)
  - svchost.exe (PID: 4332)
  - svchost.exe (PID: 4532)
  - svchost.exe (PID: 4324)
  - RuntimeBroker.exe (PID: 5560)
  - svchost.exe (PID: 3496)
  - svchost.exe (PID: 3260)
  - svchost.exe (PID: 3304)
  - RuntimeBroker.exe (PID: 4244)
  - RuntimeBroker.exe (PID: 776)
  - dllhost.exe (PID: 5568)
  - svchost.exe (PID: 2092)
  - dllhost.exe (PID: 3312)
  - svchost.exe (PID: 5036)
  - uhssvc.exe (PID: 536)
  - svchost.exe (PID: 1824)
  - svchost.exe (PID: 5256)
  - UserOOBEBroker.exe (PID: 2744)
  - svchost.exe (PID: 4000)
  - svchost.exe (PID: 2096)
  - svchost.exe (PID: 3276)
  - MoUsoCoreWorker.exe (PID: 2120)
  - svchost.exe (PID: 5416)
  - ApplicationFrameHost.exe (PID: 4052)
  - WmiPrvSE.exe (PID: 8048)
  - WmiPrvSE.exe (PID: 3980)
  - svchost.exe (PID: 3376)
  - svchost.exe (PID: 7864)
  - svchost.exe (PID: 5236)
- Modifies hosts file to block updates
  - BidenSucks.exe (PID: 7236)
- Runs injected code in another process
  - dialer.exe (PID: 3864)
  - dialer.exe (PID: 872)
- Antivirus name has been found in the command line (generic signature)
  - taskkill.exe (PID: 7632)
  - taskkill.exe (PID: 3116)
  - taskkill.exe (PID: 8032)
  - taskkill.exe (PID: 7320)
  - taskkill.exe (PID: 3900)
- MINER has been detected (SURICATA)
  - svchost.exe (PID: 2256)
SUSPICIOUS
- Reads security settings of Internet Explorer
  - s4pe.exe (PID: 4772)
  - SystemAnalysis.exe (PID: 4080)
  - clipper.exe (PID: 7644)
- BASE64 encoded PowerShell command has been detected
  - s4pe.exe (PID: 4772)
- Reads the date of Windows installation
  - s4pe.exe (PID: 4772)
  - SystemAnalysis.exe (PID: 4080)
  - clipper.exe (PID: 7644)
- Executable content was dropped or overwritten
  - s4pe.exe (PID: 4772)
  - Rflower.exe (PID: 7952)
  - source_prepared.exe (PID: 7604)
  - clipper.exe (PID: 7644)
  - BidenSucks.exe (PID: 7236)
  - lrxaytgrgkta.exe (PID: 5144)
- Base64-obfuscated command line is found
  - s4pe.exe (PID: 4772)
- Drops the executable file immediately after the start
  - s4pe.exe (PID: 4772)
  - Rflower.exe (PID: 7952)
  - source_prepared.exe (PID: 7604)
  - clipper.exe (PID: 7644)
  - BidenSucks.exe (PID: 7236)
  - lrxaytgrgkta.exe (PID: 5144)
- Starts CMD.EXE for commands execution
  - SystemAnalysis.exe (PID: 4080)
  - clipper.exe (PID: 7644)
  - BidenSucks.exe (PID: 7236)
  - lrxaytgrgkta.exe (PID: 5144)
- Uses REG/REGEDIT.EXE to modify registry
  - cmd.exe (PID: 6012)
- Executing commands from a ".bat" file
  - SystemAnalysis.exe (PID: 4080)
- Modifies existing scheduled task
  - schtasks.exe (PID: 8124)
  - schtasks.exe (PID: 1356)
  - schtasks.exe (PID: 8100)
  - schtasks.exe (PID: 5600)
  - schtasks.exe (PID: 3028)
- Executes application which crashes
  - s4pe.exe (PID: 4692)
  - taskkill.exe (PID: 2204)
- Powershell scripting: start process
  - BidenSucks.exe (PID: 7328)
- Process drops python dynamic module
  - Rflower.exe (PID: 7952)
  - source_prepared.exe (PID: 7604)
- Starts POWERSHELL.EXE for commands execution
  - BidenSucks.exe (PID: 7328)
  - s4pe.exe (PID: 4772)
  - BidenSucks.exe (PID: 7236)
  - lrxaytgrgkta.exe (PID: 5144)
- Detected use of alternative data streams (AltDS)
  - powershell.exe (PID: 7344)
- The process drops C-runtime libraries
  - Rflower.exe (PID: 7952)
  - source_prepared.exe (PID: 7604)
- Uses NETSH.EXE to change the status of the firewall
  - cmd.exe (PID: 6012)
- Process drops legitimate windows executable
  - s4pe.exe (PID: 4772)
  - Rflower.exe (PID: 7952)
  - source_prepared.exe (PID: 7604)
  - clipper.exe (PID: 7644)
  - svchost.exe (PID: 5236)
- Starts a Microsoft application from unusual location
  - clipper.exe (PID: 7644)
- Uses TASKKILL.EXE to kill process
  - cmd.exe (PID: 6012)
- Drops a system driver (possible attempt to evade defenses)
  - s4pe.exe (PID: 4772)
  - lrxaytgrgkta.exe (PID: 5144)
- The process creates files with name similar to system file names
  - clipper.exe (PID: 7644)
- Executing commands from ".cmd" file
  - clipper.exe (PID: 7644)
- Uses TIMEOUT.EXE to delay execution
  - cmd.exe (PID: 7736)
- Starts itself from another location
  - clipper.exe (PID: 7644)
- Script adds exclusion path to Windows Defender
  - BidenSucks.exe (PID: 7236)
  - lrxaytgrgkta.exe (PID: 5144)
- Script adds exclusion extension to Windows Defender
  - BidenSucks.exe (PID: 7236)
  - lrxaytgrgkta.exe (PID: 5144)
- Process uninstalls Windows update
  - wusa.exe (PID: 1784)
  - wusa.exe (PID: 7840)
- Uses TASKKILL.EXE to kill Browsers
  - cmd.exe (PID: 6012)
- Starts SC.EXE for service management
  - BidenSucks.exe (PID: 7236)
  - lrxaytgrgkta.exe (PID: 5144)
- Uses powercfg.exe to modify the power settings
  - BidenSucks.exe (PID: 7236)
  - lrxaytgrgkta.exe (PID: 5144)
- Executes as Windows Service
  - lrxaytgrgkta.exe (PID: 5144)
- Crypto Currency Mining Activity Detected
  - svchost.exe (PID: 2256)
- Found regular expressions for crypto-addresses (YARA)
  - Usermode Font Driver Host.exe (PID: 1104)
INFO
- Reads Microsoft Office registry keys
  - msedge.exe (PID: 6376)
  - OfficeClickToRun.exe (PID: 2656)
- Reads security settings of Internet Explorer
  - svchost.exe (PID: 2304)
  - explorer.exe (PID: 4552)
- Checks supported languages
  - identity_helper.exe (PID: 5484)
  - s4pe.exe (PID: 4772)
  - s4pe.exe (PID: 4692)
  - Terminator.exe (PID: 5084)
  - Rflower.exe (PID: 7952)
  - BidenSucks.exe (PID: 7328)
  - source_prepared.exe (PID: 7604)
  - clipper.exe (PID: 7644)
  - SystemAnalysis.exe (PID: 4080)
  - BidenSucks.exe (PID: 7236)
  - Usermode Font Driver Host.exe (PID: 1104)
  - lrxaytgrgkta.exe (PID: 5144)
- Application launched itself
  - msedge.exe (PID: 6376)
- Reads the computer name
  - identity_helper.exe (PID: 5484)
  - s4pe.exe (PID: 4772)
  - SystemAnalysis.exe (PID: 4080)
  - s4pe.exe (PID: 4692)
  - Rflower.exe (PID: 7952)
  - source_prepared.exe (PID: 7604)
  - clipper.exe (PID: 7644)
  - Usermode Font Driver Host.exe (PID: 1104)
- Creates files in the program directory
  - MoUsoCoreWorker.exe (PID: 2120)
  - svchost.exe (PID: 3376)
  - BidenSucks.exe (PID: 7236)
- Reads the software policy settings
  - lsass.exe (PID: 768)
  - OfficeClickToRun.exe (PID: 2656)
  - WerFault.exe (PID: 7396)
  - WerFault.exe (PID: 8028)
- The process uses the downloaded file
  - WinRAR.exe (PID: 7968)
  - msedge.exe (PID: 6376)
  - msedge.exe (PID: 7844)
- Executable content was dropped or overwritten
  - WinRAR.exe (PID: 7968)
- Manual execution by a user
  - s4pe.exe (PID: 4772)
- Reads Environment values
  - identity_helper.exe (PID: 5484)
- Reads the time zone
  - svchost.exe (PID: 2692)
- Process checks computer location settings
  - s4pe.exe (PID: 4772)
  - SystemAnalysis.exe (PID: 4080)
  - clipper.exe (PID: 7644)
- Create files in a temporary directory
  - SystemAnalysis.exe (PID: 4080)
  - s4pe.exe (PID: 4772)
  - Rflower.exe (PID: 7952)
  - source_prepared.exe (PID: 7604)
  - clipper.exe (PID: 7644)
- Checks proxy server information
  - WerFault.exe (PID: 7396)
  - WerFault.exe (PID: 8028)
- Creates files or folders in the user directory
  - WerFault.exe (PID: 7396)
  - clipper.exe (PID: 7644)
  - explorer.exe (PID: 4552)
  - WerFault.exe (PID: 8028)
- The executable file from the user directory is run by the Powershell process
  - BidenSucks.exe (PID: 7236)
- Checks if a key exists in the options dictionary (POWERSHELL)
  - powershell.exe (PID: 6636)
  - powershell.exe (PID: 7984)
  - powershell.exe (PID: 5388)
- Checks transactions between databases Windows and Oracle
  - WmiPrvSE.exe (PID: 8048)
- Reads the machine GUID from the registry
  - Usermode Font Driver Host.exe (PID: 1104)
- Script raised an exception (POWERSHELL)
  - powershell.exe (PID: 6636)
  - powershell.exe (PID: 7984)
  - powershell.exe (PID: 5388)
- UPX packer has been detected
  - Rflower.exe (PID: 7952)
- PyInstaller has been detected (YARA)
  - source_prepared.exe (PID: 7604)
  - Rflower.exe (PID: 7952)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

No Malware configuration.

Add for printing

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

913

Monitored processes

853

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

188

net stop Avsched32

C:\Windows\System32\net.exe

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Net Command

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll

188

taskkill /f /t /im Agnitum Outpost Firewall

C:\Windows\System32\taskkill.exe

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Terminates Processes

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll

188

\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\conhost.exe

—

sc.exe

User:

SYSTEM

Company:

Microsoft Corporation

Integrity Level:

SYSTEM

Description:

Console Window Host

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

208

net stop IOMON98

C:\Windows\System32\net.exe

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Net Command

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll

208

C:\WINDOWS\system32\net1 stop NAVAPW32

C:\Windows\System32\net1.exe

—

net.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Net Command

Exit code:

Version:

10.0.19041.3636 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\netutils.dll
c:\windows\system32\ucrtbase.dll

236

taskkill /f /t /im Cleaner3.exe

C:\Windows\System32\taskkill.exe

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Terminates Processes

Exit code:

128

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\taskkill.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll

360

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4336 --field-trial-handle=2536,i,13784421013167060299,530461526640120548,262144 --variations-seed-version /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

—

msedge.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

LOW

Description:

Microsoft Edge

Exit code:

Version:

122.0.2365.59

Modules

Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

360

net stop CLEANER3

C:\Windows\System32\net.exe

—

cmd.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Net Command

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\mpr.dll
c:\windows\system32\rpcrt4.dll

360

C:\WINDOWS\system32\net1 stop ICSUPP95

C:\Windows\System32\net1.exe

—

net.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Net Command

Exit code:

Version:

10.0.19041.3636 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\net1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\samcli.dll
c:\windows\system32\netutils.dll

400

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5216 --field-trial-handle=2536,i,13784421013167060299,530461526640120548,262144 --variations-seed-version /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

—

msedge.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

LOW

Description:

Microsoft Edge

Exit code:

Version:

122.0.2365.59

Modules

Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll

Add for printing

Total events

196 676

Read events

195 487

Write events

839

Delete events

350

Modification events


(PID) Process:	(4552) explorer.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000502C6
Operation:	write	Name:	VirtualDesktop
Value: 1000000030304456033BCEE44DE41B4E8AEC331E84F566D2
(PID) Process:	(6376) msedge.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:	write	Name:	failed_count
Value: 0
(PID) Process:	(6376) msedge.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:	write	Name:	state
Value: 2
(PID) Process:	(6376) msedge.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\ThirdParty
Operation:	write	Name:	StatusCodes
Value:
(PID) Process:	(6376) msedge.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\ThirdParty
Operation:	write	Name:	StatusCodes
Value: 01000000
(PID) Process:	(6376) msedge.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:	write	Name:	state
Value: 1
(PID) Process:	(6376) msedge.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
Operation:	write	Name:	dr
Value: 1
(PID) Process:	(6376) msedge.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\StabilityMetrics
Operation:	write	Name:	user_experience_metrics.stability.exited_cleanly
Value: 0
(PID) Process:	(6376) msedge.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge
Operation:	write	Name:	UsageStatsInSample
Value: 1
(PID) Process:	(6376) msedge.exe	Key:	HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}
Operation:	write	Name:	usagestats
Value: 0

Add for printing

Executable files

705

Suspicious files

463

Text files

1 902

Unknown types

Dropped files

PID	Process	Filename		Type
6376	msedge.exe	C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RFe5494.TMP		—
		MD5:—	SHA256:—
6376	msedge.exe	C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old		—
		MD5:—	SHA256:—
6376	msedge.exe	C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RFe5494.TMP		—
		MD5:—	SHA256:—
6376	msedge.exe	C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old		—
		MD5:—	SHA256:—
6376	msedge.exe	C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RFe54a3.TMP		—
		MD5:—	SHA256:—
6376	msedge.exe	C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old		—
		MD5:—	SHA256:—
6376	msedge.exe	C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RFe54a3.TMP		—
		MD5:—	SHA256:—
6376	msedge.exe	C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old		—
		MD5:—	SHA256:—
6376	msedge.exe	C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RFe5494.TMP		—
		MD5:—	SHA256:—
6376	msedge.exe	C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old		—
		MD5:—	SHA256:—

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
6948	backgroundTaskHost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	unknown	—	—	whitelisted
8032	svchost.exe	HEAD	200	23.48.23.7:80	http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/b794342e-59ba-4ce6-87da-b8bc5e6ce532?P1=1724486467&P2=404&P3=2&P4=M2xYqR8Mm5sMxOcrYm2B6ZoKX8JjYWWy0c4%2bcutw2zclU3%2bQq9zoF7Jtc5S1IiQufm5NaHg6agZuxjHqmXpIow%3d%3d	unknown	—	—	whitelisted
8032	svchost.exe	GET	206	23.48.23.7:80	http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/b794342e-59ba-4ce6-87da-b8bc5e6ce532?P1=1724486467&P2=404&P3=2&P4=M2xYqR8Mm5sMxOcrYm2B6ZoKX8JjYWWy0c4%2bcutw2zclU3%2bQq9zoF7Jtc5S1IiQufm5NaHg6agZuxjHqmXpIow%3d%3d	unknown	—	—	whitelisted
8032	svchost.exe	GET	206	23.48.23.7:80	http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/b794342e-59ba-4ce6-87da-b8bc5e6ce532?P1=1724486467&P2=404&P3=2&P4=M2xYqR8Mm5sMxOcrYm2B6ZoKX8JjYWWy0c4%2bcutw2zclU3%2bQq9zoF7Jtc5S1IiQufm5NaHg6agZuxjHqmXpIow%3d%3d	unknown	—	—	whitelisted
7228	backgroundTaskHost.exe	GET	200	192.229.221.95:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D	unknown	—	—	whitelisted
8032	svchost.exe	GET	206	23.48.23.7:80	http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/b794342e-59ba-4ce6-87da-b8bc5e6ce532?P1=1724486467&P2=404&P3=2&P4=M2xYqR8Mm5sMxOcrYm2B6ZoKX8JjYWWy0c4%2bcutw2zclU3%2bQq9zoF7Jtc5S1IiQufm5NaHg6agZuxjHqmXpIow%3d%3d	unknown	—	—	whitelisted
8032	svchost.exe	GET	206	23.48.23.7:80	http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/68fecda8-3692-48b1-92f7-722862b2bb34?P1=1724352206&P2=404&P3=2&P4=aWTK5CrTSfcYG%2fQrL6mGOzhRE4FrDYD3naiFDVI89PqH6haql2%2b0xzzXQGDTyUSLA%2faE9FSb4ZKqfo59i6okTw%3d%3d	unknown	—	—	whitelisted
8032	svchost.exe	GET	206	23.48.23.7:80	http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/b794342e-59ba-4ce6-87da-b8bc5e6ce532?P1=1724486467&P2=404&P3=2&P4=M2xYqR8Mm5sMxOcrYm2B6ZoKX8JjYWWy0c4%2bcutw2zclU3%2bQq9zoF7Jtc5S1IiQufm5NaHg6agZuxjHqmXpIow%3d%3d	unknown	—	—	whitelisted
8032	svchost.exe	HEAD	200	23.48.23.7:80	http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/68fecda8-3692-48b1-92f7-722862b2bb34?P1=1724352206&P2=404&P3=2&P4=aWTK5CrTSfcYG%2fQrL6mGOzhRE4FrDYD3naiFDVI89PqH6haql2%2b0xzzXQGDTyUSLA%2faE9FSb4ZKqfo59i6okTw%3d%3d	unknown	—	—	whitelisted
8032	svchost.exe	GET	206	23.48.23.7:80	http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/68fecda8-3692-48b1-92f7-722862b2bb34?P1=1724352206&P2=404&P3=2&P4=aWTK5CrTSfcYG%2fQrL6mGOzhRE4FrDYD3naiFDVI89PqH6haql2%2b0xzzXQGDTyUSLA%2faE9FSb4ZKqfo59i6okTw%3d%3d	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
2632	RUXIMICS.exe	20.73.194.208:443	—	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
2120	MoUsoCoreWorker.exe	20.73.194.208:443	—	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
4084	svchost.exe	20.73.194.208:443	—	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
3888	svchost.exe	239.255.255.250:1900	—	—	—	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
6376	msedge.exe	239.255.255.250:1900	—	—	—	whitelisted
6712	msedge.exe	13.107.42.16:443	config.edge.skype.com	MICROSOFT-CORP-MSN-AS-BLOCK	US	whitelisted
6712	msedge.exe	13.107.21.239:443	edge.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	US	unknown
6712	msedge.exe	104.22.4.172:443	icedrive.net	CLOUDFLARENET	—	unknown
6712	msedge.exe	13.107.246.45:443	edge-mobile-static.azureedge.net	MICROSOFT-CORP-MSN-AS-BLOCK	US	unknown

DNS requests

Domain	IP	Reputation
google.com	142.250.185.206	whitelisted
config.edge.skype.com	13.107.42.16	whitelisted
icedrive.net	104.22.4.172 172.67.10.241 104.22.5.172	unknown
edge.microsoft.com	13.107.21.239 204.79.197.239	whitelisted
edge-mobile-static.azureedge.net	13.107.246.45	whitelisted
business.bing.com	13.107.6.158	whitelisted
cdn.icedrive.net	104.22.5.172 104.22.4.172 172.67.10.241	unknown
www.bing.com	92.123.104.32 92.123.104.34 92.123.104.33 2.23.209.187 2.23.209.133 2.23.209.182 2.23.209.130 2.23.209.149	whitelisted
bzib.nelreports.net	23.48.23.51 23.48.23.26	whitelisted
xpaywalletcdn.azureedge.net	13.107.246.45	whitelisted

Threats

PID	Process	Class	Message
2256	svchost.exe	Crypto Currency Mining Activity Detected	ET COINMINER CoinMiner Domain in DNS Lookup (pool .hashvault .pro)

Add for printing

No debug info

General Info

https://icedrive.net/s/uyg1C5Q3WBh7wPhPBDaT8kD3jj9R

31C953A25F5E4E858FBBC9DC22A6C3EC

286B2F84BDE94B492AD08E3A373B8A96B73D9B3D

5CB911164613221FA41C6E0AD5DAD7E385D49196F39FFECEC0571190B3A2AEF4

3:N82LHGV:2bV

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

Starts NET.EXE for service management

Uses NET.EXE to stop Windows Security Center service

Uses NET.EXE to stop Windows Defender service

Uses NET.EXE to stop Windows Update service

Uses Task Scheduler to run other applications

Create files in the Startup directory

Adds extension to the Windows Defender exclusion list

Application was injected by another process

Modifies hosts file to block updates

Runs injected code in another process

Antivirus name has been found in the command line (generic signature)

MINER has been detected (SURICATA)

SUSPICIOUS

Reads security settings of Internet Explorer

BASE64 encoded PowerShell command has been detected

Reads the date of Windows installation

Executable content was dropped or overwritten

Base64-obfuscated command line is found

Drops the executable file immediately after the start

Starts CMD.EXE for commands execution

Uses REG/REGEDIT.EXE to modify registry

Executing commands from a ".bat" file

Modifies existing scheduled task

Executes application which crashes

Powershell scripting: start process

Process drops python dynamic module

Starts POWERSHELL.EXE for commands execution

Detected use of alternative data streams (AltDS)

The process drops C-runtime libraries

Uses NETSH.EXE to change the status of the firewall

Process drops legitimate windows executable

Starts a Microsoft application from unusual location

Uses TASKKILL.EXE to kill process

Drops a system driver (possible attempt to evade defenses)

The process creates files with name similar to system file names

Executing commands from ".cmd" file

Uses TIMEOUT.EXE to delay execution

Starts itself from another location

Script adds exclusion path to Windows Defender

Script adds exclusion extension to Windows Defender

Process uninstalls Windows update

Uses TASKKILL.EXE to kill Browsers

Starts SC.EXE for service management

Uses powercfg.exe to modify the power settings

Executes as Windows Service

Crypto Currency Mining Activity Detected

Found regular expressions for crypto-addresses (YARA)

INFO

Reads Microsoft Office registry keys

Reads security settings of Internet Explorer

Checks supported languages

Application launched itself

Reads the computer name

Creates files in the program directory

Reads the software policy settings

The process uses the downloaded file

Executable content was dropped or overwritten

Manual execution by a user

Reads Environment values

Reads the time zone

Process checks computer location settings

Create files in a temporary directory

Checks proxy server information

Creates files or folders in the user directory

The executable file from the user directory is run by the Powershell process

Checks if a key exists in the options dictionary (POWERSHELL)

Checks transactions between databases Windows and Oracle

Reads the machine GUID from the registry