IOC Report
PXUVmodpCYqRIPQ.exe

loading gif

Files

File Path
Type
Category
Malicious
PXUVmodpCYqRIPQ.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
initial sample
malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PXUVmodpCYqRIPQ.exe.log
ASCII text, with CRLF line terminators
dropped
malicious
C:\Users\user\AppData\Local\Temp\tmp6ABF.tmp
XML 1.0 document, ASCII text
dropped
malicious
C:\Users\user\AppData\Roaming\Taskshell.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
malicious
C:\Users\user\AppData\Roaming\xcsUjVN.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
dropped
malicious
C:\Users\user\AppData\Roaming\xcsUjVN.exe:Zone.Identifier
ASCII text, with CRLF line terminators
dropped
malicious
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Taskshell.exe.log
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\xcsUjVN.exe.log
ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
data
modified
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1ocduxlf.la4.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4qaakl0i.rrq.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_a51n0j4b.0fp.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cnupz1of.aeq.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_epka4x3w.cn0.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fswybfmh.z10.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_h0liy2mn.kgo.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_i0zwkwtd.go3.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jukudura.zah.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kfpvhpkj.svu.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ssmkoa0k.fzb.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_twon4kc3.b3x.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_u4jblz2x.tla.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uaccw03f.dni.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xjvv15qu.wsa.ps1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_ynt0owbr.qdb.psm1
ASCII text, with no line terminators
dropped
C:\Users\user\AppData\Local\Temp\tmp4AB4.tmp.bat
DOS batch file, ASCII text, with CRLF line terminators
dropped
C:\Users\user\AppData\Local\Temp\tmp880B.tmp
XML 1.0 document, ASCII text
dropped
C:\Users\user\AppData\Local\Temp\tmp948E.tmp
XML 1.0 document, ASCII text
dropped
C:\Users\user\AppData\Local\Temp\tmpCF93.tmp
XML 1.0 document, ASCII text
dropped
C:\Users\user\AppData\Local\Temp\tmpEF41.tmp
XML 1.0 document, ASCII text
dropped
\Device\Null
ASCII text, with CRLF line terminators, with overstriking
dropped
There are 21 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\PXUVmodpCYqRIPQ.exe
"C:\Users\user\Desktop\PXUVmodpCYqRIPQ.exe"
malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\PXUVmodpCYqRIPQ.exe"
malicious
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\xcsUjVN.exe"
malicious
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xcsUjVN" /XML "C:\Users\user\AppData\Local\Temp\tmp6ABF.tmp"
malicious
C:\Users\user\Desktop\PXUVmodpCYqRIPQ.exe
"C:\Users\user\Desktop\PXUVmodpCYqRIPQ.exe"
malicious
C:\Users\user\Desktop\PXUVmodpCYqRIPQ.exe
"C:\Users\user\Desktop\PXUVmodpCYqRIPQ.exe"
malicious
C:\Users\user\AppData\Roaming\xcsUjVN.exe
C:\Users\user\AppData\Roaming\xcsUjVN.exe
malicious
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Taskshell" /tr '"C:\Users\user\AppData\Roaming\Taskshell.exe"' & exit
malicious