Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
13-05-2021 12:56
Static task
static1
Behavioral task
behavioral1
Sample
56ad1418f470bc5e6667574e054649d85cbb1242818baf62a294bdfca90df717.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
56ad1418f470bc5e6667574e054649d85cbb1242818baf62a294bdfca90df717.exe
Resource
win10v20210408
General
-
Target
56ad1418f470bc5e6667574e054649d85cbb1242818baf62a294bdfca90df717.exe
-
Size
704KB
-
MD5
e7f9d6dd424f33059dda93a35ab3f69c
-
SHA1
617c2988a2149f71c185d0e5f2f0a3a2f31225ec
-
SHA256
56ad1418f470bc5e6667574e054649d85cbb1242818baf62a294bdfca90df717
-
SHA512
cd24b7603efa82f0cda296bddb96e6361c73de071545ab59e51ce779ceda87e85dce8b97edd12be06a8ec0b743629673360150e67f3ccec618bd14b22e5826fd
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
Processes:
guxcek.exeguxcek.exe56ad1418f470bc5e6667574e054649d85cbb1242818baf62a294bdfca90df717.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" guxcek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" guxcek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" 56ad1418f470bc5e6667574e054649d85cbb1242818baf62a294bdfca90df717.exe -
Adds policy Run key to start application 2 TTPs 28 IoCs
Processes:
56ad1418f470bc5e6667574e054649d85cbb1242818baf62a294bdfca90df717.exeguxcek.exeguxcek.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\timsvcq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iixocutincpemawpkk.exe" 56ad1418f470bc5e6667574e054649d85cbb1242818baf62a294bdfca90df717.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\timsvcq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gizsicdubshyiywroqha.exe" guxcek.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 56ad1418f470bc5e6667574e054649d85cbb1242818baf62a294bdfca90df717.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\skragqhols = "gizsicdubshyiywroqha.exe" 56ad1418f470bc5e6667574e054649d85cbb1242818baf62a294bdfca90df717.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\skragqhols = "iixocutincpemawpkk.exe" guxcek.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run guxcek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\skragqhols = "vyqkbwyqyqgyjazvtwoiz.exe" guxcek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\skragqhols = "zymcpgeswkwkrezrl.exe" guxcek.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run guxcek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\skragqhols = "tukcrkkagwkajyvplmc.exe" guxcek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\timsvcq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vyqkbwyqyqgyjazvtwoiz.exe" guxcek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\skragqhols = "gizsicdubshyiywroqha.exe" guxcek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\skragqhols = "sqdseurehufsykev.exe" guxcek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\timsvcq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tukcrkkagwkajyvplmc.exe" guxcek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\timsvcq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iixocutincpemawpkk.exe" guxcek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\timsvcq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zymcpgeswkwkrezrl.exe" 56ad1418f470bc5e6667574e054649d85cbb1242818baf62a294bdfca90df717.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\timsvcq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iixocutincpemawpkk.exe" guxcek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\skragqhols = "zymcpgeswkwkrezrl.exe" guxcek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\timsvcq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gizsicdubshyiywroqha.exe" guxcek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\timsvcq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sqdseurehufsykev.exe" guxcek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\skragqhols = "vyqkbwyqyqgyjazvtwoiz.exe" 56ad1418f470bc5e6667574e054649d85cbb1242818baf62a294bdfca90df717.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\skragqhols = "tukcrkkagwkajyvplmc.exe" guxcek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\skragqhols = "sqdseurehufsykev.exe" guxcek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\timsvcq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vyqkbwyqyqgyjazvtwoiz.exe" guxcek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\timsvcq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sqdseurehufsykev.exe" guxcek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\timsvcq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zymcpgeswkwkrezrl.exe" guxcek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\skragqhols = "iixocutincpemawpkk.exe" guxcek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\timsvcq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tukcrkkagwkajyvplmc.exe" guxcek.exe -
Disables RegEdit via registry modification
-
Executes dropped EXE 2 IoCs
Processes:
guxcek.exeguxcek.exepid process 3356 guxcek.exe 184 guxcek.exe -
Adds Run key to start application 2 TTPs 64 IoCs
Processes:
guxcek.exeguxcek.exe56ad1418f470bc5e6667574e054649d85cbb1242818baf62a294bdfca90df717.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\iydkowlq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iixocutincpemawpkk.exe" guxcek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zqwejsiok = "sqdseurehufsykev.exe ." guxcek.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\kenygslutcjs = "vyqkbwyqyqgyjazvtwoiz.exe ." guxcek.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\iydkowlq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sqdseurehufsykev.exe" guxcek.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ngoyfqiqowc = "zymcpgeswkwkrezrl.exe" 56ad1418f470bc5e6667574e054649d85cbb1242818baf62a294bdfca90df717.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ngoyfqiqowc = "tukcrkkagwkajyvplmc.exe" guxcek.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ngoyfqiqowc = "vyqkbwyqyqgyjazvtwoiz.exe" guxcek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\jeoajwqaakscf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sqdseurehufsykev.exe ." guxcek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\iydkowlq = "sqdseurehufsykev.exe" 56ad1418f470bc5e6667574e054649d85cbb1242818baf62a294bdfca90df717.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\jeoajwqaakscf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vyqkbwyqyqgyjazvtwoiz.exe ." 56ad1418f470bc5e6667574e054649d85cbb1242818baf62a294bdfca90df717.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run guxcek.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\kenygslutcjs = "iixocutincpemawpkk.exe ." guxcek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\jeoajwqaakscf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sqdseurehufsykev.exe ." guxcek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kgreocxijudosc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iixocutincpemawpkk.exe" guxcek.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\iydkowlq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iixocutincpemawpkk.exe" 56ad1418f470bc5e6667574e054649d85cbb1242818baf62a294bdfca90df717.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\iydkowlq = "iixocutincpemawpkk.exe" guxcek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\iydkowlq = "gizsicdubshyiywroqha.exe" guxcek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\iydkowlq = "tukcrkkagwkajyvplmc.exe" guxcek.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ngoyfqiqowc = "gizsicdubshyiywroqha.exe" guxcek.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\zqwejsiok = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zymcpgeswkwkrezrl.exe ." guxcek.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ngoyfqiqowc = "iixocutincpemawpkk.exe" guxcek.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce guxcek.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ngoyfqiqowc = "zymcpgeswkwkrezrl.exe" guxcek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\iydkowlq = "iixocutincpemawpkk.exe" guxcek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zqwejsiok = "gizsicdubshyiywroqha.exe ." guxcek.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ngoyfqiqowc = "sqdseurehufsykev.exe" guxcek.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\zqwejsiok = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tukcrkkagwkajyvplmc.exe ." guxcek.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\kenygslutcjs = "vyqkbwyqyqgyjazvtwoiz.exe ." guxcek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kgreocxijudosc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vyqkbwyqyqgyjazvtwoiz.exe" guxcek.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ngoyfqiqowc = "vyqkbwyqyqgyjazvtwoiz.exe" 56ad1418f470bc5e6667574e054649d85cbb1242818baf62a294bdfca90df717.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\jeoajwqaakscf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vyqkbwyqyqgyjazvtwoiz.exe ." guxcek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zqwejsiok = "vyqkbwyqyqgyjazvtwoiz.exe ." guxcek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\jeoajwqaakscf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tukcrkkagwkajyvplmc.exe ." guxcek.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\kenygslutcjs = "vyqkbwyqyqgyjazvtwoiz.exe ." 56ad1418f470bc5e6667574e054649d85cbb1242818baf62a294bdfca90df717.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\iydkowlq = "gizsicdubshyiywroqha.exe" guxcek.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\kenygslutcjs = "zymcpgeswkwkrezrl.exe ." 56ad1418f470bc5e6667574e054649d85cbb1242818baf62a294bdfca90df717.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\kenygslutcjs = "zymcpgeswkwkrezrl.exe ." guxcek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zqwejsiok = "iixocutincpemawpkk.exe ." guxcek.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\zqwejsiok = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iixocutincpemawpkk.exe ." guxcek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kgreocxijudosc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sqdseurehufsykev.exe" 56ad1418f470bc5e6667574e054649d85cbb1242818baf62a294bdfca90df717.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\iydkowlq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zymcpgeswkwkrezrl.exe" guxcek.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\ngoyfqiqowc = "sqdseurehufsykev.exe" guxcek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\jeoajwqaakscf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vyqkbwyqyqgyjazvtwoiz.exe ." guxcek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\jeoajwqaakscf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tukcrkkagwkajyvplmc.exe ." guxcek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\jeoajwqaakscf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iixocutincpemawpkk.exe ." guxcek.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\iydkowlq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tukcrkkagwkajyvplmc.exe" guxcek.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run guxcek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\jeoajwqaakscf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iixocutincpemawpkk.exe ." guxcek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\jeoajwqaakscf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gizsicdubshyiywroqha.exe ." guxcek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kgreocxijudosc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gizsicdubshyiywroqha.exe" 56ad1418f470bc5e6667574e054649d85cbb1242818baf62a294bdfca90df717.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce guxcek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\iydkowlq = "vyqkbwyqyqgyjazvtwoiz.exe" guxcek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zqwejsiok = "gizsicdubshyiywroqha.exe ." guxcek.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce guxcek.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\kenygslutcjs = "gizsicdubshyiywroqha.exe ." guxcek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\iydkowlq = "zymcpgeswkwkrezrl.exe" guxcek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zqwejsiok = "tukcrkkagwkajyvplmc.exe ." guxcek.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\zqwejsiok = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gizsicdubshyiywroqha.exe ." guxcek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zqwejsiok = "tukcrkkagwkajyvplmc.exe ." guxcek.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\zqwejsiok = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vyqkbwyqyqgyjazvtwoiz.exe ." guxcek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\jeoajwqaakscf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tukcrkkagwkajyvplmc.exe ." 56ad1418f470bc5e6667574e054649d85cbb1242818baf62a294bdfca90df717.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zqwejsiok = "zymcpgeswkwkrezrl.exe ." guxcek.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run guxcek.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\iydkowlq = "tukcrkkagwkajyvplmc.exe" guxcek.exe -
Processes:
56ad1418f470bc5e6667574e054649d85cbb1242818baf62a294bdfca90df717.exeguxcek.exeguxcek.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 56ad1418f470bc5e6667574e054649d85cbb1242818baf62a294bdfca90df717.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 56ad1418f470bc5e6667574e054649d85cbb1242818baf62a294bdfca90df717.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" guxcek.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA guxcek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" guxcek.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA guxcek.exe -
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 17 www.showmyipaddress.com 19 whatismyipaddress.com 14 whatismyip.everdot.org 15 whatismyipaddress.com -
Drops file in System32 directory 4 IoCs
Processes:
guxcek.exedescription ioc process File opened for modification C:\Windows\SysWOW64\vikopugiaccezajpxkmqrwikcee.bcl guxcek.exe File created C:\Windows\SysWOW64\vikopugiaccezajpxkmqrwikcee.bcl guxcek.exe File opened for modification C:\Windows\SysWOW64\sqdseurehufsykevomzoaqnadqbougarkivkwm.wzm guxcek.exe File created C:\Windows\SysWOW64\sqdseurehufsykevomzoaqnadqbougarkivkwm.wzm guxcek.exe -
Drops file in Program Files directory 4 IoCs
Processes:
guxcek.exedescription ioc process File opened for modification C:\Program Files (x86)\vikopugiaccezajpxkmqrwikcee.bcl guxcek.exe File created C:\Program Files (x86)\vikopugiaccezajpxkmqrwikcee.bcl guxcek.exe File opened for modification C:\Program Files (x86)\sqdseurehufsykevomzoaqnadqbougarkivkwm.wzm guxcek.exe File created C:\Program Files (x86)\sqdseurehufsykevomzoaqnadqbougarkivkwm.wzm guxcek.exe -
Drops file in Windows directory 4 IoCs
Processes:
guxcek.exedescription ioc process File opened for modification C:\Windows\sqdseurehufsykevomzoaqnadqbougarkivkwm.wzm guxcek.exe File created C:\Windows\sqdseurehufsykevomzoaqnadqbougarkivkwm.wzm guxcek.exe File opened for modification C:\Windows\vikopugiaccezajpxkmqrwikcee.bcl guxcek.exe File created C:\Windows\vikopugiaccezajpxkmqrwikcee.bcl guxcek.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 3 IoCs
Processes:
56ad1418f470bc5e6667574e054649d85cbb1242818baf62a294bdfca90df717.exeguxcek.exeguxcek.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings 56ad1418f470bc5e6667574e054649d85cbb1242818baf62a294bdfca90df717.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings guxcek.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings guxcek.exe -
Suspicious behavior: EnumeratesProcesses 34 IoCs
Processes:
guxcek.exepid process 3356 guxcek.exe 3356 guxcek.exe 3356 guxcek.exe 3356 guxcek.exe 3356 guxcek.exe 3356 guxcek.exe 3356 guxcek.exe 3356 guxcek.exe 3356 guxcek.exe 3356 guxcek.exe 3356 guxcek.exe 3356 guxcek.exe 3356 guxcek.exe 3356 guxcek.exe 3356 guxcek.exe 3356 guxcek.exe 3356 guxcek.exe 3356 guxcek.exe 3356 guxcek.exe 3356 guxcek.exe 3356 guxcek.exe 3356 guxcek.exe 3356 guxcek.exe 3356 guxcek.exe 3356 guxcek.exe 3356 guxcek.exe 3356 guxcek.exe 3356 guxcek.exe 3356 guxcek.exe 3356 guxcek.exe 3356 guxcek.exe 3356 guxcek.exe 3356 guxcek.exe 3356 guxcek.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
guxcek.exepid process 184 guxcek.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
guxcek.exedescription pid process Token: SeDebugPrivilege 3356 guxcek.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
56ad1418f470bc5e6667574e054649d85cbb1242818baf62a294bdfca90df717.exedescription pid process target process PID 1108 wrote to memory of 3356 1108 56ad1418f470bc5e6667574e054649d85cbb1242818baf62a294bdfca90df717.exe guxcek.exe PID 1108 wrote to memory of 3356 1108 56ad1418f470bc5e6667574e054649d85cbb1242818baf62a294bdfca90df717.exe guxcek.exe PID 1108 wrote to memory of 3356 1108 56ad1418f470bc5e6667574e054649d85cbb1242818baf62a294bdfca90df717.exe guxcek.exe PID 1108 wrote to memory of 184 1108 56ad1418f470bc5e6667574e054649d85cbb1242818baf62a294bdfca90df717.exe guxcek.exe PID 1108 wrote to memory of 184 1108 56ad1418f470bc5e6667574e054649d85cbb1242818baf62a294bdfca90df717.exe guxcek.exe PID 1108 wrote to memory of 184 1108 56ad1418f470bc5e6667574e054649d85cbb1242818baf62a294bdfca90df717.exe guxcek.exe -
System policy modification 1 TTPs 39 IoCs
Processes:
guxcek.exeguxcek.exe56ad1418f470bc5e6667574e054649d85cbb1242818baf62a294bdfca90df717.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System guxcek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" guxcek.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer guxcek.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System guxcek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" guxcek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" guxcek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" guxcek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" guxcek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" 56ad1418f470bc5e6667574e054649d85cbb1242818baf62a294bdfca90df717.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" guxcek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" guxcek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" guxcek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" guxcek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 56ad1418f470bc5e6667574e054649d85cbb1242818baf62a294bdfca90df717.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 56ad1418f470bc5e6667574e054649d85cbb1242818baf62a294bdfca90df717.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" guxcek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" guxcek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" guxcek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" 56ad1418f470bc5e6667574e054649d85cbb1242818baf62a294bdfca90df717.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" guxcek.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer guxcek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" guxcek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" guxcek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" guxcek.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 56ad1418f470bc5e6667574e054649d85cbb1242818baf62a294bdfca90df717.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 56ad1418f470bc5e6667574e054649d85cbb1242818baf62a294bdfca90df717.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" 56ad1418f470bc5e6667574e054649d85cbb1242818baf62a294bdfca90df717.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" 56ad1418f470bc5e6667574e054649d85cbb1242818baf62a294bdfca90df717.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" 56ad1418f470bc5e6667574e054649d85cbb1242818baf62a294bdfca90df717.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" guxcek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" guxcek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" 56ad1418f470bc5e6667574e054649d85cbb1242818baf62a294bdfca90df717.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" guxcek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" guxcek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" guxcek.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 56ad1418f470bc5e6667574e054649d85cbb1242818baf62a294bdfca90df717.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 56ad1418f470bc5e6667574e054649d85cbb1242818baf62a294bdfca90df717.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" 56ad1418f470bc5e6667574e054649d85cbb1242818baf62a294bdfca90df717.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" guxcek.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\56ad1418f470bc5e6667574e054649d85cbb1242818baf62a294bdfca90df717.exe"C:\Users\Admin\AppData\Local\Temp\56ad1418f470bc5e6667574e054649d85cbb1242818baf62a294bdfca90df717.exe"1⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Adds Run key to start application
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\guxcek.exe"C:\Users\Admin\AppData\Local\Temp\guxcek.exe" "-"2⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\guxcek.exe"C:\Users\Admin\AppData\Local\Temp\guxcek.exe" "-"2⤵
- Modifies WinLogon for persistence
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- System policy modification
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\guxcek.exeMD5
7ce4dea919a4b9ed983b3e05349ae419
SHA1162596dd9b666b953051b43931c97d7bac06ae9b
SHA25618eda6a88bbcf9a0ef3c8d8c603cf56b8649a9f5866c944444c87a3333ae5ea4
SHA512ce8f5629923b281bafc6438cc4485f54df375d15427ce6e7859616a772218f4f7771d707b88483cccebec60cafdd60f1c8562fd068b53ea7b07d948f2ffd3bbd
-
C:\Users\Admin\AppData\Local\Temp\guxcek.exeMD5
7ce4dea919a4b9ed983b3e05349ae419
SHA1162596dd9b666b953051b43931c97d7bac06ae9b
SHA25618eda6a88bbcf9a0ef3c8d8c603cf56b8649a9f5866c944444c87a3333ae5ea4
SHA512ce8f5629923b281bafc6438cc4485f54df375d15427ce6e7859616a772218f4f7771d707b88483cccebec60cafdd60f1c8562fd068b53ea7b07d948f2ffd3bbd
-
C:\Users\Admin\AppData\Local\Temp\guxcek.exeMD5
7ce4dea919a4b9ed983b3e05349ae419
SHA1162596dd9b666b953051b43931c97d7bac06ae9b
SHA25618eda6a88bbcf9a0ef3c8d8c603cf56b8649a9f5866c944444c87a3333ae5ea4
SHA512ce8f5629923b281bafc6438cc4485f54df375d15427ce6e7859616a772218f4f7771d707b88483cccebec60cafdd60f1c8562fd068b53ea7b07d948f2ffd3bbd
-
memory/184-117-0x0000000000000000-mapping.dmp
-
memory/3356-114-0x0000000000000000-mapping.dmp