2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a

Analysis

max time kernel
151s
max time network
155s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19-09-2022 20:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe
Size

892KB
MD5

d926c47b0ac935c8364502032b439f5e
SHA1

63f3d8e9c63c97d79b7df48b38880332e9a37597
SHA256

2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a
SHA512

1c3f9fda3f4193a1c81aa6cd1e96be427b65775c15885969caa8ccba42c7f12073faf437eb71fff4defda97205b512f817b0d3cda6c3ebf62344a61de4be48fe
SSDEEP

12288:eQMiG+2gef5x/xQTB2OfDKC7WgcEY53khxzNNu0A5YPSbXKLePlWd6SeCd:eQ0+29VgfDnKYY53SuNYPSb8ePlixd

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	yiqqyfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	iffdguquspp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	yiqqyfp.exe

UAC bypass 3 TTPs 9 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	yiqqyfp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	yiqqyfp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	yiqqyfp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	yiqqyfp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	iffdguquspp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	yiqqyfp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	yiqqyfp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	yiqqyfp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	yiqqyfp.exe

Adds policy Run key to start application 2 TTPs 20 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xkvyjtgtug = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lidqlfczkgtzipbydqhe.exe"	yiqqyfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\oesymzpfjyedf = "ayuiezxvheszjreciwomi.exe"	yiqqyfp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	yiqqyfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xkvyjtgtug = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yuoaunjfpkwbjpawamc.exe"	yiqqyfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xkvyjtgtug = "C:\\Users\\Admin\\AppData\\Local\\Temp\\eyqasjdxfyilrveya.exe"	yiqqyfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\oesymzpfjyedf = "ayuiezxvheszjreciwomi.exe"	yiqqyfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\oesymzpfjyedf = "yuoaunjfpkwbjpawamc.exe"	yiqqyfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\oesymzpfjyedf = "xqhqhxqjqirtybjc.exe"	yiqqyfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xkvyjtgtug = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ayuiezxvheszjreciwomi.exe"	yiqqyfp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	yiqqyfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\oesymzpfjyedf = "yuoaunjfpkwbjpawamc.exe"	yiqqyfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\oesymzpfjyedf = "yuoaunjfpkwbjpawamc.exe"	iffdguquspp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\oesymzpfjyedf = "xqhqhxqjqirtybjc.exe"	yiqqyfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xkvyjtgtug = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ayuiezxvheszjreciwomi.exe"	yiqqyfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\oesymzpfjyedf = "eyqasjdxfyilrveya.exe"	yiqqyfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xkvyjtgtug = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xqhqhxqjqirtybjc.exe"	yiqqyfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\oesymzpfjyedf = "lidqlfczkgtzipbydqhe.exe"	yiqqyfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xkvyjtgtug = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yuoaunjfpkwbjpawamc.exe"	yiqqyfp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	iffdguquspp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xkvyjtgtug = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ayuiezxvheszjreciwomi.exe"	iffdguquspp.exe

Disables RegEdit via registry modification 6 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	iffdguquspp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	iffdguquspp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	yiqqyfp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	yiqqyfp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	yiqqyfp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	yiqqyfp.exe

Executes dropped EXE 3 IoCs

pid	Process
844	iffdguquspp.exe
1040	yiqqyfp.exe
688	yiqqyfp.exe

Loads dropped DLL 6 IoCs

pid	Process
1204	2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe
1204	2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe
844	iffdguquspp.exe
844	iffdguquspp.exe
844	iffdguquspp.exe
844	iffdguquspp.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xqhqhxqjqirtybjc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lidqlfczkgtzipbydqhe.exe ."	iffdguquspp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\perwjvkzcqvt = "xqhqhxqjqirtybjc.exe ."	yiqqyfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\perwjvkzcqvt = "nibmfxsnwqbfmrbwzk.exe ."	yiqqyfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\perwjvkzcqvt = "yuoaunjfpkwbjpawamc.exe ."	yiqqyfp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\sgswithvxko = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lidqlfczkgtzipbydqhe.exe"	yiqqyfp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	iffdguquspp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\pgvcrfwnsippst = "nibmfxsnwqbfmrbwzk.exe"	iffdguquspp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\sgswithvxko = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nibmfxsnwqbfmrbwzk.exe"	yiqqyfp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\pgvcrfwnsippst = "ayuiezxvheszjreciwomi.exe"	yiqqyfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\eyqasjdxfyilrveya = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lidqlfczkgtzipbydqhe.exe"	yiqqyfp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\skaiynfxducdhjq = "nibmfxsnwqbfmrbwzk.exe ."	yiqqyfp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\skaiynfxducdhjq = "xqhqhxqjqirtybjc.exe ."	iffdguquspp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\sgswithvxko = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ayuiezxvheszjreciwomi.exe"	yiqqyfp.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	yiqqyfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\eyqasjdxfyilrveya = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ayuiezxvheszjreciwomi.exe"	yiqqyfp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\sgswithvxko = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xqhqhxqjqirtybjc.exe"	yiqqyfp.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	iffdguquspp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\sgswithvxko = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nibmfxsnwqbfmrbwzk.exe"	iffdguquspp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	yiqqyfp.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	yiqqyfp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\perwjvkzcqvt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lidqlfczkgtzipbydqhe.exe ."	yiqqyfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\eyqasjdxfyilrveya = "C:\\Users\\Admin\\AppData\\Local\\Temp\\eyqasjdxfyilrveya.exe"	yiqqyfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\perwjvkzcqvt = "lidqlfczkgtzipbydqhe.exe ."	iffdguquspp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\eyqasjdxfyilrveya = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yuoaunjfpkwbjpawamc.exe"	yiqqyfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\sgswithvxko = "ayuiezxvheszjreciwomi.exe"	yiqqyfp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\sgswithvxko = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xqhqhxqjqirtybjc.exe"	yiqqyfp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\sgswithvxko = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lidqlfczkgtzipbydqhe.exe"	yiqqyfp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	yiqqyfp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\pgvcrfwnsippst = "yuoaunjfpkwbjpawamc.exe"	yiqqyfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\eyqasjdxfyilrveya = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nibmfxsnwqbfmrbwzk.exe"	yiqqyfp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	iffdguquspp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\perwjvkzcqvt = "lidqlfczkgtzipbydqhe.exe ."	yiqqyfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\eyqasjdxfyilrveya = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ayuiezxvheszjreciwomi.exe"	yiqqyfp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\perwjvkzcqvt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xqhqhxqjqirtybjc.exe ."	yiqqyfp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\pgvcrfwnsippst = "ayuiezxvheszjreciwomi.exe"	yiqqyfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xqhqhxqjqirtybjc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nibmfxsnwqbfmrbwzk.exe ."	yiqqyfp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\perwjvkzcqvt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yuoaunjfpkwbjpawamc.exe ."	yiqqyfp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\skaiynfxducdhjq = "xqhqhxqjqirtybjc.exe ."	yiqqyfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xqhqhxqjqirtybjc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lidqlfczkgtzipbydqhe.exe ."	yiqqyfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xqhqhxqjqirtybjc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yuoaunjfpkwbjpawamc.exe ."	yiqqyfp.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	yiqqyfp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\pgvcrfwnsippst = "lidqlfczkgtzipbydqhe.exe"	yiqqyfp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\pgvcrfwnsippst = "xqhqhxqjqirtybjc.exe"	yiqqyfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\sgswithvxko = "nibmfxsnwqbfmrbwzk.exe"	yiqqyfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\sgswithvxko = "lidqlfczkgtzipbydqhe.exe"	yiqqyfp.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	iffdguquspp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	yiqqyfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\sgswithvxko = "ayuiezxvheszjreciwomi.exe"	yiqqyfp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\skaiynfxducdhjq = "yuoaunjfpkwbjpawamc.exe ."	yiqqyfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xqhqhxqjqirtybjc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xqhqhxqjqirtybjc.exe ."	yiqqyfp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\sgswithvxko = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nibmfxsnwqbfmrbwzk.exe"	yiqqyfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\eyqasjdxfyilrveya = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ayuiezxvheszjreciwomi.exe"	iffdguquspp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\sgswithvxko = "ayuiezxvheszjreciwomi.exe"	iffdguquspp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\sgswithvxko = "eyqasjdxfyilrveya.exe"	yiqqyfp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	yiqqyfp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\perwjvkzcqvt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lidqlfczkgtzipbydqhe.exe ."	yiqqyfp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\perwjvkzcqvt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ayuiezxvheszjreciwomi.exe ."	yiqqyfp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\pgvcrfwnsippst = "eyqasjdxfyilrveya.exe"	yiqqyfp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\skaiynfxducdhjq = "nibmfxsnwqbfmrbwzk.exe ."	yiqqyfp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\perwjvkzcqvt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yuoaunjfpkwbjpawamc.exe ."	yiqqyfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\sgswithvxko = "nibmfxsnwqbfmrbwzk.exe"	yiqqyfp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\pgvcrfwnsippst = "nibmfxsnwqbfmrbwzk.exe"	yiqqyfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xqhqhxqjqirtybjc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nibmfxsnwqbfmrbwzk.exe ."	yiqqyfp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\sgswithvxko = "xqhqhxqjqirtybjc.exe"	yiqqyfp.exe

Checks whether UAC is enabled 1 TTPs 6 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	iffdguquspp.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	iffdguquspp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	yiqqyfp.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	yiqqyfp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	yiqqyfp.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	yiqqyfp.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	whatismyip.everdot.org
2	www.showmyipaddress.com
4	whatismyipaddress.com

Drops file in System32 directory 46 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\lidqlfczkgtzipbydqhe.exe	yiqqyfp.exe
File opened for modification	C:\Windows\SysWOW64\rqnczvutgetbmvjipexwti.exe	yiqqyfp.exe
File opened for modification	C:\Windows\SysWOW64\nibmfxsnwqbfmrbwzk.exe	yiqqyfp.exe
File created	C:\Windows\SysWOW64\xqhqhxqjqirtybjc.exe	iffdguquspp.exe
File opened for modification	C:\Windows\SysWOW64\ayuiezxvheszjreciwomi.exe	iffdguquspp.exe
File created	C:\Windows\SysWOW64\rqnczvutgetbmvjipexwti.exe	iffdguquspp.exe
File created	C:\Windows\SysWOW64\yuoaunjfpkwbjpawamc.exe	yiqqyfp.exe
File created	C:\Windows\SysWOW64\lidqlfczkgtzipbydqhe.exe	yiqqyfp.exe
File created	C:\Windows\SysWOW64\rqnczvutgetbmvjipexwti.exe	yiqqyfp.exe
File opened for modification	C:\Windows\SysWOW64\aiomsxfnjqofzrowmkmuayejrzv.arl	yiqqyfp.exe
File opened for modification	C:\Windows\SysWOW64\xqhqhxqjqirtybjcdmzsjsjzslsktvadlefobu.ulb	yiqqyfp.exe
File created	C:\Windows\SysWOW64\eyqasjdxfyilrveya.exe	iffdguquspp.exe
File opened for modification	C:\Windows\SysWOW64\yuoaunjfpkwbjpawamc.exe	yiqqyfp.exe
File created	C:\Windows\SysWOW64\yuoaunjfpkwbjpawamc.exe	yiqqyfp.exe
File created	C:\Windows\SysWOW64\ayuiezxvheszjreciwomi.exe	yiqqyfp.exe
File created	C:\Windows\SysWOW64\rqnczvutgetbmvjipexwti.exe	yiqqyfp.exe
File opened for modification	C:\Windows\SysWOW64\yuoaunjfpkwbjpawamc.exe	yiqqyfp.exe
File created	C:\Windows\SysWOW64\yuoaunjfpkwbjpawamc.exe	iffdguquspp.exe
File opened for modification	C:\Windows\SysWOW64\lidqlfczkgtzipbydqhe.exe	iffdguquspp.exe
File created	C:\Windows\SysWOW64\ayuiezxvheszjreciwomi.exe	iffdguquspp.exe
File opened for modification	C:\Windows\SysWOW64\nibmfxsnwqbfmrbwzk.exe	yiqqyfp.exe
File created	C:\Windows\SysWOW64\lidqlfczkgtzipbydqhe.exe	yiqqyfp.exe
File opened for modification	C:\Windows\SysWOW64\eyqasjdxfyilrveya.exe	iffdguquspp.exe
File opened for modification	C:\Windows\SysWOW64\nibmfxsnwqbfmrbwzk.exe	iffdguquspp.exe
File opened for modification	C:\Windows\SysWOW64\yuoaunjfpkwbjpawamc.exe	iffdguquspp.exe
File created	C:\Windows\SysWOW64\ayuiezxvheszjreciwomi.exe	yiqqyfp.exe
File created	C:\Windows\SysWOW64\eyqasjdxfyilrveya.exe	yiqqyfp.exe
File created	C:\Windows\SysWOW64\nibmfxsnwqbfmrbwzk.exe	yiqqyfp.exe
File opened for modification	C:\Windows\SysWOW64\lidqlfczkgtzipbydqhe.exe	yiqqyfp.exe
File created	C:\Windows\SysWOW64\eyqasjdxfyilrveya.exe	yiqqyfp.exe
File created	C:\Windows\SysWOW64\nibmfxsnwqbfmrbwzk.exe	yiqqyfp.exe
File opened for modification	C:\Windows\SysWOW64\ayuiezxvheszjreciwomi.exe	yiqqyfp.exe
File opened for modification	C:\Windows\SysWOW64\rqnczvutgetbmvjipexwti.exe	iffdguquspp.exe
File opened for modification	C:\Windows\SysWOW64\eyqasjdxfyilrveya.exe	yiqqyfp.exe
File opened for modification	C:\Windows\SysWOW64\rqnczvutgetbmvjipexwti.exe	yiqqyfp.exe
File opened for modification	C:\Windows\SysWOW64\xqhqhxqjqirtybjc.exe	iffdguquspp.exe
File created	C:\Windows\SysWOW64\lidqlfczkgtzipbydqhe.exe	iffdguquspp.exe
File created	C:\Windows\SysWOW64\xqhqhxqjqirtybjc.exe	yiqqyfp.exe
File created	C:\Windows\SysWOW64\xqhqhxqjqirtybjc.exe	yiqqyfp.exe
File opened for modification	C:\Windows\SysWOW64\eyqasjdxfyilrveya.exe	yiqqyfp.exe
File opened for modification	C:\Windows\SysWOW64\ayuiezxvheszjreciwomi.exe	yiqqyfp.exe
File created	C:\Windows\SysWOW64\aiomsxfnjqofzrowmkmuayejrzv.arl	yiqqyfp.exe
File created	C:\Windows\SysWOW64\xqhqhxqjqirtybjcdmzsjsjzslsktvadlefobu.ulb	yiqqyfp.exe
File created	C:\Windows\SysWOW64\nibmfxsnwqbfmrbwzk.exe	iffdguquspp.exe
File opened for modification	C:\Windows\SysWOW64\xqhqhxqjqirtybjc.exe	yiqqyfp.exe
File opened for modification	C:\Windows\SysWOW64\xqhqhxqjqirtybjc.exe	yiqqyfp.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\aiomsxfnjqofzrowmkmuayejrzv.arl	yiqqyfp.exe
File created	C:\Program Files (x86)\aiomsxfnjqofzrowmkmuayejrzv.arl	yiqqyfp.exe
File opened for modification	C:\Program Files (x86)\xqhqhxqjqirtybjcdmzsjsjzslsktvadlefobu.ulb	yiqqyfp.exe
File created	C:\Program Files (x86)\xqhqhxqjqirtybjcdmzsjsjzslsktvadlefobu.ulb	yiqqyfp.exe

Drops file in Windows directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Windows\xqhqhxqjqirtybjc.exe	yiqqyfp.exe
File opened for modification	C:\Windows\eyqasjdxfyilrveya.exe	yiqqyfp.exe
File opened for modification	C:\Windows\nibmfxsnwqbfmrbwzk.exe	yiqqyfp.exe
File opened for modification	C:\Windows\yuoaunjfpkwbjpawamc.exe	iffdguquspp.exe
File opened for modification	C:\Windows\ayuiezxvheszjreciwomi.exe	iffdguquspp.exe
File opened for modification	C:\Windows\xqhqhxqjqirtybjc.exe	yiqqyfp.exe
File opened for modification	C:\Windows\nibmfxsnwqbfmrbwzk.exe	iffdguquspp.exe
File opened for modification	C:\Windows\lidqlfczkgtzipbydqhe.exe	iffdguquspp.exe
File opened for modification	C:\Windows\yuoaunjfpkwbjpawamc.exe	yiqqyfp.exe
File opened for modification	C:\Windows\aiomsxfnjqofzrowmkmuayejrzv.arl	yiqqyfp.exe
File opened for modification	C:\Windows\xqhqhxqjqirtybjcdmzsjsjzslsktvadlefobu.ulb	yiqqyfp.exe
File created	C:\Windows\yuoaunjfpkwbjpawamc.exe	iffdguquspp.exe
File opened for modification	C:\Windows\rqnczvutgetbmvjipexwti.exe	iffdguquspp.exe
File opened for modification	C:\Windows\lidqlfczkgtzipbydqhe.exe	yiqqyfp.exe
File opened for modification	C:\Windows\ayuiezxvheszjreciwomi.exe	yiqqyfp.exe
File opened for modification	C:\Windows\xqhqhxqjqirtybjc.exe	iffdguquspp.exe
File created	C:\Windows\xqhqhxqjqirtybjc.exe	iffdguquspp.exe
File created	C:\Windows\lidqlfczkgtzipbydqhe.exe	iffdguquspp.exe
File opened for modification	C:\Windows\yuoaunjfpkwbjpawamc.exe	yiqqyfp.exe
File opened for modification	C:\Windows\ayuiezxvheszjreciwomi.exe	yiqqyfp.exe
File opened for modification	C:\Windows\rqnczvutgetbmvjipexwti.exe	yiqqyfp.exe
File created	C:\Windows\xqhqhxqjqirtybjcdmzsjsjzslsktvadlefobu.ulb	yiqqyfp.exe
File created	C:\Windows\ayuiezxvheszjreciwomi.exe	iffdguquspp.exe
File created	C:\Windows\rqnczvutgetbmvjipexwti.exe	iffdguquspp.exe
File opened for modification	C:\Windows\eyqasjdxfyilrveya.exe	yiqqyfp.exe
File opened for modification	C:\Windows\nibmfxsnwqbfmrbwzk.exe	yiqqyfp.exe
File opened for modification	C:\Windows\rqnczvutgetbmvjipexwti.exe	yiqqyfp.exe
File opened for modification	C:\Windows\lidqlfczkgtzipbydqhe.exe	yiqqyfp.exe
File created	C:\Windows\aiomsxfnjqofzrowmkmuayejrzv.arl	yiqqyfp.exe
File opened for modification	C:\Windows\eyqasjdxfyilrveya.exe	iffdguquspp.exe
File created	C:\Windows\eyqasjdxfyilrveya.exe	iffdguquspp.exe
File created	C:\Windows\nibmfxsnwqbfmrbwzk.exe	iffdguquspp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1204	2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe
1204	2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe
1204	2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe
1204	2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe
1204	2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe
1204	2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe
1204	2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe
1204	2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe
1204	2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe
1204	2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe
1204	2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe
1204	2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe
1204	2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe
1204	2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe
1204	2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe
1204	2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe
1204	2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe
1204	2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe
1204	2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe
1204	2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe
1204	2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe
1204	2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe
1204	2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe
1204	2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe
1204	2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe
1040	yiqqyfp.exe
1040	yiqqyfp.exe
1204	2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe
1204	2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe
1204	2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe
1204	2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe
1204	2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe
1204	2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe
1204	2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe
1204	2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe
1204	2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe
1204	2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe
1204	2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe
1204	2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe
1204	2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe
1204	2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe
1204	2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe
1204	2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe
1204	2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe
1204	2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe
1204	2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe
1204	2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe
1204	2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe
1204	2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe
1204	2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe
1204	2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe
1204	2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe
1204	2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe
1204	2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe
1204	2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe
1204	2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe
1204	2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe
1204	2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe
1204	2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe
1040	yiqqyfp.exe
1040	yiqqyfp.exe
1204	2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe
1204	2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe
1204	2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1040	yiqqyfp.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 844	1204	2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe	27
PID 1204 wrote to memory of 844	1204	2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe	27
PID 1204 wrote to memory of 844	1204	2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe	27
PID 1204 wrote to memory of 844	1204	2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe	27
PID 844 wrote to memory of 1040	844	iffdguquspp.exe	28
PID 844 wrote to memory of 1040	844	iffdguquspp.exe	28
PID 844 wrote to memory of 1040	844	iffdguquspp.exe	28
PID 844 wrote to memory of 1040	844	iffdguquspp.exe	28
PID 844 wrote to memory of 688	844	iffdguquspp.exe	29
PID 844 wrote to memory of 688	844	iffdguquspp.exe	29
PID 844 wrote to memory of 688	844	iffdguquspp.exe	29
PID 844 wrote to memory of 688	844	iffdguquspp.exe	29

System policy modification 1 TTPs 29 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	yiqqyfp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	yiqqyfp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	yiqqyfp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	yiqqyfp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	yiqqyfp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	yiqqyfp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	iffdguquspp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	yiqqyfp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	yiqqyfp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	yiqqyfp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	iffdguquspp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	yiqqyfp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	yiqqyfp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	yiqqyfp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	yiqqyfp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	yiqqyfp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	yiqqyfp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	yiqqyfp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	yiqqyfp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	yiqqyfp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	yiqqyfp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	yiqqyfp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	yiqqyfp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	yiqqyfp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	yiqqyfp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	yiqqyfp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	yiqqyfp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	yiqqyfp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	iffdguquspp.exe

C:\Users\Admin\AppData\Local\Temp\2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe
"C:\Users\Admin\AppData\Local\Temp\2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Users\Admin\AppData\Local\Temp\iffdguquspp.exe
  "C:\Users\Admin\AppData\Local\Temp\iffdguquspp.exe" "c:\users\admin\appdata\local\temp\2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a.exe*"
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Adds policy Run key to start application
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:844
- - C:\Users\Admin\AppData\Local\Temp\yiqqyfp.exe
    "C:\Users\Admin\AppData\Local\Temp\yiqqyfp.exe" "-C:\Users\Admin\AppData\Local\Temp\xqhqhxqjqirtybjc.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - System policy modification
    PID:1040
- - C:\Users\Admin\AppData\Local\Temp\yiqqyfp.exe
    "C:\Users\Admin\AppData\Local\Temp\yiqqyfp.exe" "-C:\Users\Admin\AppData\Local\Temp\xqhqhxqjqirtybjc.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System policy modification
    PID:688

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ayuiezxvheszjreciwomi.exe

Filesize
892KB

MD5
d926c47b0ac935c8364502032b439f5e

SHA1
63f3d8e9c63c97d79b7df48b38880332e9a37597

SHA256
2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a

SHA512
1c3f9fda3f4193a1c81aa6cd1e96be427b65775c15885969caa8ccba42c7f12073faf437eb71fff4defda97205b512f817b0d3cda6c3ebf62344a61de4be48fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\eyqasjdxfyilrveya.exe

Filesize
892KB

MD5
d926c47b0ac935c8364502032b439f5e

SHA1
63f3d8e9c63c97d79b7df48b38880332e9a37597

SHA256
2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a

SHA512
1c3f9fda3f4193a1c81aa6cd1e96be427b65775c15885969caa8ccba42c7f12073faf437eb71fff4defda97205b512f817b0d3cda6c3ebf62344a61de4be48fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\iffdguquspp.exe

Filesize
320KB

MD5
304415df6ad55a90301aa8158e5e3582

SHA1
cc20ee7d5e8607f4fa0633093083ec0a68dcf3cd

SHA256
34a5f9e2b494b086abad2721019be271fa43350c9146f000e50fe554f170743d

SHA512
4ef2a9a8a3b36ba8c40a0bda9de415c76f985da34475f9110f7fe7b70a8e235d66ec6e15f76b45c5f75f5594fe05051d8112745e5031a18c817bd5d86212c687

Download Submit
C:\Users\Admin\AppData\Local\Temp\iffdguquspp.exe

Filesize
320KB

MD5
304415df6ad55a90301aa8158e5e3582

SHA1
cc20ee7d5e8607f4fa0633093083ec0a68dcf3cd

SHA256
34a5f9e2b494b086abad2721019be271fa43350c9146f000e50fe554f170743d

SHA512
4ef2a9a8a3b36ba8c40a0bda9de415c76f985da34475f9110f7fe7b70a8e235d66ec6e15f76b45c5f75f5594fe05051d8112745e5031a18c817bd5d86212c687

Download Submit
C:\Users\Admin\AppData\Local\Temp\lidqlfczkgtzipbydqhe.exe

Filesize
892KB

MD5
d926c47b0ac935c8364502032b439f5e

SHA1
63f3d8e9c63c97d79b7df48b38880332e9a37597

SHA256
2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a

SHA512
1c3f9fda3f4193a1c81aa6cd1e96be427b65775c15885969caa8ccba42c7f12073faf437eb71fff4defda97205b512f817b0d3cda6c3ebf62344a61de4be48fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\nibmfxsnwqbfmrbwzk.exe

Filesize
892KB

MD5
d926c47b0ac935c8364502032b439f5e

SHA1
63f3d8e9c63c97d79b7df48b38880332e9a37597

SHA256
2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a

SHA512
1c3f9fda3f4193a1c81aa6cd1e96be427b65775c15885969caa8ccba42c7f12073faf437eb71fff4defda97205b512f817b0d3cda6c3ebf62344a61de4be48fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\rqnczvutgetbmvjipexwti.exe

Filesize
892KB

MD5
d926c47b0ac935c8364502032b439f5e

SHA1
63f3d8e9c63c97d79b7df48b38880332e9a37597

SHA256
2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a

SHA512
1c3f9fda3f4193a1c81aa6cd1e96be427b65775c15885969caa8ccba42c7f12073faf437eb71fff4defda97205b512f817b0d3cda6c3ebf62344a61de4be48fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\xqhqhxqjqirtybjc.exe

Filesize
892KB

MD5
d926c47b0ac935c8364502032b439f5e

SHA1
63f3d8e9c63c97d79b7df48b38880332e9a37597

SHA256
2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a

SHA512
1c3f9fda3f4193a1c81aa6cd1e96be427b65775c15885969caa8ccba42c7f12073faf437eb71fff4defda97205b512f817b0d3cda6c3ebf62344a61de4be48fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\yiqqyfp.exe

Filesize
692KB

MD5
c5f093ef8409fe152a904f437db8a03a

SHA1
5e7bb04c37b32a4fc1f07545998a58e3b7b3e917

SHA256
eb056a583c878c41ad7afb3404f54f695327a42d48e9ab7135843a47fad27517

SHA512
67fbf2a376041b3da093eaf295dc515f08e4e1111f4e8b2278314ceb1379c6a9b6adcfbaf68f0a0966474d6ce5f64fb9e5468e246e76ab55d7008f28c553882d

Download Submit
C:\Users\Admin\AppData\Local\Temp\yiqqyfp.exe

Filesize
692KB

MD5
c5f093ef8409fe152a904f437db8a03a

SHA1
5e7bb04c37b32a4fc1f07545998a58e3b7b3e917

SHA256
eb056a583c878c41ad7afb3404f54f695327a42d48e9ab7135843a47fad27517

SHA512
67fbf2a376041b3da093eaf295dc515f08e4e1111f4e8b2278314ceb1379c6a9b6adcfbaf68f0a0966474d6ce5f64fb9e5468e246e76ab55d7008f28c553882d

Download Submit
C:\Users\Admin\AppData\Local\Temp\yuoaunjfpkwbjpawamc.exe

Filesize
892KB

MD5
d926c47b0ac935c8364502032b439f5e

SHA1
63f3d8e9c63c97d79b7df48b38880332e9a37597

SHA256
2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a

SHA512
1c3f9fda3f4193a1c81aa6cd1e96be427b65775c15885969caa8ccba42c7f12073faf437eb71fff4defda97205b512f817b0d3cda6c3ebf62344a61de4be48fe

Download Submit
C:\Windows\SysWOW64\ayuiezxvheszjreciwomi.exe

Filesize
892KB

MD5
d926c47b0ac935c8364502032b439f5e

SHA1
63f3d8e9c63c97d79b7df48b38880332e9a37597

SHA256
2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a

SHA512
1c3f9fda3f4193a1c81aa6cd1e96be427b65775c15885969caa8ccba42c7f12073faf437eb71fff4defda97205b512f817b0d3cda6c3ebf62344a61de4be48fe

Download Submit
C:\Windows\SysWOW64\eyqasjdxfyilrveya.exe

Filesize
892KB

MD5
d926c47b0ac935c8364502032b439f5e

SHA1
63f3d8e9c63c97d79b7df48b38880332e9a37597

SHA256
2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a

SHA512
1c3f9fda3f4193a1c81aa6cd1e96be427b65775c15885969caa8ccba42c7f12073faf437eb71fff4defda97205b512f817b0d3cda6c3ebf62344a61de4be48fe

Download Submit
C:\Windows\SysWOW64\lidqlfczkgtzipbydqhe.exe

Filesize
892KB

MD5
d926c47b0ac935c8364502032b439f5e

SHA1
63f3d8e9c63c97d79b7df48b38880332e9a37597

SHA256
2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a

SHA512
1c3f9fda3f4193a1c81aa6cd1e96be427b65775c15885969caa8ccba42c7f12073faf437eb71fff4defda97205b512f817b0d3cda6c3ebf62344a61de4be48fe

Download Submit
C:\Windows\SysWOW64\nibmfxsnwqbfmrbwzk.exe

Filesize
892KB

MD5
d926c47b0ac935c8364502032b439f5e

SHA1
63f3d8e9c63c97d79b7df48b38880332e9a37597

SHA256
2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a

SHA512
1c3f9fda3f4193a1c81aa6cd1e96be427b65775c15885969caa8ccba42c7f12073faf437eb71fff4defda97205b512f817b0d3cda6c3ebf62344a61de4be48fe

Download Submit
C:\Windows\SysWOW64\rqnczvutgetbmvjipexwti.exe

Filesize
892KB

MD5
d926c47b0ac935c8364502032b439f5e

SHA1
63f3d8e9c63c97d79b7df48b38880332e9a37597

SHA256
2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a

SHA512
1c3f9fda3f4193a1c81aa6cd1e96be427b65775c15885969caa8ccba42c7f12073faf437eb71fff4defda97205b512f817b0d3cda6c3ebf62344a61de4be48fe

Download Submit
C:\Windows\SysWOW64\xqhqhxqjqirtybjc.exe

Filesize
892KB

MD5
d926c47b0ac935c8364502032b439f5e

SHA1
63f3d8e9c63c97d79b7df48b38880332e9a37597

SHA256
2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a

SHA512
1c3f9fda3f4193a1c81aa6cd1e96be427b65775c15885969caa8ccba42c7f12073faf437eb71fff4defda97205b512f817b0d3cda6c3ebf62344a61de4be48fe

Download Submit
C:\Windows\SysWOW64\yuoaunjfpkwbjpawamc.exe

Filesize
892KB

MD5
d926c47b0ac935c8364502032b439f5e

SHA1
63f3d8e9c63c97d79b7df48b38880332e9a37597

SHA256
2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a

SHA512
1c3f9fda3f4193a1c81aa6cd1e96be427b65775c15885969caa8ccba42c7f12073faf437eb71fff4defda97205b512f817b0d3cda6c3ebf62344a61de4be48fe

Download Submit
C:\Windows\ayuiezxvheszjreciwomi.exe

Filesize
892KB

MD5
d926c47b0ac935c8364502032b439f5e

SHA1
63f3d8e9c63c97d79b7df48b38880332e9a37597

SHA256
2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a

SHA512
1c3f9fda3f4193a1c81aa6cd1e96be427b65775c15885969caa8ccba42c7f12073faf437eb71fff4defda97205b512f817b0d3cda6c3ebf62344a61de4be48fe

Download Submit
C:\Windows\ayuiezxvheszjreciwomi.exe

Filesize
892KB

MD5
d926c47b0ac935c8364502032b439f5e

SHA1
63f3d8e9c63c97d79b7df48b38880332e9a37597

SHA256
2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a

SHA512
1c3f9fda3f4193a1c81aa6cd1e96be427b65775c15885969caa8ccba42c7f12073faf437eb71fff4defda97205b512f817b0d3cda6c3ebf62344a61de4be48fe

Download Submit
C:\Windows\eyqasjdxfyilrveya.exe

Filesize
892KB

MD5
d926c47b0ac935c8364502032b439f5e

SHA1
63f3d8e9c63c97d79b7df48b38880332e9a37597

SHA256
2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a

SHA512
1c3f9fda3f4193a1c81aa6cd1e96be427b65775c15885969caa8ccba42c7f12073faf437eb71fff4defda97205b512f817b0d3cda6c3ebf62344a61de4be48fe

Download Submit
C:\Windows\eyqasjdxfyilrveya.exe

Filesize
892KB

MD5
d926c47b0ac935c8364502032b439f5e

SHA1
63f3d8e9c63c97d79b7df48b38880332e9a37597

SHA256
2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a

SHA512
1c3f9fda3f4193a1c81aa6cd1e96be427b65775c15885969caa8ccba42c7f12073faf437eb71fff4defda97205b512f817b0d3cda6c3ebf62344a61de4be48fe

Download Submit
C:\Windows\lidqlfczkgtzipbydqhe.exe

Filesize
892KB

MD5
d926c47b0ac935c8364502032b439f5e

SHA1
63f3d8e9c63c97d79b7df48b38880332e9a37597

SHA256
2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a

SHA512
1c3f9fda3f4193a1c81aa6cd1e96be427b65775c15885969caa8ccba42c7f12073faf437eb71fff4defda97205b512f817b0d3cda6c3ebf62344a61de4be48fe

Download Submit
C:\Windows\lidqlfczkgtzipbydqhe.exe

Filesize
892KB

MD5
d926c47b0ac935c8364502032b439f5e

SHA1
63f3d8e9c63c97d79b7df48b38880332e9a37597

SHA256
2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a

SHA512
1c3f9fda3f4193a1c81aa6cd1e96be427b65775c15885969caa8ccba42c7f12073faf437eb71fff4defda97205b512f817b0d3cda6c3ebf62344a61de4be48fe

Download Submit
C:\Windows\nibmfxsnwqbfmrbwzk.exe

Filesize
892KB

MD5
d926c47b0ac935c8364502032b439f5e

SHA1
63f3d8e9c63c97d79b7df48b38880332e9a37597

SHA256
2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a

SHA512
1c3f9fda3f4193a1c81aa6cd1e96be427b65775c15885969caa8ccba42c7f12073faf437eb71fff4defda97205b512f817b0d3cda6c3ebf62344a61de4be48fe

Download Submit
C:\Windows\nibmfxsnwqbfmrbwzk.exe

Filesize
892KB

MD5
d926c47b0ac935c8364502032b439f5e

SHA1
63f3d8e9c63c97d79b7df48b38880332e9a37597

SHA256
2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a

SHA512
1c3f9fda3f4193a1c81aa6cd1e96be427b65775c15885969caa8ccba42c7f12073faf437eb71fff4defda97205b512f817b0d3cda6c3ebf62344a61de4be48fe

Download Submit
C:\Windows\rqnczvutgetbmvjipexwti.exe

Filesize
892KB

MD5
d926c47b0ac935c8364502032b439f5e

SHA1
63f3d8e9c63c97d79b7df48b38880332e9a37597

SHA256
2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a

SHA512
1c3f9fda3f4193a1c81aa6cd1e96be427b65775c15885969caa8ccba42c7f12073faf437eb71fff4defda97205b512f817b0d3cda6c3ebf62344a61de4be48fe

Download Submit
C:\Windows\rqnczvutgetbmvjipexwti.exe

Filesize
892KB

MD5
d926c47b0ac935c8364502032b439f5e

SHA1
63f3d8e9c63c97d79b7df48b38880332e9a37597

SHA256
2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a

SHA512
1c3f9fda3f4193a1c81aa6cd1e96be427b65775c15885969caa8ccba42c7f12073faf437eb71fff4defda97205b512f817b0d3cda6c3ebf62344a61de4be48fe

Download Submit
C:\Windows\xqhqhxqjqirtybjc.exe

Filesize
892KB

MD5
d926c47b0ac935c8364502032b439f5e

SHA1
63f3d8e9c63c97d79b7df48b38880332e9a37597

SHA256
2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a

SHA512
1c3f9fda3f4193a1c81aa6cd1e96be427b65775c15885969caa8ccba42c7f12073faf437eb71fff4defda97205b512f817b0d3cda6c3ebf62344a61de4be48fe

Download Submit
C:\Windows\xqhqhxqjqirtybjc.exe

Filesize
892KB

MD5
d926c47b0ac935c8364502032b439f5e

SHA1
63f3d8e9c63c97d79b7df48b38880332e9a37597

SHA256
2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a

SHA512
1c3f9fda3f4193a1c81aa6cd1e96be427b65775c15885969caa8ccba42c7f12073faf437eb71fff4defda97205b512f817b0d3cda6c3ebf62344a61de4be48fe

Download Submit
C:\Windows\yuoaunjfpkwbjpawamc.exe

Filesize
892KB

MD5
d926c47b0ac935c8364502032b439f5e

SHA1
63f3d8e9c63c97d79b7df48b38880332e9a37597

SHA256
2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a

SHA512
1c3f9fda3f4193a1c81aa6cd1e96be427b65775c15885969caa8ccba42c7f12073faf437eb71fff4defda97205b512f817b0d3cda6c3ebf62344a61de4be48fe

Download Submit
C:\Windows\yuoaunjfpkwbjpawamc.exe

Filesize
892KB

MD5
d926c47b0ac935c8364502032b439f5e

SHA1
63f3d8e9c63c97d79b7df48b38880332e9a37597

SHA256
2b259640cce618d5919731adc0b3d8ce1124d474227104de1914d1b8ee76b35a

SHA512
1c3f9fda3f4193a1c81aa6cd1e96be427b65775c15885969caa8ccba42c7f12073faf437eb71fff4defda97205b512f817b0d3cda6c3ebf62344a61de4be48fe

Download Submit
\Users\Admin\AppData\Local\Temp\iffdguquspp.exe

Filesize
320KB

MD5
304415df6ad55a90301aa8158e5e3582

SHA1
cc20ee7d5e8607f4fa0633093083ec0a68dcf3cd

SHA256
34a5f9e2b494b086abad2721019be271fa43350c9146f000e50fe554f170743d

SHA512
4ef2a9a8a3b36ba8c40a0bda9de415c76f985da34475f9110f7fe7b70a8e235d66ec6e15f76b45c5f75f5594fe05051d8112745e5031a18c817bd5d86212c687

Download Submit
\Users\Admin\AppData\Local\Temp\iffdguquspp.exe

Filesize
320KB

MD5
304415df6ad55a90301aa8158e5e3582

SHA1
cc20ee7d5e8607f4fa0633093083ec0a68dcf3cd

SHA256
34a5f9e2b494b086abad2721019be271fa43350c9146f000e50fe554f170743d

SHA512
4ef2a9a8a3b36ba8c40a0bda9de415c76f985da34475f9110f7fe7b70a8e235d66ec6e15f76b45c5f75f5594fe05051d8112745e5031a18c817bd5d86212c687

Download Submit
\Users\Admin\AppData\Local\Temp\yiqqyfp.exe

Filesize
692KB

MD5
c5f093ef8409fe152a904f437db8a03a

SHA1
5e7bb04c37b32a4fc1f07545998a58e3b7b3e917

SHA256
eb056a583c878c41ad7afb3404f54f695327a42d48e9ab7135843a47fad27517

SHA512
67fbf2a376041b3da093eaf295dc515f08e4e1111f4e8b2278314ceb1379c6a9b6adcfbaf68f0a0966474d6ce5f64fb9e5468e246e76ab55d7008f28c553882d

Download Submit
\Users\Admin\AppData\Local\Temp\yiqqyfp.exe

Filesize
692KB

MD5
c5f093ef8409fe152a904f437db8a03a

SHA1
5e7bb04c37b32a4fc1f07545998a58e3b7b3e917

SHA256
eb056a583c878c41ad7afb3404f54f695327a42d48e9ab7135843a47fad27517

SHA512
67fbf2a376041b3da093eaf295dc515f08e4e1111f4e8b2278314ceb1379c6a9b6adcfbaf68f0a0966474d6ce5f64fb9e5468e246e76ab55d7008f28c553882d

Download Submit
\Users\Admin\AppData\Local\Temp\yiqqyfp.exe

Filesize
692KB

MD5
c5f093ef8409fe152a904f437db8a03a

SHA1
5e7bb04c37b32a4fc1f07545998a58e3b7b3e917

SHA256
eb056a583c878c41ad7afb3404f54f695327a42d48e9ab7135843a47fad27517

SHA512
67fbf2a376041b3da093eaf295dc515f08e4e1111f4e8b2278314ceb1379c6a9b6adcfbaf68f0a0966474d6ce5f64fb9e5468e246e76ab55d7008f28c553882d

Download Submit
\Users\Admin\AppData\Local\Temp\yiqqyfp.exe

Filesize
692KB

MD5
c5f093ef8409fe152a904f437db8a03a

SHA1
5e7bb04c37b32a4fc1f07545998a58e3b7b3e917

SHA256
eb056a583c878c41ad7afb3404f54f695327a42d48e9ab7135843a47fad27517

SHA512
67fbf2a376041b3da093eaf295dc515f08e4e1111f4e8b2278314ceb1379c6a9b6adcfbaf68f0a0966474d6ce5f64fb9e5468e246e76ab55d7008f28c553882d

Download Submit
memory/1204-54-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download