5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19

Analysis

max time kernel
151s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2022, 08:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe
Size

1016KB
MD5

6b56a1712fd79a0e804686fc741233a0
SHA1

19db5f81ac96bc6d66aa1c47e06412c6c59a9710
SHA256

5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19
SHA512

8503c62c9d9d6f1eeb1b9a7347776fd5355e87c65fa3f5faba78f2a6466b383b8f00a1bfa22d89e929689911338c25eac299ddf251f7b958bd7495f4fd9cae4a
SSDEEP

6144:PIXsL0tvrSVz1DnemeYbpsnEf78AoXh6KkiD0OofzA+/VygHU:PIXsgtvm1De5YlOx6lzBH46U

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	jrtbjq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	jrtbjq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	pwyrqtqlzgi.exe

UAC bypass 3 TTPs 13 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	jrtbjq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	jrtbjq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	jrtbjq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	jrtbjq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	jrtbjq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	jrtbjq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	jrtbjq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	jrtbjq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	pwyrqtqlzgi.exe

Adds policy Run key to start application 2 TTPs 30 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cnsdoyequ = "wrgbwqgcqldscdkvada.exe"	jrtbjq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\jrtbjq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cvibumaugzpckjoxa.exe"	jrtbjq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\jrtbjq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lftnhapkxriwfflvzb.exe"	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\jrtbjq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lftnhapkxriwfflvzb.exe"	jrtbjq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cnsdoyequ = "vnzrjangrjykrptb.exe"	jrtbjq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\jrtbjq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jfvrnizwlhaqbdlxdhfb.exe"	jrtbjq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cnsdoyequ = "lftnhapkxriwfflvzb.exe"	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cnsdoyequ = "lftnhapkxriwfflvzb.exe"	jrtbjq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cnsdoyequ = "cvibumaugzpckjoxa.exe"	jrtbjq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\jrtbjq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yvmjgcusifzqcfobinmja.exe"	jrtbjq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\jrtbjq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jfvrnizwlhaqbdlxdhfb.exe"	jrtbjq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\jrtbjq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cvibumaugzpckjoxa.exe"	jrtbjq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\jrtbjq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vnzrjangrjykrptb.exe"	jrtbjq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\jrtbjq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wrgbwqgcqldscdkvada.exe"	jrtbjq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cnsdoyequ = "yvmjgcusifzqcfobinmja.exe"	jrtbjq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cnsdoyequ = "wrgbwqgcqldscdkvada.exe"	jrtbjq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\jrtbjq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lftnhapkxriwfflvzb.exe"	jrtbjq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	pwyrqtqlzgi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	jrtbjq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\jrtbjq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wrgbwqgcqldscdkvada.exe"	jrtbjq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cnsdoyequ = "vnzrjangrjykrptb.exe"	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\jrtbjq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vnzrjangrjykrptb.exe"	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cnsdoyequ = "yvmjgcusifzqcfobinmja.exe"	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cnsdoyequ = "jfvrnizwlhaqbdlxdhfb.exe"	jrtbjq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	jrtbjq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\jrtbjq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vnzrjangrjykrptb.exe"	jrtbjq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cnsdoyequ = "lftnhapkxriwfflvzb.exe"	jrtbjq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cnsdoyequ = "jfvrnizwlhaqbdlxdhfb.exe"	jrtbjq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\jrtbjq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yvmjgcusifzqcfobinmja.exe"	jrtbjq.exe

Disables RegEdit via registry modification 6 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	jrtbjq.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	jrtbjq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	jrtbjq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	jrtbjq.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	pwyrqtqlzgi.exe

Executes dropped EXE 4 IoCs

pid	Process
840	pwyrqtqlzgi.exe
2852	jrtbjq.exe
4296	jrtbjq.exe
5060	pwyrqtqlzgi.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	pwyrqtqlzgi.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\lvzjtchs = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lftnhapkxriwfflvzb.exe ."	jrtbjq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\lvzjtchs = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cvibumaugzpckjoxa.exe ."	jrtbjq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vhnzlwdqvh = "vnzrjangrjykrptb.exe"	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\lvzjtchs = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wrgbwqgcqldscdkvada.exe ."	jrtbjq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wfiraim = "wrgbwqgcqldscdkvada.exe"	jrtbjq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wfiraim = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jfvrnizwlhaqbdlxdhfb.exe"	jrtbjq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nbjxlyhwdrck = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cvibumaugzpckjoxa.exe ."	jrtbjq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\qdkxkwesylv = "jfvrnizwlhaqbdlxdhfb.exe ."	jrtbjq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wfiraim = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yvmjgcusifzqcfobinmja.exe"	jrtbjq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nbjxlyhwdrck = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lftnhapkxriwfflvzb.exe ."	jrtbjq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lvzjtchs = "jfvrnizwlhaqbdlxdhfb.exe ."	jrtbjq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lvzjtchs = "vnzrjangrjykrptb.exe ."	jrtbjq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lvzjtchs = "lftnhapkxriwfflvzb.exe ."	jrtbjq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wfiraim = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vnzrjangrjykrptb.exe"	jrtbjq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mbkzocmckzluy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cvibumaugzpckjoxa.exe"	jrtbjq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wfiraim = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lftnhapkxriwfflvzb.exe"	jrtbjq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	jrtbjq.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	jrtbjq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wfiraim = "jfvrnizwlhaqbdlxdhfb.exe"	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\qdkxkwesylv = "yvmjgcusifzqcfobinmja.exe ."	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mbkzocmckzluy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vnzrjangrjykrptb.exe"	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lvzjtchs = "cvibumaugzpckjoxa.exe ."	jrtbjq.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	jrtbjq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mbkzocmckzluy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wrgbwqgcqldscdkvada.exe"	jrtbjq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wfiraim = "lftnhapkxriwfflvzb.exe"	jrtbjq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\lvzjtchs = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wrgbwqgcqldscdkvada.exe ."	jrtbjq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nbjxlyhwdrck = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cvibumaugzpckjoxa.exe ."	jrtbjq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wfiraim = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wrgbwqgcqldscdkvada.exe"	jrtbjq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wfiraim = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cvibumaugzpckjoxa.exe"	jrtbjq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\qdkxkwesylv = "jfvrnizwlhaqbdlxdhfb.exe ."	pwyrqtqlzgi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	jrtbjq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wfiraim = "jfvrnizwlhaqbdlxdhfb.exe"	jrtbjq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vhnzlwdqvh = "yvmjgcusifzqcfobinmja.exe"	jrtbjq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lvzjtchs = "vnzrjangrjykrptb.exe ."	jrtbjq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\qdkxkwesylv = "yvmjgcusifzqcfobinmja.exe ."	jrtbjq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vhnzlwdqvh = "yvmjgcusifzqcfobinmja.exe"	jrtbjq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lvzjtchs = "jfvrnizwlhaqbdlxdhfb.exe ."	jrtbjq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wfiraim = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jfvrnizwlhaqbdlxdhfb.exe"	jrtbjq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\lvzjtchs = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yvmjgcusifzqcfobinmja.exe ."	jrtbjq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wfiraim = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lftnhapkxriwfflvzb.exe"	jrtbjq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\lvzjtchs = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jfvrnizwlhaqbdlxdhfb.exe ."	jrtbjq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nbjxlyhwdrck = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yvmjgcusifzqcfobinmja.exe ."	jrtbjq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\qdkxkwesylv = "cvibumaugzpckjoxa.exe ."	jrtbjq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wfiraim = "yvmjgcusifzqcfobinmja.exe"	jrtbjq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wfiraim = "vnzrjangrjykrptb.exe"	jrtbjq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vhnzlwdqvh = "wrgbwqgcqldscdkvada.exe"	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nbjxlyhwdrck = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lftnhapkxriwfflvzb.exe ."	jrtbjq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nbjxlyhwdrck = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wrgbwqgcqldscdkvada.exe ."	jrtbjq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wfiraim = "cvibumaugzpckjoxa.exe"	jrtbjq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vhnzlwdqvh = "vnzrjangrjykrptb.exe"	jrtbjq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wfiraim = "lftnhapkxriwfflvzb.exe"	jrtbjq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vhnzlwdqvh = "lftnhapkxriwfflvzb.exe"	jrtbjq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wfiraim = "wrgbwqgcqldscdkvada.exe"	jrtbjq.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	jrtbjq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wfiraim = "yvmjgcusifzqcfobinmja.exe"	jrtbjq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lvzjtchs = "cvibumaugzpckjoxa.exe ."	jrtbjq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mbkzocmckzluy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wrgbwqgcqldscdkvada.exe"	jrtbjq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lvzjtchs = "yvmjgcusifzqcfobinmja.exe ."	jrtbjq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\lvzjtchs = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wrgbwqgcqldscdkvada.exe ."	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wfiraim = "yvmjgcusifzqcfobinmja.exe"	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nbjxlyhwdrck = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jfvrnizwlhaqbdlxdhfb.exe ."	jrtbjq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	jrtbjq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vhnzlwdqvh = "cvibumaugzpckjoxa.exe"	jrtbjq.exe

Checks whether UAC is enabled 1 TTPs 8 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	jrtbjq.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	jrtbjq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	pwyrqtqlzgi.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	pwyrqtqlzgi.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	jrtbjq.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	jrtbjq.exe

Looks up external IP address via web service 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
63	www.showmyipaddress.com
80	whatismyipaddress.com
23	whatismyipaddress.com
45	www.showmyipaddress.com
53	whatismyip.everdot.org

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\autorun.inf	jrtbjq.exe
File created	C:\autorun.inf	jrtbjq.exe

Drops file in System32 directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\vnzrjangrjykrptb.exe	jrtbjq.exe
File opened for modification	C:\Windows\SysWOW64\cvibumaugzpckjoxa.exe	jrtbjq.exe
File created	C:\Windows\SysWOW64\adadgigkgjjgyhwpcnsvsvy.ycy	jrtbjq.exe
File opened for modification	C:\Windows\SysWOW64\lftnhapkxriwfflvzb.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\SysWOW64\yvmjgcusifzqcfobinmja.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\SysWOW64\yvmjgcusifzqcfobinmja.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\SysWOW64\jfvrnizwlhaqbdlxdhfb.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\SysWOW64\vnzrjangrjykrptb.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\SysWOW64\lftnhapkxriwfflvzb.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\SysWOW64\jfvrnizwlhaqbdlxdhfb.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\SysWOW64\cvibumaugzpckjoxa.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\SysWOW64\pnfdbyrqhfasfjthpvvtlj.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\SysWOW64\lftnhapkxriwfflvzb.exe	jrtbjq.exe
File opened for modification	C:\Windows\SysWOW64\jfvrnizwlhaqbdlxdhfb.exe	jrtbjq.exe
File opened for modification	C:\Windows\SysWOW64\wrgbwqgcqldscdkvada.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\SysWOW64\wrgbwqgcqldscdkvada.exe	jrtbjq.exe
File opened for modification	C:\Windows\SysWOW64\nbjxlyhwdrcknhhljfvjrftgpelzksvppt.ndr	jrtbjq.exe
File opened for modification	C:\Windows\SysWOW64\wrgbwqgcqldscdkvada.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\SysWOW64\lftnhapkxriwfflvzb.exe	jrtbjq.exe
File opened for modification	C:\Windows\SysWOW64\jfvrnizwlhaqbdlxdhfb.exe	jrtbjq.exe
File opened for modification	C:\Windows\SysWOW64\yvmjgcusifzqcfobinmja.exe	jrtbjq.exe
File opened for modification	C:\Windows\SysWOW64\pnfdbyrqhfasfjthpvvtlj.exe	jrtbjq.exe
File opened for modification	C:\Windows\SysWOW64\cvibumaugzpckjoxa.exe	jrtbjq.exe
File opened for modification	C:\Windows\SysWOW64\yvmjgcusifzqcfobinmja.exe	jrtbjq.exe
File opened for modification	C:\Windows\SysWOW64\adadgigkgjjgyhwpcnsvsvy.ycy	jrtbjq.exe
File opened for modification	C:\Windows\SysWOW64\cvibumaugzpckjoxa.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\SysWOW64\vnzrjangrjykrptb.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\SysWOW64\pnfdbyrqhfasfjthpvvtlj.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\SysWOW64\vnzrjangrjykrptb.exe	jrtbjq.exe
File opened for modification	C:\Windows\SysWOW64\pnfdbyrqhfasfjthpvvtlj.exe	jrtbjq.exe
File created	C:\Windows\SysWOW64\nbjxlyhwdrcknhhljfvjrftgpelzksvppt.ndr	jrtbjq.exe
File opened for modification	C:\Windows\SysWOW64\wrgbwqgcqldscdkvada.exe	jrtbjq.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\adadgigkgjjgyhwpcnsvsvy.ycy	jrtbjq.exe
File created	C:\Program Files (x86)\adadgigkgjjgyhwpcnsvsvy.ycy	jrtbjq.exe
File opened for modification	C:\Program Files (x86)\nbjxlyhwdrcknhhljfvjrftgpelzksvppt.ndr	jrtbjq.exe
File created	C:\Program Files (x86)\nbjxlyhwdrcknhhljfvjrftgpelzksvppt.ndr	jrtbjq.exe

Drops file in Windows directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Windows\yvmjgcusifzqcfobinmja.exe	jrtbjq.exe
File opened for modification	C:\Windows\lftnhapkxriwfflvzb.exe	jrtbjq.exe
File opened for modification	C:\Windows\jfvrnizwlhaqbdlxdhfb.exe	jrtbjq.exe
File opened for modification	C:\Windows\yvmjgcusifzqcfobinmja.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\wrgbwqgcqldscdkvada.exe	jrtbjq.exe
File opened for modification	C:\Windows\cvibumaugzpckjoxa.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\wrgbwqgcqldscdkvada.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\pnfdbyrqhfasfjthpvvtlj.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\nbjxlyhwdrcknhhljfvjrftgpelzksvppt.ndr	jrtbjq.exe
File opened for modification	C:\Windows\lftnhapkxriwfflvzb.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\cvibumaugzpckjoxa.exe	jrtbjq.exe
File opened for modification	C:\Windows\yvmjgcusifzqcfobinmja.exe	jrtbjq.exe
File opened for modification	C:\Windows\pnfdbyrqhfasfjthpvvtlj.exe	jrtbjq.exe
File created	C:\Windows\adadgigkgjjgyhwpcnsvsvy.ycy	jrtbjq.exe
File opened for modification	C:\Windows\jfvrnizwlhaqbdlxdhfb.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\lftnhapkxriwfflvzb.exe	jrtbjq.exe
File created	C:\Windows\nbjxlyhwdrcknhhljfvjrftgpelzksvppt.ndr	jrtbjq.exe
File opened for modification	C:\Windows\jfvrnizwlhaqbdlxdhfb.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\vnzrjangrjykrptb.exe	jrtbjq.exe
File opened for modification	C:\Windows\adadgigkgjjgyhwpcnsvsvy.ycy	jrtbjq.exe
File opened for modification	C:\Windows\yvmjgcusifzqcfobinmja.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\vnzrjangrjykrptb.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\wrgbwqgcqldscdkvada.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\vnzrjangrjykrptb.exe	jrtbjq.exe
File opened for modification	C:\Windows\wrgbwqgcqldscdkvada.exe	jrtbjq.exe
File opened for modification	C:\Windows\jfvrnizwlhaqbdlxdhfb.exe	jrtbjq.exe
File opened for modification	C:\Windows\cvibumaugzpckjoxa.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\pnfdbyrqhfasfjthpvvtlj.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\pnfdbyrqhfasfjthpvvtlj.exe	jrtbjq.exe
File opened for modification	C:\Windows\cvibumaugzpckjoxa.exe	jrtbjq.exe
File opened for modification	C:\Windows\lftnhapkxriwfflvzb.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\vnzrjangrjykrptb.exe	pwyrqtqlzgi.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1476	5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe
1476	5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe
1476	5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe
1476	5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe
1476	5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe
1476	5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe
1476	5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe
1476	5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe
1476	5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe
1476	5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe
1476	5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe
1476	5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe
1476	5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe
1476	5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe
1476	5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe
1476	5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe
1476	5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe
1476	5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe
1476	5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe
1476	5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe
2852	jrtbjq.exe
2852	jrtbjq.exe
1476	5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe
1476	5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe
1476	5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe
1476	5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe
1476	5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe
1476	5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe
1476	5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe
1476	5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe
1476	5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe
1476	5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe
1476	5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe
1476	5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe
1476	5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe
1476	5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe
1476	5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe
1476	5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe
1476	5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe
1476	5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe
1476	5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe
1476	5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe
1476	5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe
1476	5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe
1476	5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe
1476	5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe
1476	5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe
1476	5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe
1476	5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe
1476	5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe
2852	jrtbjq.exe
2852	jrtbjq.exe
1476	5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe
1476	5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe
1476	5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe
1476	5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe
1476	5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe
1476	5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe
1476	5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe
1476	5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe
1476	5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe
1476	5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe
1476	5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe
1476	5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2852	jrtbjq.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 840	1476	5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe	86
PID 1476 wrote to memory of 840	1476	5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe	86
PID 1476 wrote to memory of 840	1476	5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe	86
PID 840 wrote to memory of 2852	840	pwyrqtqlzgi.exe	89
PID 840 wrote to memory of 2852	840	pwyrqtqlzgi.exe	89
PID 840 wrote to memory of 2852	840	pwyrqtqlzgi.exe	89
PID 840 wrote to memory of 4296	840	pwyrqtqlzgi.exe	90
PID 840 wrote to memory of 4296	840	pwyrqtqlzgi.exe	90
PID 840 wrote to memory of 4296	840	pwyrqtqlzgi.exe	90
PID 1476 wrote to memory of 5060	1476	5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe	109
PID 1476 wrote to memory of 5060	1476	5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe	109
PID 1476 wrote to memory of 5060	1476	5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe	109

System policy modification 1 TTPs 41 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	jrtbjq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	jrtbjq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	jrtbjq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	pwyrqtqlzgi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	jrtbjq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	jrtbjq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	jrtbjq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	pwyrqtqlzgi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	jrtbjq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	pwyrqtqlzgi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	jrtbjq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	jrtbjq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	jrtbjq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	jrtbjq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	jrtbjq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	jrtbjq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	pwyrqtqlzgi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	jrtbjq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	jrtbjq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	jrtbjq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	jrtbjq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	jrtbjq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	jrtbjq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	jrtbjq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	jrtbjq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	jrtbjq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	jrtbjq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	jrtbjq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	jrtbjq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	jrtbjq.exe

C:\Users\Admin\AppData\Local\Temp\5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe
"C:\Users\Admin\AppData\Local\Temp\5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Users\Admin\AppData\Local\Temp\pwyrqtqlzgi.exe
  "C:\Users\Admin\AppData\Local\Temp\pwyrqtqlzgi.exe" "c:\users\admin\appdata\local\temp\5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe*"
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Adds policy Run key to start application
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Checks computer location settings
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:840
- - C:\Users\Admin\AppData\Local\Temp\jrtbjq.exe
    "C:\Users\Admin\AppData\Local\Temp\jrtbjq.exe" "-C:\Users\Admin\AppData\Local\Temp\vnzrjangrjykrptb.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops autorun.inf file
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - System policy modification
    PID:2852
- - C:\Users\Admin\AppData\Local\Temp\jrtbjq.exe
    "C:\Users\Admin\AppData\Local\Temp\jrtbjq.exe" "-C:\Users\Admin\AppData\Local\Temp\vnzrjangrjykrptb.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System policy modification
    PID:4296
- C:\Users\Admin\AppData\Local\Temp\pwyrqtqlzgi.exe
  "C:\Users\Admin\AppData\Local\Temp\pwyrqtqlzgi.exe" "c:\users\admin\appdata\local\temp\5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19.exe"
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Adds policy Run key to start application
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System policy modification
  PID:5060

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cvibumaugzpckjoxa.exe

Filesize
1016KB

MD5
6b56a1712fd79a0e804686fc741233a0

SHA1
19db5f81ac96bc6d66aa1c47e06412c6c59a9710

SHA256
5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19

SHA512
8503c62c9d9d6f1eeb1b9a7347776fd5355e87c65fa3f5faba78f2a6466b383b8f00a1bfa22d89e929689911338c25eac299ddf251f7b958bd7495f4fd9cae4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\jfvrnizwlhaqbdlxdhfb.exe

Filesize
1016KB

MD5
6b56a1712fd79a0e804686fc741233a0

SHA1
19db5f81ac96bc6d66aa1c47e06412c6c59a9710

SHA256
5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19

SHA512
8503c62c9d9d6f1eeb1b9a7347776fd5355e87c65fa3f5faba78f2a6466b383b8f00a1bfa22d89e929689911338c25eac299ddf251f7b958bd7495f4fd9cae4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\jrtbjq.exe

Filesize
704KB

MD5
ebe32d577c4726083a0284c24741ccb7

SHA1
b8340ec935c44f37f2c264f5e81955b8d1319110

SHA256
e9d5a819394e6a9ea04a66b31e09c144b9252f6e47d413fdc1364a9793a3c92b

SHA512
8d1a26914dd5c72f593b06d7be57e91cd178dd107feec2289d6291cb28a94adaef95faa2484c9e7c1921f847bbcc23d40f2e872d004305af6f88a9c0088a57b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\jrtbjq.exe

Filesize
704KB

MD5
ebe32d577c4726083a0284c24741ccb7

SHA1
b8340ec935c44f37f2c264f5e81955b8d1319110

SHA256
e9d5a819394e6a9ea04a66b31e09c144b9252f6e47d413fdc1364a9793a3c92b

SHA512
8d1a26914dd5c72f593b06d7be57e91cd178dd107feec2289d6291cb28a94adaef95faa2484c9e7c1921f847bbcc23d40f2e872d004305af6f88a9c0088a57b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\jrtbjq.exe

Filesize
704KB

MD5
ebe32d577c4726083a0284c24741ccb7

SHA1
b8340ec935c44f37f2c264f5e81955b8d1319110

SHA256
e9d5a819394e6a9ea04a66b31e09c144b9252f6e47d413fdc1364a9793a3c92b

SHA512
8d1a26914dd5c72f593b06d7be57e91cd178dd107feec2289d6291cb28a94adaef95faa2484c9e7c1921f847bbcc23d40f2e872d004305af6f88a9c0088a57b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\lftnhapkxriwfflvzb.exe

Filesize
1016KB

MD5
6b56a1712fd79a0e804686fc741233a0

SHA1
19db5f81ac96bc6d66aa1c47e06412c6c59a9710

SHA256
5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19

SHA512
8503c62c9d9d6f1eeb1b9a7347776fd5355e87c65fa3f5faba78f2a6466b383b8f00a1bfa22d89e929689911338c25eac299ddf251f7b958bd7495f4fd9cae4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\pnfdbyrqhfasfjthpvvtlj.exe

Filesize
1016KB

MD5
6b56a1712fd79a0e804686fc741233a0

SHA1
19db5f81ac96bc6d66aa1c47e06412c6c59a9710

SHA256
5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19

SHA512
8503c62c9d9d6f1eeb1b9a7347776fd5355e87c65fa3f5faba78f2a6466b383b8f00a1bfa22d89e929689911338c25eac299ddf251f7b958bd7495f4fd9cae4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\pwyrqtqlzgi.exe

Filesize
320KB

MD5
1d02e85e4b436e7986b5d706f7ca019b

SHA1
44edbeb71c5e34141c2278d04ee6fa6ee8a5d95e

SHA256
8efb80894480f0d7e243b9d0256be52bf5bac65a79cf7e5a1d549acd7c805fd0

SHA512
08aa295c653db171fa217591939937cb673059eba9126277ed05f4d58b8489c8bef942defaa002affa2bc04f3f598822e9f32e666b1cb76672aaff7520e6c0af

Download Submit
C:\Users\Admin\AppData\Local\Temp\pwyrqtqlzgi.exe

Filesize
320KB

MD5
1d02e85e4b436e7986b5d706f7ca019b

SHA1
44edbeb71c5e34141c2278d04ee6fa6ee8a5d95e

SHA256
8efb80894480f0d7e243b9d0256be52bf5bac65a79cf7e5a1d549acd7c805fd0

SHA512
08aa295c653db171fa217591939937cb673059eba9126277ed05f4d58b8489c8bef942defaa002affa2bc04f3f598822e9f32e666b1cb76672aaff7520e6c0af

Download Submit
C:\Users\Admin\AppData\Local\Temp\pwyrqtqlzgi.exe

Filesize
320KB

MD5
1d02e85e4b436e7986b5d706f7ca019b

SHA1
44edbeb71c5e34141c2278d04ee6fa6ee8a5d95e

SHA256
8efb80894480f0d7e243b9d0256be52bf5bac65a79cf7e5a1d549acd7c805fd0

SHA512
08aa295c653db171fa217591939937cb673059eba9126277ed05f4d58b8489c8bef942defaa002affa2bc04f3f598822e9f32e666b1cb76672aaff7520e6c0af

Download Submit
C:\Users\Admin\AppData\Local\Temp\vnzrjangrjykrptb.exe

Filesize
1016KB

MD5
6b56a1712fd79a0e804686fc741233a0

SHA1
19db5f81ac96bc6d66aa1c47e06412c6c59a9710

SHA256
5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19

SHA512
8503c62c9d9d6f1eeb1b9a7347776fd5355e87c65fa3f5faba78f2a6466b383b8f00a1bfa22d89e929689911338c25eac299ddf251f7b958bd7495f4fd9cae4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\wrgbwqgcqldscdkvada.exe

Filesize
1016KB

MD5
6b56a1712fd79a0e804686fc741233a0

SHA1
19db5f81ac96bc6d66aa1c47e06412c6c59a9710

SHA256
5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19

SHA512
8503c62c9d9d6f1eeb1b9a7347776fd5355e87c65fa3f5faba78f2a6466b383b8f00a1bfa22d89e929689911338c25eac299ddf251f7b958bd7495f4fd9cae4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\yvmjgcusifzqcfobinmja.exe

Filesize
1016KB

MD5
6b56a1712fd79a0e804686fc741233a0

SHA1
19db5f81ac96bc6d66aa1c47e06412c6c59a9710

SHA256
5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19

SHA512
8503c62c9d9d6f1eeb1b9a7347776fd5355e87c65fa3f5faba78f2a6466b383b8f00a1bfa22d89e929689911338c25eac299ddf251f7b958bd7495f4fd9cae4a

Download Submit
C:\Windows\SysWOW64\cvibumaugzpckjoxa.exe

Filesize
1016KB

MD5
6b56a1712fd79a0e804686fc741233a0

SHA1
19db5f81ac96bc6d66aa1c47e06412c6c59a9710

SHA256
5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19

SHA512
8503c62c9d9d6f1eeb1b9a7347776fd5355e87c65fa3f5faba78f2a6466b383b8f00a1bfa22d89e929689911338c25eac299ddf251f7b958bd7495f4fd9cae4a

Download Submit
C:\Windows\SysWOW64\jfvrnizwlhaqbdlxdhfb.exe

Filesize
1016KB

MD5
6b56a1712fd79a0e804686fc741233a0

SHA1
19db5f81ac96bc6d66aa1c47e06412c6c59a9710

SHA256
5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19

SHA512
8503c62c9d9d6f1eeb1b9a7347776fd5355e87c65fa3f5faba78f2a6466b383b8f00a1bfa22d89e929689911338c25eac299ddf251f7b958bd7495f4fd9cae4a

Download Submit
C:\Windows\SysWOW64\lftnhapkxriwfflvzb.exe

Filesize
1016KB

MD5
6b56a1712fd79a0e804686fc741233a0

SHA1
19db5f81ac96bc6d66aa1c47e06412c6c59a9710

SHA256
5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19

SHA512
8503c62c9d9d6f1eeb1b9a7347776fd5355e87c65fa3f5faba78f2a6466b383b8f00a1bfa22d89e929689911338c25eac299ddf251f7b958bd7495f4fd9cae4a

Download Submit
C:\Windows\SysWOW64\pnfdbyrqhfasfjthpvvtlj.exe

Filesize
1016KB

MD5
6b56a1712fd79a0e804686fc741233a0

SHA1
19db5f81ac96bc6d66aa1c47e06412c6c59a9710

SHA256
5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19

SHA512
8503c62c9d9d6f1eeb1b9a7347776fd5355e87c65fa3f5faba78f2a6466b383b8f00a1bfa22d89e929689911338c25eac299ddf251f7b958bd7495f4fd9cae4a

Download Submit
C:\Windows\SysWOW64\vnzrjangrjykrptb.exe

Filesize
1016KB

MD5
6b56a1712fd79a0e804686fc741233a0

SHA1
19db5f81ac96bc6d66aa1c47e06412c6c59a9710

SHA256
5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19

SHA512
8503c62c9d9d6f1eeb1b9a7347776fd5355e87c65fa3f5faba78f2a6466b383b8f00a1bfa22d89e929689911338c25eac299ddf251f7b958bd7495f4fd9cae4a

Download Submit
C:\Windows\SysWOW64\wrgbwqgcqldscdkvada.exe

Filesize
1016KB

MD5
6b56a1712fd79a0e804686fc741233a0

SHA1
19db5f81ac96bc6d66aa1c47e06412c6c59a9710

SHA256
5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19

SHA512
8503c62c9d9d6f1eeb1b9a7347776fd5355e87c65fa3f5faba78f2a6466b383b8f00a1bfa22d89e929689911338c25eac299ddf251f7b958bd7495f4fd9cae4a

Download Submit
C:\Windows\SysWOW64\yvmjgcusifzqcfobinmja.exe

Filesize
1016KB

MD5
6b56a1712fd79a0e804686fc741233a0

SHA1
19db5f81ac96bc6d66aa1c47e06412c6c59a9710

SHA256
5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19

SHA512
8503c62c9d9d6f1eeb1b9a7347776fd5355e87c65fa3f5faba78f2a6466b383b8f00a1bfa22d89e929689911338c25eac299ddf251f7b958bd7495f4fd9cae4a

Download Submit
C:\Windows\cvibumaugzpckjoxa.exe

Filesize
1016KB

MD5
6b56a1712fd79a0e804686fc741233a0

SHA1
19db5f81ac96bc6d66aa1c47e06412c6c59a9710

SHA256
5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19

SHA512
8503c62c9d9d6f1eeb1b9a7347776fd5355e87c65fa3f5faba78f2a6466b383b8f00a1bfa22d89e929689911338c25eac299ddf251f7b958bd7495f4fd9cae4a

Download Submit
C:\Windows\cvibumaugzpckjoxa.exe

Filesize
1016KB

MD5
6b56a1712fd79a0e804686fc741233a0

SHA1
19db5f81ac96bc6d66aa1c47e06412c6c59a9710

SHA256
5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19

SHA512
8503c62c9d9d6f1eeb1b9a7347776fd5355e87c65fa3f5faba78f2a6466b383b8f00a1bfa22d89e929689911338c25eac299ddf251f7b958bd7495f4fd9cae4a

Download Submit
C:\Windows\cvibumaugzpckjoxa.exe

Filesize
1016KB

MD5
6b56a1712fd79a0e804686fc741233a0

SHA1
19db5f81ac96bc6d66aa1c47e06412c6c59a9710

SHA256
5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19

SHA512
8503c62c9d9d6f1eeb1b9a7347776fd5355e87c65fa3f5faba78f2a6466b383b8f00a1bfa22d89e929689911338c25eac299ddf251f7b958bd7495f4fd9cae4a

Download Submit
C:\Windows\jfvrnizwlhaqbdlxdhfb.exe

Filesize
1016KB

MD5
6b56a1712fd79a0e804686fc741233a0

SHA1
19db5f81ac96bc6d66aa1c47e06412c6c59a9710

SHA256
5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19

SHA512
8503c62c9d9d6f1eeb1b9a7347776fd5355e87c65fa3f5faba78f2a6466b383b8f00a1bfa22d89e929689911338c25eac299ddf251f7b958bd7495f4fd9cae4a

Download Submit
C:\Windows\jfvrnizwlhaqbdlxdhfb.exe

Filesize
1016KB

MD5
6b56a1712fd79a0e804686fc741233a0

SHA1
19db5f81ac96bc6d66aa1c47e06412c6c59a9710

SHA256
5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19

SHA512
8503c62c9d9d6f1eeb1b9a7347776fd5355e87c65fa3f5faba78f2a6466b383b8f00a1bfa22d89e929689911338c25eac299ddf251f7b958bd7495f4fd9cae4a

Download Submit
C:\Windows\jfvrnizwlhaqbdlxdhfb.exe

Filesize
1016KB

MD5
6b56a1712fd79a0e804686fc741233a0

SHA1
19db5f81ac96bc6d66aa1c47e06412c6c59a9710

SHA256
5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19

SHA512
8503c62c9d9d6f1eeb1b9a7347776fd5355e87c65fa3f5faba78f2a6466b383b8f00a1bfa22d89e929689911338c25eac299ddf251f7b958bd7495f4fd9cae4a

Download Submit
C:\Windows\lftnhapkxriwfflvzb.exe

Filesize
1016KB

MD5
6b56a1712fd79a0e804686fc741233a0

SHA1
19db5f81ac96bc6d66aa1c47e06412c6c59a9710

SHA256
5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19

SHA512
8503c62c9d9d6f1eeb1b9a7347776fd5355e87c65fa3f5faba78f2a6466b383b8f00a1bfa22d89e929689911338c25eac299ddf251f7b958bd7495f4fd9cae4a

Download Submit
C:\Windows\lftnhapkxriwfflvzb.exe

Filesize
1016KB

MD5
6b56a1712fd79a0e804686fc741233a0

SHA1
19db5f81ac96bc6d66aa1c47e06412c6c59a9710

SHA256
5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19

SHA512
8503c62c9d9d6f1eeb1b9a7347776fd5355e87c65fa3f5faba78f2a6466b383b8f00a1bfa22d89e929689911338c25eac299ddf251f7b958bd7495f4fd9cae4a

Download Submit
C:\Windows\lftnhapkxriwfflvzb.exe

Filesize
1016KB

MD5
6b56a1712fd79a0e804686fc741233a0

SHA1
19db5f81ac96bc6d66aa1c47e06412c6c59a9710

SHA256
5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19

SHA512
8503c62c9d9d6f1eeb1b9a7347776fd5355e87c65fa3f5faba78f2a6466b383b8f00a1bfa22d89e929689911338c25eac299ddf251f7b958bd7495f4fd9cae4a

Download Submit
C:\Windows\pnfdbyrqhfasfjthpvvtlj.exe

Filesize
1016KB

MD5
6b56a1712fd79a0e804686fc741233a0

SHA1
19db5f81ac96bc6d66aa1c47e06412c6c59a9710

SHA256
5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19

SHA512
8503c62c9d9d6f1eeb1b9a7347776fd5355e87c65fa3f5faba78f2a6466b383b8f00a1bfa22d89e929689911338c25eac299ddf251f7b958bd7495f4fd9cae4a

Download Submit
C:\Windows\pnfdbyrqhfasfjthpvvtlj.exe

Filesize
1016KB

MD5
6b56a1712fd79a0e804686fc741233a0

SHA1
19db5f81ac96bc6d66aa1c47e06412c6c59a9710

SHA256
5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19

SHA512
8503c62c9d9d6f1eeb1b9a7347776fd5355e87c65fa3f5faba78f2a6466b383b8f00a1bfa22d89e929689911338c25eac299ddf251f7b958bd7495f4fd9cae4a

Download Submit
C:\Windows\pnfdbyrqhfasfjthpvvtlj.exe

Filesize
1016KB

MD5
6b56a1712fd79a0e804686fc741233a0

SHA1
19db5f81ac96bc6d66aa1c47e06412c6c59a9710

SHA256
5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19

SHA512
8503c62c9d9d6f1eeb1b9a7347776fd5355e87c65fa3f5faba78f2a6466b383b8f00a1bfa22d89e929689911338c25eac299ddf251f7b958bd7495f4fd9cae4a

Download Submit
C:\Windows\vnzrjangrjykrptb.exe

Filesize
1016KB

MD5
6b56a1712fd79a0e804686fc741233a0

SHA1
19db5f81ac96bc6d66aa1c47e06412c6c59a9710

SHA256
5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19

SHA512
8503c62c9d9d6f1eeb1b9a7347776fd5355e87c65fa3f5faba78f2a6466b383b8f00a1bfa22d89e929689911338c25eac299ddf251f7b958bd7495f4fd9cae4a

Download Submit
C:\Windows\vnzrjangrjykrptb.exe

Filesize
1016KB

MD5
6b56a1712fd79a0e804686fc741233a0

SHA1
19db5f81ac96bc6d66aa1c47e06412c6c59a9710

SHA256
5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19

SHA512
8503c62c9d9d6f1eeb1b9a7347776fd5355e87c65fa3f5faba78f2a6466b383b8f00a1bfa22d89e929689911338c25eac299ddf251f7b958bd7495f4fd9cae4a

Download Submit
C:\Windows\vnzrjangrjykrptb.exe

Filesize
1016KB

MD5
6b56a1712fd79a0e804686fc741233a0

SHA1
19db5f81ac96bc6d66aa1c47e06412c6c59a9710

SHA256
5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19

SHA512
8503c62c9d9d6f1eeb1b9a7347776fd5355e87c65fa3f5faba78f2a6466b383b8f00a1bfa22d89e929689911338c25eac299ddf251f7b958bd7495f4fd9cae4a

Download Submit
C:\Windows\wrgbwqgcqldscdkvada.exe

Filesize
1016KB

MD5
6b56a1712fd79a0e804686fc741233a0

SHA1
19db5f81ac96bc6d66aa1c47e06412c6c59a9710

SHA256
5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19

SHA512
8503c62c9d9d6f1eeb1b9a7347776fd5355e87c65fa3f5faba78f2a6466b383b8f00a1bfa22d89e929689911338c25eac299ddf251f7b958bd7495f4fd9cae4a

Download Submit
C:\Windows\wrgbwqgcqldscdkvada.exe

Filesize
1016KB

MD5
6b56a1712fd79a0e804686fc741233a0

SHA1
19db5f81ac96bc6d66aa1c47e06412c6c59a9710

SHA256
5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19

SHA512
8503c62c9d9d6f1eeb1b9a7347776fd5355e87c65fa3f5faba78f2a6466b383b8f00a1bfa22d89e929689911338c25eac299ddf251f7b958bd7495f4fd9cae4a

Download Submit
C:\Windows\wrgbwqgcqldscdkvada.exe

Filesize
1016KB

MD5
6b56a1712fd79a0e804686fc741233a0

SHA1
19db5f81ac96bc6d66aa1c47e06412c6c59a9710

SHA256
5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19

SHA512
8503c62c9d9d6f1eeb1b9a7347776fd5355e87c65fa3f5faba78f2a6466b383b8f00a1bfa22d89e929689911338c25eac299ddf251f7b958bd7495f4fd9cae4a

Download Submit
C:\Windows\yvmjgcusifzqcfobinmja.exe

Filesize
1016KB

MD5
6b56a1712fd79a0e804686fc741233a0

SHA1
19db5f81ac96bc6d66aa1c47e06412c6c59a9710

SHA256
5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19

SHA512
8503c62c9d9d6f1eeb1b9a7347776fd5355e87c65fa3f5faba78f2a6466b383b8f00a1bfa22d89e929689911338c25eac299ddf251f7b958bd7495f4fd9cae4a

Download Submit
C:\Windows\yvmjgcusifzqcfobinmja.exe

Filesize
1016KB

MD5
6b56a1712fd79a0e804686fc741233a0

SHA1
19db5f81ac96bc6d66aa1c47e06412c6c59a9710

SHA256
5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19

SHA512
8503c62c9d9d6f1eeb1b9a7347776fd5355e87c65fa3f5faba78f2a6466b383b8f00a1bfa22d89e929689911338c25eac299ddf251f7b958bd7495f4fd9cae4a

Download Submit
C:\Windows\yvmjgcusifzqcfobinmja.exe

Filesize
1016KB

MD5
6b56a1712fd79a0e804686fc741233a0

SHA1
19db5f81ac96bc6d66aa1c47e06412c6c59a9710

SHA256
5df7d55896c2de3ab2b9965b4289363b88440eb1d9d02ff79f0294a56ddf2d19

SHA512
8503c62c9d9d6f1eeb1b9a7347776fd5355e87c65fa3f5faba78f2a6466b383b8f00a1bfa22d89e929689911338c25eac299ddf251f7b958bd7495f4fd9cae4a

Download Submit