8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5

Analysis

max time kernel
60s
max time network
61s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2022 08:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe
Size

1016KB
MD5

72b5bde90f2196e493674f72560bcfe0
SHA1

a6b1f9554e3ec42e3f08ed2a67cecb2d488f5053
SHA256

8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5
SHA512

e8ccd05744ab202d3e6a7609f224c0273b443a44e1dd915a2066d10a94b453f944a333703376d44339ee1e9e9a7de06731b461903ebed3e63c6e1bba20777d23
SSDEEP

6144:yIXsL0tvrSVz1DnemeYbpsnEf78AoXh6KkiD0OofzA+/VygHU:yIXsgtvm1De5YlOx6lzBH46U

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	hkaqkpraruk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	irxcko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	irxcko.exe

UAC bypass 3 TTPs 12 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	irxcko.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	irxcko.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	irxcko.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	irxcko.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	irxcko.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	irxcko.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	irxcko.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	irxcko.exe

Adds policy Run key to start application 2 TTPs 14 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mbnymwhyfruy = "ifzsogzynhsedcfteweb.exe"	irxcko.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	hkaqkpraruk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bnwepwesw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\undskynitjqytonx.exe"	irxcko.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	irxcko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bnwepwesw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\undskynitjqytonx.exe"	irxcko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bnwepwesw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bvmcvkawizhqmiitb.exe"	irxcko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bnwepwesw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vrkcxogeslvgecerbsz.exe"	hkaqkpraruk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mbnymwhyfruy = "xvqkhauukfreeeixjclje.exe"	irxcko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mbnymwhyfruy = "kfxoiypmzrakhefraq.exe"	irxcko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bnwepwesw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kfxoiypmzrakhefraq.exe"	irxcko.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	irxcko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mbnymwhyfruy = "vrkcxogeslvgecerbsz.exe"	irxcko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mbnymwhyfruy = "bvmcvkawizhqmiitb.exe"	hkaqkpraruk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bnwepwesw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ifzsogzynhsedcfteweb.exe"	irxcko.exe

Disables RegEdit via registry modification 6 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	hkaqkpraruk.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	irxcko.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	irxcko.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	irxcko.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	irxcko.exe

Executes dropped EXE 3 IoCs

pid	Process
384	hkaqkpraruk.exe
1824	irxcko.exe
1876	irxcko.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	hkaqkpraruk.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pdoylueualn = "xvqkhauukfreeeixjclje.exe ."	irxcko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\undskynitjqytonx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vrkcxogeslvgecerbsz.exe"	irxcko.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\mdreugtmvjoung = "kfxoiypmzrakhefraq.exe ."	hkaqkpraruk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\mdreugtmvjoung = "ifzsogzynhsedcfteweb.exe ."	hkaqkpraruk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lboapamemzdia = "kfxoiypmzrakhefraq.exe"	irxcko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\undskynitjqytonx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bvmcvkawizhqmiitb.exe"	hkaqkpraruk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\pdoylueualn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\undskynitjqytonx.exe ."	irxcko.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\uhramudsxh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xvqkhauukfreeeixjclje.exe"	irxcko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\uhramudsxh = "kfxoiypmzrakhefraq.exe"	hkaqkpraruk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\mdreugtmvjoung = "bvmcvkawizhqmiitb.exe ."	irxcko.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\uhramudsxh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kfxoiypmzrakhefraq.exe"	irxcko.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\mdreugtmvjoung = "xvqkhauukfreeeixjclje.exe ."	irxcko.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	hkaqkpraruk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\mdreugtmvjoung = "kfxoiypmzrakhefraq.exe ."	irxcko.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\uhramudsxh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ifzsogzynhsedcfteweb.exe"	irxcko.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\pdoylueualn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xvqkhauukfreeeixjclje.exe ."	irxcko.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\pdoylueualn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vrkcxogeslvgecerbsz.exe ."	irxcko.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\pdoylueualn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vrkcxogeslvgecerbsz.exe ."	hkaqkpraruk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	irxcko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\phwkbocwgvbicwu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vrkcxogeslvgecerbsz.exe ."	hkaqkpraruk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	irxcko.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\mdreugtmvjoung = "xvqkhauukfreeeixjclje.exe ."	irxcko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\undskynitjqytonx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xvqkhauukfreeeixjclje.exe"	irxcko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\phwkbocwgvbicwu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vrkcxogeslvgecerbsz.exe ."	irxcko.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\pdoylueualn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\undskynitjqytonx.exe ."	irxcko.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\mdreugtmvjoung = "vrkcxogeslvgecerbsz.exe ."	irxcko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\undskynitjqytonx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kfxoiypmzrakhefraq.exe"	irxcko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\uhramudsxh = "ifzsogzynhsedcfteweb.exe"	irxcko.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	hkaqkpraruk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\undskynitjqytonx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\undskynitjqytonx.exe"	hkaqkpraruk.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	irxcko.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\uhramudsxh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ifzsogzynhsedcfteweb.exe"	irxcko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\phwkbocwgvbicwu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xvqkhauukfreeeixjclje.exe ."	hkaqkpraruk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\mdreugtmvjoung = "undskynitjqytonx.exe ."	irxcko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\undskynitjqytonx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ifzsogzynhsedcfteweb.exe"	irxcko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\uhramudsxh = "bvmcvkawizhqmiitb.exe"	irxcko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pdoylueualn = "vrkcxogeslvgecerbsz.exe ."	irxcko.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lboapamemzdia = "ifzsogzynhsedcfteweb.exe"	irxcko.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lboapamemzdia = "undskynitjqytonx.exe"	irxcko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pdoylueualn = "xvqkhauukfreeeixjclje.exe ."	irxcko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\phwkbocwgvbicwu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xvqkhauukfreeeixjclje.exe ."	irxcko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\uhramudsxh = "xvqkhauukfreeeixjclje.exe"	hkaqkpraruk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pdoylueualn = "ifzsogzynhsedcfteweb.exe ."	hkaqkpraruk.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	hkaqkpraruk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\uhramudsxh = "vrkcxogeslvgecerbsz.exe"	irxcko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\uhramudsxh = "bvmcvkawizhqmiitb.exe"	irxcko.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lboapamemzdia = "bvmcvkawizhqmiitb.exe"	irxcko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pdoylueualn = "bvmcvkawizhqmiitb.exe ."	irxcko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\phwkbocwgvbicwu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\undskynitjqytonx.exe ."	irxcko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pdoylueualn = "ifzsogzynhsedcfteweb.exe ."	irxcko.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	irxcko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\undskynitjqytonx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bvmcvkawizhqmiitb.exe"	irxcko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\phwkbocwgvbicwu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xvqkhauukfreeeixjclje.exe ."	irxcko.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\pdoylueualn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vrkcxogeslvgecerbsz.exe ."	irxcko.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	irxcko.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pdoylueualn = "ifzsogzynhsedcfteweb.exe ."	irxcko.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	hkaqkpraruk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pdoylueualn = "bvmcvkawizhqmiitb.exe ."	hkaqkpraruk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	irxcko.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	irxcko.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\uhramudsxh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vrkcxogeslvgecerbsz.exe"	irxcko.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lboapamemzdia = "xvqkhauukfreeeixjclje.exe"	hkaqkpraruk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\uhramudsxh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ifzsogzynhsedcfteweb.exe"	hkaqkpraruk.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	irxcko.exe

Checks whether UAC is enabled 1 TTPs 6 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	irxcko.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	irxcko.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	irxcko.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	hkaqkpraruk.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	irxcko.exe

Looks up external IP address via web service 6 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
28	whatismyip.everdot.org
29	www.showmyipaddress.com
32	whatismyip.everdot.org
36	whatismyip.everdot.org
14	whatismyip.everdot.org
21	whatismyipaddress.com

Drops file in System32 directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\ifzsogzynhsedcfteweb.exe	irxcko.exe
File opened for modification	C:\Windows\SysWOW64\xvqkhauukfreeeixjclje.exe	irxcko.exe
File created	C:\Windows\SysWOW64\uhramudsxhikzohlmusfpyksbqvfgixm.jks	irxcko.exe
File opened for modification	C:\Windows\SysWOW64\kfxoiypmzrakhefraq.exe	irxcko.exe
File opened for modification	C:\Windows\SysWOW64\kfxoiypmzrakhefraq.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\SysWOW64\ifzsogzynhsedcfteweb.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\SysWOW64\xvqkhauukfreeeixjclje.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\SysWOW64\bvmcvkawizhqmiitb.exe	irxcko.exe
File opened for modification	C:\Windows\SysWOW64\vrkcxogeslvgecerbsz.exe	irxcko.exe
File opened for modification	C:\Windows\SysWOW64\xvqkhauukfreeeixjclje.exe	irxcko.exe
File opened for modification	C:\Windows\SysWOW64\onjecwrsjfsghindqkutpk.exe	irxcko.exe
File opened for modification	C:\Windows\SysWOW64\zbayzwuysrhycgohxuhji.hec	irxcko.exe
File opened for modification	C:\Windows\SysWOW64\undskynitjqytonx.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\SysWOW64\bvmcvkawizhqmiitb.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\SysWOW64\onjecwrsjfsghindqkutpk.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\SysWOW64\bvmcvkawizhqmiitb.exe	irxcko.exe
File opened for modification	C:\Windows\SysWOW64\onjecwrsjfsghindqkutpk.exe	irxcko.exe
File opened for modification	C:\Windows\SysWOW64\undskynitjqytonx.exe	irxcko.exe
File opened for modification	C:\Windows\SysWOW64\ifzsogzynhsedcfteweb.exe	irxcko.exe
File created	C:\Windows\SysWOW64\zbayzwuysrhycgohxuhji.hec	irxcko.exe
File opened for modification	C:\Windows\SysWOW64\vrkcxogeslvgecerbsz.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\SysWOW64\undskynitjqytonx.exe	irxcko.exe
File opened for modification	C:\Windows\SysWOW64\kfxoiypmzrakhefraq.exe	irxcko.exe
File opened for modification	C:\Windows\SysWOW64\vrkcxogeslvgecerbsz.exe	irxcko.exe
File opened for modification	C:\Windows\SysWOW64\uhramudsxhikzohlmusfpyksbqvfgixm.jks	irxcko.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\zbayzwuysrhycgohxuhji.hec	irxcko.exe
File created	C:\Program Files (x86)\zbayzwuysrhycgohxuhji.hec	irxcko.exe
File opened for modification	C:\Program Files (x86)\uhramudsxhikzohlmusfpyksbqvfgixm.jks	irxcko.exe
File created	C:\Program Files (x86)\uhramudsxhikzohlmusfpyksbqvfgixm.jks	irxcko.exe

Drops file in Windows directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ifzsogzynhsedcfteweb.exe	irxcko.exe
File opened for modification	C:\Windows\xvqkhauukfreeeixjclje.exe	irxcko.exe
File opened for modification	C:\Windows\undskynitjqytonx.exe	irxcko.exe
File opened for modification	C:\Windows\kfxoiypmzrakhefraq.exe	irxcko.exe
File opened for modification	C:\Windows\xvqkhauukfreeeixjclje.exe	irxcko.exe
File opened for modification	C:\Windows\onjecwrsjfsghindqkutpk.exe	irxcko.exe
File opened for modification	C:\Windows\undskynitjqytonx.exe	irxcko.exe
File opened for modification	C:\Windows\vrkcxogeslvgecerbsz.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\bvmcvkawizhqmiitb.exe	irxcko.exe
File opened for modification	C:\Windows\uhramudsxhikzohlmusfpyksbqvfgixm.jks	irxcko.exe
File created	C:\Windows\uhramudsxhikzohlmusfpyksbqvfgixm.jks	irxcko.exe
File opened for modification	C:\Windows\kfxoiypmzrakhefraq.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\onjecwrsjfsghindqkutpk.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\bvmcvkawizhqmiitb.exe	irxcko.exe
File opened for modification	C:\Windows\kfxoiypmzrakhefraq.exe	irxcko.exe
File opened for modification	C:\Windows\vrkcxogeslvgecerbsz.exe	irxcko.exe
File opened for modification	C:\Windows\onjecwrsjfsghindqkutpk.exe	irxcko.exe
File opened for modification	C:\Windows\zbayzwuysrhycgohxuhji.hec	irxcko.exe
File created	C:\Windows\zbayzwuysrhycgohxuhji.hec	irxcko.exe
File opened for modification	C:\Windows\xvqkhauukfreeeixjclje.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\bvmcvkawizhqmiitb.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\ifzsogzynhsedcfteweb.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\vrkcxogeslvgecerbsz.exe	irxcko.exe
File opened for modification	C:\Windows\ifzsogzynhsedcfteweb.exe	irxcko.exe
File opened for modification	C:\Windows\undskynitjqytonx.exe	hkaqkpraruk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3172	8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe
3172	8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe
3172	8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe
3172	8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe
3172	8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe
3172	8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe
3172	8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe
3172	8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe
3172	8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe
3172	8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe
3172	8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe
3172	8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe
3172	8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe
3172	8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe
3172	8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe
3172	8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe
3172	8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe
3172	8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe
3172	8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe
3172	8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe
3172	8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe
3172	8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe
1824	irxcko.exe
1824	irxcko.exe
3172	8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe
3172	8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe
3172	8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe
3172	8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe
3172	8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe
3172	8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe
3172	8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe
3172	8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe
3172	8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe
3172	8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe
3172	8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe
3172	8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe
3172	8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe
3172	8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe
3172	8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe
3172	8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe
3172	8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe
3172	8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe
3172	8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe
3172	8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe
3172	8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe
3172	8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe
3172	8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe
3172	8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe
1824	irxcko.exe
1824	irxcko.exe
3172	8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe
3172	8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe
3172	8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe
3172	8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe
3172	8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe
3172	8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe
3172	8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe
3172	8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe
3172	8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe
3172	8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe
3172	8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe
3172	8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe
3172	8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe
3172	8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1824	irxcko.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3172 wrote to memory of 384	3172	8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe	81
PID 3172 wrote to memory of 384	3172	8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe	81
PID 3172 wrote to memory of 384	3172	8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe	81
PID 384 wrote to memory of 1824	384	hkaqkpraruk.exe	82
PID 384 wrote to memory of 1824	384	hkaqkpraruk.exe	82
PID 384 wrote to memory of 1824	384	hkaqkpraruk.exe	82
PID 384 wrote to memory of 1876	384	hkaqkpraruk.exe	83
PID 384 wrote to memory of 1876	384	hkaqkpraruk.exe	83
PID 384 wrote to memory of 1876	384	hkaqkpraruk.exe	83

System policy modification 1 TTPs 39 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	irxcko.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	irxcko.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	irxcko.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	irxcko.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	irxcko.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	irxcko.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	irxcko.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	irxcko.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	irxcko.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	irxcko.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	irxcko.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	irxcko.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	irxcko.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	irxcko.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	irxcko.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	irxcko.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	irxcko.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	irxcko.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	irxcko.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	irxcko.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	irxcko.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	irxcko.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	irxcko.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	irxcko.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	irxcko.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	irxcko.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	hkaqkpraruk.exe

C:\Users\Admin\AppData\Local\Temp\8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe
"C:\Users\Admin\AppData\Local\Temp\8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3172
- C:\Users\Admin\AppData\Local\Temp\hkaqkpraruk.exe
  "C:\Users\Admin\AppData\Local\Temp\hkaqkpraruk.exe" "c:\users\admin\appdata\local\temp\8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5.exe*"
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Adds policy Run key to start application
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Checks computer location settings
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:384
- - C:\Users\Admin\AppData\Local\Temp\irxcko.exe
    "C:\Users\Admin\AppData\Local\Temp\irxcko.exe" "-C:\Users\Admin\AppData\Local\Temp\undskynitjqytonx.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - System policy modification
    PID:1824
- - C:\Users\Admin\AppData\Local\Temp\irxcko.exe
    "C:\Users\Admin\AppData\Local\Temp\irxcko.exe" "-C:\Users\Admin\AppData\Local\Temp\undskynitjqytonx.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System policy modification
    PID:1876

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bvmcvkawizhqmiitb.exe

Filesize
1016KB

MD5
72b5bde90f2196e493674f72560bcfe0

SHA1
a6b1f9554e3ec42e3f08ed2a67cecb2d488f5053

SHA256
8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5

SHA512
e8ccd05744ab202d3e6a7609f224c0273b443a44e1dd915a2066d10a94b453f944a333703376d44339ee1e9e9a7de06731b461903ebed3e63c6e1bba20777d23

Download Submit
C:\Users\Admin\AppData\Local\Temp\hkaqkpraruk.exe

Filesize
320KB

MD5
7008640450c4c0383d449a2168a03ab2

SHA1
4f9616a261e07177f1d76fa1c4219848e92db679

SHA256
3693b39a77090da8c5b6ef737d8e7aa91d550a174d8253ad7cd0a00909131d8f

SHA512
55171c2d2fb7b8299e2148e216cc2238b1e3c05a6b45422ca5069a2fdaeabe1fed4214c558fee40c5ac49042e92582e86ae35421d9686010358cdf7f748dc86e

Download Submit
C:\Users\Admin\AppData\Local\Temp\hkaqkpraruk.exe

Filesize
320KB

MD5
7008640450c4c0383d449a2168a03ab2

SHA1
4f9616a261e07177f1d76fa1c4219848e92db679

SHA256
3693b39a77090da8c5b6ef737d8e7aa91d550a174d8253ad7cd0a00909131d8f

SHA512
55171c2d2fb7b8299e2148e216cc2238b1e3c05a6b45422ca5069a2fdaeabe1fed4214c558fee40c5ac49042e92582e86ae35421d9686010358cdf7f748dc86e

Download Submit
C:\Users\Admin\AppData\Local\Temp\ifzsogzynhsedcfteweb.exe

Filesize
1016KB

MD5
72b5bde90f2196e493674f72560bcfe0

SHA1
a6b1f9554e3ec42e3f08ed2a67cecb2d488f5053

SHA256
8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5

SHA512
e8ccd05744ab202d3e6a7609f224c0273b443a44e1dd915a2066d10a94b453f944a333703376d44339ee1e9e9a7de06731b461903ebed3e63c6e1bba20777d23

Download Submit
C:\Users\Admin\AppData\Local\Temp\irxcko.exe

Filesize
712KB

MD5
237b27acbaa1421bb2542739dc803661

SHA1
da3776adc9e36eb5242cc3cfa7e11ecf94b62b7b

SHA256
de9a301e7e9d9f5e4c5e9bfff868b7cff905ad80f4397647725c57d9a102c179

SHA512
54ebde4b92ede348f1c120a5c31c5b89fb88552ae4cd75a2daa2c40d7e586150be655426cef7cf199814b853aeedb4568f277e1b4bd315d4b37234e96d971776

Download Submit
C:\Users\Admin\AppData\Local\Temp\irxcko.exe

Filesize
712KB

MD5
237b27acbaa1421bb2542739dc803661

SHA1
da3776adc9e36eb5242cc3cfa7e11ecf94b62b7b

SHA256
de9a301e7e9d9f5e4c5e9bfff868b7cff905ad80f4397647725c57d9a102c179

SHA512
54ebde4b92ede348f1c120a5c31c5b89fb88552ae4cd75a2daa2c40d7e586150be655426cef7cf199814b853aeedb4568f277e1b4bd315d4b37234e96d971776

Download Submit
C:\Users\Admin\AppData\Local\Temp\irxcko.exe

Filesize
712KB

MD5
237b27acbaa1421bb2542739dc803661

SHA1
da3776adc9e36eb5242cc3cfa7e11ecf94b62b7b

SHA256
de9a301e7e9d9f5e4c5e9bfff868b7cff905ad80f4397647725c57d9a102c179

SHA512
54ebde4b92ede348f1c120a5c31c5b89fb88552ae4cd75a2daa2c40d7e586150be655426cef7cf199814b853aeedb4568f277e1b4bd315d4b37234e96d971776

Download Submit
C:\Users\Admin\AppData\Local\Temp\kfxoiypmzrakhefraq.exe

Filesize
1016KB

MD5
72b5bde90f2196e493674f72560bcfe0

SHA1
a6b1f9554e3ec42e3f08ed2a67cecb2d488f5053

SHA256
8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5

SHA512
e8ccd05744ab202d3e6a7609f224c0273b443a44e1dd915a2066d10a94b453f944a333703376d44339ee1e9e9a7de06731b461903ebed3e63c6e1bba20777d23

Download Submit
C:\Users\Admin\AppData\Local\Temp\onjecwrsjfsghindqkutpk.exe

Filesize
1016KB

MD5
72b5bde90f2196e493674f72560bcfe0

SHA1
a6b1f9554e3ec42e3f08ed2a67cecb2d488f5053

SHA256
8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5

SHA512
e8ccd05744ab202d3e6a7609f224c0273b443a44e1dd915a2066d10a94b453f944a333703376d44339ee1e9e9a7de06731b461903ebed3e63c6e1bba20777d23

Download Submit
C:\Users\Admin\AppData\Local\Temp\undskynitjqytonx.exe

Filesize
1016KB

MD5
72b5bde90f2196e493674f72560bcfe0

SHA1
a6b1f9554e3ec42e3f08ed2a67cecb2d488f5053

SHA256
8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5

SHA512
e8ccd05744ab202d3e6a7609f224c0273b443a44e1dd915a2066d10a94b453f944a333703376d44339ee1e9e9a7de06731b461903ebed3e63c6e1bba20777d23

Download Submit
C:\Users\Admin\AppData\Local\Temp\vrkcxogeslvgecerbsz.exe

Filesize
1016KB

MD5
72b5bde90f2196e493674f72560bcfe0

SHA1
a6b1f9554e3ec42e3f08ed2a67cecb2d488f5053

SHA256
8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5

SHA512
e8ccd05744ab202d3e6a7609f224c0273b443a44e1dd915a2066d10a94b453f944a333703376d44339ee1e9e9a7de06731b461903ebed3e63c6e1bba20777d23

Download Submit
C:\Users\Admin\AppData\Local\Temp\xvqkhauukfreeeixjclje.exe

Filesize
1016KB

MD5
72b5bde90f2196e493674f72560bcfe0

SHA1
a6b1f9554e3ec42e3f08ed2a67cecb2d488f5053

SHA256
8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5

SHA512
e8ccd05744ab202d3e6a7609f224c0273b443a44e1dd915a2066d10a94b453f944a333703376d44339ee1e9e9a7de06731b461903ebed3e63c6e1bba20777d23

Download Submit
C:\Windows\SysWOW64\bvmcvkawizhqmiitb.exe

Filesize
1016KB

MD5
72b5bde90f2196e493674f72560bcfe0

SHA1
a6b1f9554e3ec42e3f08ed2a67cecb2d488f5053

SHA256
8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5

SHA512
e8ccd05744ab202d3e6a7609f224c0273b443a44e1dd915a2066d10a94b453f944a333703376d44339ee1e9e9a7de06731b461903ebed3e63c6e1bba20777d23

Download Submit
C:\Windows\SysWOW64\ifzsogzynhsedcfteweb.exe

Filesize
1016KB

MD5
72b5bde90f2196e493674f72560bcfe0

SHA1
a6b1f9554e3ec42e3f08ed2a67cecb2d488f5053

SHA256
8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5

SHA512
e8ccd05744ab202d3e6a7609f224c0273b443a44e1dd915a2066d10a94b453f944a333703376d44339ee1e9e9a7de06731b461903ebed3e63c6e1bba20777d23

Download Submit
C:\Windows\SysWOW64\kfxoiypmzrakhefraq.exe

Filesize
1016KB

MD5
72b5bde90f2196e493674f72560bcfe0

SHA1
a6b1f9554e3ec42e3f08ed2a67cecb2d488f5053

SHA256
8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5

SHA512
e8ccd05744ab202d3e6a7609f224c0273b443a44e1dd915a2066d10a94b453f944a333703376d44339ee1e9e9a7de06731b461903ebed3e63c6e1bba20777d23

Download Submit
C:\Windows\SysWOW64\onjecwrsjfsghindqkutpk.exe

Filesize
1016KB

MD5
72b5bde90f2196e493674f72560bcfe0

SHA1
a6b1f9554e3ec42e3f08ed2a67cecb2d488f5053

SHA256
8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5

SHA512
e8ccd05744ab202d3e6a7609f224c0273b443a44e1dd915a2066d10a94b453f944a333703376d44339ee1e9e9a7de06731b461903ebed3e63c6e1bba20777d23

Download Submit
C:\Windows\SysWOW64\undskynitjqytonx.exe

Filesize
1016KB

MD5
72b5bde90f2196e493674f72560bcfe0

SHA1
a6b1f9554e3ec42e3f08ed2a67cecb2d488f5053

SHA256
8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5

SHA512
e8ccd05744ab202d3e6a7609f224c0273b443a44e1dd915a2066d10a94b453f944a333703376d44339ee1e9e9a7de06731b461903ebed3e63c6e1bba20777d23

Download Submit
C:\Windows\SysWOW64\vrkcxogeslvgecerbsz.exe

Filesize
1016KB

MD5
72b5bde90f2196e493674f72560bcfe0

SHA1
a6b1f9554e3ec42e3f08ed2a67cecb2d488f5053

SHA256
8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5

SHA512
e8ccd05744ab202d3e6a7609f224c0273b443a44e1dd915a2066d10a94b453f944a333703376d44339ee1e9e9a7de06731b461903ebed3e63c6e1bba20777d23

Download Submit
C:\Windows\SysWOW64\xvqkhauukfreeeixjclje.exe

Filesize
1016KB

MD5
72b5bde90f2196e493674f72560bcfe0

SHA1
a6b1f9554e3ec42e3f08ed2a67cecb2d488f5053

SHA256
8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5

SHA512
e8ccd05744ab202d3e6a7609f224c0273b443a44e1dd915a2066d10a94b453f944a333703376d44339ee1e9e9a7de06731b461903ebed3e63c6e1bba20777d23

Download Submit
C:\Windows\bvmcvkawizhqmiitb.exe

Filesize
1016KB

MD5
72b5bde90f2196e493674f72560bcfe0

SHA1
a6b1f9554e3ec42e3f08ed2a67cecb2d488f5053

SHA256
8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5

SHA512
e8ccd05744ab202d3e6a7609f224c0273b443a44e1dd915a2066d10a94b453f944a333703376d44339ee1e9e9a7de06731b461903ebed3e63c6e1bba20777d23

Download Submit
C:\Windows\bvmcvkawizhqmiitb.exe

Filesize
1016KB

MD5
72b5bde90f2196e493674f72560bcfe0

SHA1
a6b1f9554e3ec42e3f08ed2a67cecb2d488f5053

SHA256
8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5

SHA512
e8ccd05744ab202d3e6a7609f224c0273b443a44e1dd915a2066d10a94b453f944a333703376d44339ee1e9e9a7de06731b461903ebed3e63c6e1bba20777d23

Download Submit
C:\Windows\ifzsogzynhsedcfteweb.exe

Filesize
1016KB

MD5
72b5bde90f2196e493674f72560bcfe0

SHA1
a6b1f9554e3ec42e3f08ed2a67cecb2d488f5053

SHA256
8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5

SHA512
e8ccd05744ab202d3e6a7609f224c0273b443a44e1dd915a2066d10a94b453f944a333703376d44339ee1e9e9a7de06731b461903ebed3e63c6e1bba20777d23

Download Submit
C:\Windows\ifzsogzynhsedcfteweb.exe

Filesize
1016KB

MD5
72b5bde90f2196e493674f72560bcfe0

SHA1
a6b1f9554e3ec42e3f08ed2a67cecb2d488f5053

SHA256
8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5

SHA512
e8ccd05744ab202d3e6a7609f224c0273b443a44e1dd915a2066d10a94b453f944a333703376d44339ee1e9e9a7de06731b461903ebed3e63c6e1bba20777d23

Download Submit
C:\Windows\kfxoiypmzrakhefraq.exe

Filesize
1016KB

MD5
72b5bde90f2196e493674f72560bcfe0

SHA1
a6b1f9554e3ec42e3f08ed2a67cecb2d488f5053

SHA256
8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5

SHA512
e8ccd05744ab202d3e6a7609f224c0273b443a44e1dd915a2066d10a94b453f944a333703376d44339ee1e9e9a7de06731b461903ebed3e63c6e1bba20777d23

Download Submit
C:\Windows\kfxoiypmzrakhefraq.exe

Filesize
1016KB

MD5
72b5bde90f2196e493674f72560bcfe0

SHA1
a6b1f9554e3ec42e3f08ed2a67cecb2d488f5053

SHA256
8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5

SHA512
e8ccd05744ab202d3e6a7609f224c0273b443a44e1dd915a2066d10a94b453f944a333703376d44339ee1e9e9a7de06731b461903ebed3e63c6e1bba20777d23

Download Submit
C:\Windows\onjecwrsjfsghindqkutpk.exe

Filesize
1016KB

MD5
72b5bde90f2196e493674f72560bcfe0

SHA1
a6b1f9554e3ec42e3f08ed2a67cecb2d488f5053

SHA256
8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5

SHA512
e8ccd05744ab202d3e6a7609f224c0273b443a44e1dd915a2066d10a94b453f944a333703376d44339ee1e9e9a7de06731b461903ebed3e63c6e1bba20777d23

Download Submit
C:\Windows\onjecwrsjfsghindqkutpk.exe

Filesize
1016KB

MD5
72b5bde90f2196e493674f72560bcfe0

SHA1
a6b1f9554e3ec42e3f08ed2a67cecb2d488f5053

SHA256
8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5

SHA512
e8ccd05744ab202d3e6a7609f224c0273b443a44e1dd915a2066d10a94b453f944a333703376d44339ee1e9e9a7de06731b461903ebed3e63c6e1bba20777d23

Download Submit
C:\Windows\undskynitjqytonx.exe

Filesize
1016KB

MD5
72b5bde90f2196e493674f72560bcfe0

SHA1
a6b1f9554e3ec42e3f08ed2a67cecb2d488f5053

SHA256
8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5

SHA512
e8ccd05744ab202d3e6a7609f224c0273b443a44e1dd915a2066d10a94b453f944a333703376d44339ee1e9e9a7de06731b461903ebed3e63c6e1bba20777d23

Download Submit
C:\Windows\undskynitjqytonx.exe

Filesize
1016KB

MD5
72b5bde90f2196e493674f72560bcfe0

SHA1
a6b1f9554e3ec42e3f08ed2a67cecb2d488f5053

SHA256
8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5

SHA512
e8ccd05744ab202d3e6a7609f224c0273b443a44e1dd915a2066d10a94b453f944a333703376d44339ee1e9e9a7de06731b461903ebed3e63c6e1bba20777d23

Download Submit
C:\Windows\vrkcxogeslvgecerbsz.exe

Filesize
1016KB

MD5
72b5bde90f2196e493674f72560bcfe0

SHA1
a6b1f9554e3ec42e3f08ed2a67cecb2d488f5053

SHA256
8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5

SHA512
e8ccd05744ab202d3e6a7609f224c0273b443a44e1dd915a2066d10a94b453f944a333703376d44339ee1e9e9a7de06731b461903ebed3e63c6e1bba20777d23

Download Submit
C:\Windows\vrkcxogeslvgecerbsz.exe

Filesize
1016KB

MD5
72b5bde90f2196e493674f72560bcfe0

SHA1
a6b1f9554e3ec42e3f08ed2a67cecb2d488f5053

SHA256
8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5

SHA512
e8ccd05744ab202d3e6a7609f224c0273b443a44e1dd915a2066d10a94b453f944a333703376d44339ee1e9e9a7de06731b461903ebed3e63c6e1bba20777d23

Download Submit
C:\Windows\xvqkhauukfreeeixjclje.exe

Filesize
1016KB

MD5
72b5bde90f2196e493674f72560bcfe0

SHA1
a6b1f9554e3ec42e3f08ed2a67cecb2d488f5053

SHA256
8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5

SHA512
e8ccd05744ab202d3e6a7609f224c0273b443a44e1dd915a2066d10a94b453f944a333703376d44339ee1e9e9a7de06731b461903ebed3e63c6e1bba20777d23

Download Submit
C:\Windows\xvqkhauukfreeeixjclje.exe

Filesize
1016KB

MD5
72b5bde90f2196e493674f72560bcfe0

SHA1
a6b1f9554e3ec42e3f08ed2a67cecb2d488f5053

SHA256
8592575dc544817d18545a0e71486d7b01497093870450d54528a7ada083c6d5

SHA512
e8ccd05744ab202d3e6a7609f224c0273b443a44e1dd915a2066d10a94b453f944a333703376d44339ee1e9e9a7de06731b461903ebed3e63c6e1bba20777d23

Download Submit