9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470

Analysis

max time kernel
151s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-10-2022 07:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe
Size

1016KB
MD5

62b2e0d8bd5b0380d5ccb843196df2d0
SHA1

c6beb82fae4fb229c6c3de4a20f9324ebc4d1a09
SHA256

9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470
SHA512

20c6f2f0546d619a2118948ec3ac01774afb0bd976af70fe3e99ed2142923f5ad60e5dd63be611cc00426cdf9d6acca4809b2d36c79878a6dd5e953c70a34e07
SSDEEP

6144:XIXsL0tvrSVz1DnemeYbpsnEf78AoXh6KkiD0OofzA+/VygHU:XIXsgtvm1De5YlOx6lzBH46U

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	hkaqkpraruk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	bghrs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	bghrs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	hkaqkpraruk.exe

UAC bypass 3 TTPs 13 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	bghrs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	bghrs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	bghrs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	bghrs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	bghrs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	bghrs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	bghrs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	bghrs.exe

Adds policy Run key to start application 2 TTPs 28 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\yiodjtdpuf = "mgwvlfzvkfsedcftewic.exe"	hkaqkpraruk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zgjvyfm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bwnnezurhdreeeixjcpkb.exe"	bghrs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zgjvyfm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mgwvlfzvkfsedcftewic.exe"	bghrs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	hkaqkpraruk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\yiodjtdpuf = "ogurfxpjwpakhefraq.exe"	bghrs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zgjvyfm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bwnnezurhdreeeixjcpkb.exe"	hkaqkpraruk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zgjvyfm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zshfungbpjvgecerbsd.exe"	hkaqkpraruk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	bghrs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zgjvyfm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ogurfxpjwpakhefraq.exe"	bghrs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zgjvyfm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bwnnezurhdreeeixjcpkb.exe"	bghrs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zgjvyfm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zshfungbpjvgecerbsd.exe"	bghrs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	hkaqkpraruk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\yiodjtdpuf = "zshfungbpjvgecerbsd.exe"	hkaqkpraruk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	bghrs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\yiodjtdpuf = "fwjfsjatfxhqmiitb.exe"	bghrs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zgjvyfm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fwjfsjatfxhqmiitb.exe"	bghrs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zgjvyfm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yoavhxnfqhqytonx.exe"	bghrs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\yiodjtdpuf = "yoavhxnfqhqytonx.exe"	bghrs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\yiodjtdpuf = "zshfungbpjvgecerbsd.exe"	bghrs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\yiodjtdpuf = "zshfungbpjvgecerbsd.exe"	bghrs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zgjvyfm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mgwvlfzvkfsedcftewic.exe"	bghrs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\yiodjtdpuf = "ogurfxpjwpakhefraq.exe"	hkaqkpraruk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\yiodjtdpuf = "yoavhxnfqhqytonx.exe"	bghrs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zgjvyfm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fwjfsjatfxhqmiitb.exe"	bghrs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\yiodjtdpuf = "mgwvlfzvkfsedcftewic.exe"	bghrs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zgjvyfm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ogurfxpjwpakhefraq.exe"	bghrs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zgjvyfm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zshfungbpjvgecerbsd.exe"	bghrs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\yiodjtdpuf = "fwjfsjatfxhqmiitb.exe"	bghrs.exe

Disables RegEdit via registry modification 6 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	hkaqkpraruk.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	bghrs.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	bghrs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	bghrs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	bghrs.exe

Executes dropped EXE 4 IoCs

pid	Process
4940	hkaqkpraruk.exe
224	bghrs.exe
5116	bghrs.exe
1464	hkaqkpraruk.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	hkaqkpraruk.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qeohrftjshoung = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bwnnezurhdreeeixjcpkb.exe"	bghrs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\fothmvept = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ogurfxpjwpakhefraq.exe ."	bghrs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\owanrzhr = "yoavhxnfqhqytonx.exe"	bghrs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\owanrzhr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mgwvlfzvkfsedcftewic.exe"	bghrs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qeohrftjshoung = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mgwvlfzvkfsedcftewic.exe"	bghrs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\fothmvept = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fwjfsjatfxhqmiitb.exe ."	bghrs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fothmvept = "ogurfxpjwpakhefraq.exe ."	bghrs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fothmvept = "mgwvlfzvkfsedcftewic.exe ."	bghrs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\owanrzhr = "fwjfsjatfxhqmiitb.exe"	bghrs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qeohrftjshoung = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bwnnezurhdreeeixjcpkb.exe"	bghrs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pcldmzmbjxdia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zshfungbpjvgecerbsd.exe ."	bghrs.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	hkaqkpraruk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pcldmzmbjxdia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mgwvlfzvkfsedcftewic.exe ."	bghrs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\fothmvept = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fwjfsjatfxhqmiitb.exe ."	bghrs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pcldmzmbjxdia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ogurfxpjwpakhefraq.exe ."	bghrs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	bghrs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\fothmvept = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fwjfsjatfxhqmiitb.exe ."	hkaqkpraruk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\owanrzhr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zshfungbpjvgecerbsd.exe"	bghrs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\fothmvept = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bwnnezurhdreeeixjcpkb.exe ."	bghrs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\owanrzhr = "ogurfxpjwpakhefraq.exe"	bghrs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fothmvept = "zshfungbpjvgecerbsd.exe ."	bghrs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	hkaqkpraruk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	hkaqkpraruk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fothmvept = "mgwvlfzvkfsedcftewic.exe ."	bghrs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\telbiterxjn = "bwnnezurhdreeeixjcpkb.exe"	bghrs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pcldmzmbjxdia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bwnnezurhdreeeixjcpkb.exe ."	bghrs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qeohrftjshoung = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fwjfsjatfxhqmiitb.exe"	hkaqkpraruk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\fothmvept = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bwnnezurhdreeeixjcpkb.exe ."	bghrs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	bghrs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\qckbjvhvcpuy = "yoavhxnfqhqytonx.exe ."	bghrs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fothmvept = "fwjfsjatfxhqmiitb.exe ."	bghrs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\owanrzhr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mgwvlfzvkfsedcftewic.exe"	hkaqkpraruk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\telbiterxjn = "fwjfsjatfxhqmiitb.exe"	bghrs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fothmvept = "yoavhxnfqhqytonx.exe ."	bghrs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\owanrzhr = "ogurfxpjwpakhefraq.exe"	hkaqkpraruk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\telbiterxjn = "fwjfsjatfxhqmiitb.exe"	hkaqkpraruk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pcldmzmbjxdia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bwnnezurhdreeeixjcpkb.exe ."	bghrs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\owanrzhr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fwjfsjatfxhqmiitb.exe"	bghrs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\fothmvept = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mgwvlfzvkfsedcftewic.exe ."	bghrs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	bghrs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\qckbjvhvcpuy = "ogurfxpjwpakhefraq.exe ."	bghrs.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	hkaqkpraruk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\qckbjvhvcpuy = "fwjfsjatfxhqmiitb.exe ."	bghrs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pcldmzmbjxdia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ogurfxpjwpakhefraq.exe ."	bghrs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fothmvept = "zshfungbpjvgecerbsd.exe ."	bghrs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qeohrftjshoung = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yoavhxnfqhqytonx.exe"	bghrs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\owanrzhr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fwjfsjatfxhqmiitb.exe"	bghrs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\owanrzhr = "zshfungbpjvgecerbsd.exe"	bghrs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\owanrzhr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ogurfxpjwpakhefraq.exe"	bghrs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\owanrzhr = "fwjfsjatfxhqmiitb.exe"	hkaqkpraruk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pcldmzmbjxdia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fwjfsjatfxhqmiitb.exe ."	hkaqkpraruk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pcldmzmbjxdia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mgwvlfzvkfsedcftewic.exe ."	hkaqkpraruk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\fothmvept = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fwjfsjatfxhqmiitb.exe ."	hkaqkpraruk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pcldmzmbjxdia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yoavhxnfqhqytonx.exe ."	bghrs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fothmvept = "bwnnezurhdreeeixjcpkb.exe ."	bghrs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fothmvept = "ogurfxpjwpakhefraq.exe ."	bghrs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\telbiterxjn = "zshfungbpjvgecerbsd.exe"	bghrs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\fothmvept = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mgwvlfzvkfsedcftewic.exe ."	bghrs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\owanrzhr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bwnnezurhdreeeixjcpkb.exe"	bghrs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\owanrzhr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mgwvlfzvkfsedcftewic.exe"	bghrs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fothmvept = "yoavhxnfqhqytonx.exe ."	hkaqkpraruk.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	bghrs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\owanrzhr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yoavhxnfqhqytonx.exe"	bghrs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\qckbjvhvcpuy = "bwnnezurhdreeeixjcpkb.exe ."	bghrs.exe

Checks whether UAC is enabled 1 TTPs 8 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	bghrs.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	bghrs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	bghrs.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	bghrs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	hkaqkpraruk.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	hkaqkpraruk.exe

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
16	www.showmyipaddress.com
18	whatismyipaddress.com
42	whatismyip.everdot.org
47	whatismyip.everdot.org

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\autorun.inf	bghrs.exe
File created	C:\autorun.inf	bghrs.exe

Drops file in System32 directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\bwnnezurhdreeeixjcpkb.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\SysWOW64\ogurfxpjwpakhefraq.exe	bghrs.exe
File opened for modification	C:\Windows\SysWOW64\zshfungbpjvgecerbsd.exe	bghrs.exe
File opened for modification	C:\Windows\SysWOW64\ccydzzzbwxqinsbvmkccyd.zzb	bghrs.exe
File opened for modification	C:\Windows\SysWOW64\ogurfxpjwpakhefraq.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\SysWOW64\zshfungbpjvgecerbsd.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\SysWOW64\yoavhxnfqhqytonx.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\SysWOW64\soghzvrpgdsghindqkyumn.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\SysWOW64\yoavhxnfqhqytonx.exe	bghrs.exe
File opened for modification	C:\Windows\SysWOW64\bwnnezurhdreeeixjcpkb.exe	bghrs.exe
File opened for modification	C:\Windows\SysWOW64\mgwvlfzvkfsedcftewic.exe	bghrs.exe
File opened for modification	C:\Windows\SysWOW64\ogurfxpjwpakhefraq.exe	bghrs.exe
File opened for modification	C:\Windows\SysWOW64\fwjfsjatfxhqmiitb.exe	bghrs.exe
File opened for modification	C:\Windows\SysWOW64\soghzvrpgdsghindqkyumn.exe	bghrs.exe
File opened for modification	C:\Windows\SysWOW64\yoavhxnfqhqytonx.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\SysWOW64\mgwvlfzvkfsedcftewic.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\SysWOW64\ogurfxpjwpakhefraq.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\SysWOW64\zshfungbpjvgecerbsd.exe	hkaqkpraruk.exe
File created	C:\Windows\SysWOW64\telbiterxjnqgwqvxgjubryjuhnzdgwmg.nwz	bghrs.exe
File opened for modification	C:\Windows\SysWOW64\soghzvrpgdsghindqkyumn.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\SysWOW64\mgwvlfzvkfsedcftewic.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\SysWOW64\fwjfsjatfxhqmiitb.exe	bghrs.exe
File opened for modification	C:\Windows\SysWOW64\zshfungbpjvgecerbsd.exe	bghrs.exe
File opened for modification	C:\Windows\SysWOW64\yoavhxnfqhqytonx.exe	bghrs.exe
File created	C:\Windows\SysWOW64\ccydzzzbwxqinsbvmkccyd.zzb	bghrs.exe
File opened for modification	C:\Windows\SysWOW64\bwnnezurhdreeeixjcpkb.exe	bghrs.exe
File opened for modification	C:\Windows\SysWOW64\telbiterxjnqgwqvxgjubryjuhnzdgwmg.nwz	bghrs.exe
File opened for modification	C:\Windows\SysWOW64\fwjfsjatfxhqmiitb.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\SysWOW64\mgwvlfzvkfsedcftewic.exe	bghrs.exe
File opened for modification	C:\Windows\SysWOW64\soghzvrpgdsghindqkyumn.exe	bghrs.exe
File opened for modification	C:\Windows\SysWOW64\fwjfsjatfxhqmiitb.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\SysWOW64\bwnnezurhdreeeixjcpkb.exe	hkaqkpraruk.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ccydzzzbwxqinsbvmkccyd.zzb	bghrs.exe
File opened for modification	C:\Program Files (x86)\telbiterxjnqgwqvxgjubryjuhnzdgwmg.nwz	bghrs.exe
File created	C:\Program Files (x86)\telbiterxjnqgwqvxgjubryjuhnzdgwmg.nwz	bghrs.exe
File opened for modification	C:\Program Files (x86)\ccydzzzbwxqinsbvmkccyd.zzb	bghrs.exe

Drops file in Windows directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Windows\fwjfsjatfxhqmiitb.exe	bghrs.exe
File opened for modification	C:\Windows\mgwvlfzvkfsedcftewic.exe	bghrs.exe
File opened for modification	C:\Windows\telbiterxjnqgwqvxgjubryjuhnzdgwmg.nwz	bghrs.exe
File opened for modification	C:\Windows\soghzvrpgdsghindqkyumn.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\bwnnezurhdreeeixjcpkb.exe	bghrs.exe
File created	C:\Windows\ccydzzzbwxqinsbvmkccyd.zzb	bghrs.exe
File opened for modification	C:\Windows\fwjfsjatfxhqmiitb.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\ogurfxpjwpakhefraq.exe	bghrs.exe
File opened for modification	C:\Windows\zshfungbpjvgecerbsd.exe	bghrs.exe
File opened for modification	C:\Windows\zshfungbpjvgecerbsd.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\mgwvlfzvkfsedcftewic.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\ccydzzzbwxqinsbvmkccyd.zzb	bghrs.exe
File opened for modification	C:\Windows\yoavhxnfqhqytonx.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\ogurfxpjwpakhefraq.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\bwnnezurhdreeeixjcpkb.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\yoavhxnfqhqytonx.exe	bghrs.exe
File opened for modification	C:\Windows\ogurfxpjwpakhefraq.exe	bghrs.exe
File opened for modification	C:\Windows\zshfungbpjvgecerbsd.exe	bghrs.exe
File opened for modification	C:\Windows\fwjfsjatfxhqmiitb.exe	bghrs.exe
File created	C:\Windows\telbiterxjnqgwqvxgjubryjuhnzdgwmg.nwz	bghrs.exe
File opened for modification	C:\Windows\ogurfxpjwpakhefraq.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\bwnnezurhdreeeixjcpkb.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\fwjfsjatfxhqmiitb.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\yoavhxnfqhqytonx.exe	bghrs.exe
File opened for modification	C:\Windows\bwnnezurhdreeeixjcpkb.exe	bghrs.exe
File opened for modification	C:\Windows\soghzvrpgdsghindqkyumn.exe	bghrs.exe
File opened for modification	C:\Windows\mgwvlfzvkfsedcftewic.exe	bghrs.exe
File opened for modification	C:\Windows\zshfungbpjvgecerbsd.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\mgwvlfzvkfsedcftewic.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\soghzvrpgdsghindqkyumn.exe	bghrs.exe
File opened for modification	C:\Windows\yoavhxnfqhqytonx.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\soghzvrpgdsghindqkyumn.exe	hkaqkpraruk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3716	9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe
3716	9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe
3716	9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe
3716	9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe
3716	9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe
3716	9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe
3716	9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe
3716	9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe
3716	9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe
3716	9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe
3716	9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe
3716	9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe
3716	9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe
3716	9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe
3716	9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe
3716	9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe
3716	9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe
3716	9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe
3716	9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe
3716	9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe
3716	9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe
3716	9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe
3716	9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe
3716	9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe
224	bghrs.exe
224	bghrs.exe
3716	9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe
3716	9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe
3716	9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe
3716	9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe
3716	9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe
3716	9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe
3716	9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe
3716	9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe
3716	9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe
3716	9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe
3716	9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe
3716	9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe
3716	9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe
3716	9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe
3716	9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe
3716	9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe
3716	9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe
3716	9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe
3716	9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe
3716	9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe
3716	9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe
3716	9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe
3716	9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe
3716	9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe
3716	9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe
3716	9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe
3716	9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe
3716	9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe
3716	9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe
3716	9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe
224	bghrs.exe
224	bghrs.exe
3716	9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe
3716	9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe
3716	9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe
3716	9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe
3716	9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe
3716	9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	224	bghrs.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3716 wrote to memory of 4940	3716	9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe	81
PID 3716 wrote to memory of 4940	3716	9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe	81
PID 3716 wrote to memory of 4940	3716	9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe	81
PID 4940 wrote to memory of 224	4940	hkaqkpraruk.exe	86
PID 4940 wrote to memory of 224	4940	hkaqkpraruk.exe	86
PID 4940 wrote to memory of 224	4940	hkaqkpraruk.exe	86
PID 4940 wrote to memory of 5116	4940	hkaqkpraruk.exe	87
PID 4940 wrote to memory of 5116	4940	hkaqkpraruk.exe	87
PID 4940 wrote to memory of 5116	4940	hkaqkpraruk.exe	87
PID 3716 wrote to memory of 1464	3716	9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe	93
PID 3716 wrote to memory of 1464	3716	9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe	93
PID 3716 wrote to memory of 1464	3716	9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe	93

System policy modification 1 TTPs 41 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	bghrs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	bghrs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	bghrs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	bghrs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	bghrs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	bghrs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	bghrs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	hkaqkpraruk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	bghrs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	bghrs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	bghrs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	bghrs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	bghrs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	bghrs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	bghrs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	bghrs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	bghrs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	bghrs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	bghrs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	bghrs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	hkaqkpraruk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	hkaqkpraruk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	bghrs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	bghrs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	bghrs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	bghrs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	bghrs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	bghrs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	bghrs.exe

C:\Users\Admin\AppData\Local\Temp\9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe
"C:\Users\Admin\AppData\Local\Temp\9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3716
- C:\Users\Admin\AppData\Local\Temp\hkaqkpraruk.exe
  "C:\Users\Admin\AppData\Local\Temp\hkaqkpraruk.exe" "c:\users\admin\appdata\local\temp\9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe*"
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Adds policy Run key to start application
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Checks computer location settings
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4940
- - C:\Users\Admin\AppData\Local\Temp\bghrs.exe
    "C:\Users\Admin\AppData\Local\Temp\bghrs.exe" "-C:\Users\Admin\AppData\Local\Temp\yoavhxnfqhqytonx.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops autorun.inf file
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - System policy modification
    PID:224
- - C:\Users\Admin\AppData\Local\Temp\bghrs.exe
    "C:\Users\Admin\AppData\Local\Temp\bghrs.exe" "-C:\Users\Admin\AppData\Local\Temp\yoavhxnfqhqytonx.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System policy modification
    PID:5116
- C:\Users\Admin\AppData\Local\Temp\hkaqkpraruk.exe
  "C:\Users\Admin\AppData\Local\Temp\hkaqkpraruk.exe" "c:\users\admin\appdata\local\temp\9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470.exe"
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Adds policy Run key to start application
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System policy modification
  PID:1464

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bghrs.exe

Filesize
708KB

MD5
ca0343bfc6f97c53d7c5495c761e9b56

SHA1
040b556db6a41bd9d38a865f657d14e57b7a70f1

SHA256
00322eb503a94376b68ba35ce505d5b2cab12c6b609e029f9a425ee9872dea68

SHA512
2bb1fa5d5182ba7c7aebbd5ba099ec96ea2138fd85a1b9a73e10d707e598d0c00630a7d9de747fa2c1cbe34d3a7de16d6e0f23d3599a6f18e31dedfc153d0a9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\bghrs.exe

Filesize
708KB

MD5
ca0343bfc6f97c53d7c5495c761e9b56

SHA1
040b556db6a41bd9d38a865f657d14e57b7a70f1

SHA256
00322eb503a94376b68ba35ce505d5b2cab12c6b609e029f9a425ee9872dea68

SHA512
2bb1fa5d5182ba7c7aebbd5ba099ec96ea2138fd85a1b9a73e10d707e598d0c00630a7d9de747fa2c1cbe34d3a7de16d6e0f23d3599a6f18e31dedfc153d0a9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\bghrs.exe

Filesize
708KB

MD5
ca0343bfc6f97c53d7c5495c761e9b56

SHA1
040b556db6a41bd9d38a865f657d14e57b7a70f1

SHA256
00322eb503a94376b68ba35ce505d5b2cab12c6b609e029f9a425ee9872dea68

SHA512
2bb1fa5d5182ba7c7aebbd5ba099ec96ea2138fd85a1b9a73e10d707e598d0c00630a7d9de747fa2c1cbe34d3a7de16d6e0f23d3599a6f18e31dedfc153d0a9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\bwnnezurhdreeeixjcpkb.exe

Filesize
1016KB

MD5
62b2e0d8bd5b0380d5ccb843196df2d0

SHA1
c6beb82fae4fb229c6c3de4a20f9324ebc4d1a09

SHA256
9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470

SHA512
20c6f2f0546d619a2118948ec3ac01774afb0bd976af70fe3e99ed2142923f5ad60e5dd63be611cc00426cdf9d6acca4809b2d36c79878a6dd5e953c70a34e07

Download Submit
C:\Users\Admin\AppData\Local\Temp\fwjfsjatfxhqmiitb.exe

Filesize
1016KB

MD5
62b2e0d8bd5b0380d5ccb843196df2d0

SHA1
c6beb82fae4fb229c6c3de4a20f9324ebc4d1a09

SHA256
9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470

SHA512
20c6f2f0546d619a2118948ec3ac01774afb0bd976af70fe3e99ed2142923f5ad60e5dd63be611cc00426cdf9d6acca4809b2d36c79878a6dd5e953c70a34e07

Download Submit
C:\Users\Admin\AppData\Local\Temp\hkaqkpraruk.exe

Filesize
320KB

MD5
4949147d2f03b837901a92f2b2651f32

SHA1
a03e228f4124508569356df204d39bec5defb970

SHA256
f9863940ffb6d9ed938edcd4bff274504e2e45aa7256356aaaef65a40124adb2

SHA512
37aa77909bd3690b89cb5ec3fcf1fc358ff901db9005778a681cb3851c3600b2ed78b4375c1c44786a86a38666a3b68d94d414ea833b7a2bd891bcd01286da10

Download Submit
C:\Users\Admin\AppData\Local\Temp\hkaqkpraruk.exe

Filesize
320KB

MD5
4949147d2f03b837901a92f2b2651f32

SHA1
a03e228f4124508569356df204d39bec5defb970

SHA256
f9863940ffb6d9ed938edcd4bff274504e2e45aa7256356aaaef65a40124adb2

SHA512
37aa77909bd3690b89cb5ec3fcf1fc358ff901db9005778a681cb3851c3600b2ed78b4375c1c44786a86a38666a3b68d94d414ea833b7a2bd891bcd01286da10

Download Submit
C:\Users\Admin\AppData\Local\Temp\hkaqkpraruk.exe

Filesize
320KB

MD5
4949147d2f03b837901a92f2b2651f32

SHA1
a03e228f4124508569356df204d39bec5defb970

SHA256
f9863940ffb6d9ed938edcd4bff274504e2e45aa7256356aaaef65a40124adb2

SHA512
37aa77909bd3690b89cb5ec3fcf1fc358ff901db9005778a681cb3851c3600b2ed78b4375c1c44786a86a38666a3b68d94d414ea833b7a2bd891bcd01286da10

Download Submit
C:\Users\Admin\AppData\Local\Temp\mgwvlfzvkfsedcftewic.exe

Filesize
1016KB

MD5
62b2e0d8bd5b0380d5ccb843196df2d0

SHA1
c6beb82fae4fb229c6c3de4a20f9324ebc4d1a09

SHA256
9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470

SHA512
20c6f2f0546d619a2118948ec3ac01774afb0bd976af70fe3e99ed2142923f5ad60e5dd63be611cc00426cdf9d6acca4809b2d36c79878a6dd5e953c70a34e07

Download Submit
C:\Users\Admin\AppData\Local\Temp\ogurfxpjwpakhefraq.exe

Filesize
1016KB

MD5
62b2e0d8bd5b0380d5ccb843196df2d0

SHA1
c6beb82fae4fb229c6c3de4a20f9324ebc4d1a09

SHA256
9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470

SHA512
20c6f2f0546d619a2118948ec3ac01774afb0bd976af70fe3e99ed2142923f5ad60e5dd63be611cc00426cdf9d6acca4809b2d36c79878a6dd5e953c70a34e07

Download Submit
C:\Users\Admin\AppData\Local\Temp\soghzvrpgdsghindqkyumn.exe

Filesize
1016KB

MD5
62b2e0d8bd5b0380d5ccb843196df2d0

SHA1
c6beb82fae4fb229c6c3de4a20f9324ebc4d1a09

SHA256
9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470

SHA512
20c6f2f0546d619a2118948ec3ac01774afb0bd976af70fe3e99ed2142923f5ad60e5dd63be611cc00426cdf9d6acca4809b2d36c79878a6dd5e953c70a34e07

Download Submit
C:\Users\Admin\AppData\Local\Temp\yoavhxnfqhqytonx.exe

Filesize
1016KB

MD5
62b2e0d8bd5b0380d5ccb843196df2d0

SHA1
c6beb82fae4fb229c6c3de4a20f9324ebc4d1a09

SHA256
9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470

SHA512
20c6f2f0546d619a2118948ec3ac01774afb0bd976af70fe3e99ed2142923f5ad60e5dd63be611cc00426cdf9d6acca4809b2d36c79878a6dd5e953c70a34e07

Download Submit
C:\Users\Admin\AppData\Local\Temp\zshfungbpjvgecerbsd.exe

Filesize
1016KB

MD5
62b2e0d8bd5b0380d5ccb843196df2d0

SHA1
c6beb82fae4fb229c6c3de4a20f9324ebc4d1a09

SHA256
9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470

SHA512
20c6f2f0546d619a2118948ec3ac01774afb0bd976af70fe3e99ed2142923f5ad60e5dd63be611cc00426cdf9d6acca4809b2d36c79878a6dd5e953c70a34e07

Download Submit
C:\Windows\SysWOW64\bwnnezurhdreeeixjcpkb.exe

Filesize
1016KB

MD5
62b2e0d8bd5b0380d5ccb843196df2d0

SHA1
c6beb82fae4fb229c6c3de4a20f9324ebc4d1a09

SHA256
9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470

SHA512
20c6f2f0546d619a2118948ec3ac01774afb0bd976af70fe3e99ed2142923f5ad60e5dd63be611cc00426cdf9d6acca4809b2d36c79878a6dd5e953c70a34e07

Download Submit
C:\Windows\SysWOW64\fwjfsjatfxhqmiitb.exe

Filesize
1016KB

MD5
62b2e0d8bd5b0380d5ccb843196df2d0

SHA1
c6beb82fae4fb229c6c3de4a20f9324ebc4d1a09

SHA256
9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470

SHA512
20c6f2f0546d619a2118948ec3ac01774afb0bd976af70fe3e99ed2142923f5ad60e5dd63be611cc00426cdf9d6acca4809b2d36c79878a6dd5e953c70a34e07

Download Submit
C:\Windows\SysWOW64\mgwvlfzvkfsedcftewic.exe

Filesize
1016KB

MD5
62b2e0d8bd5b0380d5ccb843196df2d0

SHA1
c6beb82fae4fb229c6c3de4a20f9324ebc4d1a09

SHA256
9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470

SHA512
20c6f2f0546d619a2118948ec3ac01774afb0bd976af70fe3e99ed2142923f5ad60e5dd63be611cc00426cdf9d6acca4809b2d36c79878a6dd5e953c70a34e07

Download Submit
C:\Windows\SysWOW64\ogurfxpjwpakhefraq.exe

Filesize
1016KB

MD5
62b2e0d8bd5b0380d5ccb843196df2d0

SHA1
c6beb82fae4fb229c6c3de4a20f9324ebc4d1a09

SHA256
9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470

SHA512
20c6f2f0546d619a2118948ec3ac01774afb0bd976af70fe3e99ed2142923f5ad60e5dd63be611cc00426cdf9d6acca4809b2d36c79878a6dd5e953c70a34e07

Download Submit
C:\Windows\SysWOW64\soghzvrpgdsghindqkyumn.exe

Filesize
1016KB

MD5
62b2e0d8bd5b0380d5ccb843196df2d0

SHA1
c6beb82fae4fb229c6c3de4a20f9324ebc4d1a09

SHA256
9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470

SHA512
20c6f2f0546d619a2118948ec3ac01774afb0bd976af70fe3e99ed2142923f5ad60e5dd63be611cc00426cdf9d6acca4809b2d36c79878a6dd5e953c70a34e07

Download Submit
C:\Windows\SysWOW64\yoavhxnfqhqytonx.exe

Filesize
1016KB

MD5
62b2e0d8bd5b0380d5ccb843196df2d0

SHA1
c6beb82fae4fb229c6c3de4a20f9324ebc4d1a09

SHA256
9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470

SHA512
20c6f2f0546d619a2118948ec3ac01774afb0bd976af70fe3e99ed2142923f5ad60e5dd63be611cc00426cdf9d6acca4809b2d36c79878a6dd5e953c70a34e07

Download Submit
C:\Windows\SysWOW64\zshfungbpjvgecerbsd.exe

Filesize
1016KB

MD5
62b2e0d8bd5b0380d5ccb843196df2d0

SHA1
c6beb82fae4fb229c6c3de4a20f9324ebc4d1a09

SHA256
9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470

SHA512
20c6f2f0546d619a2118948ec3ac01774afb0bd976af70fe3e99ed2142923f5ad60e5dd63be611cc00426cdf9d6acca4809b2d36c79878a6dd5e953c70a34e07

Download Submit
C:\Windows\bwnnezurhdreeeixjcpkb.exe

Filesize
1016KB

MD5
62b2e0d8bd5b0380d5ccb843196df2d0

SHA1
c6beb82fae4fb229c6c3de4a20f9324ebc4d1a09

SHA256
9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470

SHA512
20c6f2f0546d619a2118948ec3ac01774afb0bd976af70fe3e99ed2142923f5ad60e5dd63be611cc00426cdf9d6acca4809b2d36c79878a6dd5e953c70a34e07

Download Submit
C:\Windows\bwnnezurhdreeeixjcpkb.exe

Filesize
1016KB

MD5
62b2e0d8bd5b0380d5ccb843196df2d0

SHA1
c6beb82fae4fb229c6c3de4a20f9324ebc4d1a09

SHA256
9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470

SHA512
20c6f2f0546d619a2118948ec3ac01774afb0bd976af70fe3e99ed2142923f5ad60e5dd63be611cc00426cdf9d6acca4809b2d36c79878a6dd5e953c70a34e07

Download Submit
C:\Windows\bwnnezurhdreeeixjcpkb.exe

Filesize
1016KB

MD5
62b2e0d8bd5b0380d5ccb843196df2d0

SHA1
c6beb82fae4fb229c6c3de4a20f9324ebc4d1a09

SHA256
9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470

SHA512
20c6f2f0546d619a2118948ec3ac01774afb0bd976af70fe3e99ed2142923f5ad60e5dd63be611cc00426cdf9d6acca4809b2d36c79878a6dd5e953c70a34e07

Download Submit
C:\Windows\fwjfsjatfxhqmiitb.exe

Filesize
1016KB

MD5
62b2e0d8bd5b0380d5ccb843196df2d0

SHA1
c6beb82fae4fb229c6c3de4a20f9324ebc4d1a09

SHA256
9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470

SHA512
20c6f2f0546d619a2118948ec3ac01774afb0bd976af70fe3e99ed2142923f5ad60e5dd63be611cc00426cdf9d6acca4809b2d36c79878a6dd5e953c70a34e07

Download Submit
C:\Windows\fwjfsjatfxhqmiitb.exe

Filesize
1016KB

MD5
62b2e0d8bd5b0380d5ccb843196df2d0

SHA1
c6beb82fae4fb229c6c3de4a20f9324ebc4d1a09

SHA256
9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470

SHA512
20c6f2f0546d619a2118948ec3ac01774afb0bd976af70fe3e99ed2142923f5ad60e5dd63be611cc00426cdf9d6acca4809b2d36c79878a6dd5e953c70a34e07

Download Submit
C:\Windows\fwjfsjatfxhqmiitb.exe

Filesize
1016KB

MD5
62b2e0d8bd5b0380d5ccb843196df2d0

SHA1
c6beb82fae4fb229c6c3de4a20f9324ebc4d1a09

SHA256
9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470

SHA512
20c6f2f0546d619a2118948ec3ac01774afb0bd976af70fe3e99ed2142923f5ad60e5dd63be611cc00426cdf9d6acca4809b2d36c79878a6dd5e953c70a34e07

Download Submit
C:\Windows\mgwvlfzvkfsedcftewic.exe

Filesize
1016KB

MD5
62b2e0d8bd5b0380d5ccb843196df2d0

SHA1
c6beb82fae4fb229c6c3de4a20f9324ebc4d1a09

SHA256
9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470

SHA512
20c6f2f0546d619a2118948ec3ac01774afb0bd976af70fe3e99ed2142923f5ad60e5dd63be611cc00426cdf9d6acca4809b2d36c79878a6dd5e953c70a34e07

Download Submit
C:\Windows\mgwvlfzvkfsedcftewic.exe

Filesize
1016KB

MD5
62b2e0d8bd5b0380d5ccb843196df2d0

SHA1
c6beb82fae4fb229c6c3de4a20f9324ebc4d1a09

SHA256
9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470

SHA512
20c6f2f0546d619a2118948ec3ac01774afb0bd976af70fe3e99ed2142923f5ad60e5dd63be611cc00426cdf9d6acca4809b2d36c79878a6dd5e953c70a34e07

Download Submit
C:\Windows\mgwvlfzvkfsedcftewic.exe

Filesize
1016KB

MD5
62b2e0d8bd5b0380d5ccb843196df2d0

SHA1
c6beb82fae4fb229c6c3de4a20f9324ebc4d1a09

SHA256
9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470

SHA512
20c6f2f0546d619a2118948ec3ac01774afb0bd976af70fe3e99ed2142923f5ad60e5dd63be611cc00426cdf9d6acca4809b2d36c79878a6dd5e953c70a34e07

Download Submit
C:\Windows\ogurfxpjwpakhefraq.exe

Filesize
1016KB

MD5
62b2e0d8bd5b0380d5ccb843196df2d0

SHA1
c6beb82fae4fb229c6c3de4a20f9324ebc4d1a09

SHA256
9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470

SHA512
20c6f2f0546d619a2118948ec3ac01774afb0bd976af70fe3e99ed2142923f5ad60e5dd63be611cc00426cdf9d6acca4809b2d36c79878a6dd5e953c70a34e07

Download Submit
C:\Windows\ogurfxpjwpakhefraq.exe

Filesize
1016KB

MD5
62b2e0d8bd5b0380d5ccb843196df2d0

SHA1
c6beb82fae4fb229c6c3de4a20f9324ebc4d1a09

SHA256
9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470

SHA512
20c6f2f0546d619a2118948ec3ac01774afb0bd976af70fe3e99ed2142923f5ad60e5dd63be611cc00426cdf9d6acca4809b2d36c79878a6dd5e953c70a34e07

Download Submit
C:\Windows\ogurfxpjwpakhefraq.exe

Filesize
1016KB

MD5
62b2e0d8bd5b0380d5ccb843196df2d0

SHA1
c6beb82fae4fb229c6c3de4a20f9324ebc4d1a09

SHA256
9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470

SHA512
20c6f2f0546d619a2118948ec3ac01774afb0bd976af70fe3e99ed2142923f5ad60e5dd63be611cc00426cdf9d6acca4809b2d36c79878a6dd5e953c70a34e07

Download Submit
C:\Windows\soghzvrpgdsghindqkyumn.exe

Filesize
1016KB

MD5
62b2e0d8bd5b0380d5ccb843196df2d0

SHA1
c6beb82fae4fb229c6c3de4a20f9324ebc4d1a09

SHA256
9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470

SHA512
20c6f2f0546d619a2118948ec3ac01774afb0bd976af70fe3e99ed2142923f5ad60e5dd63be611cc00426cdf9d6acca4809b2d36c79878a6dd5e953c70a34e07

Download Submit
C:\Windows\soghzvrpgdsghindqkyumn.exe

Filesize
1016KB

MD5
62b2e0d8bd5b0380d5ccb843196df2d0

SHA1
c6beb82fae4fb229c6c3de4a20f9324ebc4d1a09

SHA256
9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470

SHA512
20c6f2f0546d619a2118948ec3ac01774afb0bd976af70fe3e99ed2142923f5ad60e5dd63be611cc00426cdf9d6acca4809b2d36c79878a6dd5e953c70a34e07

Download Submit
C:\Windows\soghzvrpgdsghindqkyumn.exe

Filesize
1016KB

MD5
62b2e0d8bd5b0380d5ccb843196df2d0

SHA1
c6beb82fae4fb229c6c3de4a20f9324ebc4d1a09

SHA256
9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470

SHA512
20c6f2f0546d619a2118948ec3ac01774afb0bd976af70fe3e99ed2142923f5ad60e5dd63be611cc00426cdf9d6acca4809b2d36c79878a6dd5e953c70a34e07

Download Submit
C:\Windows\yoavhxnfqhqytonx.exe

Filesize
1016KB

MD5
62b2e0d8bd5b0380d5ccb843196df2d0

SHA1
c6beb82fae4fb229c6c3de4a20f9324ebc4d1a09

SHA256
9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470

SHA512
20c6f2f0546d619a2118948ec3ac01774afb0bd976af70fe3e99ed2142923f5ad60e5dd63be611cc00426cdf9d6acca4809b2d36c79878a6dd5e953c70a34e07

Download Submit
C:\Windows\yoavhxnfqhqytonx.exe

Filesize
1016KB

MD5
62b2e0d8bd5b0380d5ccb843196df2d0

SHA1
c6beb82fae4fb229c6c3de4a20f9324ebc4d1a09

SHA256
9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470

SHA512
20c6f2f0546d619a2118948ec3ac01774afb0bd976af70fe3e99ed2142923f5ad60e5dd63be611cc00426cdf9d6acca4809b2d36c79878a6dd5e953c70a34e07

Download Submit
C:\Windows\yoavhxnfqhqytonx.exe

Filesize
1016KB

MD5
62b2e0d8bd5b0380d5ccb843196df2d0

SHA1
c6beb82fae4fb229c6c3de4a20f9324ebc4d1a09

SHA256
9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470

SHA512
20c6f2f0546d619a2118948ec3ac01774afb0bd976af70fe3e99ed2142923f5ad60e5dd63be611cc00426cdf9d6acca4809b2d36c79878a6dd5e953c70a34e07

Download Submit
C:\Windows\zshfungbpjvgecerbsd.exe

Filesize
1016KB

MD5
62b2e0d8bd5b0380d5ccb843196df2d0

SHA1
c6beb82fae4fb229c6c3de4a20f9324ebc4d1a09

SHA256
9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470

SHA512
20c6f2f0546d619a2118948ec3ac01774afb0bd976af70fe3e99ed2142923f5ad60e5dd63be611cc00426cdf9d6acca4809b2d36c79878a6dd5e953c70a34e07

Download Submit
C:\Windows\zshfungbpjvgecerbsd.exe

Filesize
1016KB

MD5
62b2e0d8bd5b0380d5ccb843196df2d0

SHA1
c6beb82fae4fb229c6c3de4a20f9324ebc4d1a09

SHA256
9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470

SHA512
20c6f2f0546d619a2118948ec3ac01774afb0bd976af70fe3e99ed2142923f5ad60e5dd63be611cc00426cdf9d6acca4809b2d36c79878a6dd5e953c70a34e07

Download Submit
C:\Windows\zshfungbpjvgecerbsd.exe

Filesize
1016KB

MD5
62b2e0d8bd5b0380d5ccb843196df2d0

SHA1
c6beb82fae4fb229c6c3de4a20f9324ebc4d1a09

SHA256
9201eabe3f51259efec00983e9161ae74e9ebb977d397c7cacb49613abeaa470

SHA512
20c6f2f0546d619a2118948ec3ac01774afb0bd976af70fe3e99ed2142923f5ad60e5dd63be611cc00426cdf9d6acca4809b2d36c79878a6dd5e953c70a34e07

Download Submit