8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a

Analysis

max time kernel
151s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 07:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe
Size

1016KB
MD5

63bf0cf15e3b5d6b659a1a2ecd1e5e00
SHA1

25bb8b6dbccf58d1584022965ba79e20554d1507
SHA256

8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a
SHA512

b3f2005c0f2ca1e373bf17d2ee1307841c1a19ea749e7ae1555a7692ecd181ebfc21560cb00179f8a8e6e99c66fb89e697e911d87efb329fb9e500a2e409ad7d
SSDEEP

6144:szIXsL0tvrSVz1DnemeYbpsnEf78AoXh6KkiD0OofzA+/VygHUmkjP:szIXsgtvm1De5YlOx6lzBH46U

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	kpsakr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	kpsakr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	yborjrewily.exe

UAC bypass 3 TTPs 13 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	kpsakr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	kpsakr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	kpsakr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	kpsakr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	kpsakr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	kpsakr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	kpsakr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	kpsakr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	yborjrewily.exe

Adds policy Run key to start application 2 TTPs 29 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\wfmymxdtwg = "dthavnaxhyyhajhvo.exe"	kpsakr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xdhqbjm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xpfaxrgfrkmxsddtoob.exe"	kpsakr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\wfmymxdtwg = "mdsmibpnyqrbvfetnm.exe"	yborjrewily.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	kpsakr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\wfmymxdtwg = "mdsmibpnyqrbvfetnm.exe"	kpsakr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xdhqbjm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kduqojzzmgjvrdevrsgz.exe"	kpsakr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\wfmymxdtwg = "dthavnaxhyyhajhvo.exe"	kpsakr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xdhqbjm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wlyqkbnjsihphpmz.exe"	kpsakr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xdhqbjm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wlyqkbnjsihphpmz.exe"	kpsakr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\wfmymxdtwg = "ztlihduvjeivsfhzwynhz.exe"	kpsakr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\wfmymxdtwg = "xpfaxrgfrkmxsddtoob.exe"	kpsakr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\wfmymxdtwg = "wlyqkbnjsihphpmz.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\wfmymxdtwg = "xpfaxrgfrkmxsddtoob.exe"	kpsakr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xdhqbjm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ztlihduvjeivsfhzwynhz.exe"	kpsakr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\wfmymxdtwg = "wlyqkbnjsihphpmz.exe"	kpsakr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xdhqbjm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mdsmibpnyqrbvfetnm.exe"	kpsakr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\wfmymxdtwg = "kduqojzzmgjvrdevrsgz.exe"	kpsakr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xdhqbjm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mdsmibpnyqrbvfetnm.exe"	kpsakr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\wfmymxdtwg = "xpfaxrgfrkmxsddtoob.exe"	yborjrewily.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	kpsakr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\wfmymxdtwg = "wlyqkbnjsihphpmz.exe"	kpsakr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xdhqbjm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dthavnaxhyyhajhvo.exe"	kpsakr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xdhqbjm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mdsmibpnyqrbvfetnm.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xdhqbjm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ztlihduvjeivsfhzwynhz.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xdhqbjm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dthavnaxhyyhajhvo.exe"	kpsakr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xdhqbjm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kduqojzzmgjvrdevrsgz.exe"	kpsakr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\wfmymxdtwg = "ztlihduvjeivsfhzwynhz.exe"	kpsakr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	yborjrewily.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	yborjrewily.exe

Disables RegEdit via registry modification 6 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	yborjrewily.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	kpsakr.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	kpsakr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	kpsakr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	kpsakr.exe

Executes dropped EXE 4 IoCs

pid	Process
2140	yborjrewily.exe
4880	kpsakr.exe
4844	kpsakr.exe
4716	yborjrewily.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	yborjrewily.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nzjypdmflyuzo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ztlihduvjeivsfhzwynhz.exe ."	kpsakr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\dlrcpzetv = "dthavnaxhyyhajhvo.exe ."	kpsakr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\oziwmzhzeqlp = "ztlihduvjeivsfhzwynhz.exe ."	kpsakr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\dlrcpzetv = "mdsmibpnyqrbvfetnm.exe ."	kpsakr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mtyiudhv = "mdsmibpnyqrbvfetnm.exe"	kpsakr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\obmcujtnuiflbh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mdsmibpnyqrbvfetnm.exe"	kpsakr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mtyiudhv = "ztlihduvjeivsfhzwynhz.exe"	kpsakr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\oziwmzhzeqlp = "wlyqkbnjsihphpmz.exe ."	kpsakr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\dlrcpzetv = "dthavnaxhyyhajhvo.exe ."	kpsakr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\dlrcpzetv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mdsmibpnyqrbvfetnm.exe ."	kpsakr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\dlrcpzetv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mdsmibpnyqrbvfetnm.exe ."	kpsakr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nzjypdmflyuzo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kduqojzzmgjvrdevrsgz.exe ."	kpsakr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mtyiudhv = "kduqojzzmgjvrdevrsgz.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\obmcujtnuiflbh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dthavnaxhyyhajhvo.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\dlrcpzetv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mdsmibpnyqrbvfetnm.exe ."	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\dlrcpzetv = "mdsmibpnyqrbvfetnm.exe ."	kpsakr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\obmcujtnuiflbh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dthavnaxhyyhajhvo.exe"	kpsakr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nzjypdmflyuzo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wlyqkbnjsihphpmz.exe ."	kpsakr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rbjwlxevzke = "mdsmibpnyqrbvfetnm.exe"	kpsakr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mtyiudhv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mdsmibpnyqrbvfetnm.exe"	kpsakr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mtyiudhv = "mdsmibpnyqrbvfetnm.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rbjwlxevzke = "xpfaxrgfrkmxsddtoob.exe"	kpsakr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\obmcujtnuiflbh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ztlihduvjeivsfhzwynhz.exe"	kpsakr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\dlrcpzetv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dthavnaxhyyhajhvo.exe ."	kpsakr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	yborjrewily.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rbjwlxevzke = "ztlihduvjeivsfhzwynhz.exe"	kpsakr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rbjwlxevzke = "kduqojzzmgjvrdevrsgz.exe"	kpsakr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nzjypdmflyuzo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mdsmibpnyqrbvfetnm.exe ."	kpsakr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rbjwlxevzke = "kduqojzzmgjvrdevrsgz.exe"	kpsakr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nzjypdmflyuzo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mdsmibpnyqrbvfetnm.exe ."	kpsakr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nzjypdmflyuzo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dthavnaxhyyhajhvo.exe ."	kpsakr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mtyiudhv = "wlyqkbnjsihphpmz.exe"	kpsakr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\oziwmzhzeqlp = "wlyqkbnjsihphpmz.exe ."	kpsakr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\obmcujtnuiflbh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xpfaxrgfrkmxsddtoob.exe"	kpsakr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\dlrcpzetv = "kduqojzzmgjvrdevrsgz.exe ."	kpsakr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rbjwlxevzke = "ztlihduvjeivsfhzwynhz.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mtyiudhv = "ztlihduvjeivsfhzwynhz.exe"	kpsakr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rbjwlxevzke = "dthavnaxhyyhajhvo.exe"	kpsakr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\obmcujtnuiflbh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dthavnaxhyyhajhvo.exe"	kpsakr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	kpsakr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nzjypdmflyuzo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dthavnaxhyyhajhvo.exe ."	kpsakr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\dlrcpzetv = "ztlihduvjeivsfhzwynhz.exe ."	kpsakr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mtyiudhv = "kduqojzzmgjvrdevrsgz.exe"	kpsakr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\dlrcpzetv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wlyqkbnjsihphpmz.exe ."	kpsakr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mtyiudhv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mdsmibpnyqrbvfetnm.exe"	kpsakr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mtyiudhv = "mdsmibpnyqrbvfetnm.exe"	kpsakr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\dlrcpzetv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xpfaxrgfrkmxsddtoob.exe ."	kpsakr.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	yborjrewily.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mtyiudhv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dthavnaxhyyhajhvo.exe"	kpsakr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mtyiudhv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xpfaxrgfrkmxsddtoob.exe"	kpsakr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\obmcujtnuiflbh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wlyqkbnjsihphpmz.exe"	kpsakr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\oziwmzhzeqlp = "mdsmibpnyqrbvfetnm.exe ."	kpsakr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\dlrcpzetv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ztlihduvjeivsfhzwynhz.exe ."	kpsakr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\dlrcpzetv = "kduqojzzmgjvrdevrsgz.exe ."	kpsakr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mtyiudhv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ztlihduvjeivsfhzwynhz.exe"	kpsakr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\dlrcpzetv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dthavnaxhyyhajhvo.exe ."	kpsakr.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\dlrcpzetv = "wlyqkbnjsihphpmz.exe ."	kpsakr.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	kpsakr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mtyiudhv = "dthavnaxhyyhajhvo.exe"	kpsakr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mtyiudhv = "xpfaxrgfrkmxsddtoob.exe"	kpsakr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\oziwmzhzeqlp = "xpfaxrgfrkmxsddtoob.exe ."	kpsakr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mtyiudhv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wlyqkbnjsihphpmz.exe"	yborjrewily.exe

Checks whether UAC is enabled 1 TTPs 8 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	yborjrewily.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	yborjrewily.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	kpsakr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	kpsakr.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	kpsakr.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	kpsakr.exe

Looks up external IP address via web service 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
16	whatismyipaddress.com
18	whatismyip.everdot.org
23	www.showmyipaddress.com
28	whatismyip.everdot.org
44	whatismyip.everdot.org

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\autorun.inf	kpsakr.exe
File created	C:\autorun.inf	kpsakr.exe

Drops file in System32 directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\kduqojzzmgjvrdevrsgz.exe	kpsakr.exe
File opened for modification	C:\Windows\SysWOW64\xpfaxrgfrkmxsddtoob.exe	kpsakr.exe
File opened for modification	C:\Windows\SysWOW64\kduqojzzmgjvrdevrsgz.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\dthavnaxhyyhajhvo.exe	kpsakr.exe
File opened for modification	C:\Windows\SysWOW64\rfribrcxfuszqxtfwsbpbslbmhpecjahdpgcl.lcv	kpsakr.exe
File opened for modification	C:\Windows\SysWOW64\mdsmibpnyqrbvfetnm.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\ztlihduvjeivsfhzwynhz.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\dthavnaxhyyhajhvo.exe	kpsakr.exe
File opened for modification	C:\Windows\SysWOW64\ztlihduvjeivsfhzwynhz.exe	kpsakr.exe
File opened for modification	C:\Windows\SysWOW64\qlecczrtiejxvjmfdgwrki.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\dthavnaxhyyhajhvo.exe	yborjrewily.exe
File created	C:\Windows\SysWOW64\qtuainnxuylhnjuvbmknouchhr.sfb	kpsakr.exe
File opened for modification	C:\Windows\SysWOW64\xpfaxrgfrkmxsddtoob.exe	kpsakr.exe
File opened for modification	C:\Windows\SysWOW64\kduqojzzmgjvrdevrsgz.exe	kpsakr.exe
File opened for modification	C:\Windows\SysWOW64\xpfaxrgfrkmxsddtoob.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\kduqojzzmgjvrdevrsgz.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\qlecczrtiejxvjmfdgwrki.exe	kpsakr.exe
File opened for modification	C:\Windows\SysWOW64\qtuainnxuylhnjuvbmknouchhr.sfb	kpsakr.exe
File created	C:\Windows\SysWOW64\rfribrcxfuszqxtfwsbpbslbmhpecjahdpgcl.lcv	kpsakr.exe
File opened for modification	C:\Windows\SysWOW64\dthavnaxhyyhajhvo.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\wlyqkbnjsihphpmz.exe	kpsakr.exe
File opened for modification	C:\Windows\SysWOW64\ztlihduvjeivsfhzwynhz.exe	kpsakr.exe
File opened for modification	C:\Windows\SysWOW64\wlyqkbnjsihphpmz.exe	kpsakr.exe
File opened for modification	C:\Windows\SysWOW64\mdsmibpnyqrbvfetnm.exe	kpsakr.exe
File opened for modification	C:\Windows\SysWOW64\wlyqkbnjsihphpmz.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\ztlihduvjeivsfhzwynhz.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\qlecczrtiejxvjmfdgwrki.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\mdsmibpnyqrbvfetnm.exe	kpsakr.exe
File opened for modification	C:\Windows\SysWOW64\qlecczrtiejxvjmfdgwrki.exe	kpsakr.exe
File opened for modification	C:\Windows\SysWOW64\wlyqkbnjsihphpmz.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\mdsmibpnyqrbvfetnm.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\xpfaxrgfrkmxsddtoob.exe	yborjrewily.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\rfribrcxfuszqxtfwsbpbslbmhpecjahdpgcl.lcv	kpsakr.exe
File opened for modification	C:\Program Files (x86)\qtuainnxuylhnjuvbmknouchhr.sfb	kpsakr.exe
File created	C:\Program Files (x86)\qtuainnxuylhnjuvbmknouchhr.sfb	kpsakr.exe
File opened for modification	C:\Program Files (x86)\rfribrcxfuszqxtfwsbpbslbmhpecjahdpgcl.lcv	kpsakr.exe

Drops file in Windows directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Windows\xpfaxrgfrkmxsddtoob.exe	yborjrewily.exe
File opened for modification	C:\Windows\kduqojzzmgjvrdevrsgz.exe	kpsakr.exe
File opened for modification	C:\Windows\mdsmibpnyqrbvfetnm.exe	kpsakr.exe
File opened for modification	C:\Windows\kduqojzzmgjvrdevrsgz.exe	yborjrewily.exe
File opened for modification	C:\Windows\wlyqkbnjsihphpmz.exe	yborjrewily.exe
File opened for modification	C:\Windows\mdsmibpnyqrbvfetnm.exe	yborjrewily.exe
File opened for modification	C:\Windows\qlecczrtiejxvjmfdgwrki.exe	yborjrewily.exe
File opened for modification	C:\Windows\wlyqkbnjsihphpmz.exe	kpsakr.exe
File opened for modification	C:\Windows\ztlihduvjeivsfhzwynhz.exe	kpsakr.exe
File opened for modification	C:\Windows\xpfaxrgfrkmxsddtoob.exe	yborjrewily.exe
File created	C:\Windows\rfribrcxfuszqxtfwsbpbslbmhpecjahdpgcl.lcv	kpsakr.exe
File opened for modification	C:\Windows\wlyqkbnjsihphpmz.exe	yborjrewily.exe
File opened for modification	C:\Windows\qlecczrtiejxvjmfdgwrki.exe	yborjrewily.exe
File opened for modification	C:\Windows\dthavnaxhyyhajhvo.exe	kpsakr.exe
File opened for modification	C:\Windows\kduqojzzmgjvrdevrsgz.exe	yborjrewily.exe
File opened for modification	C:\Windows\dthavnaxhyyhajhvo.exe	yborjrewily.exe
File opened for modification	C:\Windows\mdsmibpnyqrbvfetnm.exe	kpsakr.exe
File opened for modification	C:\Windows\xpfaxrgfrkmxsddtoob.exe	kpsakr.exe
File opened for modification	C:\Windows\ztlihduvjeivsfhzwynhz.exe	yborjrewily.exe
File opened for modification	C:\Windows\xpfaxrgfrkmxsddtoob.exe	kpsakr.exe
File opened for modification	C:\Windows\qtuainnxuylhnjuvbmknouchhr.sfb	kpsakr.exe
File opened for modification	C:\Windows\dthavnaxhyyhajhvo.exe	yborjrewily.exe
File created	C:\Windows\qtuainnxuylhnjuvbmknouchhr.sfb	kpsakr.exe
File opened for modification	C:\Windows\rfribrcxfuszqxtfwsbpbslbmhpecjahdpgcl.lcv	kpsakr.exe
File opened for modification	C:\Windows\mdsmibpnyqrbvfetnm.exe	yborjrewily.exe
File opened for modification	C:\Windows\wlyqkbnjsihphpmz.exe	kpsakr.exe
File opened for modification	C:\Windows\ztlihduvjeivsfhzwynhz.exe	kpsakr.exe
File opened for modification	C:\Windows\kduqojzzmgjvrdevrsgz.exe	kpsakr.exe
File opened for modification	C:\Windows\qlecczrtiejxvjmfdgwrki.exe	kpsakr.exe
File opened for modification	C:\Windows\ztlihduvjeivsfhzwynhz.exe	yborjrewily.exe
File opened for modification	C:\Windows\qlecczrtiejxvjmfdgwrki.exe	kpsakr.exe
File opened for modification	C:\Windows\dthavnaxhyyhajhvo.exe	kpsakr.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4448	8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe
4448	8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe
4448	8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe
4448	8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe
4448	8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe
4448	8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe
4448	8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe
4448	8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe
4448	8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe
4448	8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe
4448	8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe
4448	8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe
4448	8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe
4448	8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe
4448	8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe
4448	8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe
4448	8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe
4448	8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe
4448	8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe
4448	8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe
4880	kpsakr.exe
4880	kpsakr.exe
4448	8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe
4448	8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe
4448	8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe
4448	8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe
4448	8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe
4448	8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe
4448	8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe
4448	8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe
4448	8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe
4448	8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe
4448	8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe
4448	8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe
4448	8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe
4448	8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe
4448	8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe
4448	8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe
4448	8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe
4448	8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe
4448	8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe
4448	8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe
4448	8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe
4448	8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe
4448	8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe
4448	8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe
4448	8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe
4448	8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe
4448	8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe
4448	8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe
4448	8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe
4448	8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe
4880	kpsakr.exe
4880	kpsakr.exe
4448	8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe
4448	8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe
4448	8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe
4448	8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe
4448	8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe
4448	8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe
4448	8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe
4448	8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe
4448	8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe
4448	8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4880	kpsakr.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4448 wrote to memory of 2140	4448	8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe	82
PID 4448 wrote to memory of 2140	4448	8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe	82
PID 4448 wrote to memory of 2140	4448	8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe	82
PID 2140 wrote to memory of 4880	2140	yborjrewily.exe	84
PID 2140 wrote to memory of 4880	2140	yborjrewily.exe	84
PID 2140 wrote to memory of 4880	2140	yborjrewily.exe	84
PID 2140 wrote to memory of 4844	2140	yborjrewily.exe	83
PID 2140 wrote to memory of 4844	2140	yborjrewily.exe	83
PID 2140 wrote to memory of 4844	2140	yborjrewily.exe	83
PID 4448 wrote to memory of 4716	4448	8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe	92
PID 4448 wrote to memory of 4716	4448	8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe	92
PID 4448 wrote to memory of 4716	4448	8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe	92

System policy modification 1 TTPs 41 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	kpsakr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	kpsakr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	kpsakr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	kpsakr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	kpsakr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	kpsakr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	kpsakr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	kpsakr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	kpsakr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	kpsakr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	kpsakr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	kpsakr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	kpsakr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	yborjrewily.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	kpsakr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	kpsakr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	kpsakr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	kpsakr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	kpsakr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	kpsakr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	kpsakr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	kpsakr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	kpsakr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	kpsakr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	kpsakr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	yborjrewily.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	kpsakr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	kpsakr.exe

C:\Users\Admin\AppData\Local\Temp\8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe
"C:\Users\Admin\AppData\Local\Temp\8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4448
- C:\Users\Admin\AppData\Local\Temp\yborjrewily.exe
  "C:\Users\Admin\AppData\Local\Temp\yborjrewily.exe" "c:\users\admin\appdata\local\temp\8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe*"
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Adds policy Run key to start application
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Checks computer location settings
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2140
- - C:\Users\Admin\AppData\Local\Temp\kpsakr.exe
    "C:\Users\Admin\AppData\Local\Temp\kpsakr.exe" "-C:\Users\Admin\AppData\Local\Temp\wlyqkbnjsihphpmz.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System policy modification
    PID:4844
- - C:\Users\Admin\AppData\Local\Temp\kpsakr.exe
    "C:\Users\Admin\AppData\Local\Temp\kpsakr.exe" "-C:\Users\Admin\AppData\Local\Temp\wlyqkbnjsihphpmz.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops autorun.inf file
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - System policy modification
    PID:4880
- C:\Users\Admin\AppData\Local\Temp\yborjrewily.exe
  "C:\Users\Admin\AppData\Local\Temp\yborjrewily.exe" "c:\users\admin\appdata\local\temp\8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a.exe"
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Adds policy Run key to start application
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System policy modification
  PID:4716

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\dthavnaxhyyhajhvo.exe

Filesize
1016KB

MD5
63bf0cf15e3b5d6b659a1a2ecd1e5e00

SHA1
25bb8b6dbccf58d1584022965ba79e20554d1507

SHA256
8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a

SHA512
b3f2005c0f2ca1e373bf17d2ee1307841c1a19ea749e7ae1555a7692ecd181ebfc21560cb00179f8a8e6e99c66fb89e697e911d87efb329fb9e500a2e409ad7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\kduqojzzmgjvrdevrsgz.exe

Filesize
1016KB

MD5
63bf0cf15e3b5d6b659a1a2ecd1e5e00

SHA1
25bb8b6dbccf58d1584022965ba79e20554d1507

SHA256
8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a

SHA512
b3f2005c0f2ca1e373bf17d2ee1307841c1a19ea749e7ae1555a7692ecd181ebfc21560cb00179f8a8e6e99c66fb89e697e911d87efb329fb9e500a2e409ad7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\kpsakr.exe

Filesize
708KB

MD5
b536fce7a56a7c24b4e2028f9e5288b2

SHA1
a662a9fd009975fab0b05dcb59e0d0bd4d2550b9

SHA256
c6ab6a1c32e06ceab593f08960c70266bd57dba6123bcd7c6c31ea0c49dedc81

SHA512
0806b05b8335413401cc70ab4600f7e0bd76848c38209c2e6cdb3174ab1bd362cb4a079263118fa8b56df3aa8b160a55ba1221a2a25e4e137f835debbe820ae7

Download Submit
C:\Users\Admin\AppData\Local\Temp\kpsakr.exe

Filesize
708KB

MD5
b536fce7a56a7c24b4e2028f9e5288b2

SHA1
a662a9fd009975fab0b05dcb59e0d0bd4d2550b9

SHA256
c6ab6a1c32e06ceab593f08960c70266bd57dba6123bcd7c6c31ea0c49dedc81

SHA512
0806b05b8335413401cc70ab4600f7e0bd76848c38209c2e6cdb3174ab1bd362cb4a079263118fa8b56df3aa8b160a55ba1221a2a25e4e137f835debbe820ae7

Download Submit
C:\Users\Admin\AppData\Local\Temp\kpsakr.exe

Filesize
708KB

MD5
b536fce7a56a7c24b4e2028f9e5288b2

SHA1
a662a9fd009975fab0b05dcb59e0d0bd4d2550b9

SHA256
c6ab6a1c32e06ceab593f08960c70266bd57dba6123bcd7c6c31ea0c49dedc81

SHA512
0806b05b8335413401cc70ab4600f7e0bd76848c38209c2e6cdb3174ab1bd362cb4a079263118fa8b56df3aa8b160a55ba1221a2a25e4e137f835debbe820ae7

Download Submit
C:\Users\Admin\AppData\Local\Temp\mdsmibpnyqrbvfetnm.exe

Filesize
1016KB

MD5
63bf0cf15e3b5d6b659a1a2ecd1e5e00

SHA1
25bb8b6dbccf58d1584022965ba79e20554d1507

SHA256
8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a

SHA512
b3f2005c0f2ca1e373bf17d2ee1307841c1a19ea749e7ae1555a7692ecd181ebfc21560cb00179f8a8e6e99c66fb89e697e911d87efb329fb9e500a2e409ad7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\qlecczrtiejxvjmfdgwrki.exe

Filesize
1016KB

MD5
63bf0cf15e3b5d6b659a1a2ecd1e5e00

SHA1
25bb8b6dbccf58d1584022965ba79e20554d1507

SHA256
8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a

SHA512
b3f2005c0f2ca1e373bf17d2ee1307841c1a19ea749e7ae1555a7692ecd181ebfc21560cb00179f8a8e6e99c66fb89e697e911d87efb329fb9e500a2e409ad7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\wlyqkbnjsihphpmz.exe

Filesize
1016KB

MD5
63bf0cf15e3b5d6b659a1a2ecd1e5e00

SHA1
25bb8b6dbccf58d1584022965ba79e20554d1507

SHA256
8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a

SHA512
b3f2005c0f2ca1e373bf17d2ee1307841c1a19ea749e7ae1555a7692ecd181ebfc21560cb00179f8a8e6e99c66fb89e697e911d87efb329fb9e500a2e409ad7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\xpfaxrgfrkmxsddtoob.exe

Filesize
1016KB

MD5
63bf0cf15e3b5d6b659a1a2ecd1e5e00

SHA1
25bb8b6dbccf58d1584022965ba79e20554d1507

SHA256
8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a

SHA512
b3f2005c0f2ca1e373bf17d2ee1307841c1a19ea749e7ae1555a7692ecd181ebfc21560cb00179f8a8e6e99c66fb89e697e911d87efb329fb9e500a2e409ad7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\yborjrewily.exe

Filesize
320KB

MD5
24eb630da67bf8db48efcd3c1ba85a0c

SHA1
1ce742d157e715b879d4f9c9829fdc5b514d044e

SHA256
ce4319c79ad82b088ef8582b8207606d31656bf44c15f4add4cb9880d7bf8599

SHA512
485d28f1d85841615ad1a6f94e9d4d5ae5717e35c4a3f1ad9c47d0ce0d58b4c97ee753a8297c1fa56f8d8cbafde3d6437c0e4da13dd6720d7d5f1c78897984f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\yborjrewily.exe

Filesize
320KB

MD5
24eb630da67bf8db48efcd3c1ba85a0c

SHA1
1ce742d157e715b879d4f9c9829fdc5b514d044e

SHA256
ce4319c79ad82b088ef8582b8207606d31656bf44c15f4add4cb9880d7bf8599

SHA512
485d28f1d85841615ad1a6f94e9d4d5ae5717e35c4a3f1ad9c47d0ce0d58b4c97ee753a8297c1fa56f8d8cbafde3d6437c0e4da13dd6720d7d5f1c78897984f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\yborjrewily.exe

Filesize
320KB

MD5
24eb630da67bf8db48efcd3c1ba85a0c

SHA1
1ce742d157e715b879d4f9c9829fdc5b514d044e

SHA256
ce4319c79ad82b088ef8582b8207606d31656bf44c15f4add4cb9880d7bf8599

SHA512
485d28f1d85841615ad1a6f94e9d4d5ae5717e35c4a3f1ad9c47d0ce0d58b4c97ee753a8297c1fa56f8d8cbafde3d6437c0e4da13dd6720d7d5f1c78897984f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\ztlihduvjeivsfhzwynhz.exe

Filesize
1016KB

MD5
63bf0cf15e3b5d6b659a1a2ecd1e5e00

SHA1
25bb8b6dbccf58d1584022965ba79e20554d1507

SHA256
8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a

SHA512
b3f2005c0f2ca1e373bf17d2ee1307841c1a19ea749e7ae1555a7692ecd181ebfc21560cb00179f8a8e6e99c66fb89e697e911d87efb329fb9e500a2e409ad7d

Download Submit
C:\Windows\SysWOW64\dthavnaxhyyhajhvo.exe

Filesize
1016KB

MD5
63bf0cf15e3b5d6b659a1a2ecd1e5e00

SHA1
25bb8b6dbccf58d1584022965ba79e20554d1507

SHA256
8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a

SHA512
b3f2005c0f2ca1e373bf17d2ee1307841c1a19ea749e7ae1555a7692ecd181ebfc21560cb00179f8a8e6e99c66fb89e697e911d87efb329fb9e500a2e409ad7d

Download Submit
C:\Windows\SysWOW64\kduqojzzmgjvrdevrsgz.exe

Filesize
1016KB

MD5
63bf0cf15e3b5d6b659a1a2ecd1e5e00

SHA1
25bb8b6dbccf58d1584022965ba79e20554d1507

SHA256
8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a

SHA512
b3f2005c0f2ca1e373bf17d2ee1307841c1a19ea749e7ae1555a7692ecd181ebfc21560cb00179f8a8e6e99c66fb89e697e911d87efb329fb9e500a2e409ad7d

Download Submit
C:\Windows\SysWOW64\mdsmibpnyqrbvfetnm.exe

Filesize
1016KB

MD5
63bf0cf15e3b5d6b659a1a2ecd1e5e00

SHA1
25bb8b6dbccf58d1584022965ba79e20554d1507

SHA256
8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a

SHA512
b3f2005c0f2ca1e373bf17d2ee1307841c1a19ea749e7ae1555a7692ecd181ebfc21560cb00179f8a8e6e99c66fb89e697e911d87efb329fb9e500a2e409ad7d

Download Submit
C:\Windows\SysWOW64\qlecczrtiejxvjmfdgwrki.exe

Filesize
1016KB

MD5
63bf0cf15e3b5d6b659a1a2ecd1e5e00

SHA1
25bb8b6dbccf58d1584022965ba79e20554d1507

SHA256
8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a

SHA512
b3f2005c0f2ca1e373bf17d2ee1307841c1a19ea749e7ae1555a7692ecd181ebfc21560cb00179f8a8e6e99c66fb89e697e911d87efb329fb9e500a2e409ad7d

Download Submit
C:\Windows\SysWOW64\wlyqkbnjsihphpmz.exe

Filesize
1016KB

MD5
63bf0cf15e3b5d6b659a1a2ecd1e5e00

SHA1
25bb8b6dbccf58d1584022965ba79e20554d1507

SHA256
8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a

SHA512
b3f2005c0f2ca1e373bf17d2ee1307841c1a19ea749e7ae1555a7692ecd181ebfc21560cb00179f8a8e6e99c66fb89e697e911d87efb329fb9e500a2e409ad7d

Download Submit
C:\Windows\SysWOW64\xpfaxrgfrkmxsddtoob.exe

Filesize
1016KB

MD5
63bf0cf15e3b5d6b659a1a2ecd1e5e00

SHA1
25bb8b6dbccf58d1584022965ba79e20554d1507

SHA256
8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a

SHA512
b3f2005c0f2ca1e373bf17d2ee1307841c1a19ea749e7ae1555a7692ecd181ebfc21560cb00179f8a8e6e99c66fb89e697e911d87efb329fb9e500a2e409ad7d

Download Submit
C:\Windows\SysWOW64\ztlihduvjeivsfhzwynhz.exe

Filesize
1016KB

MD5
63bf0cf15e3b5d6b659a1a2ecd1e5e00

SHA1
25bb8b6dbccf58d1584022965ba79e20554d1507

SHA256
8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a

SHA512
b3f2005c0f2ca1e373bf17d2ee1307841c1a19ea749e7ae1555a7692ecd181ebfc21560cb00179f8a8e6e99c66fb89e697e911d87efb329fb9e500a2e409ad7d

Download Submit
C:\Windows\dthavnaxhyyhajhvo.exe

Filesize
1016KB

MD5
63bf0cf15e3b5d6b659a1a2ecd1e5e00

SHA1
25bb8b6dbccf58d1584022965ba79e20554d1507

SHA256
8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a

SHA512
b3f2005c0f2ca1e373bf17d2ee1307841c1a19ea749e7ae1555a7692ecd181ebfc21560cb00179f8a8e6e99c66fb89e697e911d87efb329fb9e500a2e409ad7d

Download Submit
C:\Windows\dthavnaxhyyhajhvo.exe

Filesize
1016KB

MD5
63bf0cf15e3b5d6b659a1a2ecd1e5e00

SHA1
25bb8b6dbccf58d1584022965ba79e20554d1507

SHA256
8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a

SHA512
b3f2005c0f2ca1e373bf17d2ee1307841c1a19ea749e7ae1555a7692ecd181ebfc21560cb00179f8a8e6e99c66fb89e697e911d87efb329fb9e500a2e409ad7d

Download Submit
C:\Windows\dthavnaxhyyhajhvo.exe

Filesize
1016KB

MD5
63bf0cf15e3b5d6b659a1a2ecd1e5e00

SHA1
25bb8b6dbccf58d1584022965ba79e20554d1507

SHA256
8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a

SHA512
b3f2005c0f2ca1e373bf17d2ee1307841c1a19ea749e7ae1555a7692ecd181ebfc21560cb00179f8a8e6e99c66fb89e697e911d87efb329fb9e500a2e409ad7d

Download Submit
C:\Windows\kduqojzzmgjvrdevrsgz.exe

Filesize
1016KB

MD5
63bf0cf15e3b5d6b659a1a2ecd1e5e00

SHA1
25bb8b6dbccf58d1584022965ba79e20554d1507

SHA256
8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a

SHA512
b3f2005c0f2ca1e373bf17d2ee1307841c1a19ea749e7ae1555a7692ecd181ebfc21560cb00179f8a8e6e99c66fb89e697e911d87efb329fb9e500a2e409ad7d

Download Submit
C:\Windows\kduqojzzmgjvrdevrsgz.exe

Filesize
1016KB

MD5
63bf0cf15e3b5d6b659a1a2ecd1e5e00

SHA1
25bb8b6dbccf58d1584022965ba79e20554d1507

SHA256
8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a

SHA512
b3f2005c0f2ca1e373bf17d2ee1307841c1a19ea749e7ae1555a7692ecd181ebfc21560cb00179f8a8e6e99c66fb89e697e911d87efb329fb9e500a2e409ad7d

Download Submit
C:\Windows\kduqojzzmgjvrdevrsgz.exe

Filesize
1016KB

MD5
63bf0cf15e3b5d6b659a1a2ecd1e5e00

SHA1
25bb8b6dbccf58d1584022965ba79e20554d1507

SHA256
8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a

SHA512
b3f2005c0f2ca1e373bf17d2ee1307841c1a19ea749e7ae1555a7692ecd181ebfc21560cb00179f8a8e6e99c66fb89e697e911d87efb329fb9e500a2e409ad7d

Download Submit
C:\Windows\mdsmibpnyqrbvfetnm.exe

Filesize
1016KB

MD5
63bf0cf15e3b5d6b659a1a2ecd1e5e00

SHA1
25bb8b6dbccf58d1584022965ba79e20554d1507

SHA256
8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a

SHA512
b3f2005c0f2ca1e373bf17d2ee1307841c1a19ea749e7ae1555a7692ecd181ebfc21560cb00179f8a8e6e99c66fb89e697e911d87efb329fb9e500a2e409ad7d

Download Submit
C:\Windows\mdsmibpnyqrbvfetnm.exe

Filesize
1016KB

MD5
63bf0cf15e3b5d6b659a1a2ecd1e5e00

SHA1
25bb8b6dbccf58d1584022965ba79e20554d1507

SHA256
8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a

SHA512
b3f2005c0f2ca1e373bf17d2ee1307841c1a19ea749e7ae1555a7692ecd181ebfc21560cb00179f8a8e6e99c66fb89e697e911d87efb329fb9e500a2e409ad7d

Download Submit
C:\Windows\mdsmibpnyqrbvfetnm.exe

Filesize
1016KB

MD5
63bf0cf15e3b5d6b659a1a2ecd1e5e00

SHA1
25bb8b6dbccf58d1584022965ba79e20554d1507

SHA256
8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a

SHA512
b3f2005c0f2ca1e373bf17d2ee1307841c1a19ea749e7ae1555a7692ecd181ebfc21560cb00179f8a8e6e99c66fb89e697e911d87efb329fb9e500a2e409ad7d

Download Submit
C:\Windows\qlecczrtiejxvjmfdgwrki.exe

Filesize
1016KB

MD5
63bf0cf15e3b5d6b659a1a2ecd1e5e00

SHA1
25bb8b6dbccf58d1584022965ba79e20554d1507

SHA256
8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a

SHA512
b3f2005c0f2ca1e373bf17d2ee1307841c1a19ea749e7ae1555a7692ecd181ebfc21560cb00179f8a8e6e99c66fb89e697e911d87efb329fb9e500a2e409ad7d

Download Submit
C:\Windows\qlecczrtiejxvjmfdgwrki.exe

Filesize
1016KB

MD5
63bf0cf15e3b5d6b659a1a2ecd1e5e00

SHA1
25bb8b6dbccf58d1584022965ba79e20554d1507

SHA256
8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a

SHA512
b3f2005c0f2ca1e373bf17d2ee1307841c1a19ea749e7ae1555a7692ecd181ebfc21560cb00179f8a8e6e99c66fb89e697e911d87efb329fb9e500a2e409ad7d

Download Submit
C:\Windows\qlecczrtiejxvjmfdgwrki.exe

Filesize
1016KB

MD5
63bf0cf15e3b5d6b659a1a2ecd1e5e00

SHA1
25bb8b6dbccf58d1584022965ba79e20554d1507

SHA256
8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a

SHA512
b3f2005c0f2ca1e373bf17d2ee1307841c1a19ea749e7ae1555a7692ecd181ebfc21560cb00179f8a8e6e99c66fb89e697e911d87efb329fb9e500a2e409ad7d

Download Submit
C:\Windows\wlyqkbnjsihphpmz.exe

Filesize
1016KB

MD5
63bf0cf15e3b5d6b659a1a2ecd1e5e00

SHA1
25bb8b6dbccf58d1584022965ba79e20554d1507

SHA256
8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a

SHA512
b3f2005c0f2ca1e373bf17d2ee1307841c1a19ea749e7ae1555a7692ecd181ebfc21560cb00179f8a8e6e99c66fb89e697e911d87efb329fb9e500a2e409ad7d

Download Submit
C:\Windows\wlyqkbnjsihphpmz.exe

Filesize
1016KB

MD5
63bf0cf15e3b5d6b659a1a2ecd1e5e00

SHA1
25bb8b6dbccf58d1584022965ba79e20554d1507

SHA256
8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a

SHA512
b3f2005c0f2ca1e373bf17d2ee1307841c1a19ea749e7ae1555a7692ecd181ebfc21560cb00179f8a8e6e99c66fb89e697e911d87efb329fb9e500a2e409ad7d

Download Submit
C:\Windows\wlyqkbnjsihphpmz.exe

Filesize
1016KB

MD5
63bf0cf15e3b5d6b659a1a2ecd1e5e00

SHA1
25bb8b6dbccf58d1584022965ba79e20554d1507

SHA256
8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a

SHA512
b3f2005c0f2ca1e373bf17d2ee1307841c1a19ea749e7ae1555a7692ecd181ebfc21560cb00179f8a8e6e99c66fb89e697e911d87efb329fb9e500a2e409ad7d

Download Submit
C:\Windows\xpfaxrgfrkmxsddtoob.exe

Filesize
1016KB

MD5
63bf0cf15e3b5d6b659a1a2ecd1e5e00

SHA1
25bb8b6dbccf58d1584022965ba79e20554d1507

SHA256
8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a

SHA512
b3f2005c0f2ca1e373bf17d2ee1307841c1a19ea749e7ae1555a7692ecd181ebfc21560cb00179f8a8e6e99c66fb89e697e911d87efb329fb9e500a2e409ad7d

Download Submit
C:\Windows\xpfaxrgfrkmxsddtoob.exe

Filesize
1016KB

MD5
63bf0cf15e3b5d6b659a1a2ecd1e5e00

SHA1
25bb8b6dbccf58d1584022965ba79e20554d1507

SHA256
8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a

SHA512
b3f2005c0f2ca1e373bf17d2ee1307841c1a19ea749e7ae1555a7692ecd181ebfc21560cb00179f8a8e6e99c66fb89e697e911d87efb329fb9e500a2e409ad7d

Download Submit
C:\Windows\xpfaxrgfrkmxsddtoob.exe

Filesize
1016KB

MD5
63bf0cf15e3b5d6b659a1a2ecd1e5e00

SHA1
25bb8b6dbccf58d1584022965ba79e20554d1507

SHA256
8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a

SHA512
b3f2005c0f2ca1e373bf17d2ee1307841c1a19ea749e7ae1555a7692ecd181ebfc21560cb00179f8a8e6e99c66fb89e697e911d87efb329fb9e500a2e409ad7d

Download Submit
C:\Windows\ztlihduvjeivsfhzwynhz.exe

Filesize
1016KB

MD5
63bf0cf15e3b5d6b659a1a2ecd1e5e00

SHA1
25bb8b6dbccf58d1584022965ba79e20554d1507

SHA256
8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a

SHA512
b3f2005c0f2ca1e373bf17d2ee1307841c1a19ea749e7ae1555a7692ecd181ebfc21560cb00179f8a8e6e99c66fb89e697e911d87efb329fb9e500a2e409ad7d

Download Submit
C:\Windows\ztlihduvjeivsfhzwynhz.exe

Filesize
1016KB

MD5
63bf0cf15e3b5d6b659a1a2ecd1e5e00

SHA1
25bb8b6dbccf58d1584022965ba79e20554d1507

SHA256
8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a

SHA512
b3f2005c0f2ca1e373bf17d2ee1307841c1a19ea749e7ae1555a7692ecd181ebfc21560cb00179f8a8e6e99c66fb89e697e911d87efb329fb9e500a2e409ad7d

Download Submit
C:\Windows\ztlihduvjeivsfhzwynhz.exe

Filesize
1016KB

MD5
63bf0cf15e3b5d6b659a1a2ecd1e5e00

SHA1
25bb8b6dbccf58d1584022965ba79e20554d1507

SHA256
8c7682fec8718c1c6d4f8d2e99e434bd5710e1637b07e229699e508af5eec90a

SHA512
b3f2005c0f2ca1e373bf17d2ee1307841c1a19ea749e7ae1555a7692ecd181ebfc21560cb00179f8a8e6e99c66fb89e697e911d87efb329fb9e500a2e409ad7d

Download Submit