Analysis
-
max time kernel
155s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03-10-2022 12:49
Static task
static1
Behavioral task
behavioral1
Sample
e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe
Resource
win7-20220901-en
windows7-x64
Behavioral task
behavioral2
Sample
e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
General
-
Target
e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe
-
Size
832KB
-
MD5
66805b538e88764367a3dcdfd88283a0
-
SHA1
3ed7e44b1985bb215da47a03cee573705f870b31
-
SHA256
e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040
-
SHA512
c4e35549adac9fe19cd5ef5dcc75de56c515e5eb1478dee52ab893bf9e17ed8a64f1b9efb19ee1c81349c6bc0cacd19681151167df979a8387e35ac965dd98ab
-
SSDEEP
12288:AgkDxdkL+6JNgKVcRa+fpHyWs3OBH4pUYJPfZQ:mxsKXa+hHyWseBgzm
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" cjklt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" yborjrewily.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" cjklt.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" cjklt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" cjklt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" cjklt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" cjklt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" cjklt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" yborjrewily.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cjklt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" yborjrewily.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cjklt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" cjklt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" yborjrewily.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" yborjrewily.exe -
Adds policy Run key to start application 2 TTPs 26 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nvxzis = "avkzvsfbrkmxsddtooe.exe" yborjrewily.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mrq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\njzpmkyvmgjvrdevrsjf.exe" cjklt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nvxzis = "gzmztozthyyhajhvo.exe" cjklt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mrq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avkzvsfbrkmxsddtooe.exe" cjklt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mrq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zrdpicmfsihphpmz.exe" cjklt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nvxzis = "pjxlgcojyqrbvfetnm.exe" cjklt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run cjklt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nvxzis = "avkzvsfbrkmxsddtooe.exe" cjklt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mrq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\czqhfetrjeivsfhzwyqne.exe" cjklt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mrq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\czqhfetrjeivsfhzwyqne.exe" cjklt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mrq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zrdpicmfsihphpmz.exe" cjklt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run yborjrewily.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run cjklt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mrq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avkzvsfbrkmxsddtooe.exe" cjklt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mrq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zrdpicmfsihphpmz.exe" yborjrewily.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mrq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gzmztozthyyhajhvo.exe" cjklt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nvxzis = "czqhfetrjeivsfhzwyqne.exe" cjklt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nvxzis = "czqhfetrjeivsfhzwyqne.exe" cjklt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mrq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\njzpmkyvmgjvrdevrsjf.exe" cjklt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nvxzis = "njzpmkyvmgjvrdevrsjf.exe" cjklt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mrq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gzmztozthyyhajhvo.exe" cjklt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nvxzis = "zrdpicmfsihphpmz.exe" cjklt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nvxzis = "njzpmkyvmgjvrdevrsjf.exe" cjklt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nvxzis = "avkzvsfbrkmxsddtooe.exe" cjklt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nvxzis = "zrdpicmfsihphpmz.exe" cjklt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nvxzis = "gzmztozthyyhajhvo.exe" cjklt.exe -
Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" yborjrewily.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" cjklt.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" cjklt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" cjklt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" cjklt.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" yborjrewily.exe -
Executes dropped EXE 3 IoCs
pid Process 2784 yborjrewily.exe 1112 cjklt.exe 4088 cjklt.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation yborjrewily.exe -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\grwbnadpv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\njzpmkyvmgjvrdevrsjf.exe ." cjklt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\tzzz = "zrdpicmfsihphpmz.exe" cjklt.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run cjklt.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ajmpzkl = "gzmztozthyyhajhvo.exe" cjklt.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\pzdhsegr = "gzmztozthyyhajhvo.exe ." cjklt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\zlrxkycpwg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gzmztozthyyhajhvo.exe" cjklt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\cjklt = "pjxlgcojyqrbvfetnm.exe ." cjklt.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ajmpzkl = "avkzvsfbrkmxsddtooe.exe" cjklt.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\pzdhsegr = "czqhfetrjeivsfhzwyqne.exe ." cjklt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\cjklt = "czqhfetrjeivsfhzwyqne.exe ." yborjrewily.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\grwbnadpv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gzmztozthyyhajhvo.exe ." cjklt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\tzzz = "pjxlgcojyqrbvfetnm.exe" cjklt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\cjklt = "czqhfetrjeivsfhzwyqne.exe ." cjklt.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\pzdhsegr = "zrdpicmfsihphpmz.exe ." cjklt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\tzzz = "gzmztozthyyhajhvo.exe" cjklt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\cjklt = "gzmztozthyyhajhvo.exe ." cjklt.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\pzdhsegr = "pjxlgcojyqrbvfetnm.exe ." cjklt.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce cjklt.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\pzdhsegr = "zrdpicmfsihphpmz.exe ." cjklt.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tzzz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gzmztozthyyhajhvo.exe" cjklt.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tzzz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avkzvsfbrkmxsddtooe.exe" cjklt.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\pzdhsegr = "njzpmkyvmgjvrdevrsjf.exe ." cjklt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\grwbnadpv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pjxlgcojyqrbvfetnm.exe ." cjklt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\zlrxkycpwg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avkzvsfbrkmxsddtooe.exe" cjklt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\grwbnadpv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pjxlgcojyqrbvfetnm.exe ." cjklt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\tzzz = "zrdpicmfsihphpmz.exe" cjklt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\tzzz = "avkzvsfbrkmxsddtooe.exe" cjklt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\cjklt = "avkzvsfbrkmxsddtooe.exe ." cjklt.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce cjklt.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\cjklt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\czqhfetrjeivsfhzwyqne.exe ." cjklt.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\cjklt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zrdpicmfsihphpmz.exe ." cjklt.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\cjklt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\njzpmkyvmgjvrdevrsjf.exe ." cjklt.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ajmpzkl = "pjxlgcojyqrbvfetnm.exe" cjklt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\grwbnadpv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zrdpicmfsihphpmz.exe ." cjklt.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\pzdhsegr = "gzmztozthyyhajhvo.exe ." cjklt.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\cjklt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\czqhfetrjeivsfhzwyqne.exe ." cjklt.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run cjklt.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ajmpzkl = "zrdpicmfsihphpmz.exe" cjklt.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tzzz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zrdpicmfsihphpmz.exe" cjklt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\cjklt = "avkzvsfbrkmxsddtooe.exe ." cjklt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\tzzz = "avkzvsfbrkmxsddtooe.exe" yborjrewily.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ajmpzkl = "zrdpicmfsihphpmz.exe" yborjrewily.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\grwbnadpv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\njzpmkyvmgjvrdevrsjf.exe ." cjklt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\tzzz = "czqhfetrjeivsfhzwyqne.exe" cjklt.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ajmpzkl = "njzpmkyvmgjvrdevrsjf.exe" cjklt.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tzzz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\czqhfetrjeivsfhzwyqne.exe" cjklt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\tzzz = "czqhfetrjeivsfhzwyqne.exe" cjklt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\zlrxkycpwg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zrdpicmfsihphpmz.exe" yborjrewily.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\cjklt = "zrdpicmfsihphpmz.exe ." cjklt.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\cjklt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\njzpmkyvmgjvrdevrsjf.exe ." cjklt.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\pzdhsegr = "avkzvsfbrkmxsddtooe.exe ." cjklt.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tzzz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\njzpmkyvmgjvrdevrsjf.exe" cjklt.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tzzz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pjxlgcojyqrbvfetnm.exe" cjklt.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\pzdhsegr = "czqhfetrjeivsfhzwyqne.exe ." cjklt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\cjklt = "gzmztozthyyhajhvo.exe ." cjklt.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\cjklt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zrdpicmfsihphpmz.exe ." cjklt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\cjklt = "zrdpicmfsihphpmz.exe ." cjklt.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ajmpzkl = "czqhfetrjeivsfhzwyqne.exe" cjklt.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tzzz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\njzpmkyvmgjvrdevrsjf.exe" cjklt.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce cjklt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\tzzz = "gzmztozthyyhajhvo.exe" cjklt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\zlrxkycpwg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gzmztozthyyhajhvo.exe" cjklt.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\cjklt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pjxlgcojyqrbvfetnm.exe ." cjklt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\tzzz = "njzpmkyvmgjvrdevrsjf.exe" cjklt.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cjklt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cjklt.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cjklt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" yborjrewily.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA yborjrewily.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cjklt.exe -
Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 26 www.showmyipaddress.com 28 whatismyip.everdot.org 42 whatismyipaddress.com 46 whatismyip.everdot.org 50 whatismyip.everdot.org -
Drops file in System32 directory 25 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\njzpmkyvmgjvrdevrsjf.exe cjklt.exe File opened for modification C:\Windows\SysWOW64\trjbaaqpiejxvjmfdgzxph.exe cjklt.exe File opened for modification C:\Windows\SysWOW64\pjxlgcojyqrbvfetnm.exe cjklt.exe File opened for modification C:\Windows\SysWOW64\avkzvsfbrkmxsddtooe.exe cjklt.exe File opened for modification C:\Windows\SysWOW64\njzpmkyvmgjvrdevrsjf.exe cjklt.exe File opened for modification C:\Windows\SysWOW64\zrdpicmfsihphpmz.exe cjklt.exe File opened for modification C:\Windows\SysWOW64\avkzvsfbrkmxsddtooe.exe cjklt.exe File opened for modification C:\Windows\SysWOW64\gzmztozthyyhajhvo.exe yborjrewily.exe File opened for modification C:\Windows\SysWOW64\pjxlgcojyqrbvfetnm.exe yborjrewily.exe File opened for modification C:\Windows\SysWOW64\zrdpicmfsihphpmz.exe cjklt.exe File opened for modification C:\Windows\SysWOW64\zlrxkycpwgzbnpgnzqxjpviwanuexzln.lxo cjklt.exe File opened for modification C:\Windows\SysWOW64\efavxatvrqypqhnjkqmni.fib cjklt.exe File opened for modification C:\Windows\SysWOW64\njzpmkyvmgjvrdevrsjf.exe yborjrewily.exe File opened for modification C:\Windows\SysWOW64\czqhfetrjeivsfhzwyqne.exe yborjrewily.exe File opened for modification C:\Windows\SysWOW64\pjxlgcojyqrbvfetnm.exe cjklt.exe File opened for modification C:\Windows\SysWOW64\gzmztozthyyhajhvo.exe cjklt.exe File opened for modification C:\Windows\SysWOW64\czqhfetrjeivsfhzwyqne.exe cjklt.exe File opened for modification C:\Windows\SysWOW64\trjbaaqpiejxvjmfdgzxph.exe cjklt.exe File opened for modification C:\Windows\SysWOW64\gzmztozthyyhajhvo.exe cjklt.exe File opened for modification C:\Windows\SysWOW64\czqhfetrjeivsfhzwyqne.exe cjklt.exe File opened for modification C:\Windows\SysWOW64\zrdpicmfsihphpmz.exe yborjrewily.exe File opened for modification C:\Windows\SysWOW64\avkzvsfbrkmxsddtooe.exe yborjrewily.exe File opened for modification C:\Windows\SysWOW64\trjbaaqpiejxvjmfdgzxph.exe yborjrewily.exe File created C:\Windows\SysWOW64\efavxatvrqypqhnjkqmni.fib cjklt.exe File created C:\Windows\SysWOW64\zlrxkycpwgzbnpgnzqxjpviwanuexzln.lxo cjklt.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\efavxatvrqypqhnjkqmni.fib cjklt.exe File created C:\Program Files (x86)\efavxatvrqypqhnjkqmni.fib cjklt.exe File opened for modification C:\Program Files (x86)\zlrxkycpwgzbnpgnzqxjpviwanuexzln.lxo cjklt.exe File created C:\Program Files (x86)\zlrxkycpwgzbnpgnzqxjpviwanuexzln.lxo cjklt.exe -
Drops file in Windows directory 25 IoCs
description ioc Process File opened for modification C:\Windows\avkzvsfbrkmxsddtooe.exe cjklt.exe File opened for modification C:\Windows\gzmztozthyyhajhvo.exe cjklt.exe File opened for modification C:\Windows\pjxlgcojyqrbvfetnm.exe cjklt.exe File opened for modification C:\Windows\czqhfetrjeivsfhzwyqne.exe cjklt.exe File opened for modification C:\Windows\czqhfetrjeivsfhzwyqne.exe cjklt.exe File opened for modification C:\Windows\gzmztozthyyhajhvo.exe yborjrewily.exe File opened for modification C:\Windows\njzpmkyvmgjvrdevrsjf.exe yborjrewily.exe File opened for modification C:\Windows\czqhfetrjeivsfhzwyqne.exe yborjrewily.exe File opened for modification C:\Windows\trjbaaqpiejxvjmfdgzxph.exe yborjrewily.exe File opened for modification C:\Windows\zrdpicmfsihphpmz.exe cjklt.exe File opened for modification C:\Windows\gzmztozthyyhajhvo.exe cjklt.exe File opened for modification C:\Windows\pjxlgcojyqrbvfetnm.exe cjklt.exe File opened for modification C:\Windows\njzpmkyvmgjvrdevrsjf.exe cjklt.exe File opened for modification C:\Windows\efavxatvrqypqhnjkqmni.fib cjklt.exe File created C:\Windows\efavxatvrqypqhnjkqmni.fib cjklt.exe File opened for modification C:\Windows\pjxlgcojyqrbvfetnm.exe yborjrewily.exe File opened for modification C:\Windows\avkzvsfbrkmxsddtooe.exe yborjrewily.exe File opened for modification C:\Windows\njzpmkyvmgjvrdevrsjf.exe cjklt.exe File opened for modification C:\Windows\trjbaaqpiejxvjmfdgzxph.exe cjklt.exe File opened for modification C:\Windows\zrdpicmfsihphpmz.exe cjklt.exe File opened for modification C:\Windows\avkzvsfbrkmxsddtooe.exe cjklt.exe File opened for modification C:\Windows\trjbaaqpiejxvjmfdgzxph.exe cjklt.exe File opened for modification C:\Windows\zlrxkycpwgzbnpgnzqxjpviwanuexzln.lxo cjklt.exe File created C:\Windows\zlrxkycpwgzbnpgnzqxjpviwanuexzln.lxo cjklt.exe File opened for modification C:\Windows\zrdpicmfsihphpmz.exe yborjrewily.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4892 e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe 4892 e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe 4892 e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe 4892 e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe 4892 e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe 4892 e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe 4892 e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe 4892 e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe 4892 e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe 4892 e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe 4892 e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe 4892 e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe 4892 e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe 4892 e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe 4892 e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe 4892 e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe 1112 cjklt.exe 1112 cjklt.exe 4892 e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe 4892 e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe 4892 e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe 4892 e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe 4892 e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe 4892 e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe 4892 e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe 4892 e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe 4892 e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe 4892 e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe 4892 e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe 4892 e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe 4892 e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe 4892 e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe 4892 e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe 4892 e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe 4892 e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe 4892 e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe 4892 e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe 4892 e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe 4892 e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe 4892 e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe 4892 e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe 4892 e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe 4892 e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe 4892 e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe 4892 e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe 4892 e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe 4892 e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe 4892 e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe 1112 cjklt.exe 1112 cjklt.exe 4892 e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe 4892 e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe 4892 e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe 4892 e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe 4892 e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe 4892 e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe 4892 e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe 4892 e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe 4892 e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe 4892 e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe 4892 e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe 4892 e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe 4892 e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe 4892 e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1112 cjklt.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4892 wrote to memory of 2784 4892 e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe 83 PID 4892 wrote to memory of 2784 4892 e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe 83 PID 4892 wrote to memory of 2784 4892 e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe 83 PID 2784 wrote to memory of 1112 2784 yborjrewily.exe 84 PID 2784 wrote to memory of 1112 2784 yborjrewily.exe 84 PID 2784 wrote to memory of 1112 2784 yborjrewily.exe 84 PID 2784 wrote to memory of 4088 2784 yborjrewily.exe 85 PID 2784 wrote to memory of 4088 2784 yborjrewily.exe 85 PID 2784 wrote to memory of 4088 2784 yborjrewily.exe 85 -
System policy modification 1 TTPs 39 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" yborjrewily.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" cjklt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" cjklt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer cjklt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" cjklt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" yborjrewily.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" yborjrewily.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cjklt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" cjklt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" cjklt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" yborjrewily.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer yborjrewily.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" cjklt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" cjklt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cjklt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" cjklt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" cjklt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" cjklt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System yborjrewily.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" yborjrewily.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" yborjrewily.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" yborjrewily.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cjklt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" cjklt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" cjklt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" cjklt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" cjklt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" cjklt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" cjklt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" cjklt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" cjklt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" cjklt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" yborjrewily.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cjklt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer cjklt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" yborjrewily.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" yborjrewily.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" yborjrewily.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" cjklt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe"C:\Users\Admin\AppData\Local\Temp\e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\yborjrewily.exe"C:\Users\Admin\AppData\Local\Temp\yborjrewily.exe" "c:\users\admin\appdata\local\temp\e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040.exe*"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\cjklt.exe"C:\Users\Admin\AppData\Local\Temp\cjklt.exe" "-C:\Users\Admin\AppData\Local\Temp\zrdpicmfsihphpmz.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:1112
-
-
C:\Users\Admin\AppData\Local\Temp\cjklt.exe"C:\Users\Admin\AppData\Local\Temp\cjklt.exe" "-C:\Users\Admin\AppData\Local\Temp\zrdpicmfsihphpmz.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- System policy modification
PID:4088
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
832KB
MD566805b538e88764367a3dcdfd88283a0
SHA13ed7e44b1985bb215da47a03cee573705f870b31
SHA256e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040
SHA512c4e35549adac9fe19cd5ef5dcc75de56c515e5eb1478dee52ab893bf9e17ed8a64f1b9efb19ee1c81349c6bc0cacd19681151167df979a8387e35ac965dd98ab
-
Filesize
708KB
MD51911bcb2eeaa99ae1aea094d6d1d9f5a
SHA1306a07887453d8b003e98a4b591363eac13d7989
SHA2563b44deb9e107d29382e254fe3a6fd936efa8eb1d4214619068aa0462aca0c3df
SHA512b26697216f364b2c13907eb875d5a7c8decf2c11e018e4d1365dfb148ad09f331f176bdd60481f7624283b58631befd1487464bfe9e1ec174d196c234fd3b235
-
Filesize
708KB
MD51911bcb2eeaa99ae1aea094d6d1d9f5a
SHA1306a07887453d8b003e98a4b591363eac13d7989
SHA2563b44deb9e107d29382e254fe3a6fd936efa8eb1d4214619068aa0462aca0c3df
SHA512b26697216f364b2c13907eb875d5a7c8decf2c11e018e4d1365dfb148ad09f331f176bdd60481f7624283b58631befd1487464bfe9e1ec174d196c234fd3b235
-
Filesize
708KB
MD51911bcb2eeaa99ae1aea094d6d1d9f5a
SHA1306a07887453d8b003e98a4b591363eac13d7989
SHA2563b44deb9e107d29382e254fe3a6fd936efa8eb1d4214619068aa0462aca0c3df
SHA512b26697216f364b2c13907eb875d5a7c8decf2c11e018e4d1365dfb148ad09f331f176bdd60481f7624283b58631befd1487464bfe9e1ec174d196c234fd3b235
-
Filesize
832KB
MD566805b538e88764367a3dcdfd88283a0
SHA13ed7e44b1985bb215da47a03cee573705f870b31
SHA256e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040
SHA512c4e35549adac9fe19cd5ef5dcc75de56c515e5eb1478dee52ab893bf9e17ed8a64f1b9efb19ee1c81349c6bc0cacd19681151167df979a8387e35ac965dd98ab
-
Filesize
832KB
MD566805b538e88764367a3dcdfd88283a0
SHA13ed7e44b1985bb215da47a03cee573705f870b31
SHA256e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040
SHA512c4e35549adac9fe19cd5ef5dcc75de56c515e5eb1478dee52ab893bf9e17ed8a64f1b9efb19ee1c81349c6bc0cacd19681151167df979a8387e35ac965dd98ab
-
Filesize
832KB
MD566805b538e88764367a3dcdfd88283a0
SHA13ed7e44b1985bb215da47a03cee573705f870b31
SHA256e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040
SHA512c4e35549adac9fe19cd5ef5dcc75de56c515e5eb1478dee52ab893bf9e17ed8a64f1b9efb19ee1c81349c6bc0cacd19681151167df979a8387e35ac965dd98ab
-
Filesize
832KB
MD566805b538e88764367a3dcdfd88283a0
SHA13ed7e44b1985bb215da47a03cee573705f870b31
SHA256e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040
SHA512c4e35549adac9fe19cd5ef5dcc75de56c515e5eb1478dee52ab893bf9e17ed8a64f1b9efb19ee1c81349c6bc0cacd19681151167df979a8387e35ac965dd98ab
-
Filesize
832KB
MD566805b538e88764367a3dcdfd88283a0
SHA13ed7e44b1985bb215da47a03cee573705f870b31
SHA256e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040
SHA512c4e35549adac9fe19cd5ef5dcc75de56c515e5eb1478dee52ab893bf9e17ed8a64f1b9efb19ee1c81349c6bc0cacd19681151167df979a8387e35ac965dd98ab
-
Filesize
320KB
MD51dd5dd5561723f37ccc81e15ecdbf830
SHA1eeb9131c8d276ceb710d163e89fdc62b3e111971
SHA256c8c542ac3f6526d1501c2b9d6262bfa029a1ac0d9dd6b3c1965977abdd8bd126
SHA512b4881d7cd0c2ceeba067e13d23763e739389108d1269acd6c343dd308aa1fedde89da696a8482944342f44ea1094ea6b50021a15d4c6d03762ba032a9598bba5
-
Filesize
320KB
MD51dd5dd5561723f37ccc81e15ecdbf830
SHA1eeb9131c8d276ceb710d163e89fdc62b3e111971
SHA256c8c542ac3f6526d1501c2b9d6262bfa029a1ac0d9dd6b3c1965977abdd8bd126
SHA512b4881d7cd0c2ceeba067e13d23763e739389108d1269acd6c343dd308aa1fedde89da696a8482944342f44ea1094ea6b50021a15d4c6d03762ba032a9598bba5
-
Filesize
832KB
MD566805b538e88764367a3dcdfd88283a0
SHA13ed7e44b1985bb215da47a03cee573705f870b31
SHA256e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040
SHA512c4e35549adac9fe19cd5ef5dcc75de56c515e5eb1478dee52ab893bf9e17ed8a64f1b9efb19ee1c81349c6bc0cacd19681151167df979a8387e35ac965dd98ab
-
Filesize
832KB
MD566805b538e88764367a3dcdfd88283a0
SHA13ed7e44b1985bb215da47a03cee573705f870b31
SHA256e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040
SHA512c4e35549adac9fe19cd5ef5dcc75de56c515e5eb1478dee52ab893bf9e17ed8a64f1b9efb19ee1c81349c6bc0cacd19681151167df979a8387e35ac965dd98ab
-
Filesize
832KB
MD566805b538e88764367a3dcdfd88283a0
SHA13ed7e44b1985bb215da47a03cee573705f870b31
SHA256e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040
SHA512c4e35549adac9fe19cd5ef5dcc75de56c515e5eb1478dee52ab893bf9e17ed8a64f1b9efb19ee1c81349c6bc0cacd19681151167df979a8387e35ac965dd98ab
-
Filesize
832KB
MD566805b538e88764367a3dcdfd88283a0
SHA13ed7e44b1985bb215da47a03cee573705f870b31
SHA256e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040
SHA512c4e35549adac9fe19cd5ef5dcc75de56c515e5eb1478dee52ab893bf9e17ed8a64f1b9efb19ee1c81349c6bc0cacd19681151167df979a8387e35ac965dd98ab
-
Filesize
832KB
MD566805b538e88764367a3dcdfd88283a0
SHA13ed7e44b1985bb215da47a03cee573705f870b31
SHA256e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040
SHA512c4e35549adac9fe19cd5ef5dcc75de56c515e5eb1478dee52ab893bf9e17ed8a64f1b9efb19ee1c81349c6bc0cacd19681151167df979a8387e35ac965dd98ab
-
Filesize
832KB
MD566805b538e88764367a3dcdfd88283a0
SHA13ed7e44b1985bb215da47a03cee573705f870b31
SHA256e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040
SHA512c4e35549adac9fe19cd5ef5dcc75de56c515e5eb1478dee52ab893bf9e17ed8a64f1b9efb19ee1c81349c6bc0cacd19681151167df979a8387e35ac965dd98ab
-
Filesize
832KB
MD566805b538e88764367a3dcdfd88283a0
SHA13ed7e44b1985bb215da47a03cee573705f870b31
SHA256e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040
SHA512c4e35549adac9fe19cd5ef5dcc75de56c515e5eb1478dee52ab893bf9e17ed8a64f1b9efb19ee1c81349c6bc0cacd19681151167df979a8387e35ac965dd98ab
-
Filesize
832KB
MD566805b538e88764367a3dcdfd88283a0
SHA13ed7e44b1985bb215da47a03cee573705f870b31
SHA256e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040
SHA512c4e35549adac9fe19cd5ef5dcc75de56c515e5eb1478dee52ab893bf9e17ed8a64f1b9efb19ee1c81349c6bc0cacd19681151167df979a8387e35ac965dd98ab
-
Filesize
832KB
MD566805b538e88764367a3dcdfd88283a0
SHA13ed7e44b1985bb215da47a03cee573705f870b31
SHA256e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040
SHA512c4e35549adac9fe19cd5ef5dcc75de56c515e5eb1478dee52ab893bf9e17ed8a64f1b9efb19ee1c81349c6bc0cacd19681151167df979a8387e35ac965dd98ab
-
Filesize
832KB
MD566805b538e88764367a3dcdfd88283a0
SHA13ed7e44b1985bb215da47a03cee573705f870b31
SHA256e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040
SHA512c4e35549adac9fe19cd5ef5dcc75de56c515e5eb1478dee52ab893bf9e17ed8a64f1b9efb19ee1c81349c6bc0cacd19681151167df979a8387e35ac965dd98ab
-
Filesize
832KB
MD566805b538e88764367a3dcdfd88283a0
SHA13ed7e44b1985bb215da47a03cee573705f870b31
SHA256e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040
SHA512c4e35549adac9fe19cd5ef5dcc75de56c515e5eb1478dee52ab893bf9e17ed8a64f1b9efb19ee1c81349c6bc0cacd19681151167df979a8387e35ac965dd98ab
-
Filesize
832KB
MD566805b538e88764367a3dcdfd88283a0
SHA13ed7e44b1985bb215da47a03cee573705f870b31
SHA256e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040
SHA512c4e35549adac9fe19cd5ef5dcc75de56c515e5eb1478dee52ab893bf9e17ed8a64f1b9efb19ee1c81349c6bc0cacd19681151167df979a8387e35ac965dd98ab
-
Filesize
832KB
MD566805b538e88764367a3dcdfd88283a0
SHA13ed7e44b1985bb215da47a03cee573705f870b31
SHA256e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040
SHA512c4e35549adac9fe19cd5ef5dcc75de56c515e5eb1478dee52ab893bf9e17ed8a64f1b9efb19ee1c81349c6bc0cacd19681151167df979a8387e35ac965dd98ab
-
Filesize
832KB
MD566805b538e88764367a3dcdfd88283a0
SHA13ed7e44b1985bb215da47a03cee573705f870b31
SHA256e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040
SHA512c4e35549adac9fe19cd5ef5dcc75de56c515e5eb1478dee52ab893bf9e17ed8a64f1b9efb19ee1c81349c6bc0cacd19681151167df979a8387e35ac965dd98ab
-
Filesize
832KB
MD566805b538e88764367a3dcdfd88283a0
SHA13ed7e44b1985bb215da47a03cee573705f870b31
SHA256e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040
SHA512c4e35549adac9fe19cd5ef5dcc75de56c515e5eb1478dee52ab893bf9e17ed8a64f1b9efb19ee1c81349c6bc0cacd19681151167df979a8387e35ac965dd98ab
-
Filesize
832KB
MD566805b538e88764367a3dcdfd88283a0
SHA13ed7e44b1985bb215da47a03cee573705f870b31
SHA256e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040
SHA512c4e35549adac9fe19cd5ef5dcc75de56c515e5eb1478dee52ab893bf9e17ed8a64f1b9efb19ee1c81349c6bc0cacd19681151167df979a8387e35ac965dd98ab
-
Filesize
832KB
MD566805b538e88764367a3dcdfd88283a0
SHA13ed7e44b1985bb215da47a03cee573705f870b31
SHA256e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040
SHA512c4e35549adac9fe19cd5ef5dcc75de56c515e5eb1478dee52ab893bf9e17ed8a64f1b9efb19ee1c81349c6bc0cacd19681151167df979a8387e35ac965dd98ab
-
Filesize
832KB
MD566805b538e88764367a3dcdfd88283a0
SHA13ed7e44b1985bb215da47a03cee573705f870b31
SHA256e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040
SHA512c4e35549adac9fe19cd5ef5dcc75de56c515e5eb1478dee52ab893bf9e17ed8a64f1b9efb19ee1c81349c6bc0cacd19681151167df979a8387e35ac965dd98ab
-
Filesize
832KB
MD566805b538e88764367a3dcdfd88283a0
SHA13ed7e44b1985bb215da47a03cee573705f870b31
SHA256e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040
SHA512c4e35549adac9fe19cd5ef5dcc75de56c515e5eb1478dee52ab893bf9e17ed8a64f1b9efb19ee1c81349c6bc0cacd19681151167df979a8387e35ac965dd98ab
-
Filesize
832KB
MD566805b538e88764367a3dcdfd88283a0
SHA13ed7e44b1985bb215da47a03cee573705f870b31
SHA256e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040
SHA512c4e35549adac9fe19cd5ef5dcc75de56c515e5eb1478dee52ab893bf9e17ed8a64f1b9efb19ee1c81349c6bc0cacd19681151167df979a8387e35ac965dd98ab
-
Filesize
832KB
MD566805b538e88764367a3dcdfd88283a0
SHA13ed7e44b1985bb215da47a03cee573705f870b31
SHA256e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040
SHA512c4e35549adac9fe19cd5ef5dcc75de56c515e5eb1478dee52ab893bf9e17ed8a64f1b9efb19ee1c81349c6bc0cacd19681151167df979a8387e35ac965dd98ab
-
Filesize
832KB
MD566805b538e88764367a3dcdfd88283a0
SHA13ed7e44b1985bb215da47a03cee573705f870b31
SHA256e30472c94357090f0be7e4baa072fe68d17a1b46d20948768c1af7aa811bb040
SHA512c4e35549adac9fe19cd5ef5dcc75de56c515e5eb1478dee52ab893bf9e17ed8a64f1b9efb19ee1c81349c6bc0cacd19681151167df979a8387e35ac965dd98ab