Analysis
-
max time kernel
153s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2022, 03:02
Static task
static1
Behavioral task
behavioral1
Sample
ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe
Resource
win7-20220901-en
windows7-x64
Behavioral task
behavioral2
Sample
ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
General
-
Target
ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe
-
Size
1016KB
-
MD5
7ae900f7fff466f802d5f647c8b10df0
-
SHA1
691e97b140d66e57aa2310cbb7d6c7ca7972ca9b
-
SHA256
ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f
-
SHA512
644fdc5608aedabeebf8c1ea2fac6e5c084b1a58c02c82508c2463e9cf7a67ac35c7e15e78248dac4665aae2d433509f9e317a4bd7caee06e00e328baebe7d16
-
SSDEEP
6144:bfIXsL0tvrSVz1DnemeYbpsnEf78AoXh6KkiD0OofzA+/VygHUq:bfIXsgtvm1De5YlOx6lzBH46U
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" grrfdxtjqbb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" kuaamq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" kuaamq.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" kuaamq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" kuaamq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" kuaamq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" kuaamq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" kuaamq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" kuaamq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" kuaamq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" kuaamq.exe -
Adds policy Run key to start application 2 TTPs 27 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run grrfdxtjqbb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rgrwnwfqfbm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xunazqhaxbucyegkiif.exe" kuaamq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ogucwiuiaznqhi = "miamkaqiehzgbghkhg.exe" kuaamq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ogucwiuiaznqhi = "wqgqmaoeyzpunqpq.exe" kuaamq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ogucwiuiaznqhi = "wqgqmaoeyzpunqpq.exe" kuaamq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ogucwiuiaznqhi = "kicqqiausxraxehmlmke.exe" kuaamq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rgrwnwfqfbm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wqgqmaoeyzpunqpq.exe" kuaamq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rgrwnwfqfbm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kicqqiausxraxehmlmke.exe" kuaamq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run kuaamq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rgrwnwfqfbm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dypaxmbsnpgmgkkmi.exe" kuaamq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ogucwiuiaznqhi = "miamkaqiehzgbghkhg.exe" grrfdxtjqbb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rgrwnwfqfbm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zytijcvqpvqaygkqqsrmb.exe" kuaamq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ogucwiuiaznqhi = "wqgqmaoeyzpunqpq.exe" grrfdxtjqbb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ogucwiuiaznqhi = "zytijcvqpvqaygkqqsrmb.exe" kuaamq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rgrwnwfqfbm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zytijcvqpvqaygkqqsrmb.exe" kuaamq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rgrwnwfqfbm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kicqqiausxraxehmlmke.exe" kuaamq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rgrwnwfqfbm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wqgqmaoeyzpunqpq.exe" kuaamq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run kuaamq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ogucwiuiaznqhi = "miamkaqiehzgbghkhg.exe" kuaamq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rgrwnwfqfbm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\miamkaqiehzgbghkhg.exe" kuaamq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ogucwiuiaznqhi = "zytijcvqpvqaygkqqsrmb.exe" kuaamq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ogucwiuiaznqhi = "dypaxmbsnpgmgkkmi.exe" kuaamq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rgrwnwfqfbm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xunazqhaxbucyegkiif.exe" grrfdxtjqbb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rgrwnwfqfbm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\miamkaqiehzgbghkhg.exe" kuaamq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ogucwiuiaznqhi = "dypaxmbsnpgmgkkmi.exe" kuaamq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rgrwnwfqfbm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dypaxmbsnpgmgkkmi.exe" kuaamq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ogucwiuiaznqhi = "xunazqhaxbucyegkiif.exe" kuaamq.exe -
Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" grrfdxtjqbb.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" kuaamq.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" kuaamq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" kuaamq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" kuaamq.exe -
Executes dropped EXE 3 IoCs
pid Process 4152 grrfdxtjqbb.exe 5040 kuaamq.exe 5044 kuaamq.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation grrfdxtjqbb.exe -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\miamkaqiehzgbghkhg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\miamkaqiehzgbghkhg.exe" kuaamq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\dypaxmbsnpgmgkkmi = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xunazqhaxbucyegkiif.exe ." kuaamq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\oeqwoyiukhtu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xunazqhaxbucyegkiif.exe" kuaamq.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run kuaamq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\oeqwoyiukhtu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kicqqiausxraxehmlmke.exe" kuaamq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\neryrcnarpceu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dypaxmbsnpgmgkkmi.exe ." kuaamq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\neryrcnarpceu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zytijcvqpvqaygkqqsrmb.exe ." kuaamq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\dypaxmbsnpgmgkkmi = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wqgqmaoeyzpunqpq.exe ." kuaamq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\neryrcnarpceu = "wqgqmaoeyzpunqpq.exe ." kuaamq.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run grrfdxtjqbb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\neryrcnarpceu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xunazqhaxbucyegkiif.exe ." kuaamq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\miamkaqiehzgbghkhg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zytijcvqpvqaygkqqsrmb.exe" kuaamq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oeqwoyiukhtu = "dypaxmbsnpgmgkkmi.exe" kuaamq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oeqwoyiukhtu = "zytijcvqpvqaygkqqsrmb.exe" kuaamq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\neryrcnarpceu = "miamkaqiehzgbghkhg.exe ." kuaamq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wqgqmaoeyzpunqpq = "xunazqhaxbucyegkiif.exe ." grrfdxtjqbb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\neryrcnarpceu = "dypaxmbsnpgmgkkmi.exe ." grrfdxtjqbb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\miamkaqiehzgbghkhg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kicqqiausxraxehmlmke.exe" kuaamq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\dypaxmbsnpgmgkkmi = "C:\\Users\\Admin\\AppData\\Local\\Temp\\miamkaqiehzgbghkhg.exe ." kuaamq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wqgqmaoeyzpunqpq = "miamkaqiehzgbghkhg.exe ." kuaamq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rkzidqdsllaewyw = "wqgqmaoeyzpunqpq.exe" kuaamq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rkzidqdsllaewyw = "zytijcvqpvqaygkqqsrmb.exe" kuaamq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oeqwoyiukhtu = "wqgqmaoeyzpunqpq.exe" grrfdxtjqbb.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce grrfdxtjqbb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oeqwoyiukhtu = "wqgqmaoeyzpunqpq.exe" kuaamq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oeqwoyiukhtu = "zytijcvqpvqaygkqqsrmb.exe" grrfdxtjqbb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oeqwoyiukhtu = "wqgqmaoeyzpunqpq.exe" kuaamq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wqgqmaoeyzpunqpq = "kicqqiausxraxehmlmke.exe ." kuaamq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rkzidqdsllaewyw = "miamkaqiehzgbghkhg.exe" kuaamq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rkzidqdsllaewyw = "dypaxmbsnpgmgkkmi.exe" grrfdxtjqbb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\miamkaqiehzgbghkhg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dypaxmbsnpgmgkkmi.exe" kuaamq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\dypaxmbsnpgmgkkmi = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kicqqiausxraxehmlmke.exe ." kuaamq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\neryrcnarpceu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wqgqmaoeyzpunqpq.exe ." kuaamq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\oeqwoyiukhtu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\miamkaqiehzgbghkhg.exe" kuaamq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\miamkaqiehzgbghkhg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wqgqmaoeyzpunqpq.exe" kuaamq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\neryrcnarpceu = "xunazqhaxbucyegkiif.exe ." kuaamq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\neryrcnarpceu = "dypaxmbsnpgmgkkmi.exe ." kuaamq.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce grrfdxtjqbb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\miamkaqiehzgbghkhg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zytijcvqpvqaygkqqsrmb.exe" grrfdxtjqbb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rkzidqdsllaewyw = "dypaxmbsnpgmgkkmi.exe" kuaamq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rkzidqdsllaewyw = "kicqqiausxraxehmlmke.exe" kuaamq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\oeqwoyiukhtu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wqgqmaoeyzpunqpq.exe" kuaamq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\neryrcnarpceu = "kicqqiausxraxehmlmke.exe ." kuaamq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wqgqmaoeyzpunqpq = "wqgqmaoeyzpunqpq.exe ." kuaamq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\neryrcnarpceu = "miamkaqiehzgbghkhg.exe ." kuaamq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\dypaxmbsnpgmgkkmi = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dypaxmbsnpgmgkkmi.exe ." kuaamq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\miamkaqiehzgbghkhg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xunazqhaxbucyegkiif.exe" kuaamq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\dypaxmbsnpgmgkkmi = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kicqqiausxraxehmlmke.exe ." grrfdxtjqbb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\neryrcnarpceu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xunazqhaxbucyegkiif.exe ." kuaamq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\neryrcnarpceu = "dypaxmbsnpgmgkkmi.exe ." kuaamq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\oeqwoyiukhtu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\miamkaqiehzgbghkhg.exe" kuaamq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\miamkaqiehzgbghkhg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dypaxmbsnpgmgkkmi.exe" kuaamq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\oeqwoyiukhtu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zytijcvqpvqaygkqqsrmb.exe" kuaamq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\neryrcnarpceu = "kicqqiausxraxehmlmke.exe ." grrfdxtjqbb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rkzidqdsllaewyw = "xunazqhaxbucyegkiif.exe" kuaamq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\dypaxmbsnpgmgkkmi = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zytijcvqpvqaygkqqsrmb.exe ." kuaamq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wqgqmaoeyzpunqpq = "dypaxmbsnpgmgkkmi.exe ." kuaamq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\neryrcnarpceu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wqgqmaoeyzpunqpq.exe ." kuaamq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wqgqmaoeyzpunqpq = "zytijcvqpvqaygkqqsrmb.exe ." kuaamq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\neryrcnarpceu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zytijcvqpvqaygkqqsrmb.exe ." kuaamq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oeqwoyiukhtu = "kicqqiausxraxehmlmke.exe" kuaamq.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce kuaamq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oeqwoyiukhtu = "dypaxmbsnpgmgkkmi.exe" kuaamq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rkzidqdsllaewyw = "dypaxmbsnpgmgkkmi.exe" kuaamq.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" kuaamq.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA kuaamq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" grrfdxtjqbb.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" kuaamq.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA kuaamq.exe -
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 31 whatismyip.everdot.org 42 whatismyip.everdot.org 20 whatismyipaddress.com 27 www.showmyipaddress.com -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf kuaamq.exe File created C:\autorun.inf kuaamq.exe -
Drops file in System32 directory 25 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\dypaxmbsnpgmgkkmi.exe grrfdxtjqbb.exe File opened for modification C:\Windows\SysWOW64\dypaxmbsnpgmgkkmi.exe kuaamq.exe File opened for modification C:\Windows\SysWOW64\wqgqmaoeyzpunqpq.exe kuaamq.exe File opened for modification C:\Windows\SysWOW64\qqmceysoovrcbkpwxaawmo.exe kuaamq.exe File created C:\Windows\SysWOW64\ogucwiuiaznqhifexskygamymedrulmjibwo.keq kuaamq.exe File opened for modification C:\Windows\SysWOW64\wqgqmaoeyzpunqpq.exe grrfdxtjqbb.exe File opened for modification C:\Windows\SysWOW64\qqmceysoovrcbkpwxaawmo.exe grrfdxtjqbb.exe File opened for modification C:\Windows\SysWOW64\miamkaqiehzgbghkhg.exe grrfdxtjqbb.exe File opened for modification C:\Windows\SysWOW64\xunazqhaxbucyegkiif.exe grrfdxtjqbb.exe File opened for modification C:\Windows\SysWOW64\kicqqiausxraxehmlmke.exe grrfdxtjqbb.exe File opened for modification C:\Windows\SysWOW64\zytijcvqpvqaygkqqsrmb.exe grrfdxtjqbb.exe File opened for modification C:\Windows\SysWOW64\wqgqmaoeyzpunqpq.exe kuaamq.exe File opened for modification C:\Windows\SysWOW64\xunazqhaxbucyegkiif.exe kuaamq.exe File opened for modification C:\Windows\SysWOW64\kicqqiausxraxehmlmke.exe kuaamq.exe File opened for modification C:\Windows\SysWOW64\qqmceysoovrcbkpwxaawmo.exe kuaamq.exe File opened for modification C:\Windows\SysWOW64\dypaxmbsnpgmgkkmi.exe kuaamq.exe File opened for modification C:\Windows\SysWOW64\zytijcvqpvqaygkqqsrmb.exe kuaamq.exe File created C:\Windows\SysWOW64\jqtqzabelzcuaqcqyipspyzad.ybt kuaamq.exe File opened for modification C:\Windows\SysWOW64\miamkaqiehzgbghkhg.exe kuaamq.exe File opened for modification C:\Windows\SysWOW64\zytijcvqpvqaygkqqsrmb.exe kuaamq.exe File opened for modification C:\Windows\SysWOW64\miamkaqiehzgbghkhg.exe kuaamq.exe File opened for modification C:\Windows\SysWOW64\xunazqhaxbucyegkiif.exe kuaamq.exe File opened for modification C:\Windows\SysWOW64\kicqqiausxraxehmlmke.exe kuaamq.exe File opened for modification C:\Windows\SysWOW64\jqtqzabelzcuaqcqyipspyzad.ybt kuaamq.exe File opened for modification C:\Windows\SysWOW64\ogucwiuiaznqhifexskygamymedrulmjibwo.keq kuaamq.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files (x86)\ogucwiuiaznqhifexskygamymedrulmjibwo.keq kuaamq.exe File opened for modification C:\Program Files (x86)\jqtqzabelzcuaqcqyipspyzad.ybt kuaamq.exe File created C:\Program Files (x86)\jqtqzabelzcuaqcqyipspyzad.ybt kuaamq.exe File opened for modification C:\Program Files (x86)\ogucwiuiaznqhifexskygamymedrulmjibwo.keq kuaamq.exe -
Drops file in Windows directory 25 IoCs
description ioc Process File opened for modification C:\Windows\dypaxmbsnpgmgkkmi.exe kuaamq.exe File opened for modification C:\Windows\miamkaqiehzgbghkhg.exe kuaamq.exe File opened for modification C:\Windows\qqmceysoovrcbkpwxaawmo.exe kuaamq.exe File created C:\Windows\jqtqzabelzcuaqcqyipspyzad.ybt kuaamq.exe File opened for modification C:\Windows\ogucwiuiaznqhifexskygamymedrulmjibwo.keq kuaamq.exe File opened for modification C:\Windows\dypaxmbsnpgmgkkmi.exe grrfdxtjqbb.exe File opened for modification C:\Windows\zytijcvqpvqaygkqqsrmb.exe grrfdxtjqbb.exe File opened for modification C:\Windows\zytijcvqpvqaygkqqsrmb.exe kuaamq.exe File created C:\Windows\ogucwiuiaznqhifexskygamymedrulmjibwo.keq kuaamq.exe File opened for modification C:\Windows\qqmceysoovrcbkpwxaawmo.exe kuaamq.exe File opened for modification C:\Windows\xunazqhaxbucyegkiif.exe kuaamq.exe File opened for modification C:\Windows\kicqqiausxraxehmlmke.exe kuaamq.exe File opened for modification C:\Windows\jqtqzabelzcuaqcqyipspyzad.ybt kuaamq.exe File opened for modification C:\Windows\wqgqmaoeyzpunqpq.exe kuaamq.exe File opened for modification C:\Windows\dypaxmbsnpgmgkkmi.exe kuaamq.exe File opened for modification C:\Windows\xunazqhaxbucyegkiif.exe kuaamq.exe File opened for modification C:\Windows\miamkaqiehzgbghkhg.exe grrfdxtjqbb.exe File opened for modification C:\Windows\miamkaqiehzgbghkhg.exe kuaamq.exe File opened for modification C:\Windows\zytijcvqpvqaygkqqsrmb.exe kuaamq.exe File opened for modification C:\Windows\qqmceysoovrcbkpwxaawmo.exe grrfdxtjqbb.exe File opened for modification C:\Windows\kicqqiausxraxehmlmke.exe kuaamq.exe File opened for modification C:\Windows\wqgqmaoeyzpunqpq.exe kuaamq.exe File opened for modification C:\Windows\wqgqmaoeyzpunqpq.exe grrfdxtjqbb.exe File opened for modification C:\Windows\xunazqhaxbucyegkiif.exe grrfdxtjqbb.exe File opened for modification C:\Windows\kicqqiausxraxehmlmke.exe grrfdxtjqbb.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4928 ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe 4928 ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe 4928 ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe 4928 ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe 4928 ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe 4928 ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe 4928 ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe 4928 ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe 4928 ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe 4928 ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe 4928 ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe 4928 ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe 4928 ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe 4928 ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe 4928 ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe 4928 ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe 4928 ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe 4928 ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe 5040 kuaamq.exe 5040 kuaamq.exe 4928 ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe 4928 ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe 4928 ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe 4928 ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe 4928 ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe 4928 ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe 4928 ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe 4928 ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe 4928 ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe 4928 ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe 4928 ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe 4928 ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe 4928 ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe 4928 ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe 4928 ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe 4928 ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe 4928 ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe 4928 ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe 4928 ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe 4928 ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe 4928 ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe 4928 ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe 4928 ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe 4928 ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe 4928 ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe 4928 ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe 4928 ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe 4928 ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe 4928 ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe 4928 ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe 4928 ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe 4928 ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe 4928 ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe 4928 ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe 5040 kuaamq.exe 5040 kuaamq.exe 4928 ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe 4928 ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe 4928 ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe 4928 ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe 4928 ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe 4928 ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe 4928 ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe 4928 ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 5040 kuaamq.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4928 wrote to memory of 4152 4928 ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe 84 PID 4928 wrote to memory of 4152 4928 ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe 84 PID 4928 wrote to memory of 4152 4928 ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe 84 PID 4152 wrote to memory of 5040 4152 grrfdxtjqbb.exe 85 PID 4152 wrote to memory of 5040 4152 grrfdxtjqbb.exe 85 PID 4152 wrote to memory of 5040 4152 grrfdxtjqbb.exe 85 PID 4152 wrote to memory of 5044 4152 grrfdxtjqbb.exe 86 PID 4152 wrote to memory of 5044 4152 grrfdxtjqbb.exe 86 PID 4152 wrote to memory of 5044 4152 grrfdxtjqbb.exe 86 -
System policy modification 1 TTPs 39 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" kuaamq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" kuaamq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" kuaamq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" kuaamq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" kuaamq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" kuaamq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" kuaamq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" kuaamq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" kuaamq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" kuaamq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" grrfdxtjqbb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" kuaamq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" kuaamq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer kuaamq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer kuaamq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" grrfdxtjqbb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System kuaamq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" kuaamq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" kuaamq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" kuaamq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System kuaamq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" kuaamq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" kuaamq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" kuaamq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" kuaamq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" kuaamq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" kuaamq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" kuaamq.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe"C:\Users\Admin\AppData\Local\Temp\ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\grrfdxtjqbb.exe"C:\Users\Admin\AppData\Local\Temp\grrfdxtjqbb.exe" "c:\users\admin\appdata\local\temp\ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f.exe*"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\kuaamq.exe"C:\Users\Admin\AppData\Local\Temp\kuaamq.exe" "-C:\Users\Admin\AppData\Local\Temp\wqgqmaoeyzpunqpq.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:5040
-
-
C:\Users\Admin\AppData\Local\Temp\kuaamq.exe"C:\Users\Admin\AppData\Local\Temp\kuaamq.exe" "-C:\Users\Admin\AppData\Local\Temp\wqgqmaoeyzpunqpq.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- System policy modification
PID:5044
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1016KB
MD57ae900f7fff466f802d5f647c8b10df0
SHA1691e97b140d66e57aa2310cbb7d6c7ca7972ca9b
SHA256ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f
SHA512644fdc5608aedabeebf8c1ea2fac6e5c084b1a58c02c82508c2463e9cf7a67ac35c7e15e78248dac4665aae2d433509f9e317a4bd7caee06e00e328baebe7d16
-
Filesize
320KB
MD572003524a885e8a5af84caf05d1574d3
SHA1f6d7c7c0101bde91556a04a5b46c83e906967e81
SHA256d5c0baa2888a0576541f97e268b16b2352ec31ac10d8c6533e1fb13fb4ed3d23
SHA512489d9a2ebe1f8240ae79fadd4d49f3fdcb6c20081f48d02ef08b8ad8537557900bee67fb947181cbb31408462f57ef508eddd9abe63328b5ec9bedc04fd02878
-
Filesize
320KB
MD572003524a885e8a5af84caf05d1574d3
SHA1f6d7c7c0101bde91556a04a5b46c83e906967e81
SHA256d5c0baa2888a0576541f97e268b16b2352ec31ac10d8c6533e1fb13fb4ed3d23
SHA512489d9a2ebe1f8240ae79fadd4d49f3fdcb6c20081f48d02ef08b8ad8537557900bee67fb947181cbb31408462f57ef508eddd9abe63328b5ec9bedc04fd02878
-
Filesize
1016KB
MD57ae900f7fff466f802d5f647c8b10df0
SHA1691e97b140d66e57aa2310cbb7d6c7ca7972ca9b
SHA256ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f
SHA512644fdc5608aedabeebf8c1ea2fac6e5c084b1a58c02c82508c2463e9cf7a67ac35c7e15e78248dac4665aae2d433509f9e317a4bd7caee06e00e328baebe7d16
-
Filesize
724KB
MD5572ff088a0130b143751977faf405f25
SHA1d650f4061a421f7824b03b3b4c9360d318681b88
SHA2560e18887d103f026cb32a80f35c4f3bd9deaabec5a401e7c8fffb6e36aa96f64b
SHA512818e3c293d40893bfcdacc2d61c099cb4f8d39919f55c4fe73df8d5d6fdb7c617f59e72c6ed213fc605592fcfa4d0cd37477453127430d5c18058ae6fecbc9c6
-
Filesize
724KB
MD5572ff088a0130b143751977faf405f25
SHA1d650f4061a421f7824b03b3b4c9360d318681b88
SHA2560e18887d103f026cb32a80f35c4f3bd9deaabec5a401e7c8fffb6e36aa96f64b
SHA512818e3c293d40893bfcdacc2d61c099cb4f8d39919f55c4fe73df8d5d6fdb7c617f59e72c6ed213fc605592fcfa4d0cd37477453127430d5c18058ae6fecbc9c6
-
Filesize
724KB
MD5572ff088a0130b143751977faf405f25
SHA1d650f4061a421f7824b03b3b4c9360d318681b88
SHA2560e18887d103f026cb32a80f35c4f3bd9deaabec5a401e7c8fffb6e36aa96f64b
SHA512818e3c293d40893bfcdacc2d61c099cb4f8d39919f55c4fe73df8d5d6fdb7c617f59e72c6ed213fc605592fcfa4d0cd37477453127430d5c18058ae6fecbc9c6
-
Filesize
1016KB
MD57ae900f7fff466f802d5f647c8b10df0
SHA1691e97b140d66e57aa2310cbb7d6c7ca7972ca9b
SHA256ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f
SHA512644fdc5608aedabeebf8c1ea2fac6e5c084b1a58c02c82508c2463e9cf7a67ac35c7e15e78248dac4665aae2d433509f9e317a4bd7caee06e00e328baebe7d16
-
Filesize
1016KB
MD57ae900f7fff466f802d5f647c8b10df0
SHA1691e97b140d66e57aa2310cbb7d6c7ca7972ca9b
SHA256ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f
SHA512644fdc5608aedabeebf8c1ea2fac6e5c084b1a58c02c82508c2463e9cf7a67ac35c7e15e78248dac4665aae2d433509f9e317a4bd7caee06e00e328baebe7d16
-
Filesize
1016KB
MD57ae900f7fff466f802d5f647c8b10df0
SHA1691e97b140d66e57aa2310cbb7d6c7ca7972ca9b
SHA256ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f
SHA512644fdc5608aedabeebf8c1ea2fac6e5c084b1a58c02c82508c2463e9cf7a67ac35c7e15e78248dac4665aae2d433509f9e317a4bd7caee06e00e328baebe7d16
-
Filesize
1016KB
MD57ae900f7fff466f802d5f647c8b10df0
SHA1691e97b140d66e57aa2310cbb7d6c7ca7972ca9b
SHA256ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f
SHA512644fdc5608aedabeebf8c1ea2fac6e5c084b1a58c02c82508c2463e9cf7a67ac35c7e15e78248dac4665aae2d433509f9e317a4bd7caee06e00e328baebe7d16
-
Filesize
1016KB
MD57ae900f7fff466f802d5f647c8b10df0
SHA1691e97b140d66e57aa2310cbb7d6c7ca7972ca9b
SHA256ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f
SHA512644fdc5608aedabeebf8c1ea2fac6e5c084b1a58c02c82508c2463e9cf7a67ac35c7e15e78248dac4665aae2d433509f9e317a4bd7caee06e00e328baebe7d16
-
Filesize
1016KB
MD57ae900f7fff466f802d5f647c8b10df0
SHA1691e97b140d66e57aa2310cbb7d6c7ca7972ca9b
SHA256ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f
SHA512644fdc5608aedabeebf8c1ea2fac6e5c084b1a58c02c82508c2463e9cf7a67ac35c7e15e78248dac4665aae2d433509f9e317a4bd7caee06e00e328baebe7d16
-
Filesize
1016KB
MD57ae900f7fff466f802d5f647c8b10df0
SHA1691e97b140d66e57aa2310cbb7d6c7ca7972ca9b
SHA256ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f
SHA512644fdc5608aedabeebf8c1ea2fac6e5c084b1a58c02c82508c2463e9cf7a67ac35c7e15e78248dac4665aae2d433509f9e317a4bd7caee06e00e328baebe7d16
-
Filesize
1016KB
MD57ae900f7fff466f802d5f647c8b10df0
SHA1691e97b140d66e57aa2310cbb7d6c7ca7972ca9b
SHA256ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f
SHA512644fdc5608aedabeebf8c1ea2fac6e5c084b1a58c02c82508c2463e9cf7a67ac35c7e15e78248dac4665aae2d433509f9e317a4bd7caee06e00e328baebe7d16
-
Filesize
1016KB
MD57ae900f7fff466f802d5f647c8b10df0
SHA1691e97b140d66e57aa2310cbb7d6c7ca7972ca9b
SHA256ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f
SHA512644fdc5608aedabeebf8c1ea2fac6e5c084b1a58c02c82508c2463e9cf7a67ac35c7e15e78248dac4665aae2d433509f9e317a4bd7caee06e00e328baebe7d16
-
Filesize
1016KB
MD57ae900f7fff466f802d5f647c8b10df0
SHA1691e97b140d66e57aa2310cbb7d6c7ca7972ca9b
SHA256ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f
SHA512644fdc5608aedabeebf8c1ea2fac6e5c084b1a58c02c82508c2463e9cf7a67ac35c7e15e78248dac4665aae2d433509f9e317a4bd7caee06e00e328baebe7d16
-
Filesize
1016KB
MD57ae900f7fff466f802d5f647c8b10df0
SHA1691e97b140d66e57aa2310cbb7d6c7ca7972ca9b
SHA256ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f
SHA512644fdc5608aedabeebf8c1ea2fac6e5c084b1a58c02c82508c2463e9cf7a67ac35c7e15e78248dac4665aae2d433509f9e317a4bd7caee06e00e328baebe7d16
-
Filesize
1016KB
MD57ae900f7fff466f802d5f647c8b10df0
SHA1691e97b140d66e57aa2310cbb7d6c7ca7972ca9b
SHA256ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f
SHA512644fdc5608aedabeebf8c1ea2fac6e5c084b1a58c02c82508c2463e9cf7a67ac35c7e15e78248dac4665aae2d433509f9e317a4bd7caee06e00e328baebe7d16
-
Filesize
1016KB
MD57ae900f7fff466f802d5f647c8b10df0
SHA1691e97b140d66e57aa2310cbb7d6c7ca7972ca9b
SHA256ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f
SHA512644fdc5608aedabeebf8c1ea2fac6e5c084b1a58c02c82508c2463e9cf7a67ac35c7e15e78248dac4665aae2d433509f9e317a4bd7caee06e00e328baebe7d16
-
Filesize
1016KB
MD57ae900f7fff466f802d5f647c8b10df0
SHA1691e97b140d66e57aa2310cbb7d6c7ca7972ca9b
SHA256ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f
SHA512644fdc5608aedabeebf8c1ea2fac6e5c084b1a58c02c82508c2463e9cf7a67ac35c7e15e78248dac4665aae2d433509f9e317a4bd7caee06e00e328baebe7d16
-
Filesize
1016KB
MD57ae900f7fff466f802d5f647c8b10df0
SHA1691e97b140d66e57aa2310cbb7d6c7ca7972ca9b
SHA256ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f
SHA512644fdc5608aedabeebf8c1ea2fac6e5c084b1a58c02c82508c2463e9cf7a67ac35c7e15e78248dac4665aae2d433509f9e317a4bd7caee06e00e328baebe7d16
-
Filesize
1016KB
MD57ae900f7fff466f802d5f647c8b10df0
SHA1691e97b140d66e57aa2310cbb7d6c7ca7972ca9b
SHA256ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f
SHA512644fdc5608aedabeebf8c1ea2fac6e5c084b1a58c02c82508c2463e9cf7a67ac35c7e15e78248dac4665aae2d433509f9e317a4bd7caee06e00e328baebe7d16
-
Filesize
1016KB
MD57ae900f7fff466f802d5f647c8b10df0
SHA1691e97b140d66e57aa2310cbb7d6c7ca7972ca9b
SHA256ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f
SHA512644fdc5608aedabeebf8c1ea2fac6e5c084b1a58c02c82508c2463e9cf7a67ac35c7e15e78248dac4665aae2d433509f9e317a4bd7caee06e00e328baebe7d16
-
Filesize
1016KB
MD57ae900f7fff466f802d5f647c8b10df0
SHA1691e97b140d66e57aa2310cbb7d6c7ca7972ca9b
SHA256ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f
SHA512644fdc5608aedabeebf8c1ea2fac6e5c084b1a58c02c82508c2463e9cf7a67ac35c7e15e78248dac4665aae2d433509f9e317a4bd7caee06e00e328baebe7d16
-
Filesize
1016KB
MD57ae900f7fff466f802d5f647c8b10df0
SHA1691e97b140d66e57aa2310cbb7d6c7ca7972ca9b
SHA256ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f
SHA512644fdc5608aedabeebf8c1ea2fac6e5c084b1a58c02c82508c2463e9cf7a67ac35c7e15e78248dac4665aae2d433509f9e317a4bd7caee06e00e328baebe7d16
-
Filesize
1016KB
MD57ae900f7fff466f802d5f647c8b10df0
SHA1691e97b140d66e57aa2310cbb7d6c7ca7972ca9b
SHA256ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f
SHA512644fdc5608aedabeebf8c1ea2fac6e5c084b1a58c02c82508c2463e9cf7a67ac35c7e15e78248dac4665aae2d433509f9e317a4bd7caee06e00e328baebe7d16
-
Filesize
1016KB
MD57ae900f7fff466f802d5f647c8b10df0
SHA1691e97b140d66e57aa2310cbb7d6c7ca7972ca9b
SHA256ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f
SHA512644fdc5608aedabeebf8c1ea2fac6e5c084b1a58c02c82508c2463e9cf7a67ac35c7e15e78248dac4665aae2d433509f9e317a4bd7caee06e00e328baebe7d16
-
Filesize
1016KB
MD57ae900f7fff466f802d5f647c8b10df0
SHA1691e97b140d66e57aa2310cbb7d6c7ca7972ca9b
SHA256ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f
SHA512644fdc5608aedabeebf8c1ea2fac6e5c084b1a58c02c82508c2463e9cf7a67ac35c7e15e78248dac4665aae2d433509f9e317a4bd7caee06e00e328baebe7d16
-
Filesize
1016KB
MD57ae900f7fff466f802d5f647c8b10df0
SHA1691e97b140d66e57aa2310cbb7d6c7ca7972ca9b
SHA256ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f
SHA512644fdc5608aedabeebf8c1ea2fac6e5c084b1a58c02c82508c2463e9cf7a67ac35c7e15e78248dac4665aae2d433509f9e317a4bd7caee06e00e328baebe7d16
-
Filesize
1016KB
MD57ae900f7fff466f802d5f647c8b10df0
SHA1691e97b140d66e57aa2310cbb7d6c7ca7972ca9b
SHA256ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f
SHA512644fdc5608aedabeebf8c1ea2fac6e5c084b1a58c02c82508c2463e9cf7a67ac35c7e15e78248dac4665aae2d433509f9e317a4bd7caee06e00e328baebe7d16
-
Filesize
1016KB
MD57ae900f7fff466f802d5f647c8b10df0
SHA1691e97b140d66e57aa2310cbb7d6c7ca7972ca9b
SHA256ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f
SHA512644fdc5608aedabeebf8c1ea2fac6e5c084b1a58c02c82508c2463e9cf7a67ac35c7e15e78248dac4665aae2d433509f9e317a4bd7caee06e00e328baebe7d16
-
Filesize
1016KB
MD57ae900f7fff466f802d5f647c8b10df0
SHA1691e97b140d66e57aa2310cbb7d6c7ca7972ca9b
SHA256ac1f0108fd4b0b546df7b9ec260030347a34cfda97dece56a9935f1d128d893f
SHA512644fdc5608aedabeebf8c1ea2fac6e5c084b1a58c02c82508c2463e9cf7a67ac35c7e15e78248dac4665aae2d433509f9e317a4bd7caee06e00e328baebe7d16