69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2022 11:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe
Size

544KB
MD5

4c743c9faa0d584983aa4e096fe7a4de
SHA1

0a418ea55271587d8bab6db2060bf6c4122ddd5b
SHA256

69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79
SHA512

76db505e584af17d0d8e37b0756e35329dfaecd3a37b98a9dd2b2b3426345f9acf429b3345958df04950fc74ac3b201dfe74296cea71876d18e0173c9708ff47
SSDEEP

12288:m6bvdl0zCB8EDItMTzwg7lMQsvNuqZBRbZEYTwdD7IjLgdwdH2qGDAjs:/vdezCByqTtlMQsFuqzRbzI7IpH2N5

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	ntzzmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	ntzzmm.exe

UAC bypass 3 TTPs 13 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ntzzmm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	ntzzmm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	ntzzmm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	ntzzmm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ntzzmm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	ntzzmm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	ntzzmm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	ntzzmm.exe

Adds policy Run key to start application 2 TTPs 26 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zjtxosdkzf = "cxshjyummdzqcfobinqlg.exe"	ntzzmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ahopdem = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zpfpmwnavhykrptb.exe"	ntzzmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zjtxosdkzf = "phzlkwpebpiwfflvzb.exe"	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zjtxosdkzf = "gxozxiaokxpckjoxa.exe"	ntzzmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ahopdem = "C:\\Users\\Admin\\AppData\\Local\\Temp\\atmzzmgwujdscdkvade.exe"	ntzzmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zjtxosdkzf = "phzlkwpebpiwfflvzb.exe"	ntzzmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zjtxosdkzf = "zpfpmwnavhykrptb.exe"	ntzzmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zjtxosdkzf = "atmzzmgwujdscdkvade.exe"	ntzzmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ahopdem = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nhbpqezqpfaqbdlxdhjd.exe"	ntzzmm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zjtxosdkzf = "cxshjyummdzqcfobinqlg.exe"	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ahopdem = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cxshjyummdzqcfobinqlg.exe"	pwyrqtqlzgi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	ntzzmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ahopdem = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nhbpqezqpfaqbdlxdhjd.exe"	ntzzmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zjtxosdkzf = "nhbpqezqpfaqbdlxdhjd.exe"	ntzzmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ahopdem = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cxshjyummdzqcfobinqlg.exe"	ntzzmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zjtxosdkzf = "gxozxiaokxpckjoxa.exe"	ntzzmm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ahopdem = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cxshjyummdzqcfobinqlg.exe"	ntzzmm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	ntzzmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zjtxosdkzf = "cxshjyummdzqcfobinqlg.exe"	ntzzmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zjtxosdkzf = "zpfpmwnavhykrptb.exe"	ntzzmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ahopdem = "C:\\Users\\Admin\\AppData\\Local\\Temp\\phzlkwpebpiwfflvzb.exe"	ntzzmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ahopdem = "C:\\Users\\Admin\\AppData\\Local\\Temp\\atmzzmgwujdscdkvade.exe"	ntzzmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ahopdem = "C:\\Users\\Admin\\AppData\\Local\\Temp\\phzlkwpebpiwfflvzb.exe"	ntzzmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ahopdem = "C:\\Users\\Admin\\AppData\\Local\\Temp\\phzlkwpebpiwfflvzb.exe"	pwyrqtqlzgi.exe

Disables RegEdit via registry modification 7 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	ntzzmm.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	ntzzmm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	ntzzmm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	ntzzmm.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	pwyrqtqlzgi.exe

Executes dropped EXE 4 IoCs

pid	Process
2628	pwyrqtqlzgi.exe
3728	ntzzmm.exe
544	ntzzmm.exe
3408	pwyrqtqlzgi.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	pwyrqtqlzgi.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qdqxrymwoxluy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\atmzzmgwujdscdkvade.exe ."	ntzzmm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	pwyrqtqlzgi.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	pwyrqtqlzgi.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pxfhwyhm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nhbpqezqpfaqbdlxdhjd.exe"	ntzzmm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ufqvnsemcjv = "atmzzmgwujdscdkvade.exe"	ntzzmm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\gpybrueky = "C:\\Users\\Admin\\AppData\\Local\\Temp\\phzlkwpebpiwfflvzb.exe ."	ntzzmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\pxfhwyhm = "nhbpqezqpfaqbdlxdhjd.exe"	ntzzmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\gpybrueky = "phzlkwpebpiwfflvzb.exe ."	ntzzmm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	ntzzmm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ufqvnsemcjv = "zpfpmwnavhykrptb.exe"	ntzzmm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ufqvnsemcjv = "nhbpqezqpfaqbdlxdhjd.exe"	ntzzmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\rftbwetexhwglh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\atmzzmgwujdscdkvade.exe"	ntzzmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\pxfhwyhm = "zpfpmwnavhykrptb.exe"	ntzzmm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\gpybrueky = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cxshjyummdzqcfobinqlg.exe ."	ntzzmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\rftbwetexhwglh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cxshjyummdzqcfobinqlg.exe"	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\rdpvouhqhpck = "phzlkwpebpiwfflvzb.exe ."	ntzzmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\rftbwetexhwglh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\phzlkwpebpiwfflvzb.exe"	ntzzmm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\rdpvouhqhpck = "nhbpqezqpfaqbdlxdhjd.exe ."	ntzzmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qdqxrymwoxluy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zpfpmwnavhykrptb.exe ."	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\gpybrueky = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cxshjyummdzqcfobinqlg.exe ."	ntzzmm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\rdpvouhqhpck = "atmzzmgwujdscdkvade.exe ."	pwyrqtqlzgi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pxfhwyhm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zpfpmwnavhykrptb.exe"	ntzzmm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\rdpvouhqhpck = "phzlkwpebpiwfflvzb.exe ."	ntzzmm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ufqvnsemcjv = "zpfpmwnavhykrptb.exe"	ntzzmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\gpybrueky = "nhbpqezqpfaqbdlxdhjd.exe ."	ntzzmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qdqxrymwoxluy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zpfpmwnavhykrptb.exe ."	ntzzmm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\gpybrueky = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nhbpqezqpfaqbdlxdhjd.exe ."	ntzzmm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ufqvnsemcjv = "phzlkwpebpiwfflvzb.exe"	ntzzmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\rftbwetexhwglh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zpfpmwnavhykrptb.exe"	ntzzmm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	pwyrqtqlzgi.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	pwyrqtqlzgi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	ntzzmm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	ntzzmm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ufqvnsemcjv = "gxozxiaokxpckjoxa.exe"	ntzzmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\rftbwetexhwglh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\atmzzmgwujdscdkvade.exe"	ntzzmm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ufqvnsemcjv = "nhbpqezqpfaqbdlxdhjd.exe"	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\pxfhwyhm = "gxozxiaokxpckjoxa.exe"	ntzzmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qdqxrymwoxluy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nhbpqezqpfaqbdlxdhjd.exe ."	ntzzmm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pxfhwyhm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\phzlkwpebpiwfflvzb.exe"	ntzzmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\rftbwetexhwglh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gxozxiaokxpckjoxa.exe"	ntzzmm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pxfhwyhm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nhbpqezqpfaqbdlxdhjd.exe"	ntzzmm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pxfhwyhm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cxshjyummdzqcfobinqlg.exe"	ntzzmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\rftbwetexhwglh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nhbpqezqpfaqbdlxdhjd.exe"	ntzzmm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	ntzzmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\pxfhwyhm = "cxshjyummdzqcfobinqlg.exe"	ntzzmm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\gpybrueky = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zpfpmwnavhykrptb.exe ."	ntzzmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\pxfhwyhm = "atmzzmgwujdscdkvade.exe"	ntzzmm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\gpybrueky = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nhbpqezqpfaqbdlxdhjd.exe ."	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\pxfhwyhm = "cxshjyummdzqcfobinqlg.exe"	ntzzmm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pxfhwyhm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\phzlkwpebpiwfflvzb.exe"	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\rdpvouhqhpck = "cxshjyummdzqcfobinqlg.exe ."	ntzzmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\pxfhwyhm = "gxozxiaokxpckjoxa.exe"	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\rdpvouhqhpck = "nhbpqezqpfaqbdlxdhjd.exe ."	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qdqxrymwoxluy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\phzlkwpebpiwfflvzb.exe ."	pwyrqtqlzgi.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	ntzzmm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pxfhwyhm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gxozxiaokxpckjoxa.exe"	ntzzmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qdqxrymwoxluy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\phzlkwpebpiwfflvzb.exe ."	ntzzmm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\rdpvouhqhpck = "atmzzmgwujdscdkvade.exe ."	ntzzmm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\gpybrueky = "atmzzmgwujdscdkvade.exe ."	ntzzmm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ufqvnsemcjv = "nhbpqezqpfaqbdlxdhjd.exe"	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qdqxrymwoxluy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cxshjyummdzqcfobinqlg.exe ."	ntzzmm.exe

Checks whether UAC is enabled 1 TTPs 8 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	pwyrqtqlzgi.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ntzzmm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ntzzmm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ntzzmm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ntzzmm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	pwyrqtqlzgi.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	pwyrqtqlzgi.exe

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
40	whatismyip.everdot.org
16	www.showmyipaddress.com
21	whatismyip.everdot.org
25	whatismyipaddress.com

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\autorun.inf	ntzzmm.exe
File created	C:\autorun.inf	ntzzmm.exe

Drops file in System32 directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\nhbpqezqpfaqbdlxdhjd.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\SysWOW64\nhbpqezqpfaqbdlxdhjd.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\SysWOW64\tplbeurkldasfjthpvzvrh.exe	ntzzmm.exe
File opened for modification	C:\Windows\SysWOW64\zpfpmwnavhykrptb.exe	ntzzmm.exe
File opened for modification	C:\Windows\SysWOW64\nhbpqezqpfaqbdlxdhjd.exe	ntzzmm.exe
File opened for modification	C:\Windows\SysWOW64\cxshjyummdzqcfobinqlg.exe	ntzzmm.exe
File opened for modification	C:\Windows\SysWOW64\phzlkwpebpiwfflvzb.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\SysWOW64\gxozxiaokxpckjoxa.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\SysWOW64\cxshjyummdzqcfobinqlg.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\SysWOW64\tplbeurkldasfjthpvzvrh.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\SysWOW64\rdpvouhqhpcknhhljfzlxdwcpypxksvppt.nht	ntzzmm.exe
File opened for modification	C:\Windows\SysWOW64\phzlkwpebpiwfflvzb.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\SysWOW64\cxshjyummdzqcfobinqlg.exe	ntzzmm.exe
File opened for modification	C:\Windows\SysWOW64\efgbjegekhjgyhwpcnwxytb.ywc	ntzzmm.exe
File opened for modification	C:\Windows\SysWOW64\zpfpmwnavhykrptb.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\SysWOW64\phzlkwpebpiwfflvzb.exe	ntzzmm.exe
File opened for modification	C:\Windows\SysWOW64\atmzzmgwujdscdkvade.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\SysWOW64\zpfpmwnavhykrptb.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\SysWOW64\tplbeurkldasfjthpvzvrh.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\SysWOW64\atmzzmgwujdscdkvade.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\SysWOW64\zpfpmwnavhykrptb.exe	ntzzmm.exe
File opened for modification	C:\Windows\SysWOW64\atmzzmgwujdscdkvade.exe	ntzzmm.exe
File opened for modification	C:\Windows\SysWOW64\cxshjyummdzqcfobinqlg.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\SysWOW64\gxozxiaokxpckjoxa.exe	ntzzmm.exe
File opened for modification	C:\Windows\SysWOW64\phzlkwpebpiwfflvzb.exe	ntzzmm.exe
File opened for modification	C:\Windows\SysWOW64\gxozxiaokxpckjoxa.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\SysWOW64\nhbpqezqpfaqbdlxdhjd.exe	ntzzmm.exe
File opened for modification	C:\Windows\SysWOW64\tplbeurkldasfjthpvzvrh.exe	ntzzmm.exe
File created	C:\Windows\SysWOW64\rdpvouhqhpcknhhljfzlxdwcpypxksvppt.nht	ntzzmm.exe
File opened for modification	C:\Windows\SysWOW64\gxozxiaokxpckjoxa.exe	ntzzmm.exe
File opened for modification	C:\Windows\SysWOW64\atmzzmgwujdscdkvade.exe	ntzzmm.exe
File created	C:\Windows\SysWOW64\efgbjegekhjgyhwpcnwxytb.ywc	ntzzmm.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5116 set thread context of 5076	5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe	83

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\efgbjegekhjgyhwpcnwxytb.ywc	ntzzmm.exe
File created	C:\Program Files (x86)\efgbjegekhjgyhwpcnwxytb.ywc	ntzzmm.exe
File opened for modification	C:\Program Files (x86)\rdpvouhqhpcknhhljfzlxdwcpypxksvppt.nht	ntzzmm.exe
File created	C:\Program Files (x86)\rdpvouhqhpcknhhljfzlxdwcpypxksvppt.nht	ntzzmm.exe

Drops file in Windows directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Windows\phzlkwpebpiwfflvzb.exe	ntzzmm.exe
File opened for modification	C:\Windows\cxshjyummdzqcfobinqlg.exe	ntzzmm.exe
File opened for modification	C:\Windows\gxozxiaokxpckjoxa.exe	ntzzmm.exe
File opened for modification	C:\Windows\nhbpqezqpfaqbdlxdhjd.exe	ntzzmm.exe
File created	C:\Windows\efgbjegekhjgyhwpcnwxytb.ywc	ntzzmm.exe
File opened for modification	C:\Windows\rdpvouhqhpcknhhljfzlxdwcpypxksvppt.nht	ntzzmm.exe
File opened for modification	C:\Windows\zpfpmwnavhykrptb.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\tplbeurkldasfjthpvzvrh.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\zpfpmwnavhykrptb.exe	ntzzmm.exe
File opened for modification	C:\Windows\zpfpmwnavhykrptb.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\gxozxiaokxpckjoxa.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\phzlkwpebpiwfflvzb.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\efgbjegekhjgyhwpcnwxytb.ywc	ntzzmm.exe
File opened for modification	C:\Windows\nhbpqezqpfaqbdlxdhjd.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\tplbeurkldasfjthpvzvrh.exe	ntzzmm.exe
File opened for modification	C:\Windows\phzlkwpebpiwfflvzb.exe	ntzzmm.exe
File opened for modification	C:\Windows\atmzzmgwujdscdkvade.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\nhbpqezqpfaqbdlxdhjd.exe	ntzzmm.exe
File opened for modification	C:\Windows\zpfpmwnavhykrptb.exe	ntzzmm.exe
File opened for modification	C:\Windows\tplbeurkldasfjthpvzvrh.exe	ntzzmm.exe
File created	C:\Windows\rdpvouhqhpcknhhljfzlxdwcpypxksvppt.nht	ntzzmm.exe
File opened for modification	C:\Windows\gxozxiaokxpckjoxa.exe	ntzzmm.exe
File opened for modification	C:\Windows\cxshjyummdzqcfobinqlg.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\atmzzmgwujdscdkvade.exe	ntzzmm.exe
File opened for modification	C:\Windows\gxozxiaokxpckjoxa.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\atmzzmgwujdscdkvade.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\nhbpqezqpfaqbdlxdhjd.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\cxshjyummdzqcfobinqlg.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\atmzzmgwujdscdkvade.exe	ntzzmm.exe
File opened for modification	C:\Windows\cxshjyummdzqcfobinqlg.exe	ntzzmm.exe
File opened for modification	C:\Windows\tplbeurkldasfjthpvzvrh.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\phzlkwpebpiwfflvzb.exe	pwyrqtqlzgi.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2168	5076	WerFault.exe	83

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe
5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe
5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe
5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe
5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe
5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe
5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe
5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe
5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe
5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe
5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe
5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe
5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe
5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe
5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe
5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe
5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe
5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe
5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe
5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe
5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe
5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe
3728	ntzzmm.exe
3728	ntzzmm.exe
5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe
5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe
5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe
5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe
5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe
5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe
5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe
5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe
5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe
5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe
5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe
5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe
5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe
5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe
5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe
5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe
5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe
5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe
5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe
5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe
5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe
5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe
5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe
5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe
5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe
5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe
5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe
5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe
5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe
5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe
3728	ntzzmm.exe
3728	ntzzmm.exe
5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe
5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe
5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe
5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe
5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe
5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe
5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe
5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3728	ntzzmm.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 5116 wrote to memory of 5076	5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe	83
PID 5116 wrote to memory of 5076	5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe	83
PID 5116 wrote to memory of 5076	5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe	83
PID 5116 wrote to memory of 5076	5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe	83
PID 5116 wrote to memory of 2628	5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe	86
PID 5116 wrote to memory of 2628	5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe	86
PID 5116 wrote to memory of 2628	5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe	86
PID 2628 wrote to memory of 3728	2628	pwyrqtqlzgi.exe	91
PID 2628 wrote to memory of 3728	2628	pwyrqtqlzgi.exe	91
PID 2628 wrote to memory of 3728	2628	pwyrqtqlzgi.exe	91
PID 2628 wrote to memory of 544	2628	pwyrqtqlzgi.exe	92
PID 2628 wrote to memory of 544	2628	pwyrqtqlzgi.exe	92
PID 2628 wrote to memory of 544	2628	pwyrqtqlzgi.exe	92
PID 5116 wrote to memory of 3408	5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe	97
PID 5116 wrote to memory of 3408	5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe	97
PID 5116 wrote to memory of 3408	5116	69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe	97

System policy modification 1 TTPs 41 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	ntzzmm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	ntzzmm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	pwyrqtqlzgi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	ntzzmm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	ntzzmm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	ntzzmm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	ntzzmm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	ntzzmm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	ntzzmm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	ntzzmm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	ntzzmm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	ntzzmm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	ntzzmm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	ntzzmm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	ntzzmm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	ntzzmm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	ntzzmm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	ntzzmm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	ntzzmm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	ntzzmm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	ntzzmm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ntzzmm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	ntzzmm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	ntzzmm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	ntzzmm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ntzzmm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	ntzzmm.exe

C:\Users\Admin\AppData\Local\Temp\69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe
"C:\Users\Admin\AppData\Local\Temp\69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5116
- C:\Users\Admin\AppData\Local\Temp\69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe
  "C:\Users\Admin\AppData\Local\Temp\69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe"
  2⤵
  PID:5076
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5076 -s 356
    3⤵
    - Program crash
    PID:2168
- C:\Users\Admin\AppData\Local\Temp\pwyrqtqlzgi.exe
  "C:\Users\Admin\AppData\Local\Temp\pwyrqtqlzgi.exe" "c:\users\admin\appdata\local\temp\69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe*"
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Adds policy Run key to start application
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Checks computer location settings
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2628
- - C:\Users\Admin\AppData\Local\Temp\ntzzmm.exe
    "C:\Users\Admin\AppData\Local\Temp\ntzzmm.exe" "-c:\users\admin\appdata\local\temp\69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops autorun.inf file
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - System policy modification
    PID:3728
- - C:\Users\Admin\AppData\Local\Temp\ntzzmm.exe
    "C:\Users\Admin\AppData\Local\Temp\ntzzmm.exe" "-c:\users\admin\appdata\local\temp\69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System policy modification
    PID:544
- C:\Users\Admin\AppData\Local\Temp\pwyrqtqlzgi.exe
  "C:\Users\Admin\AppData\Local\Temp\pwyrqtqlzgi.exe" "c:\users\admin\appdata\local\temp\69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79.exe"
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Adds policy Run key to start application
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System policy modification
  PID:3408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5076 -ip 5076
1⤵
PID:504

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\atmzzmgwujdscdkvade.exe

Filesize
544KB

MD5
4c743c9faa0d584983aa4e096fe7a4de

SHA1
0a418ea55271587d8bab6db2060bf6c4122ddd5b

SHA256
69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79

SHA512
76db505e584af17d0d8e37b0756e35329dfaecd3a37b98a9dd2b2b3426345f9acf429b3345958df04950fc74ac3b201dfe74296cea71876d18e0173c9708ff47

Download Submit
C:\Users\Admin\AppData\Local\Temp\cxshjyummdzqcfobinqlg.exe

Filesize
544KB

MD5
4c743c9faa0d584983aa4e096fe7a4de

SHA1
0a418ea55271587d8bab6db2060bf6c4122ddd5b

SHA256
69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79

SHA512
76db505e584af17d0d8e37b0756e35329dfaecd3a37b98a9dd2b2b3426345f9acf429b3345958df04950fc74ac3b201dfe74296cea71876d18e0173c9708ff47

Download Submit
C:\Users\Admin\AppData\Local\Temp\gxozxiaokxpckjoxa.exe

Filesize
544KB

MD5
4c743c9faa0d584983aa4e096fe7a4de

SHA1
0a418ea55271587d8bab6db2060bf6c4122ddd5b

SHA256
69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79

SHA512
76db505e584af17d0d8e37b0756e35329dfaecd3a37b98a9dd2b2b3426345f9acf429b3345958df04950fc74ac3b201dfe74296cea71876d18e0173c9708ff47

Download Submit
C:\Users\Admin\AppData\Local\Temp\nhbpqezqpfaqbdlxdhjd.exe

Filesize
544KB

MD5
4c743c9faa0d584983aa4e096fe7a4de

SHA1
0a418ea55271587d8bab6db2060bf6c4122ddd5b

SHA256
69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79

SHA512
76db505e584af17d0d8e37b0756e35329dfaecd3a37b98a9dd2b2b3426345f9acf429b3345958df04950fc74ac3b201dfe74296cea71876d18e0173c9708ff47

Download Submit
C:\Users\Admin\AppData\Local\Temp\ntzzmm.exe

Filesize
720KB

MD5
c22b300fc6b6345302e2c5c66f4676b7

SHA1
16fe292371978c2c61110d2e5c2dcd6ee57e28fd

SHA256
91fbb936e3bcd491268690813232aff1846f20cd93b111f9cc7bb6fcf557e904

SHA512
808902dbbd593a9fd243f9d8d647b278b90a75c5b31f4a0aa51941156676c9cf2ba3a55af4eb275547e7d477cd717c380b1ba20ea86c408fd43942b1bc158d24

Download Submit
C:\Users\Admin\AppData\Local\Temp\ntzzmm.exe

Filesize
720KB

MD5
c22b300fc6b6345302e2c5c66f4676b7

SHA1
16fe292371978c2c61110d2e5c2dcd6ee57e28fd

SHA256
91fbb936e3bcd491268690813232aff1846f20cd93b111f9cc7bb6fcf557e904

SHA512
808902dbbd593a9fd243f9d8d647b278b90a75c5b31f4a0aa51941156676c9cf2ba3a55af4eb275547e7d477cd717c380b1ba20ea86c408fd43942b1bc158d24

Download Submit
C:\Users\Admin\AppData\Local\Temp\ntzzmm.exe

Filesize
720KB

MD5
c22b300fc6b6345302e2c5c66f4676b7

SHA1
16fe292371978c2c61110d2e5c2dcd6ee57e28fd

SHA256
91fbb936e3bcd491268690813232aff1846f20cd93b111f9cc7bb6fcf557e904

SHA512
808902dbbd593a9fd243f9d8d647b278b90a75c5b31f4a0aa51941156676c9cf2ba3a55af4eb275547e7d477cd717c380b1ba20ea86c408fd43942b1bc158d24

Download Submit
C:\Users\Admin\AppData\Local\Temp\phzlkwpebpiwfflvzb.exe

Filesize
544KB

MD5
4c743c9faa0d584983aa4e096fe7a4de

SHA1
0a418ea55271587d8bab6db2060bf6c4122ddd5b

SHA256
69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79

SHA512
76db505e584af17d0d8e37b0756e35329dfaecd3a37b98a9dd2b2b3426345f9acf429b3345958df04950fc74ac3b201dfe74296cea71876d18e0173c9708ff47

Download Submit
C:\Users\Admin\AppData\Local\Temp\pwyrqtqlzgi.exe

Filesize
320KB

MD5
89ec3461ef4a893428c32f89de78b396

SHA1
8067cdc0901f0dc5bc1bb67a1c9037f502ea85f9

SHA256
1849989ee704cda3b552b5021f3165012978d26d0daf7d22a09805deb6be2d0b

SHA512
7804fa36e1f050115b00d21a9a94cf92436260a385da67106b0c73eb350abafca53f2dec42d377d4eccc095dd75ac92e841fb66e874e656e412cd71ed7909fe8

Download Submit
C:\Users\Admin\AppData\Local\Temp\pwyrqtqlzgi.exe

Filesize
320KB

MD5
89ec3461ef4a893428c32f89de78b396

SHA1
8067cdc0901f0dc5bc1bb67a1c9037f502ea85f9

SHA256
1849989ee704cda3b552b5021f3165012978d26d0daf7d22a09805deb6be2d0b

SHA512
7804fa36e1f050115b00d21a9a94cf92436260a385da67106b0c73eb350abafca53f2dec42d377d4eccc095dd75ac92e841fb66e874e656e412cd71ed7909fe8

Download Submit
C:\Users\Admin\AppData\Local\Temp\pwyrqtqlzgi.exe

Filesize
320KB

MD5
89ec3461ef4a893428c32f89de78b396

SHA1
8067cdc0901f0dc5bc1bb67a1c9037f502ea85f9

SHA256
1849989ee704cda3b552b5021f3165012978d26d0daf7d22a09805deb6be2d0b

SHA512
7804fa36e1f050115b00d21a9a94cf92436260a385da67106b0c73eb350abafca53f2dec42d377d4eccc095dd75ac92e841fb66e874e656e412cd71ed7909fe8

Download Submit
C:\Users\Admin\AppData\Local\Temp\tplbeurkldasfjthpvzvrh.exe

Filesize
544KB

MD5
4c743c9faa0d584983aa4e096fe7a4de

SHA1
0a418ea55271587d8bab6db2060bf6c4122ddd5b

SHA256
69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79

SHA512
76db505e584af17d0d8e37b0756e35329dfaecd3a37b98a9dd2b2b3426345f9acf429b3345958df04950fc74ac3b201dfe74296cea71876d18e0173c9708ff47

Download Submit
C:\Users\Admin\AppData\Local\Temp\zpfpmwnavhykrptb.exe

Filesize
544KB

MD5
4c743c9faa0d584983aa4e096fe7a4de

SHA1
0a418ea55271587d8bab6db2060bf6c4122ddd5b

SHA256
69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79

SHA512
76db505e584af17d0d8e37b0756e35329dfaecd3a37b98a9dd2b2b3426345f9acf429b3345958df04950fc74ac3b201dfe74296cea71876d18e0173c9708ff47

Download Submit
C:\Windows\SysWOW64\atmzzmgwujdscdkvade.exe

Filesize
544KB

MD5
4c743c9faa0d584983aa4e096fe7a4de

SHA1
0a418ea55271587d8bab6db2060bf6c4122ddd5b

SHA256
69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79

SHA512
76db505e584af17d0d8e37b0756e35329dfaecd3a37b98a9dd2b2b3426345f9acf429b3345958df04950fc74ac3b201dfe74296cea71876d18e0173c9708ff47

Download Submit
C:\Windows\SysWOW64\cxshjyummdzqcfobinqlg.exe

Filesize
544KB

MD5
4c743c9faa0d584983aa4e096fe7a4de

SHA1
0a418ea55271587d8bab6db2060bf6c4122ddd5b

SHA256
69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79

SHA512
76db505e584af17d0d8e37b0756e35329dfaecd3a37b98a9dd2b2b3426345f9acf429b3345958df04950fc74ac3b201dfe74296cea71876d18e0173c9708ff47

Download Submit
C:\Windows\SysWOW64\gxozxiaokxpckjoxa.exe

Filesize
544KB

MD5
4c743c9faa0d584983aa4e096fe7a4de

SHA1
0a418ea55271587d8bab6db2060bf6c4122ddd5b

SHA256
69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79

SHA512
76db505e584af17d0d8e37b0756e35329dfaecd3a37b98a9dd2b2b3426345f9acf429b3345958df04950fc74ac3b201dfe74296cea71876d18e0173c9708ff47

Download Submit
C:\Windows\SysWOW64\nhbpqezqpfaqbdlxdhjd.exe

Filesize
544KB

MD5
4c743c9faa0d584983aa4e096fe7a4de

SHA1
0a418ea55271587d8bab6db2060bf6c4122ddd5b

SHA256
69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79

SHA512
76db505e584af17d0d8e37b0756e35329dfaecd3a37b98a9dd2b2b3426345f9acf429b3345958df04950fc74ac3b201dfe74296cea71876d18e0173c9708ff47

Download Submit
C:\Windows\SysWOW64\phzlkwpebpiwfflvzb.exe

Filesize
544KB

MD5
4c743c9faa0d584983aa4e096fe7a4de

SHA1
0a418ea55271587d8bab6db2060bf6c4122ddd5b

SHA256
69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79

SHA512
76db505e584af17d0d8e37b0756e35329dfaecd3a37b98a9dd2b2b3426345f9acf429b3345958df04950fc74ac3b201dfe74296cea71876d18e0173c9708ff47

Download Submit
C:\Windows\SysWOW64\tplbeurkldasfjthpvzvrh.exe

Filesize
544KB

MD5
4c743c9faa0d584983aa4e096fe7a4de

SHA1
0a418ea55271587d8bab6db2060bf6c4122ddd5b

SHA256
69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79

SHA512
76db505e584af17d0d8e37b0756e35329dfaecd3a37b98a9dd2b2b3426345f9acf429b3345958df04950fc74ac3b201dfe74296cea71876d18e0173c9708ff47

Download Submit
C:\Windows\SysWOW64\zpfpmwnavhykrptb.exe

Filesize
544KB

MD5
4c743c9faa0d584983aa4e096fe7a4de

SHA1
0a418ea55271587d8bab6db2060bf6c4122ddd5b

SHA256
69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79

SHA512
76db505e584af17d0d8e37b0756e35329dfaecd3a37b98a9dd2b2b3426345f9acf429b3345958df04950fc74ac3b201dfe74296cea71876d18e0173c9708ff47

Download Submit
C:\Windows\atmzzmgwujdscdkvade.exe

Filesize
544KB

MD5
4c743c9faa0d584983aa4e096fe7a4de

SHA1
0a418ea55271587d8bab6db2060bf6c4122ddd5b

SHA256
69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79

SHA512
76db505e584af17d0d8e37b0756e35329dfaecd3a37b98a9dd2b2b3426345f9acf429b3345958df04950fc74ac3b201dfe74296cea71876d18e0173c9708ff47

Download Submit
C:\Windows\atmzzmgwujdscdkvade.exe

Filesize
544KB

MD5
4c743c9faa0d584983aa4e096fe7a4de

SHA1
0a418ea55271587d8bab6db2060bf6c4122ddd5b

SHA256
69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79

SHA512
76db505e584af17d0d8e37b0756e35329dfaecd3a37b98a9dd2b2b3426345f9acf429b3345958df04950fc74ac3b201dfe74296cea71876d18e0173c9708ff47

Download Submit
C:\Windows\atmzzmgwujdscdkvade.exe

Filesize
544KB

MD5
4c743c9faa0d584983aa4e096fe7a4de

SHA1
0a418ea55271587d8bab6db2060bf6c4122ddd5b

SHA256
69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79

SHA512
76db505e584af17d0d8e37b0756e35329dfaecd3a37b98a9dd2b2b3426345f9acf429b3345958df04950fc74ac3b201dfe74296cea71876d18e0173c9708ff47

Download Submit
C:\Windows\cxshjyummdzqcfobinqlg.exe

Filesize
544KB

MD5
4c743c9faa0d584983aa4e096fe7a4de

SHA1
0a418ea55271587d8bab6db2060bf6c4122ddd5b

SHA256
69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79

SHA512
76db505e584af17d0d8e37b0756e35329dfaecd3a37b98a9dd2b2b3426345f9acf429b3345958df04950fc74ac3b201dfe74296cea71876d18e0173c9708ff47

Download Submit
C:\Windows\cxshjyummdzqcfobinqlg.exe

Filesize
544KB

MD5
4c743c9faa0d584983aa4e096fe7a4de

SHA1
0a418ea55271587d8bab6db2060bf6c4122ddd5b

SHA256
69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79

SHA512
76db505e584af17d0d8e37b0756e35329dfaecd3a37b98a9dd2b2b3426345f9acf429b3345958df04950fc74ac3b201dfe74296cea71876d18e0173c9708ff47

Download Submit
C:\Windows\cxshjyummdzqcfobinqlg.exe

Filesize
544KB

MD5
4c743c9faa0d584983aa4e096fe7a4de

SHA1
0a418ea55271587d8bab6db2060bf6c4122ddd5b

SHA256
69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79

SHA512
76db505e584af17d0d8e37b0756e35329dfaecd3a37b98a9dd2b2b3426345f9acf429b3345958df04950fc74ac3b201dfe74296cea71876d18e0173c9708ff47

Download Submit
C:\Windows\gxozxiaokxpckjoxa.exe

Filesize
544KB

MD5
4c743c9faa0d584983aa4e096fe7a4de

SHA1
0a418ea55271587d8bab6db2060bf6c4122ddd5b

SHA256
69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79

SHA512
76db505e584af17d0d8e37b0756e35329dfaecd3a37b98a9dd2b2b3426345f9acf429b3345958df04950fc74ac3b201dfe74296cea71876d18e0173c9708ff47

Download Submit
C:\Windows\gxozxiaokxpckjoxa.exe

Filesize
544KB

MD5
4c743c9faa0d584983aa4e096fe7a4de

SHA1
0a418ea55271587d8bab6db2060bf6c4122ddd5b

SHA256
69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79

SHA512
76db505e584af17d0d8e37b0756e35329dfaecd3a37b98a9dd2b2b3426345f9acf429b3345958df04950fc74ac3b201dfe74296cea71876d18e0173c9708ff47

Download Submit
C:\Windows\gxozxiaokxpckjoxa.exe

Filesize
544KB

MD5
4c743c9faa0d584983aa4e096fe7a4de

SHA1
0a418ea55271587d8bab6db2060bf6c4122ddd5b

SHA256
69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79

SHA512
76db505e584af17d0d8e37b0756e35329dfaecd3a37b98a9dd2b2b3426345f9acf429b3345958df04950fc74ac3b201dfe74296cea71876d18e0173c9708ff47

Download Submit
C:\Windows\nhbpqezqpfaqbdlxdhjd.exe

Filesize
544KB

MD5
4c743c9faa0d584983aa4e096fe7a4de

SHA1
0a418ea55271587d8bab6db2060bf6c4122ddd5b

SHA256
69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79

SHA512
76db505e584af17d0d8e37b0756e35329dfaecd3a37b98a9dd2b2b3426345f9acf429b3345958df04950fc74ac3b201dfe74296cea71876d18e0173c9708ff47

Download Submit
C:\Windows\nhbpqezqpfaqbdlxdhjd.exe

Filesize
544KB

MD5
4c743c9faa0d584983aa4e096fe7a4de

SHA1
0a418ea55271587d8bab6db2060bf6c4122ddd5b

SHA256
69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79

SHA512
76db505e584af17d0d8e37b0756e35329dfaecd3a37b98a9dd2b2b3426345f9acf429b3345958df04950fc74ac3b201dfe74296cea71876d18e0173c9708ff47

Download Submit
C:\Windows\nhbpqezqpfaqbdlxdhjd.exe

Filesize
544KB

MD5
4c743c9faa0d584983aa4e096fe7a4de

SHA1
0a418ea55271587d8bab6db2060bf6c4122ddd5b

SHA256
69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79

SHA512
76db505e584af17d0d8e37b0756e35329dfaecd3a37b98a9dd2b2b3426345f9acf429b3345958df04950fc74ac3b201dfe74296cea71876d18e0173c9708ff47

Download Submit
C:\Windows\phzlkwpebpiwfflvzb.exe

Filesize
544KB

MD5
4c743c9faa0d584983aa4e096fe7a4de

SHA1
0a418ea55271587d8bab6db2060bf6c4122ddd5b

SHA256
69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79

SHA512
76db505e584af17d0d8e37b0756e35329dfaecd3a37b98a9dd2b2b3426345f9acf429b3345958df04950fc74ac3b201dfe74296cea71876d18e0173c9708ff47

Download Submit
C:\Windows\phzlkwpebpiwfflvzb.exe

Filesize
544KB

MD5
4c743c9faa0d584983aa4e096fe7a4de

SHA1
0a418ea55271587d8bab6db2060bf6c4122ddd5b

SHA256
69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79

SHA512
76db505e584af17d0d8e37b0756e35329dfaecd3a37b98a9dd2b2b3426345f9acf429b3345958df04950fc74ac3b201dfe74296cea71876d18e0173c9708ff47

Download Submit
C:\Windows\phzlkwpebpiwfflvzb.exe

Filesize
544KB

MD5
4c743c9faa0d584983aa4e096fe7a4de

SHA1
0a418ea55271587d8bab6db2060bf6c4122ddd5b

SHA256
69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79

SHA512
76db505e584af17d0d8e37b0756e35329dfaecd3a37b98a9dd2b2b3426345f9acf429b3345958df04950fc74ac3b201dfe74296cea71876d18e0173c9708ff47

Download Submit
C:\Windows\tplbeurkldasfjthpvzvrh.exe

Filesize
544KB

MD5
4c743c9faa0d584983aa4e096fe7a4de

SHA1
0a418ea55271587d8bab6db2060bf6c4122ddd5b

SHA256
69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79

SHA512
76db505e584af17d0d8e37b0756e35329dfaecd3a37b98a9dd2b2b3426345f9acf429b3345958df04950fc74ac3b201dfe74296cea71876d18e0173c9708ff47

Download Submit
C:\Windows\tplbeurkldasfjthpvzvrh.exe

Filesize
544KB

MD5
4c743c9faa0d584983aa4e096fe7a4de

SHA1
0a418ea55271587d8bab6db2060bf6c4122ddd5b

SHA256
69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79

SHA512
76db505e584af17d0d8e37b0756e35329dfaecd3a37b98a9dd2b2b3426345f9acf429b3345958df04950fc74ac3b201dfe74296cea71876d18e0173c9708ff47

Download Submit
C:\Windows\tplbeurkldasfjthpvzvrh.exe

Filesize
544KB

MD5
4c743c9faa0d584983aa4e096fe7a4de

SHA1
0a418ea55271587d8bab6db2060bf6c4122ddd5b

SHA256
69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79

SHA512
76db505e584af17d0d8e37b0756e35329dfaecd3a37b98a9dd2b2b3426345f9acf429b3345958df04950fc74ac3b201dfe74296cea71876d18e0173c9708ff47

Download Submit
C:\Windows\zpfpmwnavhykrptb.exe

Filesize
544KB

MD5
4c743c9faa0d584983aa4e096fe7a4de

SHA1
0a418ea55271587d8bab6db2060bf6c4122ddd5b

SHA256
69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79

SHA512
76db505e584af17d0d8e37b0756e35329dfaecd3a37b98a9dd2b2b3426345f9acf429b3345958df04950fc74ac3b201dfe74296cea71876d18e0173c9708ff47

Download Submit
C:\Windows\zpfpmwnavhykrptb.exe

Filesize
544KB

MD5
4c743c9faa0d584983aa4e096fe7a4de

SHA1
0a418ea55271587d8bab6db2060bf6c4122ddd5b

SHA256
69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79

SHA512
76db505e584af17d0d8e37b0756e35329dfaecd3a37b98a9dd2b2b3426345f9acf429b3345958df04950fc74ac3b201dfe74296cea71876d18e0173c9708ff47

Download Submit
C:\Windows\zpfpmwnavhykrptb.exe

Filesize
544KB

MD5
4c743c9faa0d584983aa4e096fe7a4de

SHA1
0a418ea55271587d8bab6db2060bf6c4122ddd5b

SHA256
69ecc6feb07b77ae34ea064b2122d9846e532a4355ceb9aef51d65fae87aba79

SHA512
76db505e584af17d0d8e37b0756e35329dfaecd3a37b98a9dd2b2b3426345f9acf429b3345958df04950fc74ac3b201dfe74296cea71876d18e0173c9708ff47

Download Submit
memory/5076-132-0x0000000000401000-0x0000000000402000-memory.dmp

Filesize
4KB

Download