75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493

Analysis

max time kernel
151s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2022, 09:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
Size

508KB
MD5

4021b2581e5521699afcd8d29dfb12b0
SHA1

3cb26d621250ec7a6115ca1d6a037d0166e7cb2b
SHA256

75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493
SHA512

b2b06e7695843b52397b4c1fd887930974d147b75456db28288bf01bcd673333828ea8900dec986b2dd78bec7f0ef4dfbe35843603e6e1e22c866450055baddc
SSDEEP

12288:FpUJ3r6YkVwJgNnSykgb9cqWnw4q6ZmFhqss:FpUNr6YkVRFkgbeqeo68Fhq

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	eagnt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	eagnt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	pwyrqtqlzgi.exe

UAC bypass 3 TTPs 13 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	eagnt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	eagnt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	eagnt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	eagnt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	eagnt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	eagnt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	eagnt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	eagnt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	pwyrqtqlzgi.exe

Adds policy Run key to start application 2 TTPs 30 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\swkznakbrxluy = "eqmjfasrpdzqcfobinsea.exe"	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bcnzkubpcf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\eqmjfasrpdzqcfobinsea.exe"	eagnt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	eagnt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bcnzkubpcf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iqibtkytnxpckjoxa.exe"	eagnt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\swkznakbrxluy = "bizriylfyhykrptb.exe"	eagnt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bcnzkubpcf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iqibtkytnxpckjoxa.exe"	eagnt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\swkznakbrxluy = "ratngynjepiwfflvzb.exe"	eagnt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	eagnt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\swkznakbrxluy = "iqibtkytnxpckjoxa.exe"	eagnt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bcnzkubpcf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ratngynjepiwfflvzb.exe"	eagnt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\swkznakbrxluy = "ratngynjepiwfflvzb.exe"	eagnt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\swkznakbrxluy = "cmgbvoebxjdscdkvadg.exe"	eagnt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\swkznakbrxluy = "pavrmgxvsfaqbdlxdhlw.exe"	eagnt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bcnzkubpcf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ratngynjepiwfflvzb.exe"	eagnt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bcnzkubpcf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bizriylfyhykrptb.exe"	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bcnzkubpcf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bizriylfyhykrptb.exe"	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bcnzkubpcf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bizriylfyhykrptb.exe"	eagnt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bcnzkubpcf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\eqmjfasrpdzqcfobinsea.exe"	eagnt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bcnzkubpcf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bizriylfyhykrptb.exe"	eagnt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bcnzkubpcf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pavrmgxvsfaqbdlxdhlw.exe"	eagnt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\swkznakbrxluy = "cmgbvoebxjdscdkvadg.exe"	eagnt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\swkznakbrxluy = "bizriylfyhykrptb.exe"	eagnt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\swkznakbrxluy = "pavrmgxvsfaqbdlxdhlw.exe"	eagnt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bcnzkubpcf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cmgbvoebxjdscdkvadg.exe"	eagnt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\swkznakbrxluy = "iqibtkytnxpckjoxa.exe"	eagnt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bcnzkubpcf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pavrmgxvsfaqbdlxdhlw.exe"	eagnt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\swkznakbrxluy = "cmgbvoebxjdscdkvadg.exe"	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\swkznakbrxluy = "eqmjfasrpdzqcfobinsea.exe"	eagnt.exe

Disables RegEdit via registry modification 6 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	eagnt.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	eagnt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	eagnt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	eagnt.exe

Executes dropped EXE 4 IoCs

pid	Process
2412	pwyrqtqlzgi.exe
2400	eagnt.exe
4824	eagnt.exe
2368	pwyrqtqlzgi.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	pwyrqtqlzgi.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wykxjucrfjv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cmgbvoebxjdscdkvadg.exe"	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bizriylfyhykrptb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cmgbvoebxjdscdkvadg.exe ."	eagnt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wcsjzoatltjuaxa = "bizriylfyhykrptb.exe ."	eagnt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wykxjucrfjv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iqibtkytnxpckjoxa.exe"	eagnt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wcsjzoatltjuaxa = "cmgbvoebxjdscdkvadg.exe ."	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wykxjucrfjv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cmgbvoebxjdscdkvadg.exe"	eagnt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wykxjucrfjv = "cmgbvoebxjdscdkvadg.exe"	eagnt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tyndsgrjahwglh = "cmgbvoebxjdscdkvadg.exe"	eagnt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	eagnt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wykxjucrfjv = "ratngynjepiwfflvzb.exe"	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wcsjzoatltjuaxa = "ratngynjepiwfflvzb.exe ."	eagnt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wykxjucrfjv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ratngynjepiwfflvzb.exe"	eagnt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tyndsgrjahwglh = "bizriylfyhykrptb.exe"	eagnt.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	eagnt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\twjxkwfvkpck = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pavrmgxvsfaqbdlxdhlw.exe ."	eagnt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\twjxkwfvkpck = "cmgbvoebxjdscdkvadg.exe ."	eagnt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wykxjucrfjv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ratngynjepiwfflvzb.exe"	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\iqibtkytnxpckjoxa = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ratngynjepiwfflvzb.exe"	eagnt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bizriylfyhykrptb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iqibtkytnxpckjoxa.exe ."	eagnt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tyndsgrjahwglh = "bizriylfyhykrptb.exe"	eagnt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\iqibtkytnxpckjoxa = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iqibtkytnxpckjoxa.exe"	eagnt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wykxjucrfjv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\eqmjfasrpdzqcfobinsea.exe"	eagnt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tyndsgrjahwglh = "eqmjfasrpdzqcfobinsea.exe"	eagnt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wykxjucrfjv = "iqibtkytnxpckjoxa.exe"	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tyndsgrjahwglh = "iqibtkytnxpckjoxa.exe"	eagnt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bizriylfyhykrptb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ratngynjepiwfflvzb.exe ."	eagnt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\iqibtkytnxpckjoxa = "C:\\Users\\Admin\\AppData\\Local\\Temp\\eqmjfasrpdzqcfobinsea.exe"	eagnt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bizriylfyhykrptb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\eqmjfasrpdzqcfobinsea.exe ."	eagnt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wcsjzoatltjuaxa = "eqmjfasrpdzqcfobinsea.exe ."	eagnt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\twjxkwfvkpck = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bizriylfyhykrptb.exe ."	eagnt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	eagnt.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	eagnt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\twjxkwfvkpck = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bizriylfyhykrptb.exe ."	eagnt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bizriylfyhykrptb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\eqmjfasrpdzqcfobinsea.exe ."	eagnt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wykxjucrfjv = "iqibtkytnxpckjoxa.exe"	pwyrqtqlzgi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	eagnt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bizriylfyhykrptb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iqibtkytnxpckjoxa.exe ."	eagnt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wcsjzoatltjuaxa = "pavrmgxvsfaqbdlxdhlw.exe ."	eagnt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wykxjucrfjv = "iqibtkytnxpckjoxa.exe"	eagnt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wcsjzoatltjuaxa = "iqibtkytnxpckjoxa.exe ."	eagnt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\twjxkwfvkpck = "pavrmgxvsfaqbdlxdhlw.exe ."	eagnt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\iqibtkytnxpckjoxa = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cmgbvoebxjdscdkvadg.exe"	eagnt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\twjxkwfvkpck = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ratngynjepiwfflvzb.exe ."	eagnt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tyndsgrjahwglh = "eqmjfasrpdzqcfobinsea.exe"	eagnt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wcsjzoatltjuaxa = "iqibtkytnxpckjoxa.exe ."	eagnt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\twjxkwfvkpck = "iqibtkytnxpckjoxa.exe ."	eagnt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wcsjzoatltjuaxa = "cmgbvoebxjdscdkvadg.exe ."	eagnt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wykxjucrfjv = "ratngynjepiwfflvzb.exe"	eagnt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\twjxkwfvkpck = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pavrmgxvsfaqbdlxdhlw.exe ."	eagnt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wykxjucrfjv = "cmgbvoebxjdscdkvadg.exe"	eagnt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\iqibtkytnxpckjoxa = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bizriylfyhykrptb.exe"	eagnt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	pwyrqtqlzgi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\twjxkwfvkpck = "iqibtkytnxpckjoxa.exe ."	pwyrqtqlzgi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\twjxkwfvkpck = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cmgbvoebxjdscdkvadg.exe ."	eagnt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tyndsgrjahwglh = "ratngynjepiwfflvzb.exe"	eagnt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wykxjucrfjv = "ratngynjepiwfflvzb.exe"	eagnt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wykxjucrfjv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bizriylfyhykrptb.exe"	eagnt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\twjxkwfvkpck = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cmgbvoebxjdscdkvadg.exe ."	eagnt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	eagnt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bizriylfyhykrptb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pavrmgxvsfaqbdlxdhlw.exe ."	eagnt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wcsjzoatltjuaxa = "ratngynjepiwfflvzb.exe ."	eagnt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\iqibtkytnxpckjoxa = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ratngynjepiwfflvzb.exe"	eagnt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\iqibtkytnxpckjoxa = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cmgbvoebxjdscdkvadg.exe"	eagnt.exe

Checks whether UAC is enabled 1 TTPs 8 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	eagnt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	pwyrqtqlzgi.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	pwyrqtqlzgi.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	eagnt.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	eagnt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	eagnt.exe

Looks up external IP address via web service 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
31	whatismyip.everdot.org
45	www.showmyipaddress.com
19	whatismyip.everdot.org
21	whatismyipaddress.com
28	whatismyip.everdot.org

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\autorun.inf	eagnt.exe
File created	C:\autorun.inf	eagnt.exe

Drops file in System32 directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\ratngynjepiwfflvzb.exe	eagnt.exe
File opened for modification	C:\Windows\SysWOW64\iqibtkytnxpckjoxa.exe	eagnt.exe
File opened for modification	C:\Windows\SysWOW64\vifdawppodasfjthpvbolj.exe	eagnt.exe
File opened for modification	C:\Windows\SysWOW64\vifdawppodasfjthpvbolj.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\SysWOW64\iqibtkytnxpckjoxa.exe	eagnt.exe
File opened for modification	C:\Windows\SysWOW64\bizriylfyhykrptb.exe	eagnt.exe
File opened for modification	C:\Windows\SysWOW64\pavrmgxvsfaqbdlxdhlw.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\SysWOW64\ratngynjepiwfflvzb.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\SysWOW64\eqmjfasrpdzqcfobinsea.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\SysWOW64\eqmjfasrpdzqcfobinsea.exe	eagnt.exe
File opened for modification	C:\Windows\SysWOW64\gwwxxwsvxppkahulwfoee.fea	eagnt.exe
File opened for modification	C:\Windows\SysWOW64\bcnzkubpcfqwxpnplfzalxisznadouvn.njd	eagnt.exe
File opened for modification	C:\Windows\SysWOW64\iqibtkytnxpckjoxa.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\SysWOW64\vifdawppodasfjthpvbolj.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\SysWOW64\eqmjfasrpdzqcfobinsea.exe	eagnt.exe
File opened for modification	C:\Windows\SysWOW64\cmgbvoebxjdscdkvadg.exe	eagnt.exe
File opened for modification	C:\Windows\SysWOW64\eqmjfasrpdzqcfobinsea.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\SysWOW64\bizriylfyhykrptb.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\SysWOW64\pavrmgxvsfaqbdlxdhlw.exe	pwyrqtqlzgi.exe
File created	C:\Windows\SysWOW64\gwwxxwsvxppkahulwfoee.fea	eagnt.exe
File opened for modification	C:\Windows\SysWOW64\pavrmgxvsfaqbdlxdhlw.exe	eagnt.exe
File opened for modification	C:\Windows\SysWOW64\pavrmgxvsfaqbdlxdhlw.exe	eagnt.exe
File opened for modification	C:\Windows\SysWOW64\cmgbvoebxjdscdkvadg.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\SysWOW64\iqibtkytnxpckjoxa.exe	pwyrqtqlzgi.exe
File created	C:\Windows\SysWOW64\bcnzkubpcfqwxpnplfzalxisznadouvn.njd	eagnt.exe
File opened for modification	C:\Windows\SysWOW64\cmgbvoebxjdscdkvadg.exe	eagnt.exe
File opened for modification	C:\Windows\SysWOW64\ratngynjepiwfflvzb.exe	eagnt.exe
File opened for modification	C:\Windows\SysWOW64\vifdawppodasfjthpvbolj.exe	eagnt.exe
File opened for modification	C:\Windows\SysWOW64\bizriylfyhykrptb.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\SysWOW64\ratngynjepiwfflvzb.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\SysWOW64\cmgbvoebxjdscdkvadg.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\SysWOW64\bizriylfyhykrptb.exe	eagnt.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\gwwxxwsvxppkahulwfoee.fea	eagnt.exe
File created	C:\Program Files (x86)\gwwxxwsvxppkahulwfoee.fea	eagnt.exe
File opened for modification	C:\Program Files (x86)\bcnzkubpcfqwxpnplfzalxisznadouvn.njd	eagnt.exe
File created	C:\Program Files (x86)\bcnzkubpcfqwxpnplfzalxisznadouvn.njd	eagnt.exe

Drops file in Windows directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ratngynjepiwfflvzb.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\cmgbvoebxjdscdkvadg.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\eqmjfasrpdzqcfobinsea.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\vifdawppodasfjthpvbolj.exe	pwyrqtqlzgi.exe
File created	C:\Windows\gwwxxwsvxppkahulwfoee.fea	eagnt.exe
File opened for modification	C:\Windows\bizriylfyhykrptb.exe	eagnt.exe
File opened for modification	C:\Windows\ratngynjepiwfflvzb.exe	eagnt.exe
File opened for modification	C:\Windows\bcnzkubpcfqwxpnplfzalxisznadouvn.njd	eagnt.exe
File opened for modification	C:\Windows\pavrmgxvsfaqbdlxdhlw.exe	eagnt.exe
File opened for modification	C:\Windows\vifdawppodasfjthpvbolj.exe	eagnt.exe
File opened for modification	C:\Windows\vifdawppodasfjthpvbolj.exe	eagnt.exe
File opened for modification	C:\Windows\ratngynjepiwfflvzb.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\vifdawppodasfjthpvbolj.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\cmgbvoebxjdscdkvadg.exe	eagnt.exe
File opened for modification	C:\Windows\bizriylfyhykrptb.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\pavrmgxvsfaqbdlxdhlw.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\iqibtkytnxpckjoxa.exe	eagnt.exe
File opened for modification	C:\Windows\cmgbvoebxjdscdkvadg.exe	eagnt.exe
File opened for modification	C:\Windows\eqmjfasrpdzqcfobinsea.exe	eagnt.exe
File opened for modification	C:\Windows\bizriylfyhykrptb.exe	eagnt.exe
File opened for modification	C:\Windows\iqibtkytnxpckjoxa.exe	eagnt.exe
File opened for modification	C:\Windows\bizriylfyhykrptb.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\pavrmgxvsfaqbdlxdhlw.exe	eagnt.exe
File opened for modification	C:\Windows\ratngynjepiwfflvzb.exe	eagnt.exe
File opened for modification	C:\Windows\gwwxxwsvxppkahulwfoee.fea	eagnt.exe
File opened for modification	C:\Windows\eqmjfasrpdzqcfobinsea.exe	eagnt.exe
File created	C:\Windows\bcnzkubpcfqwxpnplfzalxisznadouvn.njd	eagnt.exe
File opened for modification	C:\Windows\iqibtkytnxpckjoxa.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\cmgbvoebxjdscdkvadg.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\eqmjfasrpdzqcfobinsea.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\iqibtkytnxpckjoxa.exe	pwyrqtqlzgi.exe
File opened for modification	C:\Windows\pavrmgxvsfaqbdlxdhlw.exe	pwyrqtqlzgi.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
864	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
864	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
864	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
864	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
864	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
864	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
864	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
864	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
864	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
864	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
864	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
864	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
864	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
864	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
864	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
864	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
864	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
864	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
864	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
2400	eagnt.exe
864	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
2400	eagnt.exe
864	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
864	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
864	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
864	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
864	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
864	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
864	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
864	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
864	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
864	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
864	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
864	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
864	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
864	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
864	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
864	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
864	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
864	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
864	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
864	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
864	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
864	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
864	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
864	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
864	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
864	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
864	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
864	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
864	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
864	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
2400	eagnt.exe
2400	eagnt.exe
864	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
864	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
864	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
864	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
864	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
864	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
864	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
864	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
864	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
864	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2400	eagnt.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 864 wrote to memory of 2412	864	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe	86
PID 864 wrote to memory of 2412	864	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe	86
PID 864 wrote to memory of 2412	864	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe	86
PID 2412 wrote to memory of 2400	2412	pwyrqtqlzgi.exe	89
PID 2412 wrote to memory of 2400	2412	pwyrqtqlzgi.exe	89
PID 2412 wrote to memory of 2400	2412	pwyrqtqlzgi.exe	89
PID 2412 wrote to memory of 4824	2412	pwyrqtqlzgi.exe	90
PID 2412 wrote to memory of 4824	2412	pwyrqtqlzgi.exe	90
PID 2412 wrote to memory of 4824	2412	pwyrqtqlzgi.exe	90
PID 864 wrote to memory of 2368	864	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe	95
PID 864 wrote to memory of 2368	864	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe	95
PID 864 wrote to memory of 2368	864	75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe	95

System policy modification 1 TTPs 41 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	eagnt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	eagnt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	eagnt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	eagnt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	eagnt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	eagnt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	pwyrqtqlzgi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	pwyrqtqlzgi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	eagnt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	eagnt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	eagnt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	eagnt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	eagnt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	eagnt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	eagnt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	eagnt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	eagnt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	eagnt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	pwyrqtqlzgi.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	eagnt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	eagnt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	eagnt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	eagnt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	eagnt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	eagnt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	pwyrqtqlzgi.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	eagnt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	eagnt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	eagnt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	eagnt.exe

C:\Users\Admin\AppData\Local\Temp\75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe
"C:\Users\Admin\AppData\Local\Temp\75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:864
- C:\Users\Admin\AppData\Local\Temp\pwyrqtqlzgi.exe
  "C:\Users\Admin\AppData\Local\Temp\pwyrqtqlzgi.exe" "c:\users\admin\appdata\local\temp\75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe*"
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Adds policy Run key to start application
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Checks computer location settings
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2412
- - C:\Users\Admin\AppData\Local\Temp\eagnt.exe
    "C:\Users\Admin\AppData\Local\Temp\eagnt.exe" "-C:\Users\Admin\AppData\Local\Temp\bizriylfyhykrptb.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops autorun.inf file
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - System policy modification
    PID:2400
- - C:\Users\Admin\AppData\Local\Temp\eagnt.exe
    "C:\Users\Admin\AppData\Local\Temp\eagnt.exe" "-C:\Users\Admin\AppData\Local\Temp\bizriylfyhykrptb.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System policy modification
    PID:4824
- C:\Users\Admin\AppData\Local\Temp\pwyrqtqlzgi.exe
  "C:\Users\Admin\AppData\Local\Temp\pwyrqtqlzgi.exe" "c:\users\admin\appdata\local\temp\75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493.exe"
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Adds policy Run key to start application
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System policy modification
  PID:2368

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bizriylfyhykrptb.exe

Filesize
508KB

MD5
4021b2581e5521699afcd8d29dfb12b0

SHA1
3cb26d621250ec7a6115ca1d6a037d0166e7cb2b

SHA256
75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493

SHA512
b2b06e7695843b52397b4c1fd887930974d147b75456db28288bf01bcd673333828ea8900dec986b2dd78bec7f0ef4dfbe35843603e6e1e22c866450055baddc

Download Submit
C:\Users\Admin\AppData\Local\Temp\cmgbvoebxjdscdkvadg.exe

Filesize
508KB

MD5
4021b2581e5521699afcd8d29dfb12b0

SHA1
3cb26d621250ec7a6115ca1d6a037d0166e7cb2b

SHA256
75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493

SHA512
b2b06e7695843b52397b4c1fd887930974d147b75456db28288bf01bcd673333828ea8900dec986b2dd78bec7f0ef4dfbe35843603e6e1e22c866450055baddc

Download Submit
C:\Users\Admin\AppData\Local\Temp\eagnt.exe

Filesize
720KB

MD5
ad7811c183806e076a3218c75e59c59a

SHA1
b8b2d35b0330041a3934d4a6afe493926421726d

SHA256
60197cab7760dd35b0c1e79e07871ba4916b0c8bcf34cc27e5515fff88742c21

SHA512
ec2dee9b241b48ec5eb951cbefe9aae9e8afc9437fe95c665a59e40f150b6e42cb9bcbd648063b6d997508245536efd99532c6864a02e359b3101195be7533d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\eagnt.exe

Filesize
720KB

MD5
ad7811c183806e076a3218c75e59c59a

SHA1
b8b2d35b0330041a3934d4a6afe493926421726d

SHA256
60197cab7760dd35b0c1e79e07871ba4916b0c8bcf34cc27e5515fff88742c21

SHA512
ec2dee9b241b48ec5eb951cbefe9aae9e8afc9437fe95c665a59e40f150b6e42cb9bcbd648063b6d997508245536efd99532c6864a02e359b3101195be7533d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\eagnt.exe

Filesize
720KB

MD5
ad7811c183806e076a3218c75e59c59a

SHA1
b8b2d35b0330041a3934d4a6afe493926421726d

SHA256
60197cab7760dd35b0c1e79e07871ba4916b0c8bcf34cc27e5515fff88742c21

SHA512
ec2dee9b241b48ec5eb951cbefe9aae9e8afc9437fe95c665a59e40f150b6e42cb9bcbd648063b6d997508245536efd99532c6864a02e359b3101195be7533d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\eqmjfasrpdzqcfobinsea.exe

Filesize
508KB

MD5
4021b2581e5521699afcd8d29dfb12b0

SHA1
3cb26d621250ec7a6115ca1d6a037d0166e7cb2b

SHA256
75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493

SHA512
b2b06e7695843b52397b4c1fd887930974d147b75456db28288bf01bcd673333828ea8900dec986b2dd78bec7f0ef4dfbe35843603e6e1e22c866450055baddc

Download Submit
C:\Users\Admin\AppData\Local\Temp\iqibtkytnxpckjoxa.exe

Filesize
508KB

MD5
4021b2581e5521699afcd8d29dfb12b0

SHA1
3cb26d621250ec7a6115ca1d6a037d0166e7cb2b

SHA256
75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493

SHA512
b2b06e7695843b52397b4c1fd887930974d147b75456db28288bf01bcd673333828ea8900dec986b2dd78bec7f0ef4dfbe35843603e6e1e22c866450055baddc

Download Submit
C:\Users\Admin\AppData\Local\Temp\pavrmgxvsfaqbdlxdhlw.exe

Filesize
508KB

MD5
4021b2581e5521699afcd8d29dfb12b0

SHA1
3cb26d621250ec7a6115ca1d6a037d0166e7cb2b

SHA256
75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493

SHA512
b2b06e7695843b52397b4c1fd887930974d147b75456db28288bf01bcd673333828ea8900dec986b2dd78bec7f0ef4dfbe35843603e6e1e22c866450055baddc

Download Submit
C:\Users\Admin\AppData\Local\Temp\pwyrqtqlzgi.exe

Filesize
320KB

MD5
5db4502531d02656a3ce015e519e044b

SHA1
06ae3d205da44343cdec21df89d23e4584dc1c0d

SHA256
d5f69281a07da0c21bef2b79d5b5cc11b721848e802aea715bc14e25455c22e7

SHA512
6be69533a39b639f48ded3dd38c784b7c53c6c0ff99db7b356cc24cde5934e3c004ea1acce353fc755e290f59ebbb387aeb821bab3976691fb3b263c58c070d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\pwyrqtqlzgi.exe

Filesize
320KB

MD5
5db4502531d02656a3ce015e519e044b

SHA1
06ae3d205da44343cdec21df89d23e4584dc1c0d

SHA256
d5f69281a07da0c21bef2b79d5b5cc11b721848e802aea715bc14e25455c22e7

SHA512
6be69533a39b639f48ded3dd38c784b7c53c6c0ff99db7b356cc24cde5934e3c004ea1acce353fc755e290f59ebbb387aeb821bab3976691fb3b263c58c070d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\pwyrqtqlzgi.exe

Filesize
320KB

MD5
5db4502531d02656a3ce015e519e044b

SHA1
06ae3d205da44343cdec21df89d23e4584dc1c0d

SHA256
d5f69281a07da0c21bef2b79d5b5cc11b721848e802aea715bc14e25455c22e7

SHA512
6be69533a39b639f48ded3dd38c784b7c53c6c0ff99db7b356cc24cde5934e3c004ea1acce353fc755e290f59ebbb387aeb821bab3976691fb3b263c58c070d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\ratngynjepiwfflvzb.exe

Filesize
508KB

MD5
4021b2581e5521699afcd8d29dfb12b0

SHA1
3cb26d621250ec7a6115ca1d6a037d0166e7cb2b

SHA256
75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493

SHA512
b2b06e7695843b52397b4c1fd887930974d147b75456db28288bf01bcd673333828ea8900dec986b2dd78bec7f0ef4dfbe35843603e6e1e22c866450055baddc

Download Submit
C:\Users\Admin\AppData\Local\Temp\vifdawppodasfjthpvbolj.exe

Filesize
508KB

MD5
4021b2581e5521699afcd8d29dfb12b0

SHA1
3cb26d621250ec7a6115ca1d6a037d0166e7cb2b

SHA256
75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493

SHA512
b2b06e7695843b52397b4c1fd887930974d147b75456db28288bf01bcd673333828ea8900dec986b2dd78bec7f0ef4dfbe35843603e6e1e22c866450055baddc

Download Submit
C:\Windows\SysWOW64\bizriylfyhykrptb.exe

Filesize
508KB

MD5
4021b2581e5521699afcd8d29dfb12b0

SHA1
3cb26d621250ec7a6115ca1d6a037d0166e7cb2b

SHA256
75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493

SHA512
b2b06e7695843b52397b4c1fd887930974d147b75456db28288bf01bcd673333828ea8900dec986b2dd78bec7f0ef4dfbe35843603e6e1e22c866450055baddc

Download Submit
C:\Windows\SysWOW64\cmgbvoebxjdscdkvadg.exe

Filesize
508KB

MD5
4021b2581e5521699afcd8d29dfb12b0

SHA1
3cb26d621250ec7a6115ca1d6a037d0166e7cb2b

SHA256
75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493

SHA512
b2b06e7695843b52397b4c1fd887930974d147b75456db28288bf01bcd673333828ea8900dec986b2dd78bec7f0ef4dfbe35843603e6e1e22c866450055baddc

Download Submit
C:\Windows\SysWOW64\eqmjfasrpdzqcfobinsea.exe

Filesize
508KB

MD5
4021b2581e5521699afcd8d29dfb12b0

SHA1
3cb26d621250ec7a6115ca1d6a037d0166e7cb2b

SHA256
75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493

SHA512
b2b06e7695843b52397b4c1fd887930974d147b75456db28288bf01bcd673333828ea8900dec986b2dd78bec7f0ef4dfbe35843603e6e1e22c866450055baddc

Download Submit
C:\Windows\SysWOW64\iqibtkytnxpckjoxa.exe

Filesize
508KB

MD5
4021b2581e5521699afcd8d29dfb12b0

SHA1
3cb26d621250ec7a6115ca1d6a037d0166e7cb2b

SHA256
75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493

SHA512
b2b06e7695843b52397b4c1fd887930974d147b75456db28288bf01bcd673333828ea8900dec986b2dd78bec7f0ef4dfbe35843603e6e1e22c866450055baddc

Download Submit
C:\Windows\SysWOW64\pavrmgxvsfaqbdlxdhlw.exe

Filesize
508KB

MD5
4021b2581e5521699afcd8d29dfb12b0

SHA1
3cb26d621250ec7a6115ca1d6a037d0166e7cb2b

SHA256
75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493

SHA512
b2b06e7695843b52397b4c1fd887930974d147b75456db28288bf01bcd673333828ea8900dec986b2dd78bec7f0ef4dfbe35843603e6e1e22c866450055baddc

Download Submit
C:\Windows\SysWOW64\ratngynjepiwfflvzb.exe

Filesize
508KB

MD5
4021b2581e5521699afcd8d29dfb12b0

SHA1
3cb26d621250ec7a6115ca1d6a037d0166e7cb2b

SHA256
75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493

SHA512
b2b06e7695843b52397b4c1fd887930974d147b75456db28288bf01bcd673333828ea8900dec986b2dd78bec7f0ef4dfbe35843603e6e1e22c866450055baddc

Download Submit
C:\Windows\SysWOW64\vifdawppodasfjthpvbolj.exe

Filesize
508KB

MD5
4021b2581e5521699afcd8d29dfb12b0

SHA1
3cb26d621250ec7a6115ca1d6a037d0166e7cb2b

SHA256
75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493

SHA512
b2b06e7695843b52397b4c1fd887930974d147b75456db28288bf01bcd673333828ea8900dec986b2dd78bec7f0ef4dfbe35843603e6e1e22c866450055baddc

Download Submit
C:\Windows\bizriylfyhykrptb.exe

Filesize
508KB

MD5
4021b2581e5521699afcd8d29dfb12b0

SHA1
3cb26d621250ec7a6115ca1d6a037d0166e7cb2b

SHA256
75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493

SHA512
b2b06e7695843b52397b4c1fd887930974d147b75456db28288bf01bcd673333828ea8900dec986b2dd78bec7f0ef4dfbe35843603e6e1e22c866450055baddc

Download Submit
C:\Windows\bizriylfyhykrptb.exe

Filesize
508KB

MD5
4021b2581e5521699afcd8d29dfb12b0

SHA1
3cb26d621250ec7a6115ca1d6a037d0166e7cb2b

SHA256
75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493

SHA512
b2b06e7695843b52397b4c1fd887930974d147b75456db28288bf01bcd673333828ea8900dec986b2dd78bec7f0ef4dfbe35843603e6e1e22c866450055baddc

Download Submit
C:\Windows\bizriylfyhykrptb.exe

Filesize
508KB

MD5
4021b2581e5521699afcd8d29dfb12b0

SHA1
3cb26d621250ec7a6115ca1d6a037d0166e7cb2b

SHA256
75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493

SHA512
b2b06e7695843b52397b4c1fd887930974d147b75456db28288bf01bcd673333828ea8900dec986b2dd78bec7f0ef4dfbe35843603e6e1e22c866450055baddc

Download Submit
C:\Windows\cmgbvoebxjdscdkvadg.exe

Filesize
508KB

MD5
4021b2581e5521699afcd8d29dfb12b0

SHA1
3cb26d621250ec7a6115ca1d6a037d0166e7cb2b

SHA256
75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493

SHA512
b2b06e7695843b52397b4c1fd887930974d147b75456db28288bf01bcd673333828ea8900dec986b2dd78bec7f0ef4dfbe35843603e6e1e22c866450055baddc

Download Submit
C:\Windows\cmgbvoebxjdscdkvadg.exe

Filesize
508KB

MD5
4021b2581e5521699afcd8d29dfb12b0

SHA1
3cb26d621250ec7a6115ca1d6a037d0166e7cb2b

SHA256
75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493

SHA512
b2b06e7695843b52397b4c1fd887930974d147b75456db28288bf01bcd673333828ea8900dec986b2dd78bec7f0ef4dfbe35843603e6e1e22c866450055baddc

Download Submit
C:\Windows\cmgbvoebxjdscdkvadg.exe

Filesize
508KB

MD5
4021b2581e5521699afcd8d29dfb12b0

SHA1
3cb26d621250ec7a6115ca1d6a037d0166e7cb2b

SHA256
75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493

SHA512
b2b06e7695843b52397b4c1fd887930974d147b75456db28288bf01bcd673333828ea8900dec986b2dd78bec7f0ef4dfbe35843603e6e1e22c866450055baddc

Download Submit
C:\Windows\eqmjfasrpdzqcfobinsea.exe

Filesize
508KB

MD5
4021b2581e5521699afcd8d29dfb12b0

SHA1
3cb26d621250ec7a6115ca1d6a037d0166e7cb2b

SHA256
75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493

SHA512
b2b06e7695843b52397b4c1fd887930974d147b75456db28288bf01bcd673333828ea8900dec986b2dd78bec7f0ef4dfbe35843603e6e1e22c866450055baddc

Download Submit
C:\Windows\eqmjfasrpdzqcfobinsea.exe

Filesize
508KB

MD5
4021b2581e5521699afcd8d29dfb12b0

SHA1
3cb26d621250ec7a6115ca1d6a037d0166e7cb2b

SHA256
75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493

SHA512
b2b06e7695843b52397b4c1fd887930974d147b75456db28288bf01bcd673333828ea8900dec986b2dd78bec7f0ef4dfbe35843603e6e1e22c866450055baddc

Download Submit
C:\Windows\eqmjfasrpdzqcfobinsea.exe

Filesize
508KB

MD5
4021b2581e5521699afcd8d29dfb12b0

SHA1
3cb26d621250ec7a6115ca1d6a037d0166e7cb2b

SHA256
75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493

SHA512
b2b06e7695843b52397b4c1fd887930974d147b75456db28288bf01bcd673333828ea8900dec986b2dd78bec7f0ef4dfbe35843603e6e1e22c866450055baddc

Download Submit
C:\Windows\iqibtkytnxpckjoxa.exe

Filesize
508KB

MD5
4021b2581e5521699afcd8d29dfb12b0

SHA1
3cb26d621250ec7a6115ca1d6a037d0166e7cb2b

SHA256
75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493

SHA512
b2b06e7695843b52397b4c1fd887930974d147b75456db28288bf01bcd673333828ea8900dec986b2dd78bec7f0ef4dfbe35843603e6e1e22c866450055baddc

Download Submit
C:\Windows\iqibtkytnxpckjoxa.exe

Filesize
508KB

MD5
4021b2581e5521699afcd8d29dfb12b0

SHA1
3cb26d621250ec7a6115ca1d6a037d0166e7cb2b

SHA256
75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493

SHA512
b2b06e7695843b52397b4c1fd887930974d147b75456db28288bf01bcd673333828ea8900dec986b2dd78bec7f0ef4dfbe35843603e6e1e22c866450055baddc

Download Submit
C:\Windows\iqibtkytnxpckjoxa.exe

Filesize
508KB

MD5
4021b2581e5521699afcd8d29dfb12b0

SHA1
3cb26d621250ec7a6115ca1d6a037d0166e7cb2b

SHA256
75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493

SHA512
b2b06e7695843b52397b4c1fd887930974d147b75456db28288bf01bcd673333828ea8900dec986b2dd78bec7f0ef4dfbe35843603e6e1e22c866450055baddc

Download Submit
C:\Windows\pavrmgxvsfaqbdlxdhlw.exe

Filesize
508KB

MD5
4021b2581e5521699afcd8d29dfb12b0

SHA1
3cb26d621250ec7a6115ca1d6a037d0166e7cb2b

SHA256
75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493

SHA512
b2b06e7695843b52397b4c1fd887930974d147b75456db28288bf01bcd673333828ea8900dec986b2dd78bec7f0ef4dfbe35843603e6e1e22c866450055baddc

Download Submit
C:\Windows\pavrmgxvsfaqbdlxdhlw.exe

Filesize
508KB

MD5
4021b2581e5521699afcd8d29dfb12b0

SHA1
3cb26d621250ec7a6115ca1d6a037d0166e7cb2b

SHA256
75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493

SHA512
b2b06e7695843b52397b4c1fd887930974d147b75456db28288bf01bcd673333828ea8900dec986b2dd78bec7f0ef4dfbe35843603e6e1e22c866450055baddc

Download Submit
C:\Windows\pavrmgxvsfaqbdlxdhlw.exe

Filesize
508KB

MD5
4021b2581e5521699afcd8d29dfb12b0

SHA1
3cb26d621250ec7a6115ca1d6a037d0166e7cb2b

SHA256
75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493

SHA512
b2b06e7695843b52397b4c1fd887930974d147b75456db28288bf01bcd673333828ea8900dec986b2dd78bec7f0ef4dfbe35843603e6e1e22c866450055baddc

Download Submit
C:\Windows\ratngynjepiwfflvzb.exe

Filesize
508KB

MD5
4021b2581e5521699afcd8d29dfb12b0

SHA1
3cb26d621250ec7a6115ca1d6a037d0166e7cb2b

SHA256
75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493

SHA512
b2b06e7695843b52397b4c1fd887930974d147b75456db28288bf01bcd673333828ea8900dec986b2dd78bec7f0ef4dfbe35843603e6e1e22c866450055baddc

Download Submit
C:\Windows\ratngynjepiwfflvzb.exe

Filesize
508KB

MD5
4021b2581e5521699afcd8d29dfb12b0

SHA1
3cb26d621250ec7a6115ca1d6a037d0166e7cb2b

SHA256
75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493

SHA512
b2b06e7695843b52397b4c1fd887930974d147b75456db28288bf01bcd673333828ea8900dec986b2dd78bec7f0ef4dfbe35843603e6e1e22c866450055baddc

Download Submit
C:\Windows\ratngynjepiwfflvzb.exe

Filesize
508KB

MD5
4021b2581e5521699afcd8d29dfb12b0

SHA1
3cb26d621250ec7a6115ca1d6a037d0166e7cb2b

SHA256
75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493

SHA512
b2b06e7695843b52397b4c1fd887930974d147b75456db28288bf01bcd673333828ea8900dec986b2dd78bec7f0ef4dfbe35843603e6e1e22c866450055baddc

Download Submit
C:\Windows\vifdawppodasfjthpvbolj.exe

Filesize
508KB

MD5
4021b2581e5521699afcd8d29dfb12b0

SHA1
3cb26d621250ec7a6115ca1d6a037d0166e7cb2b

SHA256
75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493

SHA512
b2b06e7695843b52397b4c1fd887930974d147b75456db28288bf01bcd673333828ea8900dec986b2dd78bec7f0ef4dfbe35843603e6e1e22c866450055baddc

Download Submit
C:\Windows\vifdawppodasfjthpvbolj.exe

Filesize
508KB

MD5
4021b2581e5521699afcd8d29dfb12b0

SHA1
3cb26d621250ec7a6115ca1d6a037d0166e7cb2b

SHA256
75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493

SHA512
b2b06e7695843b52397b4c1fd887930974d147b75456db28288bf01bcd673333828ea8900dec986b2dd78bec7f0ef4dfbe35843603e6e1e22c866450055baddc

Download Submit
C:\Windows\vifdawppodasfjthpvbolj.exe

Filesize
508KB

MD5
4021b2581e5521699afcd8d29dfb12b0

SHA1
3cb26d621250ec7a6115ca1d6a037d0166e7cb2b

SHA256
75d9ab9131128e1b4f4f5f060a622c1c4e575cc50bd83f9c02e2036388879493

SHA512
b2b06e7695843b52397b4c1fd887930974d147b75456db28288bf01bcd673333828ea8900dec986b2dd78bec7f0ef4dfbe35843603e6e1e22c866450055baddc

Download Submit