da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2

Analysis

max time kernel
151s
max time network
154s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19-10-2022 14:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe
Size

1016KB
MD5

a18c15eec6f29f6068ad2233ed5f3b20
SHA1

c27c3f1aba2e08de4bc97ea415c38c5c71e81a12
SHA256

da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2
SHA512

962cc663c7f6f352788ad8c34c10c2229e95503afa703a6298900203e078a3e22de207c887bd39a3eb257d90977cc9f98761cc660de9cf065496261bf50e2d24
SSDEEP

6144:qIXsL0tvrSVz1DnemeYbpsnEf78AoXh6KkiD0OofzA+/VygHU:qIXsgtvm1De5YlOx6lzBH46U

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	iffdguquspp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	bbonv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	bbonv.exe

UAC bypass 3 TTPs 10 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	bbonv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	iffdguquspp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	bbonv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	bbonv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	bbonv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	bbonv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	iffdguquspp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	bbonv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	bbonv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	bbonv.exe

Adds policy Run key to start application 2 TTPs 18 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mnbbkk = "mbdroccwmftzipbydqix.exe"	bbonv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mnbbkk = "frqbvgduhxilrveya.exe"	bbonv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	bbonv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mnbbkk = "mbdroccwmftzipbydqix.exe"	bbonv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lju = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yjhrkuqgshrtybjc.exe"	bbonv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mnbbkk = "frqbvgduhxilrveya.exe"	bbonv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lju = "C:\\Users\\Admin\\AppData\\Local\\Temp\\frqbvgduhxilrveya.exe"	bbonv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lju = "C:\\Users\\Admin\\AppData\\Local\\Temp\\brujhwxsjdszjreciwpfi.exe"	iffdguquspp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mnbbkk = "brujhwxsjdszjreciwpfi.exe"	bbonv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	iffdguquspp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lju = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mbdroccwmftzipbydqix.exe"	bbonv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lju = "C:\\Users\\Admin\\AppData\\Local\\Temp\\brujhwxsjdszjreciwpfi.exe"	bbonv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mnbbkk = "znobxkjcrjwbjpawamd.exe"	bbonv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mnbbkk = "brujhwxsjdszjreciwpfi.exe"	iffdguquspp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mnbbkk = "znobxkjcrjwbjpawamd.exe"	bbonv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	bbonv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lju = "C:\\Users\\Admin\\AppData\\Local\\Temp\\obbniuskypbfmrbwzk.exe"	bbonv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mnbbkk = "yjhrkuqgshrtybjc.exe"	bbonv.exe

Disables RegEdit via registry modification 6 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	iffdguquspp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	iffdguquspp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	bbonv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	bbonv.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	bbonv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	bbonv.exe

Executes dropped EXE 3 IoCs

pid	Process
1152	iffdguquspp.exe
592	bbonv.exe
868	bbonv.exe

Loads dropped DLL 6 IoCs

pid	Process
1492	da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe
1492	da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe
1152	iffdguquspp.exe
1152	iffdguquspp.exe
1152	iffdguquspp.exe
1152	iffdguquspp.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\srdb = "brujhwxsjdszjreciwpfi.exe"	bbonv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bbonv = "znobxkjcrjwbjpawamd.exe ."	bbonv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\zbqrbcp = "znobxkjcrjwbjpawamd.exe"	bbonv.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	iffdguquspp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ydvzmqgqwf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mbdroccwmftzipbydqix.exe"	bbonv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\srdb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\obbniuskypbfmrbwzk.exe"	bbonv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bbonv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\brujhwxsjdszjreciwpfi.exe ."	bbonv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fjadpshqv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\znobxkjcrjwbjpawamd.exe ."	bbonv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bbonv = "frqbvgduhxilrveya.exe ."	bbonv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\srdb = "znobxkjcrjwbjpawamd.exe"	bbonv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\srdb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\brujhwxsjdszjreciwpfi.exe"	bbonv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\zbqrbcp = "brujhwxsjdszjreciwpfi.exe"	bbonv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bbonv = "mbdroccwmftzipbydqix.exe ."	bbonv.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	bbonv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\srdb = "frqbvgduhxilrveya.exe"	bbonv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\orhjuwks = "frqbvgduhxilrveya.exe ."	iffdguquspp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bbonv = "obbniuskypbfmrbwzk.exe ."	bbonv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\orhjuwks = "znobxkjcrjwbjpawamd.exe ."	bbonv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ydvzmqgqwf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\frqbvgduhxilrveya.exe"	bbonv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bbonv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\brujhwxsjdszjreciwpfi.exe ."	bbonv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\orhjuwks = "obbniuskypbfmrbwzk.exe ."	bbonv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\srdb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\brujhwxsjdszjreciwpfi.exe"	bbonv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	iffdguquspp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bbonv = "frqbvgduhxilrveya.exe ."	iffdguquspp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fjadpshqv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\brujhwxsjdszjreciwpfi.exe ."	bbonv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\orhjuwks = "mbdroccwmftzipbydqix.exe ."	bbonv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bbonv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\obbniuskypbfmrbwzk.exe ."	iffdguquspp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\srdb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\znobxkjcrjwbjpawamd.exe"	bbonv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	bbonv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	bbonv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bbonv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\frqbvgduhxilrveya.exe ."	bbonv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\zbqrbcp = "frqbvgduhxilrveya.exe"	bbonv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bbonv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mbdroccwmftzipbydqix.exe ."	bbonv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\srdb = "mbdroccwmftzipbydqix.exe"	bbonv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\zbqrbcp = "frqbvgduhxilrveya.exe"	iffdguquspp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	bbonv.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	bbonv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\zbqrbcp = "mbdroccwmftzipbydqix.exe"	bbonv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\srdb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yjhrkuqgshrtybjc.exe"	bbonv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ydvzmqgqwf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\brujhwxsjdszjreciwpfi.exe"	iffdguquspp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\zbqrbcp = "frqbvgduhxilrveya.exe"	bbonv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fjadpshqv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yjhrkuqgshrtybjc.exe ."	bbonv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fjadpshqv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mbdroccwmftzipbydqix.exe ."	bbonv.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	iffdguquspp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\srdb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\obbniuskypbfmrbwzk.exe"	iffdguquspp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\srdb = "yjhrkuqgshrtybjc.exe"	bbonv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bbonv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yjhrkuqgshrtybjc.exe ."	bbonv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\srdb = "yjhrkuqgshrtybjc.exe"	bbonv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\orhjuwks = "brujhwxsjdszjreciwpfi.exe ."	bbonv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\orhjuwks = "znobxkjcrjwbjpawamd.exe ."	bbonv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\orhjuwks = "yjhrkuqgshrtybjc.exe ."	bbonv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ydvzmqgqwf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\frqbvgduhxilrveya.exe"	bbonv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ydvzmqgqwf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\obbniuskypbfmrbwzk.exe"	bbonv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	iffdguquspp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\srdb = "brujhwxsjdszjreciwpfi.exe"	iffdguquspp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fjadpshqv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\obbniuskypbfmrbwzk.exe ."	iffdguquspp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	bbonv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fjadpshqv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\znobxkjcrjwbjpawamd.exe ."	bbonv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\srdb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yjhrkuqgshrtybjc.exe"	bbonv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bbonv = "mbdroccwmftzipbydqix.exe ."	bbonv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bbonv = "yjhrkuqgshrtybjc.exe ."	bbonv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bbonv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\obbniuskypbfmrbwzk.exe ."	bbonv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\zbqrbcp = "obbniuskypbfmrbwzk.exe"	bbonv.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	bbonv.exe

Checks whether UAC is enabled 1 TTPs 6 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	iffdguquspp.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	iffdguquspp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	bbonv.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	bbonv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	bbonv.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	bbonv.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	whatismyipaddress.com
5	www.showmyipaddress.com
11	whatismyip.everdot.org

Drops file in System32 directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\brujhwxsjdszjreciwpfi.exe	bbonv.exe
File opened for modification	C:\Windows\SysWOW64\obbniuskypbfmrbwzk.exe	iffdguquspp.exe
File opened for modification	C:\Windows\SysWOW64\mbdroccwmftzipbydqix.exe	iffdguquspp.exe
File opened for modification	C:\Windows\SysWOW64\brujhwxsjdszjreciwpfi.exe	iffdguquspp.exe
File opened for modification	C:\Windows\SysWOW64\sjndcsuqidtbmvjipeyptj.exe	iffdguquspp.exe
File opened for modification	C:\Windows\SysWOW64\frqbvgduhxilrveya.exe	bbonv.exe
File opened for modification	C:\Windows\SysWOW64\mbdroccwmftzipbydqix.exe	bbonv.exe
File opened for modification	C:\Windows\SysWOW64\yjhrkuqgshrtybjc.exe	bbonv.exe
File opened for modification	C:\Windows\SysWOW64\qzvducwkuhppstzqpwirnvmuocmzhhklriho.jfn	bbonv.exe
File opened for modification	C:\Windows\SysWOW64\obbniuskypbfmrbwzk.exe	bbonv.exe
File opened for modification	C:\Windows\SysWOW64\znobxkjcrjwbjpawamd.exe	bbonv.exe
File opened for modification	C:\Windows\SysWOW64\znobxkjcrjwbjpawamd.exe	bbonv.exe
File created	C:\Windows\SysWOW64\qzvducwkuhppstzqpwirnvmuocmzhhklriho.jfn	bbonv.exe
File opened for modification	C:\Windows\SysWOW64\yjhrkuqgshrtybjc.exe	bbonv.exe
File opened for modification	C:\Windows\SysWOW64\sjndcsuqidtbmvjipeyptj.exe	bbonv.exe
File opened for modification	C:\Windows\SysWOW64\ljurxudgfhetlbwcqmnlwtzwf.hjg	bbonv.exe
File opened for modification	C:\Windows\SysWOW64\sjndcsuqidtbmvjipeyptj.exe	bbonv.exe
File opened for modification	C:\Windows\SysWOW64\yjhrkuqgshrtybjc.exe	iffdguquspp.exe
File opened for modification	C:\Windows\SysWOW64\frqbvgduhxilrveya.exe	iffdguquspp.exe
File opened for modification	C:\Windows\SysWOW64\znobxkjcrjwbjpawamd.exe	iffdguquspp.exe
File opened for modification	C:\Windows\SysWOW64\brujhwxsjdszjreciwpfi.exe	bbonv.exe
File opened for modification	C:\Windows\SysWOW64\frqbvgduhxilrveya.exe	bbonv.exe
File opened for modification	C:\Windows\SysWOW64\obbniuskypbfmrbwzk.exe	bbonv.exe
File opened for modification	C:\Windows\SysWOW64\mbdroccwmftzipbydqix.exe	bbonv.exe
File created	C:\Windows\SysWOW64\ljurxudgfhetlbwcqmnlwtzwf.hjg	bbonv.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ljurxudgfhetlbwcqmnlwtzwf.hjg	bbonv.exe
File opened for modification	C:\Program Files (x86)\qzvducwkuhppstzqpwirnvmuocmzhhklriho.jfn	bbonv.exe
File created	C:\Program Files (x86)\qzvducwkuhppstzqpwirnvmuocmzhhklriho.jfn	bbonv.exe
File opened for modification	C:\Program Files (x86)\ljurxudgfhetlbwcqmnlwtzwf.hjg	bbonv.exe

Drops file in Windows directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\yjhrkuqgshrtybjc.exe	iffdguquspp.exe
File opened for modification	C:\Windows\mbdroccwmftzipbydqix.exe	iffdguquspp.exe
File opened for modification	C:\Windows\mbdroccwmftzipbydqix.exe	bbonv.exe
File opened for modification	C:\Windows\znobxkjcrjwbjpawamd.exe	bbonv.exe
File opened for modification	C:\Windows\brujhwxsjdszjreciwpfi.exe	bbonv.exe
File created	C:\Windows\qzvducwkuhppstzqpwirnvmuocmzhhklriho.jfn	bbonv.exe
File opened for modification	C:\Windows\sjndcsuqidtbmvjipeyptj.exe	iffdguquspp.exe
File opened for modification	C:\Windows\znobxkjcrjwbjpawamd.exe	bbonv.exe
File opened for modification	C:\Windows\brujhwxsjdszjreciwpfi.exe	bbonv.exe
File opened for modification	C:\Windows\frqbvgduhxilrveya.exe	bbonv.exe
File opened for modification	C:\Windows\mbdroccwmftzipbydqix.exe	bbonv.exe
File created	C:\Windows\ljurxudgfhetlbwcqmnlwtzwf.hjg	bbonv.exe
File opened for modification	C:\Windows\qzvducwkuhppstzqpwirnvmuocmzhhklriho.jfn	bbonv.exe
File opened for modification	C:\Windows\obbniuskypbfmrbwzk.exe	iffdguquspp.exe
File opened for modification	C:\Windows\yjhrkuqgshrtybjc.exe	bbonv.exe
File opened for modification	C:\Windows\frqbvgduhxilrveya.exe	bbonv.exe
File opened for modification	C:\Windows\yjhrkuqgshrtybjc.exe	bbonv.exe
File opened for modification	C:\Windows\sjndcsuqidtbmvjipeyptj.exe	bbonv.exe
File opened for modification	C:\Windows\ljurxudgfhetlbwcqmnlwtzwf.hjg	bbonv.exe
File opened for modification	C:\Windows\frqbvgduhxilrveya.exe	iffdguquspp.exe
File opened for modification	C:\Windows\znobxkjcrjwbjpawamd.exe	iffdguquspp.exe
File opened for modification	C:\Windows\brujhwxsjdszjreciwpfi.exe	iffdguquspp.exe
File opened for modification	C:\Windows\obbniuskypbfmrbwzk.exe	bbonv.exe
File opened for modification	C:\Windows\sjndcsuqidtbmvjipeyptj.exe	bbonv.exe
File opened for modification	C:\Windows\obbniuskypbfmrbwzk.exe	bbonv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1492	da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe
1492	da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe
1492	da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe
1492	da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe
1492	da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe
1492	da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe
1492	da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe
1492	da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe
1492	da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe
1492	da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe
1492	da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe
1492	da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe
1492	da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe
1492	da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe
1492	da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe
1492	da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe
1492	da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe
1492	da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe
1492	da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe
1492	da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe
1492	da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe
1492	da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe
1492	da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe
1492	da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe
1492	da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe
868	bbonv.exe
1492	da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe
1492	da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe
1492	da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe
1492	da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe
1492	da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe
1492	da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe
1492	da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe
1492	da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe
1492	da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe
1492	da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe
1492	da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe
1492	da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe
1492	da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe
1492	da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe
1492	da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe
1492	da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe
1492	da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe
1492	da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe
1492	da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe
1492	da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe
1492	da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe
1492	da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe
1492	da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe
1492	da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe
1492	da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe
1492	da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe
1492	da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe
1492	da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe
1492	da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe
1492	da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe
1492	da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe
1492	da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe
868	bbonv.exe
868	bbonv.exe
1492	da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe
1492	da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe
1492	da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe
1492	da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	868	bbonv.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 1152	1492	da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe	27
PID 1492 wrote to memory of 1152	1492	da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe	27
PID 1492 wrote to memory of 1152	1492	da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe	27
PID 1492 wrote to memory of 1152	1492	da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe	27
PID 1152 wrote to memory of 592	1152	iffdguquspp.exe	28
PID 1152 wrote to memory of 592	1152	iffdguquspp.exe	28
PID 1152 wrote to memory of 592	1152	iffdguquspp.exe	28
PID 1152 wrote to memory of 592	1152	iffdguquspp.exe	28
PID 1152 wrote to memory of 868	1152	iffdguquspp.exe	29
PID 1152 wrote to memory of 868	1152	iffdguquspp.exe	29
PID 1152 wrote to memory of 868	1152	iffdguquspp.exe	29
PID 1152 wrote to memory of 868	1152	iffdguquspp.exe	29

System policy modification 1 TTPs 30 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	bbonv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	bbonv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	bbonv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	bbonv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	bbonv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	bbonv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	bbonv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	bbonv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	bbonv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	bbonv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	bbonv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	bbonv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	bbonv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	iffdguquspp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	bbonv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	bbonv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	bbonv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	bbonv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	bbonv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	bbonv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	iffdguquspp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	iffdguquspp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	bbonv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	bbonv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	bbonv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	bbonv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	iffdguquspp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	bbonv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	bbonv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	bbonv.exe

C:\Users\Admin\AppData\Local\Temp\da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe
"C:\Users\Admin\AppData\Local\Temp\da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Users\Admin\AppData\Local\Temp\iffdguquspp.exe
  "C:\Users\Admin\AppData\Local\Temp\iffdguquspp.exe" "c:\users\admin\appdata\local\temp\da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2.exe*"
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Adds policy Run key to start application
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1152
- - C:\Users\Admin\AppData\Local\Temp\bbonv.exe
    "C:\Users\Admin\AppData\Local\Temp\bbonv.exe" "-C:\Users\Admin\AppData\Local\Temp\yjhrkuqgshrtybjc.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System policy modification
    PID:592
- - C:\Users\Admin\AppData\Local\Temp\bbonv.exe
    "C:\Users\Admin\AppData\Local\Temp\bbonv.exe" "-C:\Users\Admin\AppData\Local\Temp\yjhrkuqgshrtybjc.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - System policy modification
    PID:868

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bbonv.exe

Filesize
704KB

MD5
f0c83d36b8a511170e2b35f81f5f9c65

SHA1
ac153efbf5985044fb44e2521904f39b1278fc0f

SHA256
7c4c65284c86fd59f08bed5ec5dffc9dfe19761bd850d781da900d4450c2ac97

SHA512
06324d116f2ddf88c26afc431e8f9b6b64488aa9b11d67cb813af771526350103cf2dfa4281c7693fa8bb53c0188c5c7c3e32fc7bff72e4174ae2ba9fbbb6c32

Download Submit
C:\Users\Admin\AppData\Local\Temp\bbonv.exe

Filesize
704KB

MD5
f0c83d36b8a511170e2b35f81f5f9c65

SHA1
ac153efbf5985044fb44e2521904f39b1278fc0f

SHA256
7c4c65284c86fd59f08bed5ec5dffc9dfe19761bd850d781da900d4450c2ac97

SHA512
06324d116f2ddf88c26afc431e8f9b6b64488aa9b11d67cb813af771526350103cf2dfa4281c7693fa8bb53c0188c5c7c3e32fc7bff72e4174ae2ba9fbbb6c32

Download Submit
C:\Users\Admin\AppData\Local\Temp\brujhwxsjdszjreciwpfi.exe

Filesize
1016KB

MD5
a18c15eec6f29f6068ad2233ed5f3b20

SHA1
c27c3f1aba2e08de4bc97ea415c38c5c71e81a12

SHA256
da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2

SHA512
962cc663c7f6f352788ad8c34c10c2229e95503afa703a6298900203e078a3e22de207c887bd39a3eb257d90977cc9f98761cc660de9cf065496261bf50e2d24

Download Submit
C:\Users\Admin\AppData\Local\Temp\brujhwxsjdszjreciwpfi.exe

Filesize
1016KB

MD5
a18c15eec6f29f6068ad2233ed5f3b20

SHA1
c27c3f1aba2e08de4bc97ea415c38c5c71e81a12

SHA256
da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2

SHA512
962cc663c7f6f352788ad8c34c10c2229e95503afa703a6298900203e078a3e22de207c887bd39a3eb257d90977cc9f98761cc660de9cf065496261bf50e2d24

Download Submit
C:\Users\Admin\AppData\Local\Temp\frqbvgduhxilrveya.exe

Filesize
1016KB

MD5
a18c15eec6f29f6068ad2233ed5f3b20

SHA1
c27c3f1aba2e08de4bc97ea415c38c5c71e81a12

SHA256
da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2

SHA512
962cc663c7f6f352788ad8c34c10c2229e95503afa703a6298900203e078a3e22de207c887bd39a3eb257d90977cc9f98761cc660de9cf065496261bf50e2d24

Download Submit
C:\Users\Admin\AppData\Local\Temp\frqbvgduhxilrveya.exe

Filesize
1016KB

MD5
a18c15eec6f29f6068ad2233ed5f3b20

SHA1
c27c3f1aba2e08de4bc97ea415c38c5c71e81a12

SHA256
da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2

SHA512
962cc663c7f6f352788ad8c34c10c2229e95503afa703a6298900203e078a3e22de207c887bd39a3eb257d90977cc9f98761cc660de9cf065496261bf50e2d24

Download Submit
C:\Users\Admin\AppData\Local\Temp\iffdguquspp.exe

Filesize
320KB

MD5
4e51c755b56a4296846d9eab6995eddc

SHA1
28061bebdc495894f8a62cd9a552f7932cee069d

SHA256
9a36b39808fbee2758102087cae2208701711bd9ddd8db3a60ab10d301976cad

SHA512
a3638e1954375613ed1dfe201f516a2897a5cf513f4a486d329dba2d1b0f23793a30f1e25b2bfee821f412d9c633b07c3565d7506288aca8f85289877fdc1f71

Download Submit
C:\Users\Admin\AppData\Local\Temp\iffdguquspp.exe

Filesize
320KB

MD5
4e51c755b56a4296846d9eab6995eddc

SHA1
28061bebdc495894f8a62cd9a552f7932cee069d

SHA256
9a36b39808fbee2758102087cae2208701711bd9ddd8db3a60ab10d301976cad

SHA512
a3638e1954375613ed1dfe201f516a2897a5cf513f4a486d329dba2d1b0f23793a30f1e25b2bfee821f412d9c633b07c3565d7506288aca8f85289877fdc1f71

Download Submit
C:\Users\Admin\AppData\Local\Temp\mbdroccwmftzipbydqix.exe

Filesize
1016KB

MD5
a18c15eec6f29f6068ad2233ed5f3b20

SHA1
c27c3f1aba2e08de4bc97ea415c38c5c71e81a12

SHA256
da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2

SHA512
962cc663c7f6f352788ad8c34c10c2229e95503afa703a6298900203e078a3e22de207c887bd39a3eb257d90977cc9f98761cc660de9cf065496261bf50e2d24

Download Submit
C:\Users\Admin\AppData\Local\Temp\mbdroccwmftzipbydqix.exe

Filesize
1016KB

MD5
a18c15eec6f29f6068ad2233ed5f3b20

SHA1
c27c3f1aba2e08de4bc97ea415c38c5c71e81a12

SHA256
da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2

SHA512
962cc663c7f6f352788ad8c34c10c2229e95503afa703a6298900203e078a3e22de207c887bd39a3eb257d90977cc9f98761cc660de9cf065496261bf50e2d24

Download Submit
C:\Users\Admin\AppData\Local\Temp\obbniuskypbfmrbwzk.exe

Filesize
1016KB

MD5
a18c15eec6f29f6068ad2233ed5f3b20

SHA1
c27c3f1aba2e08de4bc97ea415c38c5c71e81a12

SHA256
da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2

SHA512
962cc663c7f6f352788ad8c34c10c2229e95503afa703a6298900203e078a3e22de207c887bd39a3eb257d90977cc9f98761cc660de9cf065496261bf50e2d24

Download Submit
C:\Users\Admin\AppData\Local\Temp\obbniuskypbfmrbwzk.exe

Filesize
1016KB

MD5
a18c15eec6f29f6068ad2233ed5f3b20

SHA1
c27c3f1aba2e08de4bc97ea415c38c5c71e81a12

SHA256
da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2

SHA512
962cc663c7f6f352788ad8c34c10c2229e95503afa703a6298900203e078a3e22de207c887bd39a3eb257d90977cc9f98761cc660de9cf065496261bf50e2d24

Download Submit
C:\Users\Admin\AppData\Local\Temp\sjndcsuqidtbmvjipeyptj.exe

Filesize
1016KB

MD5
a18c15eec6f29f6068ad2233ed5f3b20

SHA1
c27c3f1aba2e08de4bc97ea415c38c5c71e81a12

SHA256
da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2

SHA512
962cc663c7f6f352788ad8c34c10c2229e95503afa703a6298900203e078a3e22de207c887bd39a3eb257d90977cc9f98761cc660de9cf065496261bf50e2d24

Download Submit
C:\Users\Admin\AppData\Local\Temp\sjndcsuqidtbmvjipeyptj.exe

Filesize
1016KB

MD5
a18c15eec6f29f6068ad2233ed5f3b20

SHA1
c27c3f1aba2e08de4bc97ea415c38c5c71e81a12

SHA256
da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2

SHA512
962cc663c7f6f352788ad8c34c10c2229e95503afa703a6298900203e078a3e22de207c887bd39a3eb257d90977cc9f98761cc660de9cf065496261bf50e2d24

Download Submit
C:\Users\Admin\AppData\Local\Temp\yjhrkuqgshrtybjc.exe

Filesize
1016KB

MD5
a18c15eec6f29f6068ad2233ed5f3b20

SHA1
c27c3f1aba2e08de4bc97ea415c38c5c71e81a12

SHA256
da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2

SHA512
962cc663c7f6f352788ad8c34c10c2229e95503afa703a6298900203e078a3e22de207c887bd39a3eb257d90977cc9f98761cc660de9cf065496261bf50e2d24

Download Submit
C:\Users\Admin\AppData\Local\Temp\znobxkjcrjwbjpawamd.exe

Filesize
1016KB

MD5
a18c15eec6f29f6068ad2233ed5f3b20

SHA1
c27c3f1aba2e08de4bc97ea415c38c5c71e81a12

SHA256
da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2

SHA512
962cc663c7f6f352788ad8c34c10c2229e95503afa703a6298900203e078a3e22de207c887bd39a3eb257d90977cc9f98761cc660de9cf065496261bf50e2d24

Download Submit
C:\Users\Admin\AppData\Local\Temp\znobxkjcrjwbjpawamd.exe

Filesize
1016KB

MD5
a18c15eec6f29f6068ad2233ed5f3b20

SHA1
c27c3f1aba2e08de4bc97ea415c38c5c71e81a12

SHA256
da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2

SHA512
962cc663c7f6f352788ad8c34c10c2229e95503afa703a6298900203e078a3e22de207c887bd39a3eb257d90977cc9f98761cc660de9cf065496261bf50e2d24

Download Submit
C:\Windows\SysWOW64\brujhwxsjdszjreciwpfi.exe

Filesize
1016KB

MD5
a18c15eec6f29f6068ad2233ed5f3b20

SHA1
c27c3f1aba2e08de4bc97ea415c38c5c71e81a12

SHA256
da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2

SHA512
962cc663c7f6f352788ad8c34c10c2229e95503afa703a6298900203e078a3e22de207c887bd39a3eb257d90977cc9f98761cc660de9cf065496261bf50e2d24

Download Submit
C:\Windows\SysWOW64\frqbvgduhxilrveya.exe

Filesize
1016KB

MD5
a18c15eec6f29f6068ad2233ed5f3b20

SHA1
c27c3f1aba2e08de4bc97ea415c38c5c71e81a12

SHA256
da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2

SHA512
962cc663c7f6f352788ad8c34c10c2229e95503afa703a6298900203e078a3e22de207c887bd39a3eb257d90977cc9f98761cc660de9cf065496261bf50e2d24

Download Submit
C:\Windows\SysWOW64\mbdroccwmftzipbydqix.exe

Filesize
1016KB

MD5
a18c15eec6f29f6068ad2233ed5f3b20

SHA1
c27c3f1aba2e08de4bc97ea415c38c5c71e81a12

SHA256
da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2

SHA512
962cc663c7f6f352788ad8c34c10c2229e95503afa703a6298900203e078a3e22de207c887bd39a3eb257d90977cc9f98761cc660de9cf065496261bf50e2d24

Download Submit
C:\Windows\SysWOW64\obbniuskypbfmrbwzk.exe

Filesize
1016KB

MD5
a18c15eec6f29f6068ad2233ed5f3b20

SHA1
c27c3f1aba2e08de4bc97ea415c38c5c71e81a12

SHA256
da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2

SHA512
962cc663c7f6f352788ad8c34c10c2229e95503afa703a6298900203e078a3e22de207c887bd39a3eb257d90977cc9f98761cc660de9cf065496261bf50e2d24

Download Submit
C:\Windows\SysWOW64\sjndcsuqidtbmvjipeyptj.exe

Filesize
1016KB

MD5
a18c15eec6f29f6068ad2233ed5f3b20

SHA1
c27c3f1aba2e08de4bc97ea415c38c5c71e81a12

SHA256
da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2

SHA512
962cc663c7f6f352788ad8c34c10c2229e95503afa703a6298900203e078a3e22de207c887bd39a3eb257d90977cc9f98761cc660de9cf065496261bf50e2d24

Download Submit
C:\Windows\SysWOW64\yjhrkuqgshrtybjc.exe

Filesize
1016KB

MD5
a18c15eec6f29f6068ad2233ed5f3b20

SHA1
c27c3f1aba2e08de4bc97ea415c38c5c71e81a12

SHA256
da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2

SHA512
962cc663c7f6f352788ad8c34c10c2229e95503afa703a6298900203e078a3e22de207c887bd39a3eb257d90977cc9f98761cc660de9cf065496261bf50e2d24

Download Submit
C:\Windows\SysWOW64\znobxkjcrjwbjpawamd.exe

Filesize
1016KB

MD5
a18c15eec6f29f6068ad2233ed5f3b20

SHA1
c27c3f1aba2e08de4bc97ea415c38c5c71e81a12

SHA256
da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2

SHA512
962cc663c7f6f352788ad8c34c10c2229e95503afa703a6298900203e078a3e22de207c887bd39a3eb257d90977cc9f98761cc660de9cf065496261bf50e2d24

Download Submit
C:\Windows\brujhwxsjdszjreciwpfi.exe

Filesize
1016KB

MD5
a18c15eec6f29f6068ad2233ed5f3b20

SHA1
c27c3f1aba2e08de4bc97ea415c38c5c71e81a12

SHA256
da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2

SHA512
962cc663c7f6f352788ad8c34c10c2229e95503afa703a6298900203e078a3e22de207c887bd39a3eb257d90977cc9f98761cc660de9cf065496261bf50e2d24

Download Submit
C:\Windows\brujhwxsjdszjreciwpfi.exe

Filesize
1016KB

MD5
a18c15eec6f29f6068ad2233ed5f3b20

SHA1
c27c3f1aba2e08de4bc97ea415c38c5c71e81a12

SHA256
da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2

SHA512
962cc663c7f6f352788ad8c34c10c2229e95503afa703a6298900203e078a3e22de207c887bd39a3eb257d90977cc9f98761cc660de9cf065496261bf50e2d24

Download Submit
C:\Windows\frqbvgduhxilrveya.exe

Filesize
1016KB

MD5
a18c15eec6f29f6068ad2233ed5f3b20

SHA1
c27c3f1aba2e08de4bc97ea415c38c5c71e81a12

SHA256
da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2

SHA512
962cc663c7f6f352788ad8c34c10c2229e95503afa703a6298900203e078a3e22de207c887bd39a3eb257d90977cc9f98761cc660de9cf065496261bf50e2d24

Download Submit
C:\Windows\frqbvgduhxilrveya.exe

Filesize
1016KB

MD5
a18c15eec6f29f6068ad2233ed5f3b20

SHA1
c27c3f1aba2e08de4bc97ea415c38c5c71e81a12

SHA256
da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2

SHA512
962cc663c7f6f352788ad8c34c10c2229e95503afa703a6298900203e078a3e22de207c887bd39a3eb257d90977cc9f98761cc660de9cf065496261bf50e2d24

Download Submit
C:\Windows\mbdroccwmftzipbydqix.exe

Filesize
1016KB

MD5
a18c15eec6f29f6068ad2233ed5f3b20

SHA1
c27c3f1aba2e08de4bc97ea415c38c5c71e81a12

SHA256
da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2

SHA512
962cc663c7f6f352788ad8c34c10c2229e95503afa703a6298900203e078a3e22de207c887bd39a3eb257d90977cc9f98761cc660de9cf065496261bf50e2d24

Download Submit
C:\Windows\mbdroccwmftzipbydqix.exe

Filesize
1016KB

MD5
a18c15eec6f29f6068ad2233ed5f3b20

SHA1
c27c3f1aba2e08de4bc97ea415c38c5c71e81a12

SHA256
da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2

SHA512
962cc663c7f6f352788ad8c34c10c2229e95503afa703a6298900203e078a3e22de207c887bd39a3eb257d90977cc9f98761cc660de9cf065496261bf50e2d24

Download Submit
C:\Windows\obbniuskypbfmrbwzk.exe

Filesize
1016KB

MD5
a18c15eec6f29f6068ad2233ed5f3b20

SHA1
c27c3f1aba2e08de4bc97ea415c38c5c71e81a12

SHA256
da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2

SHA512
962cc663c7f6f352788ad8c34c10c2229e95503afa703a6298900203e078a3e22de207c887bd39a3eb257d90977cc9f98761cc660de9cf065496261bf50e2d24

Download Submit
C:\Windows\obbniuskypbfmrbwzk.exe

Filesize
1016KB

MD5
a18c15eec6f29f6068ad2233ed5f3b20

SHA1
c27c3f1aba2e08de4bc97ea415c38c5c71e81a12

SHA256
da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2

SHA512
962cc663c7f6f352788ad8c34c10c2229e95503afa703a6298900203e078a3e22de207c887bd39a3eb257d90977cc9f98761cc660de9cf065496261bf50e2d24

Download Submit
C:\Windows\sjndcsuqidtbmvjipeyptj.exe

Filesize
1016KB

MD5
a18c15eec6f29f6068ad2233ed5f3b20

SHA1
c27c3f1aba2e08de4bc97ea415c38c5c71e81a12

SHA256
da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2

SHA512
962cc663c7f6f352788ad8c34c10c2229e95503afa703a6298900203e078a3e22de207c887bd39a3eb257d90977cc9f98761cc660de9cf065496261bf50e2d24

Download Submit
C:\Windows\sjndcsuqidtbmvjipeyptj.exe

Filesize
1016KB

MD5
a18c15eec6f29f6068ad2233ed5f3b20

SHA1
c27c3f1aba2e08de4bc97ea415c38c5c71e81a12

SHA256
da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2

SHA512
962cc663c7f6f352788ad8c34c10c2229e95503afa703a6298900203e078a3e22de207c887bd39a3eb257d90977cc9f98761cc660de9cf065496261bf50e2d24

Download Submit
C:\Windows\yjhrkuqgshrtybjc.exe

Filesize
1016KB

MD5
a18c15eec6f29f6068ad2233ed5f3b20

SHA1
c27c3f1aba2e08de4bc97ea415c38c5c71e81a12

SHA256
da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2

SHA512
962cc663c7f6f352788ad8c34c10c2229e95503afa703a6298900203e078a3e22de207c887bd39a3eb257d90977cc9f98761cc660de9cf065496261bf50e2d24

Download Submit
C:\Windows\yjhrkuqgshrtybjc.exe

Filesize
1016KB

MD5
a18c15eec6f29f6068ad2233ed5f3b20

SHA1
c27c3f1aba2e08de4bc97ea415c38c5c71e81a12

SHA256
da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2

SHA512
962cc663c7f6f352788ad8c34c10c2229e95503afa703a6298900203e078a3e22de207c887bd39a3eb257d90977cc9f98761cc660de9cf065496261bf50e2d24

Download Submit
C:\Windows\znobxkjcrjwbjpawamd.exe

Filesize
1016KB

MD5
a18c15eec6f29f6068ad2233ed5f3b20

SHA1
c27c3f1aba2e08de4bc97ea415c38c5c71e81a12

SHA256
da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2

SHA512
962cc663c7f6f352788ad8c34c10c2229e95503afa703a6298900203e078a3e22de207c887bd39a3eb257d90977cc9f98761cc660de9cf065496261bf50e2d24

Download Submit
C:\Windows\znobxkjcrjwbjpawamd.exe

Filesize
1016KB

MD5
a18c15eec6f29f6068ad2233ed5f3b20

SHA1
c27c3f1aba2e08de4bc97ea415c38c5c71e81a12

SHA256
da0fc5eb01f33f52e93c33351efd25dfc13a8ac1867cb54ef607bb243aa4afd2

SHA512
962cc663c7f6f352788ad8c34c10c2229e95503afa703a6298900203e078a3e22de207c887bd39a3eb257d90977cc9f98761cc660de9cf065496261bf50e2d24

Download Submit
\Users\Admin\AppData\Local\Temp\bbonv.exe

Filesize
704KB

MD5
f0c83d36b8a511170e2b35f81f5f9c65

SHA1
ac153efbf5985044fb44e2521904f39b1278fc0f

SHA256
7c4c65284c86fd59f08bed5ec5dffc9dfe19761bd850d781da900d4450c2ac97

SHA512
06324d116f2ddf88c26afc431e8f9b6b64488aa9b11d67cb813af771526350103cf2dfa4281c7693fa8bb53c0188c5c7c3e32fc7bff72e4174ae2ba9fbbb6c32

Download Submit
\Users\Admin\AppData\Local\Temp\bbonv.exe

Filesize
704KB

MD5
f0c83d36b8a511170e2b35f81f5f9c65

SHA1
ac153efbf5985044fb44e2521904f39b1278fc0f

SHA256
7c4c65284c86fd59f08bed5ec5dffc9dfe19761bd850d781da900d4450c2ac97

SHA512
06324d116f2ddf88c26afc431e8f9b6b64488aa9b11d67cb813af771526350103cf2dfa4281c7693fa8bb53c0188c5c7c3e32fc7bff72e4174ae2ba9fbbb6c32

Download Submit
\Users\Admin\AppData\Local\Temp\bbonv.exe

Filesize
704KB

MD5
f0c83d36b8a511170e2b35f81f5f9c65

SHA1
ac153efbf5985044fb44e2521904f39b1278fc0f

SHA256
7c4c65284c86fd59f08bed5ec5dffc9dfe19761bd850d781da900d4450c2ac97

SHA512
06324d116f2ddf88c26afc431e8f9b6b64488aa9b11d67cb813af771526350103cf2dfa4281c7693fa8bb53c0188c5c7c3e32fc7bff72e4174ae2ba9fbbb6c32

Download Submit
\Users\Admin\AppData\Local\Temp\bbonv.exe

Filesize
704KB

MD5
f0c83d36b8a511170e2b35f81f5f9c65

SHA1
ac153efbf5985044fb44e2521904f39b1278fc0f

SHA256
7c4c65284c86fd59f08bed5ec5dffc9dfe19761bd850d781da900d4450c2ac97

SHA512
06324d116f2ddf88c26afc431e8f9b6b64488aa9b11d67cb813af771526350103cf2dfa4281c7693fa8bb53c0188c5c7c3e32fc7bff72e4174ae2ba9fbbb6c32

Download Submit
\Users\Admin\AppData\Local\Temp\iffdguquspp.exe

Filesize
320KB

MD5
4e51c755b56a4296846d9eab6995eddc

SHA1
28061bebdc495894f8a62cd9a552f7932cee069d

SHA256
9a36b39808fbee2758102087cae2208701711bd9ddd8db3a60ab10d301976cad

SHA512
a3638e1954375613ed1dfe201f516a2897a5cf513f4a486d329dba2d1b0f23793a30f1e25b2bfee821f412d9c633b07c3565d7506288aca8f85289877fdc1f71

Download Submit
\Users\Admin\AppData\Local\Temp\iffdguquspp.exe

Filesize
320KB

MD5
4e51c755b56a4296846d9eab6995eddc

SHA1
28061bebdc495894f8a62cd9a552f7932cee069d

SHA256
9a36b39808fbee2758102087cae2208701711bd9ddd8db3a60ab10d301976cad

SHA512
a3638e1954375613ed1dfe201f516a2897a5cf513f4a486d329dba2d1b0f23793a30f1e25b2bfee821f412d9c633b07c3565d7506288aca8f85289877fdc1f71

Download Submit
memory/1492-54-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

Filesize
8KB

Download