Analysis
-
max time kernel
153s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
19-10-2022 14:29
Static task
static1
Behavioral task
behavioral1
Sample
95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
General
-
Target
95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe
-
Size
1016KB
-
MD5
91cfc673b1aec1b5a8358b29ba52fc30
-
SHA1
a1ba8a1f586c9ff357fee23cb3c768558959a947
-
SHA256
95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf
-
SHA512
37465f411d7d229f64351da57ec210bbae83af2e8c0180da1bc13361816a2f4e975bb6be2fa7b14fce2fe23b3a39e60f0c87e38749c43a77cb86c204299aad05
-
SSDEEP
6144:iIXsL0tvrSVz1DnemeYbpsnEf78AoXh6KkiD0OofzA+/VygHU:iIXsgtvm1De5YlOx6lzBH46U
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" grrfdxtjqbb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" cenwzdk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" cenwzdk.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" cenwzdk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" cenwzdk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" cenwzdk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cenwzdk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" cenwzdk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" cenwzdk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" cenwzdk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cenwzdk.exe -
Adds policy Run key to start application 2 TTPs 28 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\sapenxkdkxcpr = "cqlgvledqjunvrxzdbg.exe" cenwzdk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bgsekrbrvf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\eurofxstidqlvtbfllsif.exe" cenwzdk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\sapenxkdkxcpr = "eurofxstidqlvtbfllsif.exe" cenwzdk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bgsekrbrvf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bmewivlhrhpfkdgf.exe" cenwzdk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bgsekrbrvf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\reysgvnlxpzrytyzcz.exe" cenwzdk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bgsekrbrvf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cqlgvledqjunvrxzdbg.exe" cenwzdk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\sapenxkdkxcpr = "peawmdxxlfrlurybgfla.exe" cenwzdk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bgsekrbrvf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\peawmdxxlfrlurybgfla.exe" cenwzdk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bgsekrbrvf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iungthyvgxgxdxbbd.exe" cenwzdk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bgsekrbrvf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iungthyvgxgxdxbbd.exe" cenwzdk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\sapenxkdkxcpr = "peawmdxxlfrlurybgfla.exe" cenwzdk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bgsekrbrvf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\eurofxstidqlvtbfllsif.exe" cenwzdk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run grrfdxtjqbb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bgsekrbrvf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\peawmdxxlfrlurybgfla.exe" cenwzdk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\sapenxkdkxcpr = "iungthyvgxgxdxbbd.exe" cenwzdk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run cenwzdk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bgsekrbrvf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bmewivlhrhpfkdgf.exe" cenwzdk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\sapenxkdkxcpr = "eurofxstidqlvtbfllsif.exe" cenwzdk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\sapenxkdkxcpr = "bmewivlhrhpfkdgf.exe" cenwzdk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\sapenxkdkxcpr = "cqlgvledqjunvrxzdbg.exe" grrfdxtjqbb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bgsekrbrvf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bmewivlhrhpfkdgf.exe" grrfdxtjqbb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\sapenxkdkxcpr = "cqlgvledqjunvrxzdbg.exe" cenwzdk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\sapenxkdkxcpr = "eurofxstidqlvtbfllsif.exe" grrfdxtjqbb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\sapenxkdkxcpr = "reysgvnlxpzrytyzcz.exe" cenwzdk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\sapenxkdkxcpr = "iungthyvgxgxdxbbd.exe" cenwzdk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run cenwzdk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bgsekrbrvf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cqlgvledqjunvrxzdbg.exe" cenwzdk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\sapenxkdkxcpr = "bmewivlhrhpfkdgf.exe" cenwzdk.exe -
Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" grrfdxtjqbb.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" cenwzdk.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" cenwzdk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" cenwzdk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" cenwzdk.exe -
Executes dropped EXE 3 IoCs
pid Process 3400 grrfdxtjqbb.exe 1712 cenwzdk.exe 5084 cenwzdk.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation grrfdxtjqbb.exe -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\taocktfxdptf = "peawmdxxlfrlurybgfla.exe ." cenwzdk.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce cenwzdk.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run cenwzdk.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\taocktfxdptf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bmewivlhrhpfkdgf.exe ." cenwzdk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\taocktfxdptf = "iungthyvgxgxdxbbd.exe ." cenwzdk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\iungthyvgxgxdxbbd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\peawmdxxlfrlurybgfla.exe" cenwzdk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bmewivlhrhpfkdgf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bmewivlhrhpfkdgf.exe ." cenwzdk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\taocktfxdptf = "reysgvnlxpzrytyzcz.exe ." cenwzdk.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\taocktfxdptf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iungthyvgxgxdxbbd.exe ." cenwzdk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\iungthyvgxgxdxbbd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iungthyvgxgxdxbbd.exe" cenwzdk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bmewivlhrhpfkdgf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\peawmdxxlfrlurybgfla.exe ." cenwzdk.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wgxozlavetaptln = "eurofxstidqlvtbfllsif.exe ." cenwzdk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wcpcjrctyjm = "eurofxstidqlvtbfllsif.exe" cenwzdk.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tcsisdrlthnbev = "cqlgvledqjunvrxzdbg.exe" cenwzdk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\taocktfxdptf = "eurofxstidqlvtbfllsif.exe ." cenwzdk.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\taocktfxdptf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\reysgvnlxpzrytyzcz.exe ." cenwzdk.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\taocktfxdptf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\reysgvnlxpzrytyzcz.exe ." cenwzdk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wcpcjrctyjm = "bmewivlhrhpfkdgf.exe" cenwzdk.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wcpcjrctyjm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iungthyvgxgxdxbbd.exe" cenwzdk.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\taocktfxdptf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cqlgvledqjunvrxzdbg.exe ." cenwzdk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bmewivlhrhpfkdgf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iungthyvgxgxdxbbd.exe ." cenwzdk.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce cenwzdk.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\taocktfxdptf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bmewivlhrhpfkdgf.exe ." cenwzdk.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wgxozlavetaptln = "peawmdxxlfrlurybgfla.exe ." cenwzdk.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wcpcjrctyjm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\reysgvnlxpzrytyzcz.exe" cenwzdk.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tcsisdrlthnbev = "eurofxstidqlvtbfllsif.exe" cenwzdk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wcpcjrctyjm = "eurofxstidqlvtbfllsif.exe" grrfdxtjqbb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wcpcjrctyjm = "reysgvnlxpzrytyzcz.exe" cenwzdk.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce cenwzdk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\taocktfxdptf = "peawmdxxlfrlurybgfla.exe ." cenwzdk.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\taocktfxdptf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\eurofxstidqlvtbfllsif.exe ." cenwzdk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\taocktfxdptf = "eurofxstidqlvtbfllsif.exe ." cenwzdk.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wcpcjrctyjm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\eurofxstidqlvtbfllsif.exe" grrfdxtjqbb.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run cenwzdk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wcpcjrctyjm = "reysgvnlxpzrytyzcz.exe" cenwzdk.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tcsisdrlthnbev = "iungthyvgxgxdxbbd.exe" cenwzdk.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tcsisdrlthnbev = "reysgvnlxpzrytyzcz.exe" cenwzdk.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wgxozlavetaptln = "bmewivlhrhpfkdgf.exe ." cenwzdk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bmewivlhrhpfkdgf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cqlgvledqjunvrxzdbg.exe ." cenwzdk.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run cenwzdk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\taocktfxdptf = "cqlgvledqjunvrxzdbg.exe ." cenwzdk.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\taocktfxdptf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\peawmdxxlfrlurybgfla.exe ." cenwzdk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wcpcjrctyjm = "eurofxstidqlvtbfllsif.exe" cenwzdk.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tcsisdrlthnbev = "eurofxstidqlvtbfllsif.exe" cenwzdk.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tcsisdrlthnbev = "cqlgvledqjunvrxzdbg.exe" cenwzdk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bmewivlhrhpfkdgf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cqlgvledqjunvrxzdbg.exe ." cenwzdk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\taocktfxdptf = "bmewivlhrhpfkdgf.exe ." grrfdxtjqbb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\iungthyvgxgxdxbbd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cqlgvledqjunvrxzdbg.exe" cenwzdk.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wgxozlavetaptln = "reysgvnlxpzrytyzcz.exe ." grrfdxtjqbb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\taocktfxdptf = "iungthyvgxgxdxbbd.exe ." cenwzdk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\taocktfxdptf = "bmewivlhrhpfkdgf.exe ." cenwzdk.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wgxozlavetaptln = "eurofxstidqlvtbfllsif.exe ." cenwzdk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bmewivlhrhpfkdgf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bmewivlhrhpfkdgf.exe ." grrfdxtjqbb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wcpcjrctyjm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cqlgvledqjunvrxzdbg.exe" cenwzdk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\taocktfxdptf = "reysgvnlxpzrytyzcz.exe ." cenwzdk.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wgxozlavetaptln = "iungthyvgxgxdxbbd.exe ." cenwzdk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\iungthyvgxgxdxbbd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\eurofxstidqlvtbfllsif.exe" cenwzdk.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce grrfdxtjqbb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tcsisdrlthnbev = "reysgvnlxpzrytyzcz.exe" grrfdxtjqbb.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce grrfdxtjqbb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\taocktfxdptf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\eurofxstidqlvtbfllsif.exe ." grrfdxtjqbb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tcsisdrlthnbev = "iungthyvgxgxdxbbd.exe" cenwzdk.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\taocktfxdptf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\eurofxstidqlvtbfllsif.exe ." cenwzdk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bmewivlhrhpfkdgf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\eurofxstidqlvtbfllsif.exe ." cenwzdk.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" grrfdxtjqbb.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cenwzdk.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cenwzdk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cenwzdk.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cenwzdk.exe -
Looks up external IP address via web service 8 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 38 whatismyip.everdot.org 41 whatismyipaddress.com 47 whatismyip.everdot.org 52 www.showmyipaddress.com 56 whatismyip.everdot.org 59 whatismyip.everdot.org 65 whatismyip.everdot.org 24 whatismyipaddress.com -
Drops file in System32 directory 25 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\eurofxstidqlvtbfllsif.exe cenwzdk.exe File opened for modification C:\Windows\SysWOW64\vmkiatprhdrnyxglstbsqo.exe cenwzdk.exe File created C:\Windows\SysWOW64\omrwvvyhehcfxdtftbqotyxxa.gje cenwzdk.exe File opened for modification C:\Windows\SysWOW64\tcsisdrlthnbevwtsllukakvjdlzftwnolkd.mcs cenwzdk.exe File created C:\Windows\SysWOW64\tcsisdrlthnbevwtsllukakvjdlzftwnolkd.mcs cenwzdk.exe File opened for modification C:\Windows\SysWOW64\cqlgvledqjunvrxzdbg.exe grrfdxtjqbb.exe File opened for modification C:\Windows\SysWOW64\peawmdxxlfrlurybgfla.exe cenwzdk.exe File opened for modification C:\Windows\SysWOW64\reysgvnlxpzrytyzcz.exe cenwzdk.exe File opened for modification C:\Windows\SysWOW64\vmkiatprhdrnyxglstbsqo.exe cenwzdk.exe File opened for modification C:\Windows\SysWOW64\peawmdxxlfrlurybgfla.exe cenwzdk.exe File opened for modification C:\Windows\SysWOW64\eurofxstidqlvtbfllsif.exe grrfdxtjqbb.exe File opened for modification C:\Windows\SysWOW64\vmkiatprhdrnyxglstbsqo.exe grrfdxtjqbb.exe File opened for modification C:\Windows\SysWOW64\bmewivlhrhpfkdgf.exe cenwzdk.exe File opened for modification C:\Windows\SysWOW64\iungthyvgxgxdxbbd.exe cenwzdk.exe File opened for modification C:\Windows\SysWOW64\iungthyvgxgxdxbbd.exe cenwzdk.exe File opened for modification C:\Windows\SysWOW64\reysgvnlxpzrytyzcz.exe cenwzdk.exe File opened for modification C:\Windows\SysWOW64\cqlgvledqjunvrxzdbg.exe cenwzdk.exe File opened for modification C:\Windows\SysWOW64\bmewivlhrhpfkdgf.exe grrfdxtjqbb.exe File opened for modification C:\Windows\SysWOW64\reysgvnlxpzrytyzcz.exe grrfdxtjqbb.exe File opened for modification C:\Windows\SysWOW64\cqlgvledqjunvrxzdbg.exe cenwzdk.exe File opened for modification C:\Windows\SysWOW64\bmewivlhrhpfkdgf.exe cenwzdk.exe File opened for modification C:\Windows\SysWOW64\eurofxstidqlvtbfllsif.exe cenwzdk.exe File opened for modification C:\Windows\SysWOW64\omrwvvyhehcfxdtftbqotyxxa.gje cenwzdk.exe File opened for modification C:\Windows\SysWOW64\iungthyvgxgxdxbbd.exe grrfdxtjqbb.exe File opened for modification C:\Windows\SysWOW64\peawmdxxlfrlurybgfla.exe grrfdxtjqbb.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\omrwvvyhehcfxdtftbqotyxxa.gje cenwzdk.exe File created C:\Program Files (x86)\omrwvvyhehcfxdtftbqotyxxa.gje cenwzdk.exe File opened for modification C:\Program Files (x86)\tcsisdrlthnbevwtsllukakvjdlzftwnolkd.mcs cenwzdk.exe File created C:\Program Files (x86)\tcsisdrlthnbevwtsllukakvjdlzftwnolkd.mcs cenwzdk.exe -
Drops file in Windows directory 25 IoCs
description ioc Process File opened for modification C:\Windows\eurofxstidqlvtbfllsif.exe cenwzdk.exe File opened for modification C:\Windows\vmkiatprhdrnyxglstbsqo.exe cenwzdk.exe File opened for modification C:\Windows\peawmdxxlfrlurybgfla.exe cenwzdk.exe File opened for modification C:\Windows\eurofxstidqlvtbfllsif.exe cenwzdk.exe File opened for modification C:\Windows\bmewivlhrhpfkdgf.exe grrfdxtjqbb.exe File opened for modification C:\Windows\eurofxstidqlvtbfllsif.exe grrfdxtjqbb.exe File opened for modification C:\Windows\reysgvnlxpzrytyzcz.exe cenwzdk.exe File opened for modification C:\Windows\cqlgvledqjunvrxzdbg.exe cenwzdk.exe File opened for modification C:\Windows\tcsisdrlthnbevwtsllukakvjdlzftwnolkd.mcs cenwzdk.exe File opened for modification C:\Windows\reysgvnlxpzrytyzcz.exe cenwzdk.exe File opened for modification C:\Windows\cqlgvledqjunvrxzdbg.exe cenwzdk.exe File opened for modification C:\Windows\vmkiatprhdrnyxglstbsqo.exe cenwzdk.exe File created C:\Windows\omrwvvyhehcfxdtftbqotyxxa.gje cenwzdk.exe File opened for modification C:\Windows\peawmdxxlfrlurybgfla.exe grrfdxtjqbb.exe File opened for modification C:\Windows\bmewivlhrhpfkdgf.exe cenwzdk.exe File opened for modification C:\Windows\bmewivlhrhpfkdgf.exe cenwzdk.exe File opened for modification C:\Windows\iungthyvgxgxdxbbd.exe cenwzdk.exe File opened for modification C:\Windows\reysgvnlxpzrytyzcz.exe grrfdxtjqbb.exe File opened for modification C:\Windows\cqlgvledqjunvrxzdbg.exe grrfdxtjqbb.exe File opened for modification C:\Windows\omrwvvyhehcfxdtftbqotyxxa.gje cenwzdk.exe File created C:\Windows\tcsisdrlthnbevwtsllukakvjdlzftwnolkd.mcs cenwzdk.exe File opened for modification C:\Windows\iungthyvgxgxdxbbd.exe grrfdxtjqbb.exe File opened for modification C:\Windows\vmkiatprhdrnyxglstbsqo.exe grrfdxtjqbb.exe File opened for modification C:\Windows\iungthyvgxgxdxbbd.exe cenwzdk.exe File opened for modification C:\Windows\peawmdxxlfrlurybgfla.exe cenwzdk.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 620 95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe 620 95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe 620 95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe 620 95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe 620 95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe 620 95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe 620 95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe 620 95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe 620 95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe 620 95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe 620 95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe 620 95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe 620 95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe 620 95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe 620 95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe 620 95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe 620 95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe 620 95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe 620 95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe 620 95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe 1712 cenwzdk.exe 1712 cenwzdk.exe 620 95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe 620 95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe 620 95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe 620 95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe 620 95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe 620 95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe 620 95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe 620 95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe 620 95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe 620 95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe 620 95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe 620 95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe 620 95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe 620 95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe 620 95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe 620 95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe 620 95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe 620 95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe 620 95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe 620 95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe 620 95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe 620 95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe 620 95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe 620 95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe 620 95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe 620 95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe 620 95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe 620 95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe 620 95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe 620 95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe 620 95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe 620 95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe 620 95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe 620 95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe 620 95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe 620 95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe 1712 cenwzdk.exe 1712 cenwzdk.exe 620 95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe 620 95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe 620 95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe 620 95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1712 cenwzdk.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 620 wrote to memory of 3400 620 95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe 84 PID 620 wrote to memory of 3400 620 95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe 84 PID 620 wrote to memory of 3400 620 95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe 84 PID 3400 wrote to memory of 1712 3400 grrfdxtjqbb.exe 89 PID 3400 wrote to memory of 1712 3400 grrfdxtjqbb.exe 89 PID 3400 wrote to memory of 1712 3400 grrfdxtjqbb.exe 89 PID 3400 wrote to memory of 5084 3400 grrfdxtjqbb.exe 88 PID 3400 wrote to memory of 5084 3400 grrfdxtjqbb.exe 88 PID 3400 wrote to memory of 5084 3400 grrfdxtjqbb.exe 88 -
System policy modification 1 TTPs 39 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer cenwzdk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cenwzdk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" cenwzdk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" cenwzdk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" cenwzdk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" cenwzdk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" cenwzdk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" cenwzdk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cenwzdk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" cenwzdk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" cenwzdk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" cenwzdk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" grrfdxtjqbb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer grrfdxtjqbb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cenwzdk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer cenwzdk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" cenwzdk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" cenwzdk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cenwzdk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" cenwzdk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" cenwzdk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" cenwzdk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" cenwzdk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" cenwzdk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" cenwzdk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" cenwzdk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" cenwzdk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" cenwzdk.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe"C:\Users\Admin\AppData\Local\Temp\95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Users\Admin\AppData\Local\Temp\grrfdxtjqbb.exe"C:\Users\Admin\AppData\Local\Temp\grrfdxtjqbb.exe" "c:\users\admin\appdata\local\temp\95888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf.exe*"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\cenwzdk.exe"C:\Users\Admin\AppData\Local\Temp\cenwzdk.exe" "-C:\Users\Admin\AppData\Local\Temp\bmewivlhrhpfkdgf.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- System policy modification
PID:5084
-
-
C:\Users\Admin\AppData\Local\Temp\cenwzdk.exe"C:\Users\Admin\AppData\Local\Temp\cenwzdk.exe" "-C:\Users\Admin\AppData\Local\Temp\bmewivlhrhpfkdgf.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:1712
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1016KB
MD591cfc673b1aec1b5a8358b29ba52fc30
SHA1a1ba8a1f586c9ff357fee23cb3c768558959a947
SHA25695888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf
SHA51237465f411d7d229f64351da57ec210bbae83af2e8c0180da1bc13361816a2f4e975bb6be2fa7b14fce2fe23b3a39e60f0c87e38749c43a77cb86c204299aad05
-
Filesize
736KB
MD54b6d06f8fd7f2b1ff0476b7804f57419
SHA10910011af8da8d1affad24003b44f32a0812e79d
SHA2567e46e903e24ec3d97a2bbc0632bc87d1a3583dad1efc7c3266e0478696053617
SHA51218889f4acd80a13a1a9ff380c08dffc83fb77f3cf086fddbb11ae079ea778111a10cdfbf2b77462a9387c055a3aeb16dc0ad70c5e204f996179c3de7d5663dcd
-
Filesize
736KB
MD54b6d06f8fd7f2b1ff0476b7804f57419
SHA10910011af8da8d1affad24003b44f32a0812e79d
SHA2567e46e903e24ec3d97a2bbc0632bc87d1a3583dad1efc7c3266e0478696053617
SHA51218889f4acd80a13a1a9ff380c08dffc83fb77f3cf086fddbb11ae079ea778111a10cdfbf2b77462a9387c055a3aeb16dc0ad70c5e204f996179c3de7d5663dcd
-
Filesize
736KB
MD54b6d06f8fd7f2b1ff0476b7804f57419
SHA10910011af8da8d1affad24003b44f32a0812e79d
SHA2567e46e903e24ec3d97a2bbc0632bc87d1a3583dad1efc7c3266e0478696053617
SHA51218889f4acd80a13a1a9ff380c08dffc83fb77f3cf086fddbb11ae079ea778111a10cdfbf2b77462a9387c055a3aeb16dc0ad70c5e204f996179c3de7d5663dcd
-
Filesize
1016KB
MD591cfc673b1aec1b5a8358b29ba52fc30
SHA1a1ba8a1f586c9ff357fee23cb3c768558959a947
SHA25695888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf
SHA51237465f411d7d229f64351da57ec210bbae83af2e8c0180da1bc13361816a2f4e975bb6be2fa7b14fce2fe23b3a39e60f0c87e38749c43a77cb86c204299aad05
-
Filesize
1016KB
MD591cfc673b1aec1b5a8358b29ba52fc30
SHA1a1ba8a1f586c9ff357fee23cb3c768558959a947
SHA25695888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf
SHA51237465f411d7d229f64351da57ec210bbae83af2e8c0180da1bc13361816a2f4e975bb6be2fa7b14fce2fe23b3a39e60f0c87e38749c43a77cb86c204299aad05
-
Filesize
320KB
MD5428858592ca3d8b17838708c3717e498
SHA11c1733ccce8bf11db917e0aa9c69d9c4a0fead7b
SHA2564462c22532dbd6d3fb63c56e6944375f51205ba72c77cb74869df24fff2d7534
SHA512e587a1c77853c542970ad336af9b5b9c55cda31d1d3d263b37b7c098ebc18a0e1e738a9a53952adfc556c5997cce902ae2183bec5553177ae5c950e2c04accfe
-
Filesize
320KB
MD5428858592ca3d8b17838708c3717e498
SHA11c1733ccce8bf11db917e0aa9c69d9c4a0fead7b
SHA2564462c22532dbd6d3fb63c56e6944375f51205ba72c77cb74869df24fff2d7534
SHA512e587a1c77853c542970ad336af9b5b9c55cda31d1d3d263b37b7c098ebc18a0e1e738a9a53952adfc556c5997cce902ae2183bec5553177ae5c950e2c04accfe
-
Filesize
1016KB
MD591cfc673b1aec1b5a8358b29ba52fc30
SHA1a1ba8a1f586c9ff357fee23cb3c768558959a947
SHA25695888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf
SHA51237465f411d7d229f64351da57ec210bbae83af2e8c0180da1bc13361816a2f4e975bb6be2fa7b14fce2fe23b3a39e60f0c87e38749c43a77cb86c204299aad05
-
Filesize
1016KB
MD591cfc673b1aec1b5a8358b29ba52fc30
SHA1a1ba8a1f586c9ff357fee23cb3c768558959a947
SHA25695888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf
SHA51237465f411d7d229f64351da57ec210bbae83af2e8c0180da1bc13361816a2f4e975bb6be2fa7b14fce2fe23b3a39e60f0c87e38749c43a77cb86c204299aad05
-
Filesize
1016KB
MD591cfc673b1aec1b5a8358b29ba52fc30
SHA1a1ba8a1f586c9ff357fee23cb3c768558959a947
SHA25695888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf
SHA51237465f411d7d229f64351da57ec210bbae83af2e8c0180da1bc13361816a2f4e975bb6be2fa7b14fce2fe23b3a39e60f0c87e38749c43a77cb86c204299aad05
-
Filesize
1016KB
MD591cfc673b1aec1b5a8358b29ba52fc30
SHA1a1ba8a1f586c9ff357fee23cb3c768558959a947
SHA25695888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf
SHA51237465f411d7d229f64351da57ec210bbae83af2e8c0180da1bc13361816a2f4e975bb6be2fa7b14fce2fe23b3a39e60f0c87e38749c43a77cb86c204299aad05
-
Filesize
1016KB
MD591cfc673b1aec1b5a8358b29ba52fc30
SHA1a1ba8a1f586c9ff357fee23cb3c768558959a947
SHA25695888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf
SHA51237465f411d7d229f64351da57ec210bbae83af2e8c0180da1bc13361816a2f4e975bb6be2fa7b14fce2fe23b3a39e60f0c87e38749c43a77cb86c204299aad05
-
Filesize
1016KB
MD591cfc673b1aec1b5a8358b29ba52fc30
SHA1a1ba8a1f586c9ff357fee23cb3c768558959a947
SHA25695888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf
SHA51237465f411d7d229f64351da57ec210bbae83af2e8c0180da1bc13361816a2f4e975bb6be2fa7b14fce2fe23b3a39e60f0c87e38749c43a77cb86c204299aad05
-
Filesize
1016KB
MD591cfc673b1aec1b5a8358b29ba52fc30
SHA1a1ba8a1f586c9ff357fee23cb3c768558959a947
SHA25695888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf
SHA51237465f411d7d229f64351da57ec210bbae83af2e8c0180da1bc13361816a2f4e975bb6be2fa7b14fce2fe23b3a39e60f0c87e38749c43a77cb86c204299aad05
-
Filesize
1016KB
MD591cfc673b1aec1b5a8358b29ba52fc30
SHA1a1ba8a1f586c9ff357fee23cb3c768558959a947
SHA25695888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf
SHA51237465f411d7d229f64351da57ec210bbae83af2e8c0180da1bc13361816a2f4e975bb6be2fa7b14fce2fe23b3a39e60f0c87e38749c43a77cb86c204299aad05
-
Filesize
1016KB
MD591cfc673b1aec1b5a8358b29ba52fc30
SHA1a1ba8a1f586c9ff357fee23cb3c768558959a947
SHA25695888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf
SHA51237465f411d7d229f64351da57ec210bbae83af2e8c0180da1bc13361816a2f4e975bb6be2fa7b14fce2fe23b3a39e60f0c87e38749c43a77cb86c204299aad05
-
Filesize
1016KB
MD591cfc673b1aec1b5a8358b29ba52fc30
SHA1a1ba8a1f586c9ff357fee23cb3c768558959a947
SHA25695888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf
SHA51237465f411d7d229f64351da57ec210bbae83af2e8c0180da1bc13361816a2f4e975bb6be2fa7b14fce2fe23b3a39e60f0c87e38749c43a77cb86c204299aad05
-
Filesize
1016KB
MD591cfc673b1aec1b5a8358b29ba52fc30
SHA1a1ba8a1f586c9ff357fee23cb3c768558959a947
SHA25695888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf
SHA51237465f411d7d229f64351da57ec210bbae83af2e8c0180da1bc13361816a2f4e975bb6be2fa7b14fce2fe23b3a39e60f0c87e38749c43a77cb86c204299aad05
-
Filesize
1016KB
MD591cfc673b1aec1b5a8358b29ba52fc30
SHA1a1ba8a1f586c9ff357fee23cb3c768558959a947
SHA25695888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf
SHA51237465f411d7d229f64351da57ec210bbae83af2e8c0180da1bc13361816a2f4e975bb6be2fa7b14fce2fe23b3a39e60f0c87e38749c43a77cb86c204299aad05
-
Filesize
1016KB
MD591cfc673b1aec1b5a8358b29ba52fc30
SHA1a1ba8a1f586c9ff357fee23cb3c768558959a947
SHA25695888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf
SHA51237465f411d7d229f64351da57ec210bbae83af2e8c0180da1bc13361816a2f4e975bb6be2fa7b14fce2fe23b3a39e60f0c87e38749c43a77cb86c204299aad05
-
Filesize
1016KB
MD591cfc673b1aec1b5a8358b29ba52fc30
SHA1a1ba8a1f586c9ff357fee23cb3c768558959a947
SHA25695888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf
SHA51237465f411d7d229f64351da57ec210bbae83af2e8c0180da1bc13361816a2f4e975bb6be2fa7b14fce2fe23b3a39e60f0c87e38749c43a77cb86c204299aad05
-
Filesize
1016KB
MD591cfc673b1aec1b5a8358b29ba52fc30
SHA1a1ba8a1f586c9ff357fee23cb3c768558959a947
SHA25695888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf
SHA51237465f411d7d229f64351da57ec210bbae83af2e8c0180da1bc13361816a2f4e975bb6be2fa7b14fce2fe23b3a39e60f0c87e38749c43a77cb86c204299aad05
-
Filesize
1016KB
MD591cfc673b1aec1b5a8358b29ba52fc30
SHA1a1ba8a1f586c9ff357fee23cb3c768558959a947
SHA25695888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf
SHA51237465f411d7d229f64351da57ec210bbae83af2e8c0180da1bc13361816a2f4e975bb6be2fa7b14fce2fe23b3a39e60f0c87e38749c43a77cb86c204299aad05
-
Filesize
1016KB
MD591cfc673b1aec1b5a8358b29ba52fc30
SHA1a1ba8a1f586c9ff357fee23cb3c768558959a947
SHA25695888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf
SHA51237465f411d7d229f64351da57ec210bbae83af2e8c0180da1bc13361816a2f4e975bb6be2fa7b14fce2fe23b3a39e60f0c87e38749c43a77cb86c204299aad05
-
Filesize
1016KB
MD591cfc673b1aec1b5a8358b29ba52fc30
SHA1a1ba8a1f586c9ff357fee23cb3c768558959a947
SHA25695888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf
SHA51237465f411d7d229f64351da57ec210bbae83af2e8c0180da1bc13361816a2f4e975bb6be2fa7b14fce2fe23b3a39e60f0c87e38749c43a77cb86c204299aad05
-
Filesize
1016KB
MD591cfc673b1aec1b5a8358b29ba52fc30
SHA1a1ba8a1f586c9ff357fee23cb3c768558959a947
SHA25695888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf
SHA51237465f411d7d229f64351da57ec210bbae83af2e8c0180da1bc13361816a2f4e975bb6be2fa7b14fce2fe23b3a39e60f0c87e38749c43a77cb86c204299aad05
-
Filesize
1016KB
MD591cfc673b1aec1b5a8358b29ba52fc30
SHA1a1ba8a1f586c9ff357fee23cb3c768558959a947
SHA25695888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf
SHA51237465f411d7d229f64351da57ec210bbae83af2e8c0180da1bc13361816a2f4e975bb6be2fa7b14fce2fe23b3a39e60f0c87e38749c43a77cb86c204299aad05
-
Filesize
1016KB
MD591cfc673b1aec1b5a8358b29ba52fc30
SHA1a1ba8a1f586c9ff357fee23cb3c768558959a947
SHA25695888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf
SHA51237465f411d7d229f64351da57ec210bbae83af2e8c0180da1bc13361816a2f4e975bb6be2fa7b14fce2fe23b3a39e60f0c87e38749c43a77cb86c204299aad05
-
Filesize
1016KB
MD591cfc673b1aec1b5a8358b29ba52fc30
SHA1a1ba8a1f586c9ff357fee23cb3c768558959a947
SHA25695888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf
SHA51237465f411d7d229f64351da57ec210bbae83af2e8c0180da1bc13361816a2f4e975bb6be2fa7b14fce2fe23b3a39e60f0c87e38749c43a77cb86c204299aad05
-
Filesize
1016KB
MD591cfc673b1aec1b5a8358b29ba52fc30
SHA1a1ba8a1f586c9ff357fee23cb3c768558959a947
SHA25695888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf
SHA51237465f411d7d229f64351da57ec210bbae83af2e8c0180da1bc13361816a2f4e975bb6be2fa7b14fce2fe23b3a39e60f0c87e38749c43a77cb86c204299aad05
-
Filesize
1016KB
MD591cfc673b1aec1b5a8358b29ba52fc30
SHA1a1ba8a1f586c9ff357fee23cb3c768558959a947
SHA25695888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf
SHA51237465f411d7d229f64351da57ec210bbae83af2e8c0180da1bc13361816a2f4e975bb6be2fa7b14fce2fe23b3a39e60f0c87e38749c43a77cb86c204299aad05
-
Filesize
1016KB
MD591cfc673b1aec1b5a8358b29ba52fc30
SHA1a1ba8a1f586c9ff357fee23cb3c768558959a947
SHA25695888219ad17bf4c25135066e4151a9618e9506c362a1f0acf540793c943dfaf
SHA51237465f411d7d229f64351da57ec210bbae83af2e8c0180da1bc13361816a2f4e975bb6be2fa7b14fce2fe23b3a39e60f0c87e38749c43a77cb86c204299aad05