f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2

Analysis

max time kernel
152s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20-10-2022 21:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
Size

584KB
MD5

8057321335b8890a9f6b3332bbc50774
SHA1

0421b8808a74d3ef33e38177a3f7710d320c4546
SHA256

f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2
SHA512

bdce8daa9fc2436bbea4892abe4eca5f298ddf6d7b20d20647466b22eb15b24234c044bc58b5879e0c1f4b2f5a5561b6f48f67b981be7a2245e4870beb1610f8
SSDEEP

12288:7pUJ3r6YkVwJgNnSykgb9cqWnw4q6ZmFhqsAv:7pUNr6YkVRFkgbeqeo68Fhq

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	grrfdxtjqbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	xgmou.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	xgmou.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	grrfdxtjqbb.exe

UAC bypass 3 TTPs 13 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	grrfdxtjqbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	grrfdxtjqbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	grrfdxtjqbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	xgmou.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	xgmou.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	grrfdxtjqbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	grrfdxtjqbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	xgmou.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	xgmou.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	xgmou.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	xgmou.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	xgmou.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	xgmou.exe

Adds policy Run key to start application 2 TTPs 31 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\boyeoyisx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vsmcwqketbucyegkigd.exe"	xgmou.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mcpylylyghtu = "kgzohatmahzgbghkhe.exe"	xgmou.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\boyeoyisx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kgzohatmahzgbghkhe.exe"	xgmou.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mcpylylyghtu = "vsmcwqketbucyegkigd.exe"	xgmou.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mcpylylyghtu = "uofsjariuzpunqpq.exe"	xgmou.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\boyeoyisx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vsmcwqketbucyegkigd.exe"	grrfdxtjqbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mcpylylyghtu = "xwskgcyulvqaygkqqqpld.exe"	xgmou.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\boyeoyisx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bwocumewjpgmgkkmi.exe"	xgmou.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mcpylylyghtu = "bwocumewjpgmgkkmi.exe"	grrfdxtjqbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\boyeoyisx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xwskgcyulvqaygkqqqpld.exe"	xgmou.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mcpylylyghtu = "kgzohatmahzgbghkhe.exe"	xgmou.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mcpylylyghtu = "igbsnidyoxraxehmlkid.exe"	grrfdxtjqbb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	grrfdxtjqbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mcpylylyghtu = "igbsnidyoxraxehmlkid.exe"	xgmou.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mcpylylyghtu = "vsmcwqketbucyegkigd.exe"	xgmou.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\boyeoyisx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kgzohatmahzgbghkhe.exe"	xgmou.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\boyeoyisx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xwskgcyulvqaygkqqqpld.exe"	xgmou.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mcpylylyghtu = "igbsnidyoxraxehmlkid.exe"	xgmou.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\boyeoyisx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vsmcwqketbucyegkigd.exe"	xgmou.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	xgmou.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mcpylylyghtu = "bwocumewjpgmgkkmi.exe"	xgmou.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mcpylylyghtu = "xwskgcyulvqaygkqqqpld.exe"	xgmou.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\boyeoyisx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bwocumewjpgmgkkmi.exe"	xgmou.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	grrfdxtjqbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\boyeoyisx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\uofsjariuzpunqpq.exe"	xgmou.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\boyeoyisx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\uofsjariuzpunqpq.exe"	xgmou.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mcpylylyghtu = "uofsjariuzpunqpq.exe"	xgmou.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\boyeoyisx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\igbsnidyoxraxehmlkid.exe"	xgmou.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\boyeoyisx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\uofsjariuzpunqpq.exe"	grrfdxtjqbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mcpylylyghtu = "uofsjariuzpunqpq.exe"	grrfdxtjqbb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	xgmou.exe

Disables RegEdit via registry modification 6 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	grrfdxtjqbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	grrfdxtjqbb.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	xgmou.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	xgmou.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	xgmou.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	xgmou.exe

Executes dropped EXE 4 IoCs

pid	Process
4984	grrfdxtjqbb.exe
2116	xgmou.exe
4232	xgmou.exe
4524	grrfdxtjqbb.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	grrfdxtjqbb.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\uitalwhsyx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bwocumewjpgmgkkmi.exe"	xgmou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\metetixmwznqhi = "xwskgcyulvqaygkqqqpld.exe ."	grrfdxtjqbb.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	xgmou.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	xgmou.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\uitalwhsyx = "xwskgcyulvqaygkqqqpld.exe"	xgmou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\metetixmwznqhi = "vsmcwqketbucyegkigd.exe ."	xgmou.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\piykaqgwhlaewyw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xwskgcyulvqaygkqqqpld.exe ."	xgmou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\uitalwhsyx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vsmcwqketbucyegkigd.exe"	xgmou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\peqykwiubbm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bwocumewjpgmgkkmi.exe ."	xgmou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\uitalwhsyx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xwskgcyulvqaygkqqqpld.exe"	xgmou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\metetixmwznqhi = "xwskgcyulvqaygkqqqpld.exe ."	grrfdxtjqbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\peqykwiubbm = "igbsnidyoxraxehmlkid.exe ."	grrfdxtjqbb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	xgmou.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\uitalwhsyx = "bwocumewjpgmgkkmi.exe"	xgmou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\peqykwiubbm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bwocumewjpgmgkkmi.exe ."	xgmou.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	grrfdxtjqbb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lcqaocqenpceu = "vsmcwqketbucyegkigd.exe"	grrfdxtjqbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\uofsjariuzpunqpq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vsmcwqketbucyegkigd.exe"	xgmou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lcqaocqenpceu = "xwskgcyulvqaygkqqqpld.exe"	xgmou.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\uofsjariuzpunqpq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bwocumewjpgmgkkmi.exe"	xgmou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lcqaocqenpceu = "igbsnidyoxraxehmlkid.exe"	xgmou.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\uitalwhsyx = "igbsnidyoxraxehmlkid.exe"	xgmou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\metetixmwznqhi = "uofsjariuzpunqpq.exe ."	xgmou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\uitalwhsyx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kgzohatmahzgbghkhe.exe"	xgmou.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\peqykwiubbm = "bwocumewjpgmgkkmi.exe ."	xgmou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lcqaocqenpceu = "xwskgcyulvqaygkqqqpld.exe"	xgmou.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\uofsjariuzpunqpq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\igbsnidyoxraxehmlkid.exe"	xgmou.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	grrfdxtjqbb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\uitalwhsyx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\igbsnidyoxraxehmlkid.exe"	grrfdxtjqbb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\uitalwhsyx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\igbsnidyoxraxehmlkid.exe"	xgmou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\peqykwiubbm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xwskgcyulvqaygkqqqpld.exe ."	xgmou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\peqykwiubbm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xwskgcyulvqaygkqqqpld.exe ."	grrfdxtjqbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\uofsjariuzpunqpq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\igbsnidyoxraxehmlkid.exe"	xgmou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\peqykwiubbm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\igbsnidyoxraxehmlkid.exe ."	xgmou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\metetixmwznqhi = "kgzohatmahzgbghkhe.exe ."	xgmou.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\peqykwiubbm = "xwskgcyulvqaygkqqqpld.exe ."	xgmou.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\peqykwiubbm = "vsmcwqketbucyegkigd.exe ."	grrfdxtjqbb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	grrfdxtjqbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\uofsjariuzpunqpq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\uofsjariuzpunqpq.exe"	xgmou.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\uitalwhsyx = "uofsjariuzpunqpq.exe"	grrfdxtjqbb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\peqykwiubbm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\uofsjariuzpunqpq.exe ."	xgmou.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\uitalwhsyx = "vsmcwqketbucyegkigd.exe"	xgmou.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\uofsjariuzpunqpq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kgzohatmahzgbghkhe.exe"	xgmou.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	grrfdxtjqbb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lcqaocqenpceu = "bwocumewjpgmgkkmi.exe"	xgmou.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\peqykwiubbm = "vsmcwqketbucyegkigd.exe ."	xgmou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\metetixmwznqhi = "bwocumewjpgmgkkmi.exe ."	xgmou.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\uitalwhsyx = "kgzohatmahzgbghkhe.exe"	xgmou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\peqykwiubbm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kgzohatmahzgbghkhe.exe ."	grrfdxtjqbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\piykaqgwhlaewyw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kgzohatmahzgbghkhe.exe ."	xgmou.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\uitalwhsyx = "kgzohatmahzgbghkhe.exe"	grrfdxtjqbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\uitalwhsyx = "uofsjariuzpunqpq.exe"	xgmou.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\peqykwiubbm = "kgzohatmahzgbghkhe.exe ."	xgmou.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\piykaqgwhlaewyw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xwskgcyulvqaygkqqqpld.exe ."	xgmou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\metetixmwznqhi = "xwskgcyulvqaygkqqqpld.exe ."	xgmou.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\uofsjariuzpunqpq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xwskgcyulvqaygkqqqpld.exe"	xgmou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\metetixmwznqhi = "igbsnidyoxraxehmlkid.exe ."	xgmou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lcqaocqenpceu = "igbsnidyoxraxehmlkid.exe"	xgmou.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\piykaqgwhlaewyw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\igbsnidyoxraxehmlkid.exe ."	xgmou.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\piykaqgwhlaewyw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\igbsnidyoxraxehmlkid.exe ."	grrfdxtjqbb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	xgmou.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lcqaocqenpceu = "uofsjariuzpunqpq.exe"	xgmou.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\uitalwhsyx = "kgzohatmahzgbghkhe.exe"	xgmou.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\uitalwhsyx = "bwocumewjpgmgkkmi.exe"	xgmou.exe

Checks whether UAC is enabled 1 TTPs 8 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	xgmou.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	xgmou.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	xgmou.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	grrfdxtjqbb.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	grrfdxtjqbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	grrfdxtjqbb.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	grrfdxtjqbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	xgmou.exe

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
40	whatismyipaddress.com
55	whatismyip.everdot.org
22	www.showmyipaddress.com
39	whatismyip.everdot.org

Drops file in System32 directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\xwskgcyulvqaygkqqqpld.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\SysWOW64\uofsjariuzpunqpq.exe	xgmou.exe
File opened for modification	C:\Windows\SysWOW64\oolebyvskvrcbkpwxyyvol.exe	xgmou.exe
File opened for modification	C:\Windows\SysWOW64\xwskgcyulvqaygkqqqpld.exe	xgmou.exe
File opened for modification	C:\Windows\SysWOW64\hosswaeihzcuaqcqygnrrvzdh.ybt	xgmou.exe
File opened for modification	C:\Windows\SysWOW64\metetixmwznqhifexqixixmbqadrulmjibum.mbq	xgmou.exe
File opened for modification	C:\Windows\SysWOW64\uofsjariuzpunqpq.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\SysWOW64\oolebyvskvrcbkpwxyyvol.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\SysWOW64\igbsnidyoxraxehmlkid.exe	xgmou.exe
File opened for modification	C:\Windows\SysWOW64\kgzohatmahzgbghkhe.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\SysWOW64\xwskgcyulvqaygkqqqpld.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\SysWOW64\kgzohatmahzgbghkhe.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\SysWOW64\kgzohatmahzgbghkhe.exe	xgmou.exe
File opened for modification	C:\Windows\SysWOW64\oolebyvskvrcbkpwxyyvol.exe	xgmou.exe
File opened for modification	C:\Windows\SysWOW64\igbsnidyoxraxehmlkid.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\SysWOW64\vsmcwqketbucyegkigd.exe	xgmou.exe
File opened for modification	C:\Windows\SysWOW64\igbsnidyoxraxehmlkid.exe	xgmou.exe
File created	C:\Windows\SysWOW64\hosswaeihzcuaqcqygnrrvzdh.ybt	xgmou.exe
File opened for modification	C:\Windows\SysWOW64\uofsjariuzpunqpq.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\SysWOW64\vsmcwqketbucyegkigd.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\SysWOW64\bwocumewjpgmgkkmi.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\SysWOW64\vsmcwqketbucyegkigd.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\SysWOW64\bwocumewjpgmgkkmi.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\SysWOW64\igbsnidyoxraxehmlkid.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\SysWOW64\vsmcwqketbucyegkigd.exe	xgmou.exe
File opened for modification	C:\Windows\SysWOW64\bwocumewjpgmgkkmi.exe	xgmou.exe
File created	C:\Windows\SysWOW64\metetixmwznqhifexqixixmbqadrulmjibum.mbq	xgmou.exe
File opened for modification	C:\Windows\SysWOW64\oolebyvskvrcbkpwxyyvol.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\SysWOW64\bwocumewjpgmgkkmi.exe	xgmou.exe
File opened for modification	C:\Windows\SysWOW64\kgzohatmahzgbghkhe.exe	xgmou.exe
File opened for modification	C:\Windows\SysWOW64\xwskgcyulvqaygkqqqpld.exe	xgmou.exe
File opened for modification	C:\Windows\SysWOW64\uofsjariuzpunqpq.exe	xgmou.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\metetixmwznqhifexqixixmbqadrulmjibum.mbq	xgmou.exe
File created	C:\Program Files (x86)\metetixmwznqhifexqixixmbqadrulmjibum.mbq	xgmou.exe
File opened for modification	C:\Program Files (x86)\hosswaeihzcuaqcqygnrrvzdh.ybt	xgmou.exe
File created	C:\Program Files (x86)\hosswaeihzcuaqcqygnrrvzdh.ybt	xgmou.exe

Drops file in Windows directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Windows\uofsjariuzpunqpq.exe	xgmou.exe
File opened for modification	C:\Windows\xwskgcyulvqaygkqqqpld.exe	grrfdxtjqbb.exe
File created	C:\Windows\hosswaeihzcuaqcqygnrrvzdh.ybt	xgmou.exe
File opened for modification	C:\Windows\uofsjariuzpunqpq.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\kgzohatmahzgbghkhe.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\xwskgcyulvqaygkqqqpld.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\igbsnidyoxraxehmlkid.exe	xgmou.exe
File opened for modification	C:\Windows\oolebyvskvrcbkpwxyyvol.exe	xgmou.exe
File opened for modification	C:\Windows\oolebyvskvrcbkpwxyyvol.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\igbsnidyoxraxehmlkid.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\bwocumewjpgmgkkmi.exe	xgmou.exe
File opened for modification	C:\Windows\kgzohatmahzgbghkhe.exe	xgmou.exe
File opened for modification	C:\Windows\oolebyvskvrcbkpwxyyvol.exe	xgmou.exe
File opened for modification	C:\Windows\bwocumewjpgmgkkmi.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\bwocumewjpgmgkkmi.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\vsmcwqketbucyegkigd.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\vsmcwqketbucyegkigd.exe	xgmou.exe
File created	C:\Windows\metetixmwznqhifexqixixmbqadrulmjibum.mbq	xgmou.exe
File opened for modification	C:\Windows\xwskgcyulvqaygkqqqpld.exe	xgmou.exe
File opened for modification	C:\Windows\metetixmwznqhifexqixixmbqadrulmjibum.mbq	xgmou.exe
File opened for modification	C:\Windows\igbsnidyoxraxehmlkid.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\xwskgcyulvqaygkqqqpld.exe	xgmou.exe
File opened for modification	C:\Windows\uofsjariuzpunqpq.exe	xgmou.exe
File opened for modification	C:\Windows\bwocumewjpgmgkkmi.exe	xgmou.exe
File opened for modification	C:\Windows\igbsnidyoxraxehmlkid.exe	xgmou.exe
File opened for modification	C:\Windows\kgzohatmahzgbghkhe.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\oolebyvskvrcbkpwxyyvol.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\kgzohatmahzgbghkhe.exe	xgmou.exe
File opened for modification	C:\Windows\vsmcwqketbucyegkigd.exe	xgmou.exe
File opened for modification	C:\Windows\hosswaeihzcuaqcqygnrrvzdh.ybt	xgmou.exe
File opened for modification	C:\Windows\uofsjariuzpunqpq.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\vsmcwqketbucyegkigd.exe	grrfdxtjqbb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
2116	xgmou.exe
2116	xgmou.exe
4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2116	xgmou.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 4984	4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe	80
PID 4648 wrote to memory of 4984	4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe	80
PID 4648 wrote to memory of 4984	4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe	80
PID 4984 wrote to memory of 2116	4984	grrfdxtjqbb.exe	81
PID 4984 wrote to memory of 2116	4984	grrfdxtjqbb.exe	81
PID 4984 wrote to memory of 2116	4984	grrfdxtjqbb.exe	81
PID 4984 wrote to memory of 4232	4984	grrfdxtjqbb.exe	82
PID 4984 wrote to memory of 4232	4984	grrfdxtjqbb.exe	82
PID 4984 wrote to memory of 4232	4984	grrfdxtjqbb.exe	82
PID 4648 wrote to memory of 4524	4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe	91
PID 4648 wrote to memory of 4524	4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe	91
PID 4648 wrote to memory of 4524	4648	f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe	91

System policy modification 1 TTPs 41 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	xgmou.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	xgmou.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	grrfdxtjqbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	grrfdxtjqbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	xgmou.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	xgmou.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	xgmou.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	xgmou.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	xgmou.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	xgmou.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	xgmou.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	grrfdxtjqbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	grrfdxtjqbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	xgmou.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	xgmou.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	xgmou.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	grrfdxtjqbb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	xgmou.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	grrfdxtjqbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	xgmou.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	xgmou.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	xgmou.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	grrfdxtjqbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	grrfdxtjqbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	xgmou.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	grrfdxtjqbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	xgmou.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	grrfdxtjqbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	grrfdxtjqbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	grrfdxtjqbb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	xgmou.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	xgmou.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	xgmou.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	grrfdxtjqbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	grrfdxtjqbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	xgmou.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	xgmou.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	xgmou.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	xgmou.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	grrfdxtjqbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	xgmou.exe

C:\Users\Admin\AppData\Local\Temp\f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe
"C:\Users\Admin\AppData\Local\Temp\f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Users\Admin\AppData\Local\Temp\grrfdxtjqbb.exe
  "C:\Users\Admin\AppData\Local\Temp\grrfdxtjqbb.exe" "c:\users\admin\appdata\local\temp\f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe*"
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Adds policy Run key to start application
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Checks computer location settings
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4984
- - C:\Users\Admin\AppData\Local\Temp\xgmou.exe
    "C:\Users\Admin\AppData\Local\Temp\xgmou.exe" "-C:\Users\Admin\AppData\Local\Temp\uofsjariuzpunqpq.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - System policy modification
    PID:2116
- - C:\Users\Admin\AppData\Local\Temp\xgmou.exe
    "C:\Users\Admin\AppData\Local\Temp\xgmou.exe" "-C:\Users\Admin\AppData\Local\Temp\uofsjariuzpunqpq.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System policy modification
    PID:4232
- C:\Users\Admin\AppData\Local\Temp\grrfdxtjqbb.exe
  "C:\Users\Admin\AppData\Local\Temp\grrfdxtjqbb.exe" "c:\users\admin\appdata\local\temp\f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2.exe"
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Adds policy Run key to start application
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System policy modification
  PID:4524

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bwocumewjpgmgkkmi.exe

Filesize
584KB

MD5
8057321335b8890a9f6b3332bbc50774

SHA1
0421b8808a74d3ef33e38177a3f7710d320c4546

SHA256
f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2

SHA512
bdce8daa9fc2436bbea4892abe4eca5f298ddf6d7b20d20647466b22eb15b24234c044bc58b5879e0c1f4b2f5a5561b6f48f67b981be7a2245e4870beb1610f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\grrfdxtjqbb.exe

Filesize
320KB

MD5
cda5b58abcd2db9fc328b2002ea7e091

SHA1
efbff0e2abb0ba88387216f9a7cb258ef69d798e

SHA256
287408252e4ea6dabbdbb91ac1c8fee41992faeb4bc9df62c10bac9d9e0c5afb

SHA512
e4c884378951760620249cf3f4ad29c4382411e7cfda214c3715ee01ad558773401e397216e6db7d17023bf939d759fd1496a64980a34969e1e87b7aa2c4af30

Download Submit
C:\Users\Admin\AppData\Local\Temp\grrfdxtjqbb.exe

Filesize
320KB

MD5
cda5b58abcd2db9fc328b2002ea7e091

SHA1
efbff0e2abb0ba88387216f9a7cb258ef69d798e

SHA256
287408252e4ea6dabbdbb91ac1c8fee41992faeb4bc9df62c10bac9d9e0c5afb

SHA512
e4c884378951760620249cf3f4ad29c4382411e7cfda214c3715ee01ad558773401e397216e6db7d17023bf939d759fd1496a64980a34969e1e87b7aa2c4af30

Download Submit
C:\Users\Admin\AppData\Local\Temp\grrfdxtjqbb.exe

Filesize
320KB

MD5
cda5b58abcd2db9fc328b2002ea7e091

SHA1
efbff0e2abb0ba88387216f9a7cb258ef69d798e

SHA256
287408252e4ea6dabbdbb91ac1c8fee41992faeb4bc9df62c10bac9d9e0c5afb

SHA512
e4c884378951760620249cf3f4ad29c4382411e7cfda214c3715ee01ad558773401e397216e6db7d17023bf939d759fd1496a64980a34969e1e87b7aa2c4af30

Download Submit
C:\Users\Admin\AppData\Local\Temp\igbsnidyoxraxehmlkid.exe

Filesize
584KB

MD5
8057321335b8890a9f6b3332bbc50774

SHA1
0421b8808a74d3ef33e38177a3f7710d320c4546

SHA256
f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2

SHA512
bdce8daa9fc2436bbea4892abe4eca5f298ddf6d7b20d20647466b22eb15b24234c044bc58b5879e0c1f4b2f5a5561b6f48f67b981be7a2245e4870beb1610f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\kgzohatmahzgbghkhe.exe

Filesize
584KB

MD5
8057321335b8890a9f6b3332bbc50774

SHA1
0421b8808a74d3ef33e38177a3f7710d320c4546

SHA256
f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2

SHA512
bdce8daa9fc2436bbea4892abe4eca5f298ddf6d7b20d20647466b22eb15b24234c044bc58b5879e0c1f4b2f5a5561b6f48f67b981be7a2245e4870beb1610f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\oolebyvskvrcbkpwxyyvol.exe

Filesize
584KB

MD5
8057321335b8890a9f6b3332bbc50774

SHA1
0421b8808a74d3ef33e38177a3f7710d320c4546

SHA256
f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2

SHA512
bdce8daa9fc2436bbea4892abe4eca5f298ddf6d7b20d20647466b22eb15b24234c044bc58b5879e0c1f4b2f5a5561b6f48f67b981be7a2245e4870beb1610f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\uofsjariuzpunqpq.exe

Filesize
584KB

MD5
8057321335b8890a9f6b3332bbc50774

SHA1
0421b8808a74d3ef33e38177a3f7710d320c4546

SHA256
f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2

SHA512
bdce8daa9fc2436bbea4892abe4eca5f298ddf6d7b20d20647466b22eb15b24234c044bc58b5879e0c1f4b2f5a5561b6f48f67b981be7a2245e4870beb1610f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\vsmcwqketbucyegkigd.exe

Filesize
584KB

MD5
8057321335b8890a9f6b3332bbc50774

SHA1
0421b8808a74d3ef33e38177a3f7710d320c4546

SHA256
f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2

SHA512
bdce8daa9fc2436bbea4892abe4eca5f298ddf6d7b20d20647466b22eb15b24234c044bc58b5879e0c1f4b2f5a5561b6f48f67b981be7a2245e4870beb1610f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\xgmou.exe

Filesize
728KB

MD5
ac062be19a580e2782ffa312e9003d07

SHA1
8a7d3121087956d58f9543145760d506763c9e57

SHA256
14e345dec3d2252e1d82f115e66a90cdbb3f8c5b1e6b4a3ec3735129dd4d04cd

SHA512
1c538077eb0f5031cd9a27e6c2958411512bafeb0daf79cb131809c11769ea80ecff2329013e8608ab3e5bb862a5bef6cc6c262e1e372b4c2fc1a9d1a8d73f68

Download Submit
C:\Users\Admin\AppData\Local\Temp\xgmou.exe

Filesize
728KB

MD5
ac062be19a580e2782ffa312e9003d07

SHA1
8a7d3121087956d58f9543145760d506763c9e57

SHA256
14e345dec3d2252e1d82f115e66a90cdbb3f8c5b1e6b4a3ec3735129dd4d04cd

SHA512
1c538077eb0f5031cd9a27e6c2958411512bafeb0daf79cb131809c11769ea80ecff2329013e8608ab3e5bb862a5bef6cc6c262e1e372b4c2fc1a9d1a8d73f68

Download Submit
C:\Users\Admin\AppData\Local\Temp\xgmou.exe

Filesize
728KB

MD5
ac062be19a580e2782ffa312e9003d07

SHA1
8a7d3121087956d58f9543145760d506763c9e57

SHA256
14e345dec3d2252e1d82f115e66a90cdbb3f8c5b1e6b4a3ec3735129dd4d04cd

SHA512
1c538077eb0f5031cd9a27e6c2958411512bafeb0daf79cb131809c11769ea80ecff2329013e8608ab3e5bb862a5bef6cc6c262e1e372b4c2fc1a9d1a8d73f68

Download Submit
C:\Users\Admin\AppData\Local\Temp\xwskgcyulvqaygkqqqpld.exe

Filesize
584KB

MD5
8057321335b8890a9f6b3332bbc50774

SHA1
0421b8808a74d3ef33e38177a3f7710d320c4546

SHA256
f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2

SHA512
bdce8daa9fc2436bbea4892abe4eca5f298ddf6d7b20d20647466b22eb15b24234c044bc58b5879e0c1f4b2f5a5561b6f48f67b981be7a2245e4870beb1610f8

Download Submit
C:\Windows\SysWOW64\bwocumewjpgmgkkmi.exe

Filesize
584KB

MD5
8057321335b8890a9f6b3332bbc50774

SHA1
0421b8808a74d3ef33e38177a3f7710d320c4546

SHA256
f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2

SHA512
bdce8daa9fc2436bbea4892abe4eca5f298ddf6d7b20d20647466b22eb15b24234c044bc58b5879e0c1f4b2f5a5561b6f48f67b981be7a2245e4870beb1610f8

Download Submit
C:\Windows\SysWOW64\igbsnidyoxraxehmlkid.exe

Filesize
584KB

MD5
8057321335b8890a9f6b3332bbc50774

SHA1
0421b8808a74d3ef33e38177a3f7710d320c4546

SHA256
f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2

SHA512
bdce8daa9fc2436bbea4892abe4eca5f298ddf6d7b20d20647466b22eb15b24234c044bc58b5879e0c1f4b2f5a5561b6f48f67b981be7a2245e4870beb1610f8

Download Submit
C:\Windows\SysWOW64\kgzohatmahzgbghkhe.exe

Filesize
584KB

MD5
8057321335b8890a9f6b3332bbc50774

SHA1
0421b8808a74d3ef33e38177a3f7710d320c4546

SHA256
f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2

SHA512
bdce8daa9fc2436bbea4892abe4eca5f298ddf6d7b20d20647466b22eb15b24234c044bc58b5879e0c1f4b2f5a5561b6f48f67b981be7a2245e4870beb1610f8

Download Submit
C:\Windows\SysWOW64\oolebyvskvrcbkpwxyyvol.exe

Filesize
584KB

MD5
8057321335b8890a9f6b3332bbc50774

SHA1
0421b8808a74d3ef33e38177a3f7710d320c4546

SHA256
f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2

SHA512
bdce8daa9fc2436bbea4892abe4eca5f298ddf6d7b20d20647466b22eb15b24234c044bc58b5879e0c1f4b2f5a5561b6f48f67b981be7a2245e4870beb1610f8

Download Submit
C:\Windows\SysWOW64\uofsjariuzpunqpq.exe

Filesize
584KB

MD5
8057321335b8890a9f6b3332bbc50774

SHA1
0421b8808a74d3ef33e38177a3f7710d320c4546

SHA256
f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2

SHA512
bdce8daa9fc2436bbea4892abe4eca5f298ddf6d7b20d20647466b22eb15b24234c044bc58b5879e0c1f4b2f5a5561b6f48f67b981be7a2245e4870beb1610f8

Download Submit
C:\Windows\SysWOW64\vsmcwqketbucyegkigd.exe

Filesize
584KB

MD5
8057321335b8890a9f6b3332bbc50774

SHA1
0421b8808a74d3ef33e38177a3f7710d320c4546

SHA256
f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2

SHA512
bdce8daa9fc2436bbea4892abe4eca5f298ddf6d7b20d20647466b22eb15b24234c044bc58b5879e0c1f4b2f5a5561b6f48f67b981be7a2245e4870beb1610f8

Download Submit
C:\Windows\SysWOW64\xwskgcyulvqaygkqqqpld.exe

Filesize
584KB

MD5
8057321335b8890a9f6b3332bbc50774

SHA1
0421b8808a74d3ef33e38177a3f7710d320c4546

SHA256
f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2

SHA512
bdce8daa9fc2436bbea4892abe4eca5f298ddf6d7b20d20647466b22eb15b24234c044bc58b5879e0c1f4b2f5a5561b6f48f67b981be7a2245e4870beb1610f8

Download Submit
C:\Windows\bwocumewjpgmgkkmi.exe

Filesize
584KB

MD5
8057321335b8890a9f6b3332bbc50774

SHA1
0421b8808a74d3ef33e38177a3f7710d320c4546

SHA256
f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2

SHA512
bdce8daa9fc2436bbea4892abe4eca5f298ddf6d7b20d20647466b22eb15b24234c044bc58b5879e0c1f4b2f5a5561b6f48f67b981be7a2245e4870beb1610f8

Download Submit
C:\Windows\bwocumewjpgmgkkmi.exe

Filesize
584KB

MD5
8057321335b8890a9f6b3332bbc50774

SHA1
0421b8808a74d3ef33e38177a3f7710d320c4546

SHA256
f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2

SHA512
bdce8daa9fc2436bbea4892abe4eca5f298ddf6d7b20d20647466b22eb15b24234c044bc58b5879e0c1f4b2f5a5561b6f48f67b981be7a2245e4870beb1610f8

Download Submit
C:\Windows\bwocumewjpgmgkkmi.exe

Filesize
584KB

MD5
8057321335b8890a9f6b3332bbc50774

SHA1
0421b8808a74d3ef33e38177a3f7710d320c4546

SHA256
f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2

SHA512
bdce8daa9fc2436bbea4892abe4eca5f298ddf6d7b20d20647466b22eb15b24234c044bc58b5879e0c1f4b2f5a5561b6f48f67b981be7a2245e4870beb1610f8

Download Submit
C:\Windows\igbsnidyoxraxehmlkid.exe

Filesize
584KB

MD5
8057321335b8890a9f6b3332bbc50774

SHA1
0421b8808a74d3ef33e38177a3f7710d320c4546

SHA256
f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2

SHA512
bdce8daa9fc2436bbea4892abe4eca5f298ddf6d7b20d20647466b22eb15b24234c044bc58b5879e0c1f4b2f5a5561b6f48f67b981be7a2245e4870beb1610f8

Download Submit
C:\Windows\igbsnidyoxraxehmlkid.exe

Filesize
584KB

MD5
8057321335b8890a9f6b3332bbc50774

SHA1
0421b8808a74d3ef33e38177a3f7710d320c4546

SHA256
f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2

SHA512
bdce8daa9fc2436bbea4892abe4eca5f298ddf6d7b20d20647466b22eb15b24234c044bc58b5879e0c1f4b2f5a5561b6f48f67b981be7a2245e4870beb1610f8

Download Submit
C:\Windows\igbsnidyoxraxehmlkid.exe

Filesize
584KB

MD5
8057321335b8890a9f6b3332bbc50774

SHA1
0421b8808a74d3ef33e38177a3f7710d320c4546

SHA256
f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2

SHA512
bdce8daa9fc2436bbea4892abe4eca5f298ddf6d7b20d20647466b22eb15b24234c044bc58b5879e0c1f4b2f5a5561b6f48f67b981be7a2245e4870beb1610f8

Download Submit
C:\Windows\kgzohatmahzgbghkhe.exe

Filesize
584KB

MD5
8057321335b8890a9f6b3332bbc50774

SHA1
0421b8808a74d3ef33e38177a3f7710d320c4546

SHA256
f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2

SHA512
bdce8daa9fc2436bbea4892abe4eca5f298ddf6d7b20d20647466b22eb15b24234c044bc58b5879e0c1f4b2f5a5561b6f48f67b981be7a2245e4870beb1610f8

Download Submit
C:\Windows\kgzohatmahzgbghkhe.exe

Filesize
584KB

MD5
8057321335b8890a9f6b3332bbc50774

SHA1
0421b8808a74d3ef33e38177a3f7710d320c4546

SHA256
f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2

SHA512
bdce8daa9fc2436bbea4892abe4eca5f298ddf6d7b20d20647466b22eb15b24234c044bc58b5879e0c1f4b2f5a5561b6f48f67b981be7a2245e4870beb1610f8

Download Submit
C:\Windows\kgzohatmahzgbghkhe.exe

Filesize
584KB

MD5
8057321335b8890a9f6b3332bbc50774

SHA1
0421b8808a74d3ef33e38177a3f7710d320c4546

SHA256
f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2

SHA512
bdce8daa9fc2436bbea4892abe4eca5f298ddf6d7b20d20647466b22eb15b24234c044bc58b5879e0c1f4b2f5a5561b6f48f67b981be7a2245e4870beb1610f8

Download Submit
C:\Windows\oolebyvskvrcbkpwxyyvol.exe

Filesize
584KB

MD5
8057321335b8890a9f6b3332bbc50774

SHA1
0421b8808a74d3ef33e38177a3f7710d320c4546

SHA256
f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2

SHA512
bdce8daa9fc2436bbea4892abe4eca5f298ddf6d7b20d20647466b22eb15b24234c044bc58b5879e0c1f4b2f5a5561b6f48f67b981be7a2245e4870beb1610f8

Download Submit
C:\Windows\oolebyvskvrcbkpwxyyvol.exe

Filesize
584KB

MD5
8057321335b8890a9f6b3332bbc50774

SHA1
0421b8808a74d3ef33e38177a3f7710d320c4546

SHA256
f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2

SHA512
bdce8daa9fc2436bbea4892abe4eca5f298ddf6d7b20d20647466b22eb15b24234c044bc58b5879e0c1f4b2f5a5561b6f48f67b981be7a2245e4870beb1610f8

Download Submit
C:\Windows\oolebyvskvrcbkpwxyyvol.exe

Filesize
584KB

MD5
8057321335b8890a9f6b3332bbc50774

SHA1
0421b8808a74d3ef33e38177a3f7710d320c4546

SHA256
f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2

SHA512
bdce8daa9fc2436bbea4892abe4eca5f298ddf6d7b20d20647466b22eb15b24234c044bc58b5879e0c1f4b2f5a5561b6f48f67b981be7a2245e4870beb1610f8

Download Submit
C:\Windows\uofsjariuzpunqpq.exe

Filesize
584KB

MD5
8057321335b8890a9f6b3332bbc50774

SHA1
0421b8808a74d3ef33e38177a3f7710d320c4546

SHA256
f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2

SHA512
bdce8daa9fc2436bbea4892abe4eca5f298ddf6d7b20d20647466b22eb15b24234c044bc58b5879e0c1f4b2f5a5561b6f48f67b981be7a2245e4870beb1610f8

Download Submit
C:\Windows\uofsjariuzpunqpq.exe

Filesize
584KB

MD5
8057321335b8890a9f6b3332bbc50774

SHA1
0421b8808a74d3ef33e38177a3f7710d320c4546

SHA256
f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2

SHA512
bdce8daa9fc2436bbea4892abe4eca5f298ddf6d7b20d20647466b22eb15b24234c044bc58b5879e0c1f4b2f5a5561b6f48f67b981be7a2245e4870beb1610f8

Download Submit
C:\Windows\uofsjariuzpunqpq.exe

Filesize
584KB

MD5
8057321335b8890a9f6b3332bbc50774

SHA1
0421b8808a74d3ef33e38177a3f7710d320c4546

SHA256
f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2

SHA512
bdce8daa9fc2436bbea4892abe4eca5f298ddf6d7b20d20647466b22eb15b24234c044bc58b5879e0c1f4b2f5a5561b6f48f67b981be7a2245e4870beb1610f8

Download Submit
C:\Windows\vsmcwqketbucyegkigd.exe

Filesize
584KB

MD5
8057321335b8890a9f6b3332bbc50774

SHA1
0421b8808a74d3ef33e38177a3f7710d320c4546

SHA256
f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2

SHA512
bdce8daa9fc2436bbea4892abe4eca5f298ddf6d7b20d20647466b22eb15b24234c044bc58b5879e0c1f4b2f5a5561b6f48f67b981be7a2245e4870beb1610f8

Download Submit
C:\Windows\vsmcwqketbucyegkigd.exe

Filesize
584KB

MD5
8057321335b8890a9f6b3332bbc50774

SHA1
0421b8808a74d3ef33e38177a3f7710d320c4546

SHA256
f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2

SHA512
bdce8daa9fc2436bbea4892abe4eca5f298ddf6d7b20d20647466b22eb15b24234c044bc58b5879e0c1f4b2f5a5561b6f48f67b981be7a2245e4870beb1610f8

Download Submit
C:\Windows\vsmcwqketbucyegkigd.exe

Filesize
584KB

MD5
8057321335b8890a9f6b3332bbc50774

SHA1
0421b8808a74d3ef33e38177a3f7710d320c4546

SHA256
f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2

SHA512
bdce8daa9fc2436bbea4892abe4eca5f298ddf6d7b20d20647466b22eb15b24234c044bc58b5879e0c1f4b2f5a5561b6f48f67b981be7a2245e4870beb1610f8

Download Submit
C:\Windows\xwskgcyulvqaygkqqqpld.exe

Filesize
584KB

MD5
8057321335b8890a9f6b3332bbc50774

SHA1
0421b8808a74d3ef33e38177a3f7710d320c4546

SHA256
f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2

SHA512
bdce8daa9fc2436bbea4892abe4eca5f298ddf6d7b20d20647466b22eb15b24234c044bc58b5879e0c1f4b2f5a5561b6f48f67b981be7a2245e4870beb1610f8

Download Submit
C:\Windows\xwskgcyulvqaygkqqqpld.exe

Filesize
584KB

MD5
8057321335b8890a9f6b3332bbc50774

SHA1
0421b8808a74d3ef33e38177a3f7710d320c4546

SHA256
f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2

SHA512
bdce8daa9fc2436bbea4892abe4eca5f298ddf6d7b20d20647466b22eb15b24234c044bc58b5879e0c1f4b2f5a5561b6f48f67b981be7a2245e4870beb1610f8

Download Submit
C:\Windows\xwskgcyulvqaygkqqqpld.exe

Filesize
584KB

MD5
8057321335b8890a9f6b3332bbc50774

SHA1
0421b8808a74d3ef33e38177a3f7710d320c4546

SHA256
f0981e91237611b09491cc17628a62ae2654bffec702e5900594bbb98aba86e2

SHA512
bdce8daa9fc2436bbea4892abe4eca5f298ddf6d7b20d20647466b22eb15b24234c044bc58b5879e0c1f4b2f5a5561b6f48f67b981be7a2245e4870beb1610f8

Download Submit