Analysis
-
max time kernel
151s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
20-10-2022 05:31
Static task
static1
Behavioral task
behavioral1
Sample
d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
General
-
Target
d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe
-
Size
1016KB
-
MD5
80222288b66d339b74f2f8e4d4901df0
-
SHA1
045bdfa2ed1256a8968190cc66e3a41fb35041a5
-
SHA256
d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344
-
SHA512
73667bb22df2a884a855c3136ff1cc6e058df667e7a507f50ac60f916b165d7f31376164382556696b22d9a8597e28e82db026af40020b92a487324ac4c453f5
-
SSDEEP
6144:qIXsL0tvrSVz1DnemeYbpsnEf78AoXh6KkiD0OofzA+/VygHU:qIXsgtvm1De5YlOx6lzBH46U
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" grrfdxtjqbb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" hrxfjq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" hrxfjq.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" hrxfjq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" hrxfjq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" hrxfjq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" hrxfjq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" hrxfjq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" hrxfjq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" hrxfjq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" hrxfjq.exe -
Adds policy Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ohwnaqcwklaewyw = "wvqngcuuovqaygkqqpojg.exe" hrxfjq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lbnblyhyjhtu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tndvjanixzpunqpq.exe" hrxfjq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lbnblyhyjhtu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avmfumawmpgmgkkmi.exe" hrxfjq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ohwnaqcwklaewyw = "wvqngcuuovqaygkqqpojg.exe" hrxfjq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run hrxfjq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lbnblyhyjhtu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wvqngcuuovqaygkqqpojg.exe" hrxfjq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lbnblyhyjhtu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hfzvnizyrxraxehmljhb.exe" hrxfjq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lbnblyhyjhtu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\urkfwqgewbucyegkifc.exe" hrxfjq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lbnblyhyjhtu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wvqngcuuovqaygkqqpojg.exe" grrfdxtjqbb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lbnblyhyjhtu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\urkfwqgewbucyegkifc.exe" hrxfjq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ohwnaqcwklaewyw = "hfzvnizyrxraxehmljhb.exe" hrxfjq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lbnblyhyjhtu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avmfumawmpgmgkkmi.exe" hrxfjq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ohwnaqcwklaewyw = "hfzvnizyrxraxehmljhb.exe" grrfdxtjqbb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lbnblyhyjhtu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jfxrhapmdhzgbghkhd.exe" hrxfjq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lbnblyhyjhtu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wvqngcuuovqaygkqqpojg.exe" hrxfjq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lbnblyhyjhtu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tndvjanixzpunqpq.exe" hrxfjq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run grrfdxtjqbb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ohwnaqcwklaewyw = "jfxrhapmdhzgbghkhd.exe" hrxfjq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ohwnaqcwklaewyw = "hfzvnizyrxraxehmljhb.exe" hrxfjq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ohwnaqcwklaewyw = "urkfwqgewbucyegkifc.exe" hrxfjq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run hrxfjq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ohwnaqcwklaewyw = "avmfumawmpgmgkkmi.exe" hrxfjq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ohwnaqcwklaewyw = "jfxrhapmdhzgbghkhd.exe" hrxfjq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ohwnaqcwklaewyw = "urkfwqgewbucyegkifc.exe" hrxfjq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ohwnaqcwklaewyw = "tndvjanixzpunqpq.exe" hrxfjq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ohwnaqcwklaewyw = "tndvjanixzpunqpq.exe" hrxfjq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lbnblyhyjhtu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jfxrhapmdhzgbghkhd.exe" hrxfjq.exe -
Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" grrfdxtjqbb.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" hrxfjq.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" hrxfjq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" hrxfjq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" hrxfjq.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" grrfdxtjqbb.exe -
Executes dropped EXE 3 IoCs
pid Process 1840 grrfdxtjqbb.exe 224 hrxfjq.exe 2152 hrxfjq.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation grrfdxtjqbb.exe -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kbodocmeqpceu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\urkfwqgewbucyegkifc.exe" grrfdxtjqbb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ldrhtitmzznqhi = "jfxrhapmdhzgbghkhd.exe ." hrxfjq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ldrhtitmzznqhi = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jfxrhapmdhzgbghkhd.exe ." hrxfjq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tndvjanixzpunqpq = "avmfumawmpgmgkkmi.exe" hrxfjq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kbodocmeqpceu = "hfzvnizyrxraxehmljhb.exe" hrxfjq.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce grrfdxtjqbb.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce hrxfjq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kbodocmeqpceu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wvqngcuuovqaygkqqpojg.exe" hrxfjq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\urkfwqgewbucyegkifc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tndvjanixzpunqpq.exe" hrxfjq.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run hrxfjq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tndvjanixzpunqpq = "urkfwqgewbucyegkifc.exe" hrxfjq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ldrhtitmzznqhi = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wvqngcuuovqaygkqqpojg.exe ." hrxfjq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kbodocmeqpceu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tndvjanixzpunqpq.exe" hrxfjq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tndvjanixzpunqpq = "jfxrhapmdhzgbghkhd.exe" hrxfjq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ldrhtitmzznqhi = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tndvjanixzpunqpq.exe ." hrxfjq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\avmfumawmpgmgkkmi = "tndvjanixzpunqpq.exe ." hrxfjq.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce hrxfjq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\jfxrhapmdhzgbghkhd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hfzvnizyrxraxehmljhb.exe ." hrxfjq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kbodocmeqpceu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wvqngcuuovqaygkqqpojg.exe" hrxfjq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kbodocmeqpceu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jfxrhapmdhzgbghkhd.exe" hrxfjq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kbodocmeqpceu = "jfxrhapmdhzgbghkhd.exe" hrxfjq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kbodocmeqpceu = "tndvjanixzpunqpq.exe" hrxfjq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\urkfwqgewbucyegkifc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avmfumawmpgmgkkmi.exe" hrxfjq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kbodocmeqpceu = "avmfumawmpgmgkkmi.exe" grrfdxtjqbb.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce grrfdxtjqbb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ldrhtitmzznqhi = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jfxrhapmdhzgbghkhd.exe ." grrfdxtjqbb.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce hrxfjq.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run hrxfjq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\urkfwqgewbucyegkifc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avmfumawmpgmgkkmi.exe" hrxfjq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ldrhtitmzznqhi = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jfxrhapmdhzgbghkhd.exe ." hrxfjq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tndvjanixzpunqpq = "urkfwqgewbucyegkifc.exe" grrfdxtjqbb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\avmfumawmpgmgkkmi = "avmfumawmpgmgkkmi.exe ." grrfdxtjqbb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\urkfwqgewbucyegkifc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\urkfwqgewbucyegkifc.exe" grrfdxtjqbb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\urkfwqgewbucyegkifc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jfxrhapmdhzgbghkhd.exe" hrxfjq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kbodocmeqpceu = "avmfumawmpgmgkkmi.exe" hrxfjq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\jfxrhapmdhzgbghkhd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tndvjanixzpunqpq.exe ." hrxfjq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\urkfwqgewbucyegkifc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hfzvnizyrxraxehmljhb.exe" hrxfjq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ldrhtitmzznqhi = "C:\\Users\\Admin\\AppData\\Local\\Temp\\urkfwqgewbucyegkifc.exe ." hrxfjq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\avmfumawmpgmgkkmi = "wvqngcuuovqaygkqqpojg.exe ." hrxfjq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kbodocmeqpceu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tndvjanixzpunqpq.exe" hrxfjq.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run hrxfjq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\avmfumawmpgmgkkmi = "urkfwqgewbucyegkifc.exe ." hrxfjq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\urkfwqgewbucyegkifc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wvqngcuuovqaygkqqpojg.exe" hrxfjq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tndvjanixzpunqpq = "hfzvnizyrxraxehmljhb.exe" hrxfjq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\avmfumawmpgmgkkmi = "urkfwqgewbucyegkifc.exe ." hrxfjq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\jfxrhapmdhzgbghkhd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wvqngcuuovqaygkqqpojg.exe ." hrxfjq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ldrhtitmzznqhi = "avmfumawmpgmgkkmi.exe ." grrfdxtjqbb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\jfxrhapmdhzgbghkhd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tndvjanixzpunqpq.exe ." grrfdxtjqbb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\jfxrhapmdhzgbghkhd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avmfumawmpgmgkkmi.exe ." hrxfjq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ldrhtitmzznqhi = "C:\\Users\\Admin\\AppData\\Local\\Temp\\urkfwqgewbucyegkifc.exe ." hrxfjq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ldrhtitmzznqhi = "C:\\Users\\Admin\\AppData\\Local\\Temp\\avmfumawmpgmgkkmi.exe ." hrxfjq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kbodocmeqpceu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\urkfwqgewbucyegkifc.exe" hrxfjq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\jfxrhapmdhzgbghkhd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tndvjanixzpunqpq.exe ." hrxfjq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kbodocmeqpceu = "urkfwqgewbucyegkifc.exe" hrxfjq.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run grrfdxtjqbb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ldrhtitmzznqhi = "avmfumawmpgmgkkmi.exe ." hrxfjq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kbodocmeqpceu = "wvqngcuuovqaygkqqpojg.exe" hrxfjq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\avmfumawmpgmgkkmi = "avmfumawmpgmgkkmi.exe ." hrxfjq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\urkfwqgewbucyegkifc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hfzvnizyrxraxehmljhb.exe" hrxfjq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kbodocmeqpceu = "tndvjanixzpunqpq.exe" hrxfjq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\jfxrhapmdhzgbghkhd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hfzvnizyrxraxehmljhb.exe ." hrxfjq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\avmfumawmpgmgkkmi = "jfxrhapmdhzgbghkhd.exe ." hrxfjq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kbodocmeqpceu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jfxrhapmdhzgbghkhd.exe" hrxfjq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kbodocmeqpceu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hfzvnizyrxraxehmljhb.exe" hrxfjq.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" hrxfjq.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA hrxfjq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" grrfdxtjqbb.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" hrxfjq.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA hrxfjq.exe -
Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 20 whatismyipaddress.com 22 whatismyip.everdot.org 34 whatismyip.everdot.org 50 whatismyip.everdot.org 18 www.showmyipaddress.com -
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf hrxfjq.exe File created C:\autorun.inf hrxfjq.exe -
Drops file in System32 directory 25 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\wvqngcuuovqaygkqqpojg.exe grrfdxtjqbb.exe File opened for modification C:\Windows\SysWOW64\urkfwqgewbucyegkifc.exe hrxfjq.exe File opened for modification C:\Windows\SysWOW64\avmfumawmpgmgkkmi.exe hrxfjq.exe File created C:\Windows\SysWOW64\kbodocmeqpceuuqogxobqbpzrdcprhhdbtk.odo hrxfjq.exe File opened for modification C:\Windows\SysWOW64\hfzvnizyrxraxehmljhb.exe hrxfjq.exe File opened for modification C:\Windows\SysWOW64\jfxrhapmdhzgbghkhd.exe hrxfjq.exe File opened for modification C:\Windows\SysWOW64\tndvjanixzpunqpq.exe grrfdxtjqbb.exe File opened for modification C:\Windows\SysWOW64\hfzvnizyrxraxehmljhb.exe grrfdxtjqbb.exe File opened for modification C:\Windows\SysWOW64\tndvjanixzpunqpq.exe hrxfjq.exe File opened for modification C:\Windows\SysWOW64\avmfumawmpgmgkkmi.exe hrxfjq.exe File opened for modification C:\Windows\SysWOW64\nnjhbyrsnvrcbkpwxxxtrl.exe hrxfjq.exe File opened for modification C:\Windows\SysWOW64\tndvjanixzpunqpq.exe hrxfjq.exe File opened for modification C:\Windows\SysWOW64\urkfwqgewbucyegkifc.exe hrxfjq.exe File opened for modification C:\Windows\SysWOW64\hfzvnizyrxraxehmljhb.exe hrxfjq.exe File opened for modification C:\Windows\SysWOW64\avmfumawmpgmgkkmi.exe grrfdxtjqbb.exe File opened for modification C:\Windows\SysWOW64\jfxrhapmdhzgbghkhd.exe grrfdxtjqbb.exe File opened for modification C:\Windows\SysWOW64\jfxrhapmdhzgbghkhd.exe hrxfjq.exe File opened for modification C:\Windows\SysWOW64\wvqngcuuovqaygkqqpojg.exe hrxfjq.exe File created C:\Windows\SysWOW64\bhjnnqpwxlnejyjwdjprvvyx.ftv hrxfjq.exe File opened for modification C:\Windows\SysWOW64\bhjnnqpwxlnejyjwdjprvvyx.ftv hrxfjq.exe File opened for modification C:\Windows\SysWOW64\kbodocmeqpceuuqogxobqbpzrdcprhhdbtk.odo hrxfjq.exe File opened for modification C:\Windows\SysWOW64\urkfwqgewbucyegkifc.exe grrfdxtjqbb.exe File opened for modification C:\Windows\SysWOW64\nnjhbyrsnvrcbkpwxxxtrl.exe grrfdxtjqbb.exe File opened for modification C:\Windows\SysWOW64\wvqngcuuovqaygkqqpojg.exe hrxfjq.exe File opened for modification C:\Windows\SysWOW64\nnjhbyrsnvrcbkpwxxxtrl.exe hrxfjq.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files (x86)\bhjnnqpwxlnejyjwdjprvvyx.ftv hrxfjq.exe File opened for modification C:\Program Files (x86)\kbodocmeqpceuuqogxobqbpzrdcprhhdbtk.odo hrxfjq.exe File created C:\Program Files (x86)\kbodocmeqpceuuqogxobqbpzrdcprhhdbtk.odo hrxfjq.exe File opened for modification C:\Program Files (x86)\bhjnnqpwxlnejyjwdjprvvyx.ftv hrxfjq.exe -
Drops file in Windows directory 25 IoCs
description ioc Process File opened for modification C:\Windows\nnjhbyrsnvrcbkpwxxxtrl.exe grrfdxtjqbb.exe File opened for modification C:\Windows\tndvjanixzpunqpq.exe hrxfjq.exe File opened for modification C:\Windows\avmfumawmpgmgkkmi.exe hrxfjq.exe File opened for modification C:\Windows\nnjhbyrsnvrcbkpwxxxtrl.exe hrxfjq.exe File opened for modification C:\Windows\wvqngcuuovqaygkqqpojg.exe hrxfjq.exe File created C:\Windows\bhjnnqpwxlnejyjwdjprvvyx.ftv hrxfjq.exe File opened for modification C:\Windows\kbodocmeqpceuuqogxobqbpzrdcprhhdbtk.odo hrxfjq.exe File opened for modification C:\Windows\tndvjanixzpunqpq.exe grrfdxtjqbb.exe File opened for modification C:\Windows\jfxrhapmdhzgbghkhd.exe grrfdxtjqbb.exe File opened for modification C:\Windows\urkfwqgewbucyegkifc.exe grrfdxtjqbb.exe File opened for modification C:\Windows\wvqngcuuovqaygkqqpojg.exe grrfdxtjqbb.exe File opened for modification C:\Windows\wvqngcuuovqaygkqqpojg.exe hrxfjq.exe File opened for modification C:\Windows\urkfwqgewbucyegkifc.exe hrxfjq.exe File opened for modification C:\Windows\bhjnnqpwxlnejyjwdjprvvyx.ftv hrxfjq.exe File created C:\Windows\kbodocmeqpceuuqogxobqbpzrdcprhhdbtk.odo hrxfjq.exe File opened for modification C:\Windows\avmfumawmpgmgkkmi.exe grrfdxtjqbb.exe File opened for modification C:\Windows\hfzvnizyrxraxehmljhb.exe grrfdxtjqbb.exe File opened for modification C:\Windows\urkfwqgewbucyegkifc.exe hrxfjq.exe File opened for modification C:\Windows\tndvjanixzpunqpq.exe hrxfjq.exe File opened for modification C:\Windows\jfxrhapmdhzgbghkhd.exe hrxfjq.exe File opened for modification C:\Windows\hfzvnizyrxraxehmljhb.exe hrxfjq.exe File opened for modification C:\Windows\nnjhbyrsnvrcbkpwxxxtrl.exe hrxfjq.exe File opened for modification C:\Windows\jfxrhapmdhzgbghkhd.exe hrxfjq.exe File opened for modification C:\Windows\hfzvnizyrxraxehmljhb.exe hrxfjq.exe File opened for modification C:\Windows\avmfumawmpgmgkkmi.exe hrxfjq.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1388 d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe 1388 d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe 1388 d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe 1388 d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe 1388 d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe 1388 d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe 1388 d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe 1388 d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe 1388 d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe 1388 d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe 1388 d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe 1388 d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe 1388 d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe 1388 d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe 1388 d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe 1388 d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe 1388 d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe 1388 d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe 1388 d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe 1388 d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe 1388 d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe 1388 d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe 224 hrxfjq.exe 224 hrxfjq.exe 1388 d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe 1388 d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe 1388 d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe 1388 d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe 1388 d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe 1388 d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe 1388 d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe 1388 d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe 1388 d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe 1388 d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe 1388 d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe 1388 d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe 1388 d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe 1388 d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe 1388 d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe 1388 d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe 1388 d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe 1388 d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe 1388 d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe 1388 d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe 1388 d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe 1388 d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe 1388 d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe 1388 d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe 1388 d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe 1388 d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe 1388 d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe 1388 d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe 1388 d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe 1388 d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe 1388 d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe 1388 d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe 224 hrxfjq.exe 224 hrxfjq.exe 1388 d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe 1388 d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe 1388 d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe 1388 d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe 1388 d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe 1388 d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 224 hrxfjq.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1388 wrote to memory of 1840 1388 d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe 83 PID 1388 wrote to memory of 1840 1388 d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe 83 PID 1388 wrote to memory of 1840 1388 d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe 83 PID 1840 wrote to memory of 224 1840 grrfdxtjqbb.exe 88 PID 1840 wrote to memory of 224 1840 grrfdxtjqbb.exe 88 PID 1840 wrote to memory of 224 1840 grrfdxtjqbb.exe 88 PID 1840 wrote to memory of 2152 1840 grrfdxtjqbb.exe 89 PID 1840 wrote to memory of 2152 1840 grrfdxtjqbb.exe 89 PID 1840 wrote to memory of 2152 1840 grrfdxtjqbb.exe 89 -
System policy modification 1 TTPs 39 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" hrxfjq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" hrxfjq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" hrxfjq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" hrxfjq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" hrxfjq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" hrxfjq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" grrfdxtjqbb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System hrxfjq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" hrxfjq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" hrxfjq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" hrxfjq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" hrxfjq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" hrxfjq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" hrxfjq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" hrxfjq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" hrxfjq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" hrxfjq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" hrxfjq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" hrxfjq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" hrxfjq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" hrxfjq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer hrxfjq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" hrxfjq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer hrxfjq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" hrxfjq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" hrxfjq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System grrfdxtjqbb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" grrfdxtjqbb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer grrfdxtjqbb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System hrxfjq.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe"C:\Users\Admin\AppData\Local\Temp\d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\grrfdxtjqbb.exe"C:\Users\Admin\AppData\Local\Temp\grrfdxtjqbb.exe" "c:\users\admin\appdata\local\temp\d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344.exe*"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\hrxfjq.exe"C:\Users\Admin\AppData\Local\Temp\hrxfjq.exe" "-C:\Users\Admin\AppData\Local\Temp\tndvjanixzpunqpq.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:224
-
-
C:\Users\Admin\AppData\Local\Temp\hrxfjq.exe"C:\Users\Admin\AppData\Local\Temp\hrxfjq.exe" "-C:\Users\Admin\AppData\Local\Temp\tndvjanixzpunqpq.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- System policy modification
PID:2152
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1016KB
MD580222288b66d339b74f2f8e4d4901df0
SHA1045bdfa2ed1256a8968190cc66e3a41fb35041a5
SHA256d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344
SHA51273667bb22df2a884a855c3136ff1cc6e058df667e7a507f50ac60f916b165d7f31376164382556696b22d9a8597e28e82db026af40020b92a487324ac4c453f5
-
Filesize
320KB
MD5b8a7d4db5f78066998a5cdd5ff4c1694
SHA13bb5950c7b86d5cd8fbd2421cc2d3bd14bdfd8b3
SHA256bae1d2de5e3c7543129a8ccfc1db637bffd7918506bd883248086c092e711c03
SHA512056ab0e3dd4a4a886aa2421020d056034b28fb18bddf7725087e0c38f3c0c372d03212ca23e3d418099d2115f1aeb8390f4b7563f2865b0f18c8cb2f9b6e44cf
-
Filesize
320KB
MD5b8a7d4db5f78066998a5cdd5ff4c1694
SHA13bb5950c7b86d5cd8fbd2421cc2d3bd14bdfd8b3
SHA256bae1d2de5e3c7543129a8ccfc1db637bffd7918506bd883248086c092e711c03
SHA512056ab0e3dd4a4a886aa2421020d056034b28fb18bddf7725087e0c38f3c0c372d03212ca23e3d418099d2115f1aeb8390f4b7563f2865b0f18c8cb2f9b6e44cf
-
Filesize
1016KB
MD580222288b66d339b74f2f8e4d4901df0
SHA1045bdfa2ed1256a8968190cc66e3a41fb35041a5
SHA256d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344
SHA51273667bb22df2a884a855c3136ff1cc6e058df667e7a507f50ac60f916b165d7f31376164382556696b22d9a8597e28e82db026af40020b92a487324ac4c453f5
-
Filesize
700KB
MD53c06f6e58c730b7db44ded3df9842edb
SHA1a094b42346571c24408afc7d16b40331482c1ac5
SHA256c524c01d8e483c9b4b33740db3873bed3f690e973ccc059428a0cdb26b6ffd15
SHA5125980e049f938efc6afe071e233caa0dd57cc718aace601ab5a63db96095cc5fb20eec0475537f0415929c4238a9408b126b49225b52c1e5ed8db74adfecc68a9
-
Filesize
700KB
MD53c06f6e58c730b7db44ded3df9842edb
SHA1a094b42346571c24408afc7d16b40331482c1ac5
SHA256c524c01d8e483c9b4b33740db3873bed3f690e973ccc059428a0cdb26b6ffd15
SHA5125980e049f938efc6afe071e233caa0dd57cc718aace601ab5a63db96095cc5fb20eec0475537f0415929c4238a9408b126b49225b52c1e5ed8db74adfecc68a9
-
Filesize
700KB
MD53c06f6e58c730b7db44ded3df9842edb
SHA1a094b42346571c24408afc7d16b40331482c1ac5
SHA256c524c01d8e483c9b4b33740db3873bed3f690e973ccc059428a0cdb26b6ffd15
SHA5125980e049f938efc6afe071e233caa0dd57cc718aace601ab5a63db96095cc5fb20eec0475537f0415929c4238a9408b126b49225b52c1e5ed8db74adfecc68a9
-
Filesize
1016KB
MD580222288b66d339b74f2f8e4d4901df0
SHA1045bdfa2ed1256a8968190cc66e3a41fb35041a5
SHA256d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344
SHA51273667bb22df2a884a855c3136ff1cc6e058df667e7a507f50ac60f916b165d7f31376164382556696b22d9a8597e28e82db026af40020b92a487324ac4c453f5
-
Filesize
1016KB
MD580222288b66d339b74f2f8e4d4901df0
SHA1045bdfa2ed1256a8968190cc66e3a41fb35041a5
SHA256d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344
SHA51273667bb22df2a884a855c3136ff1cc6e058df667e7a507f50ac60f916b165d7f31376164382556696b22d9a8597e28e82db026af40020b92a487324ac4c453f5
-
Filesize
1016KB
MD580222288b66d339b74f2f8e4d4901df0
SHA1045bdfa2ed1256a8968190cc66e3a41fb35041a5
SHA256d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344
SHA51273667bb22df2a884a855c3136ff1cc6e058df667e7a507f50ac60f916b165d7f31376164382556696b22d9a8597e28e82db026af40020b92a487324ac4c453f5
-
Filesize
1016KB
MD580222288b66d339b74f2f8e4d4901df0
SHA1045bdfa2ed1256a8968190cc66e3a41fb35041a5
SHA256d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344
SHA51273667bb22df2a884a855c3136ff1cc6e058df667e7a507f50ac60f916b165d7f31376164382556696b22d9a8597e28e82db026af40020b92a487324ac4c453f5
-
Filesize
1016KB
MD580222288b66d339b74f2f8e4d4901df0
SHA1045bdfa2ed1256a8968190cc66e3a41fb35041a5
SHA256d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344
SHA51273667bb22df2a884a855c3136ff1cc6e058df667e7a507f50ac60f916b165d7f31376164382556696b22d9a8597e28e82db026af40020b92a487324ac4c453f5
-
Filesize
1016KB
MD580222288b66d339b74f2f8e4d4901df0
SHA1045bdfa2ed1256a8968190cc66e3a41fb35041a5
SHA256d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344
SHA51273667bb22df2a884a855c3136ff1cc6e058df667e7a507f50ac60f916b165d7f31376164382556696b22d9a8597e28e82db026af40020b92a487324ac4c453f5
-
Filesize
1016KB
MD580222288b66d339b74f2f8e4d4901df0
SHA1045bdfa2ed1256a8968190cc66e3a41fb35041a5
SHA256d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344
SHA51273667bb22df2a884a855c3136ff1cc6e058df667e7a507f50ac60f916b165d7f31376164382556696b22d9a8597e28e82db026af40020b92a487324ac4c453f5
-
Filesize
1016KB
MD580222288b66d339b74f2f8e4d4901df0
SHA1045bdfa2ed1256a8968190cc66e3a41fb35041a5
SHA256d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344
SHA51273667bb22df2a884a855c3136ff1cc6e058df667e7a507f50ac60f916b165d7f31376164382556696b22d9a8597e28e82db026af40020b92a487324ac4c453f5
-
Filesize
1016KB
MD580222288b66d339b74f2f8e4d4901df0
SHA1045bdfa2ed1256a8968190cc66e3a41fb35041a5
SHA256d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344
SHA51273667bb22df2a884a855c3136ff1cc6e058df667e7a507f50ac60f916b165d7f31376164382556696b22d9a8597e28e82db026af40020b92a487324ac4c453f5
-
Filesize
1016KB
MD580222288b66d339b74f2f8e4d4901df0
SHA1045bdfa2ed1256a8968190cc66e3a41fb35041a5
SHA256d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344
SHA51273667bb22df2a884a855c3136ff1cc6e058df667e7a507f50ac60f916b165d7f31376164382556696b22d9a8597e28e82db026af40020b92a487324ac4c453f5
-
Filesize
1016KB
MD580222288b66d339b74f2f8e4d4901df0
SHA1045bdfa2ed1256a8968190cc66e3a41fb35041a5
SHA256d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344
SHA51273667bb22df2a884a855c3136ff1cc6e058df667e7a507f50ac60f916b165d7f31376164382556696b22d9a8597e28e82db026af40020b92a487324ac4c453f5
-
Filesize
1016KB
MD580222288b66d339b74f2f8e4d4901df0
SHA1045bdfa2ed1256a8968190cc66e3a41fb35041a5
SHA256d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344
SHA51273667bb22df2a884a855c3136ff1cc6e058df667e7a507f50ac60f916b165d7f31376164382556696b22d9a8597e28e82db026af40020b92a487324ac4c453f5
-
Filesize
1016KB
MD580222288b66d339b74f2f8e4d4901df0
SHA1045bdfa2ed1256a8968190cc66e3a41fb35041a5
SHA256d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344
SHA51273667bb22df2a884a855c3136ff1cc6e058df667e7a507f50ac60f916b165d7f31376164382556696b22d9a8597e28e82db026af40020b92a487324ac4c453f5
-
Filesize
1016KB
MD580222288b66d339b74f2f8e4d4901df0
SHA1045bdfa2ed1256a8968190cc66e3a41fb35041a5
SHA256d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344
SHA51273667bb22df2a884a855c3136ff1cc6e058df667e7a507f50ac60f916b165d7f31376164382556696b22d9a8597e28e82db026af40020b92a487324ac4c453f5
-
Filesize
1016KB
MD580222288b66d339b74f2f8e4d4901df0
SHA1045bdfa2ed1256a8968190cc66e3a41fb35041a5
SHA256d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344
SHA51273667bb22df2a884a855c3136ff1cc6e058df667e7a507f50ac60f916b165d7f31376164382556696b22d9a8597e28e82db026af40020b92a487324ac4c453f5
-
Filesize
1016KB
MD580222288b66d339b74f2f8e4d4901df0
SHA1045bdfa2ed1256a8968190cc66e3a41fb35041a5
SHA256d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344
SHA51273667bb22df2a884a855c3136ff1cc6e058df667e7a507f50ac60f916b165d7f31376164382556696b22d9a8597e28e82db026af40020b92a487324ac4c453f5
-
Filesize
1016KB
MD580222288b66d339b74f2f8e4d4901df0
SHA1045bdfa2ed1256a8968190cc66e3a41fb35041a5
SHA256d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344
SHA51273667bb22df2a884a855c3136ff1cc6e058df667e7a507f50ac60f916b165d7f31376164382556696b22d9a8597e28e82db026af40020b92a487324ac4c453f5
-
Filesize
1016KB
MD580222288b66d339b74f2f8e4d4901df0
SHA1045bdfa2ed1256a8968190cc66e3a41fb35041a5
SHA256d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344
SHA51273667bb22df2a884a855c3136ff1cc6e058df667e7a507f50ac60f916b165d7f31376164382556696b22d9a8597e28e82db026af40020b92a487324ac4c453f5
-
Filesize
1016KB
MD580222288b66d339b74f2f8e4d4901df0
SHA1045bdfa2ed1256a8968190cc66e3a41fb35041a5
SHA256d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344
SHA51273667bb22df2a884a855c3136ff1cc6e058df667e7a507f50ac60f916b165d7f31376164382556696b22d9a8597e28e82db026af40020b92a487324ac4c453f5
-
Filesize
1016KB
MD580222288b66d339b74f2f8e4d4901df0
SHA1045bdfa2ed1256a8968190cc66e3a41fb35041a5
SHA256d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344
SHA51273667bb22df2a884a855c3136ff1cc6e058df667e7a507f50ac60f916b165d7f31376164382556696b22d9a8597e28e82db026af40020b92a487324ac4c453f5
-
Filesize
1016KB
MD580222288b66d339b74f2f8e4d4901df0
SHA1045bdfa2ed1256a8968190cc66e3a41fb35041a5
SHA256d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344
SHA51273667bb22df2a884a855c3136ff1cc6e058df667e7a507f50ac60f916b165d7f31376164382556696b22d9a8597e28e82db026af40020b92a487324ac4c453f5
-
Filesize
1016KB
MD580222288b66d339b74f2f8e4d4901df0
SHA1045bdfa2ed1256a8968190cc66e3a41fb35041a5
SHA256d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344
SHA51273667bb22df2a884a855c3136ff1cc6e058df667e7a507f50ac60f916b165d7f31376164382556696b22d9a8597e28e82db026af40020b92a487324ac4c453f5
-
Filesize
1016KB
MD580222288b66d339b74f2f8e4d4901df0
SHA1045bdfa2ed1256a8968190cc66e3a41fb35041a5
SHA256d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344
SHA51273667bb22df2a884a855c3136ff1cc6e058df667e7a507f50ac60f916b165d7f31376164382556696b22d9a8597e28e82db026af40020b92a487324ac4c453f5
-
Filesize
1016KB
MD580222288b66d339b74f2f8e4d4901df0
SHA1045bdfa2ed1256a8968190cc66e3a41fb35041a5
SHA256d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344
SHA51273667bb22df2a884a855c3136ff1cc6e058df667e7a507f50ac60f916b165d7f31376164382556696b22d9a8597e28e82db026af40020b92a487324ac4c453f5
-
Filesize
1016KB
MD580222288b66d339b74f2f8e4d4901df0
SHA1045bdfa2ed1256a8968190cc66e3a41fb35041a5
SHA256d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344
SHA51273667bb22df2a884a855c3136ff1cc6e058df667e7a507f50ac60f916b165d7f31376164382556696b22d9a8597e28e82db026af40020b92a487324ac4c453f5
-
Filesize
1016KB
MD580222288b66d339b74f2f8e4d4901df0
SHA1045bdfa2ed1256a8968190cc66e3a41fb35041a5
SHA256d29dfea8e5de80764a6cdabbb27404b8f72f990eda3ce571b2cf8e949e7b6344
SHA51273667bb22df2a884a855c3136ff1cc6e058df667e7a507f50ac60f916b165d7f31376164382556696b22d9a8597e28e82db026af40020b92a487324ac4c453f5