Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
20/10/2022, 09:40
Static task
static1
Behavioral task
behavioral1
Sample
9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe
Resource
win10v2004-20220812-en
General
-
Target
9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe
-
Size
508KB
-
MD5
42471a09ff6214244c8cdfcbadae2930
-
SHA1
3d9d229091565ae569051d49cfe9d41668d0f7bf
-
SHA256
9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644
-
SHA512
b463afa0b0e9e74e32afd3f23df21ff34166da0d6d328d83e34774068b1b42dc62fde1ad8226fb515347a377a390c43160ee9c250628f0e545350e3e938be024
-
SSDEEP
12288:tpUJ3r6YkVwJgNnSykgb9cqWnw4q6ZmFhqsXRfMMMMM2MMMMM:tpUNr6YkVRFkgbeqeo68FhqSRfMMMMMN
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" iffdguquspp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" ksycjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" ksycjo.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" ksycjo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" ksycjo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ksycjo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ksycjo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" ksycjo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" ksycjo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" ksycjo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" iffdguquspp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" iffdguquspp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" iffdguquspp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" ksycjo.exe -
Adds policy Run key to start application 2 TTPs 17 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\doxeowknz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\woesjytdwirtybjc.exe" ksycjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ocoylwntiqvt = "kgasngftqgtzipbydqgc.exe" ksycjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ocoylwntiqvt = "woesjytdwirtybjc.exe" iffdguquspp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run ksycjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ocoylwntiqvt = "dwncukgrlyilrveya.exe" ksycjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\doxeowknz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dwncukgrlyilrveya.exe" ksycjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ocoylwntiqvt = "kgasngftqgtzipbydqgc.exe" ksycjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ocoylwntiqvt = "zwrkgaapneszjreciwnkf.exe" ksycjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ocoylwntiqvt = "zwrkgaapneszjreciwnkf.exe" ksycjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ocoylwntiqvt = "xslcwomzvkwbjpawamb.exe" ksycjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ocoylwntiqvt = "xslcwomzvkwbjpawamb.exe" ksycjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\doxeowknz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kgasngftqgtzipbydqgc.exe" ksycjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\doxeowknz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\woesjytdwirtybjc.exe" iffdguquspp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run ksycjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ocoylwntiqvt = "dwncukgrlyilrveya.exe" ksycjo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run iffdguquspp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\doxeowknz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zwrkgaapneszjreciwnkf.exe" ksycjo.exe -
Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" iffdguquspp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" iffdguquspp.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" ksycjo.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" ksycjo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" ksycjo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" ksycjo.exe -
Executes dropped EXE 3 IoCs
pid Process 1256 iffdguquspp.exe 452 ksycjo.exe 1168 ksycjo.exe -
Loads dropped DLL 6 IoCs
pid Process 1632 9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe 1632 9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe 1256 iffdguquspp.exe 1256 iffdguquspp.exe 1256 iffdguquspp.exe 1256 iffdguquspp.exe -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ncpaoaszpyedf = "xslcwomzvkwbjpawamb.exe" iffdguquspp.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\oesetgzhyippst = "zwrkgaapneszjreciwnkf.exe ." ksycjo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wisalujnag = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dwncukgrlyilrveya.exe" ksycjo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\oesetgzhyippst = "mgyohyvhcqbfmrbwzk.exe ." ksycjo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run iffdguquspp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rixkaoirjucdhjq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mgyohyvhcqbfmrbwzk.exe ." ksycjo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wisalujnag = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kgasngftqgtzipbydqgc.exe" ksycjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\repykukpdko = "dwncukgrlyilrveya.exe ." ksycjo.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run iffdguquspp.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce ksycjo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wisalujnag = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dwncukgrlyilrveya.exe" ksycjo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\repykukpdko = "C:\\Users\\Admin\\AppData\\Local\\Temp\\woesjytdwirtybjc.exe ." ksycjo.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ksycjo.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce ksycjo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\repykukpdko = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zwrkgaapneszjreciwnkf.exe ." ksycjo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wisalujnag = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kgasngftqgtzipbydqgc.exe" ksycjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\woesjytdwirtybjc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\woesjytdwirtybjc.exe" ksycjo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\oesetgzhyippst = "zwrkgaapneszjreciwnkf.exe ." ksycjo.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce iffdguquspp.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\oesetgzhyippst = "zwrkgaapneszjreciwnkf.exe ." iffdguquspp.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ncpaoaszpyedf = "zwrkgaapneszjreciwnkf.exe" ksycjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\woesjytdwirtybjc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zwrkgaapneszjreciwnkf.exe" ksycjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\wisalujnag = "xslcwomzvkwbjpawamb.exe" ksycjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\repykukpdko = "zwrkgaapneszjreciwnkf.exe ." ksycjo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wisalujnag = "C:\\Users\\Admin\\AppData\\Local\\Temp\\woesjytdwirtybjc.exe" ksycjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\wisalujnag = "xslcwomzvkwbjpawamb.exe" ksycjo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ncpaoaszpyedf = "woesjytdwirtybjc.exe" ksycjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\repykukpdko = "woesjytdwirtybjc.exe ." ksycjo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ncpaoaszpyedf = "zwrkgaapneszjreciwnkf.exe" ksycjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\woesjytdwirtybjc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xslcwomzvkwbjpawamb.exe" ksycjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rixkaoirjucdhjq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xslcwomzvkwbjpawamb.exe ." ksycjo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\repykukpdko = "C:\\Users\\Admin\\AppData\\Local\\Temp\\woesjytdwirtybjc.exe ." ksycjo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce ksycjo.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ksycjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\repykukpdko = "woesjytdwirtybjc.exe ." ksycjo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\oesetgzhyippst = "dwncukgrlyilrveya.exe ." ksycjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\woesjytdwirtybjc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dwncukgrlyilrveya.exe" ksycjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\woesjytdwirtybjc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\woesjytdwirtybjc.exe" iffdguquspp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce ksycjo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\repykukpdko = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dwncukgrlyilrveya.exe ." ksycjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rixkaoirjucdhjq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zwrkgaapneszjreciwnkf.exe ." ksycjo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\repykukpdko = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xslcwomzvkwbjpawamb.exe ." ksycjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\wisalujnag = "woesjytdwirtybjc.exe" ksycjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\wisalujnag = "woesjytdwirtybjc.exe" ksycjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\repykukpdko = "kgasngftqgtzipbydqgc.exe ." ksycjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\wisalujnag = "mgyohyvhcqbfmrbwzk.exe" ksycjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rixkaoirjucdhjq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xslcwomzvkwbjpawamb.exe ." iffdguquspp.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\oesetgzhyippst = "mgyohyvhcqbfmrbwzk.exe ." ksycjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rixkaoirjucdhjq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\woesjytdwirtybjc.exe ." ksycjo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ncpaoaszpyedf = "mgyohyvhcqbfmrbwzk.exe" ksycjo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\wisalujnag = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xslcwomzvkwbjpawamb.exe" iffdguquspp.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\repykukpdko = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xslcwomzvkwbjpawamb.exe ." iffdguquspp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run ksycjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\wisalujnag = "mgyohyvhcqbfmrbwzk.exe" ksycjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\wisalujnag = "kgasngftqgtzipbydqgc.exe" ksycjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\repykukpdko = "dwncukgrlyilrveya.exe ." iffdguquspp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run ksycjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\woesjytdwirtybjc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mgyohyvhcqbfmrbwzk.exe" ksycjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\woesjytdwirtybjc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dwncukgrlyilrveya.exe" ksycjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rixkaoirjucdhjq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\woesjytdwirtybjc.exe ." ksycjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rixkaoirjucdhjq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kgasngftqgtzipbydqgc.exe ." ksycjo.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\repykukpdko = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mgyohyvhcqbfmrbwzk.exe ." ksycjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\wisalujnag = "zwrkgaapneszjreciwnkf.exe" ksycjo.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\wisalujnag = "mgyohyvhcqbfmrbwzk.exe" iffdguquspp.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" iffdguquspp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA iffdguquspp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ksycjo.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ksycjo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ksycjo.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ksycjo.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 5 whatismyip.everdot.org 8 whatismyipaddress.com 3 www.showmyipaddress.com -
Drops file in System32 directory 25 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\woesjytdwirtybjc.exe ksycjo.exe File opened for modification C:\Windows\SysWOW64\qokebwxnmetbmvjipewuqk.exe ksycjo.exe File opened for modification C:\Windows\SysWOW64\qokebwxnmetbmvjipewuqk.exe ksycjo.exe File opened for modification C:\Windows\SysWOW64\qwachktryyvlevrynkkquwbenl.spf ksycjo.exe File opened for modification C:\Windows\SysWOW64\zwrkgaapneszjreciwnkf.exe iffdguquspp.exe File opened for modification C:\Windows\SysWOW64\kgasngftqgtzipbydqgc.exe iffdguquspp.exe File opened for modification C:\Windows\SysWOW64\mgyohyvhcqbfmrbwzk.exe ksycjo.exe File opened for modification C:\Windows\SysWOW64\zwrkgaapneszjreciwnkf.exe ksycjo.exe File opened for modification C:\Windows\SysWOW64\dwncukgrlyilrveya.exe ksycjo.exe File opened for modification C:\Windows\SysWOW64\mgyohyvhcqbfmrbwzk.exe ksycjo.exe File created C:\Windows\SysWOW64\rixkaoirjucdhjqiiqbshukysbtemnrtassal.reu ksycjo.exe File opened for modification C:\Windows\SysWOW64\xslcwomzvkwbjpawamb.exe iffdguquspp.exe File opened for modification C:\Windows\SysWOW64\dwncukgrlyilrveya.exe ksycjo.exe File opened for modification C:\Windows\SysWOW64\xslcwomzvkwbjpawamb.exe ksycjo.exe File opened for modification C:\Windows\SysWOW64\zwrkgaapneszjreciwnkf.exe ksycjo.exe File opened for modification C:\Windows\SysWOW64\dwncukgrlyilrveya.exe iffdguquspp.exe File opened for modification C:\Windows\SysWOW64\mgyohyvhcqbfmrbwzk.exe iffdguquspp.exe File opened for modification C:\Windows\SysWOW64\qokebwxnmetbmvjipewuqk.exe iffdguquspp.exe File opened for modification C:\Windows\SysWOW64\xslcwomzvkwbjpawamb.exe ksycjo.exe File opened for modification C:\Windows\SysWOW64\kgasngftqgtzipbydqgc.exe ksycjo.exe File opened for modification C:\Windows\SysWOW64\woesjytdwirtybjc.exe ksycjo.exe File opened for modification C:\Windows\SysWOW64\kgasngftqgtzipbydqgc.exe ksycjo.exe File created C:\Windows\SysWOW64\qwachktryyvlevrynkkquwbenl.spf ksycjo.exe File opened for modification C:\Windows\SysWOW64\woesjytdwirtybjc.exe iffdguquspp.exe File opened for modification C:\Windows\SysWOW64\rixkaoirjucdhjqiiqbshukysbtemnrtassal.reu ksycjo.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\qwachktryyvlevrynkkquwbenl.spf ksycjo.exe File created C:\Program Files (x86)\qwachktryyvlevrynkkquwbenl.spf ksycjo.exe File opened for modification C:\Program Files (x86)\rixkaoirjucdhjqiiqbshukysbtemnrtassal.reu ksycjo.exe File created C:\Program Files (x86)\rixkaoirjucdhjqiiqbshukysbtemnrtassal.reu ksycjo.exe -
Drops file in Windows directory 25 IoCs
description ioc Process File opened for modification C:\Windows\dwncukgrlyilrveya.exe ksycjo.exe File opened for modification C:\Windows\mgyohyvhcqbfmrbwzk.exe ksycjo.exe File opened for modification C:\Windows\kgasngftqgtzipbydqgc.exe ksycjo.exe File opened for modification C:\Windows\zwrkgaapneszjreciwnkf.exe ksycjo.exe File created C:\Windows\qwachktryyvlevrynkkquwbenl.spf ksycjo.exe File opened for modification C:\Windows\rixkaoirjucdhjqiiqbshukysbtemnrtassal.reu ksycjo.exe File opened for modification C:\Windows\qokebwxnmetbmvjipewuqk.exe ksycjo.exe File opened for modification C:\Windows\xslcwomzvkwbjpawamb.exe ksycjo.exe File opened for modification C:\Windows\qokebwxnmetbmvjipewuqk.exe ksycjo.exe File created C:\Windows\rixkaoirjucdhjqiiqbshukysbtemnrtassal.reu ksycjo.exe File opened for modification C:\Windows\woesjytdwirtybjc.exe iffdguquspp.exe File opened for modification C:\Windows\dwncukgrlyilrveya.exe iffdguquspp.exe File opened for modification C:\Windows\mgyohyvhcqbfmrbwzk.exe iffdguquspp.exe File opened for modification C:\Windows\xslcwomzvkwbjpawamb.exe iffdguquspp.exe File opened for modification C:\Windows\kgasngftqgtzipbydqgc.exe iffdguquspp.exe File opened for modification C:\Windows\qokebwxnmetbmvjipewuqk.exe iffdguquspp.exe File opened for modification C:\Windows\dwncukgrlyilrveya.exe ksycjo.exe File opened for modification C:\Windows\mgyohyvhcqbfmrbwzk.exe ksycjo.exe File opened for modification C:\Windows\kgasngftqgtzipbydqgc.exe ksycjo.exe File opened for modification C:\Windows\qwachktryyvlevrynkkquwbenl.spf ksycjo.exe File opened for modification C:\Windows\zwrkgaapneszjreciwnkf.exe iffdguquspp.exe File opened for modification C:\Windows\woesjytdwirtybjc.exe ksycjo.exe File opened for modification C:\Windows\xslcwomzvkwbjpawamb.exe ksycjo.exe File opened for modification C:\Windows\zwrkgaapneszjreciwnkf.exe ksycjo.exe File opened for modification C:\Windows\woesjytdwirtybjc.exe ksycjo.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1632 9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe 1632 9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe 1632 9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe 1632 9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe 1632 9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe 1632 9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe 1632 9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe 1632 9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe 1632 9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe 1632 9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe 1632 9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe 1632 9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe 1632 9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe 1632 9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe 1632 9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe 1632 9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe 1632 9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe 1632 9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe 1632 9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe 1632 9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe 1632 9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe 1632 9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe 1632 9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe 1632 9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe 452 ksycjo.exe 452 ksycjo.exe 1632 9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe 1632 9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe 1632 9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe 1632 9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe 1632 9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe 1632 9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe 1632 9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe 1632 9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe 1632 9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe 1632 9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe 1632 9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe 1632 9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe 1632 9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe 1632 9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe 1632 9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe 1632 9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe 1632 9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe 1632 9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe 1632 9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe 1632 9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe 1632 9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe 1632 9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe 1632 9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe 1632 9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe 1632 9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe 1632 9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe 1632 9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe 1632 9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe 1632 9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe 1632 9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe 1632 9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe 1632 9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe 452 ksycjo.exe 452 ksycjo.exe 1632 9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe 1632 9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe 1632 9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe 1632 9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 452 ksycjo.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1632 wrote to memory of 1256 1632 9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe 28 PID 1632 wrote to memory of 1256 1632 9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe 28 PID 1632 wrote to memory of 1256 1632 9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe 28 PID 1632 wrote to memory of 1256 1632 9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe 28 PID 1256 wrote to memory of 452 1256 iffdguquspp.exe 29 PID 1256 wrote to memory of 452 1256 iffdguquspp.exe 29 PID 1256 wrote to memory of 452 1256 iffdguquspp.exe 29 PID 1256 wrote to memory of 452 1256 iffdguquspp.exe 29 PID 1256 wrote to memory of 1168 1256 iffdguquspp.exe 30 PID 1256 wrote to memory of 1168 1256 iffdguquspp.exe 30 PID 1256 wrote to memory of 1168 1256 iffdguquspp.exe 30 PID 1256 wrote to memory of 1168 1256 iffdguquspp.exe 30 -
System policy modification 1 TTPs 31 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" ksycjo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" ksycjo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" ksycjo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" iffdguquspp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System ksycjo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" ksycjo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ksycjo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" ksycjo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" ksycjo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" ksycjo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" ksycjo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" ksycjo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" ksycjo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System iffdguquspp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" iffdguquspp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" ksycjo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System ksycjo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" iffdguquspp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer ksycjo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" iffdguquspp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ksycjo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" ksycjo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" ksycjo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" ksycjo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" ksycjo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" ksycjo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" ksycjo.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer ksycjo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" ksycjo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" ksycjo.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" ksycjo.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe"C:\Users\Admin\AppData\Local\Temp\9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\iffdguquspp.exe"C:\Users\Admin\AppData\Local\Temp\iffdguquspp.exe" "c:\users\admin\appdata\local\temp\9f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644.exe*"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\ksycjo.exe"C:\Users\Admin\AppData\Local\Temp\ksycjo.exe" "-C:\Users\Admin\AppData\Local\Temp\woesjytdwirtybjc.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:452
-
-
C:\Users\Admin\AppData\Local\Temp\ksycjo.exe"C:\Users\Admin\AppData\Local\Temp\ksycjo.exe" "-C:\Users\Admin\AppData\Local\Temp\woesjytdwirtybjc.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- System policy modification
PID:1168
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
508KB
MD542471a09ff6214244c8cdfcbadae2930
SHA13d9d229091565ae569051d49cfe9d41668d0f7bf
SHA2569f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644
SHA512b463afa0b0e9e74e32afd3f23df21ff34166da0d6d328d83e34774068b1b42dc62fde1ad8226fb515347a377a390c43160ee9c250628f0e545350e3e938be024
-
Filesize
320KB
MD58c12cbf7fb3f2689738ffcca259d485f
SHA164075a6b617f9e8e9711221ef38ade21de62c3f2
SHA256f99e6be28ff4bb77d6233f8d5269120dae9ce6ac84e8ca941b0153bac8754064
SHA512fd5295fbbfced3b688cac6c499fbb21e5e4ff682e5f45603b948964de7f33533c7cc36268ec8458003e2877d47413f8c06c2bfef197966adb3afebbe421544ec
-
Filesize
320KB
MD58c12cbf7fb3f2689738ffcca259d485f
SHA164075a6b617f9e8e9711221ef38ade21de62c3f2
SHA256f99e6be28ff4bb77d6233f8d5269120dae9ce6ac84e8ca941b0153bac8754064
SHA512fd5295fbbfced3b688cac6c499fbb21e5e4ff682e5f45603b948964de7f33533c7cc36268ec8458003e2877d47413f8c06c2bfef197966adb3afebbe421544ec
-
Filesize
508KB
MD542471a09ff6214244c8cdfcbadae2930
SHA13d9d229091565ae569051d49cfe9d41668d0f7bf
SHA2569f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644
SHA512b463afa0b0e9e74e32afd3f23df21ff34166da0d6d328d83e34774068b1b42dc62fde1ad8226fb515347a377a390c43160ee9c250628f0e545350e3e938be024
-
Filesize
692KB
MD5a1fc47dd507f86c54372b5f76bb58cb1
SHA1c431b2f24b98169b6b3ed5bfd2cd2f6f6de78c66
SHA256b9909809ed3ddd9f53ef519a599dc928a7a7fbf99412ffe67bd471abb704eade
SHA512d128386bc80388c74c85d1a1bea55ed639dd807eb1dbbedd46f264d80c8435d4b8e73afbef7d3974912e1011d144141db219c842dee025d13b88ea30e9b819c6
-
Filesize
692KB
MD5a1fc47dd507f86c54372b5f76bb58cb1
SHA1c431b2f24b98169b6b3ed5bfd2cd2f6f6de78c66
SHA256b9909809ed3ddd9f53ef519a599dc928a7a7fbf99412ffe67bd471abb704eade
SHA512d128386bc80388c74c85d1a1bea55ed639dd807eb1dbbedd46f264d80c8435d4b8e73afbef7d3974912e1011d144141db219c842dee025d13b88ea30e9b819c6
-
Filesize
508KB
MD542471a09ff6214244c8cdfcbadae2930
SHA13d9d229091565ae569051d49cfe9d41668d0f7bf
SHA2569f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644
SHA512b463afa0b0e9e74e32afd3f23df21ff34166da0d6d328d83e34774068b1b42dc62fde1ad8226fb515347a377a390c43160ee9c250628f0e545350e3e938be024
-
Filesize
508KB
MD542471a09ff6214244c8cdfcbadae2930
SHA13d9d229091565ae569051d49cfe9d41668d0f7bf
SHA2569f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644
SHA512b463afa0b0e9e74e32afd3f23df21ff34166da0d6d328d83e34774068b1b42dc62fde1ad8226fb515347a377a390c43160ee9c250628f0e545350e3e938be024
-
Filesize
508KB
MD542471a09ff6214244c8cdfcbadae2930
SHA13d9d229091565ae569051d49cfe9d41668d0f7bf
SHA2569f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644
SHA512b463afa0b0e9e74e32afd3f23df21ff34166da0d6d328d83e34774068b1b42dc62fde1ad8226fb515347a377a390c43160ee9c250628f0e545350e3e938be024
-
Filesize
508KB
MD542471a09ff6214244c8cdfcbadae2930
SHA13d9d229091565ae569051d49cfe9d41668d0f7bf
SHA2569f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644
SHA512b463afa0b0e9e74e32afd3f23df21ff34166da0d6d328d83e34774068b1b42dc62fde1ad8226fb515347a377a390c43160ee9c250628f0e545350e3e938be024
-
Filesize
508KB
MD542471a09ff6214244c8cdfcbadae2930
SHA13d9d229091565ae569051d49cfe9d41668d0f7bf
SHA2569f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644
SHA512b463afa0b0e9e74e32afd3f23df21ff34166da0d6d328d83e34774068b1b42dc62fde1ad8226fb515347a377a390c43160ee9c250628f0e545350e3e938be024
-
Filesize
508KB
MD542471a09ff6214244c8cdfcbadae2930
SHA13d9d229091565ae569051d49cfe9d41668d0f7bf
SHA2569f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644
SHA512b463afa0b0e9e74e32afd3f23df21ff34166da0d6d328d83e34774068b1b42dc62fde1ad8226fb515347a377a390c43160ee9c250628f0e545350e3e938be024
-
Filesize
508KB
MD542471a09ff6214244c8cdfcbadae2930
SHA13d9d229091565ae569051d49cfe9d41668d0f7bf
SHA2569f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644
SHA512b463afa0b0e9e74e32afd3f23df21ff34166da0d6d328d83e34774068b1b42dc62fde1ad8226fb515347a377a390c43160ee9c250628f0e545350e3e938be024
-
Filesize
508KB
MD542471a09ff6214244c8cdfcbadae2930
SHA13d9d229091565ae569051d49cfe9d41668d0f7bf
SHA2569f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644
SHA512b463afa0b0e9e74e32afd3f23df21ff34166da0d6d328d83e34774068b1b42dc62fde1ad8226fb515347a377a390c43160ee9c250628f0e545350e3e938be024
-
Filesize
508KB
MD542471a09ff6214244c8cdfcbadae2930
SHA13d9d229091565ae569051d49cfe9d41668d0f7bf
SHA2569f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644
SHA512b463afa0b0e9e74e32afd3f23df21ff34166da0d6d328d83e34774068b1b42dc62fde1ad8226fb515347a377a390c43160ee9c250628f0e545350e3e938be024
-
Filesize
508KB
MD542471a09ff6214244c8cdfcbadae2930
SHA13d9d229091565ae569051d49cfe9d41668d0f7bf
SHA2569f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644
SHA512b463afa0b0e9e74e32afd3f23df21ff34166da0d6d328d83e34774068b1b42dc62fde1ad8226fb515347a377a390c43160ee9c250628f0e545350e3e938be024
-
Filesize
508KB
MD542471a09ff6214244c8cdfcbadae2930
SHA13d9d229091565ae569051d49cfe9d41668d0f7bf
SHA2569f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644
SHA512b463afa0b0e9e74e32afd3f23df21ff34166da0d6d328d83e34774068b1b42dc62fde1ad8226fb515347a377a390c43160ee9c250628f0e545350e3e938be024
-
Filesize
508KB
MD542471a09ff6214244c8cdfcbadae2930
SHA13d9d229091565ae569051d49cfe9d41668d0f7bf
SHA2569f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644
SHA512b463afa0b0e9e74e32afd3f23df21ff34166da0d6d328d83e34774068b1b42dc62fde1ad8226fb515347a377a390c43160ee9c250628f0e545350e3e938be024
-
Filesize
508KB
MD542471a09ff6214244c8cdfcbadae2930
SHA13d9d229091565ae569051d49cfe9d41668d0f7bf
SHA2569f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644
SHA512b463afa0b0e9e74e32afd3f23df21ff34166da0d6d328d83e34774068b1b42dc62fde1ad8226fb515347a377a390c43160ee9c250628f0e545350e3e938be024
-
Filesize
508KB
MD542471a09ff6214244c8cdfcbadae2930
SHA13d9d229091565ae569051d49cfe9d41668d0f7bf
SHA2569f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644
SHA512b463afa0b0e9e74e32afd3f23df21ff34166da0d6d328d83e34774068b1b42dc62fde1ad8226fb515347a377a390c43160ee9c250628f0e545350e3e938be024
-
Filesize
508KB
MD542471a09ff6214244c8cdfcbadae2930
SHA13d9d229091565ae569051d49cfe9d41668d0f7bf
SHA2569f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644
SHA512b463afa0b0e9e74e32afd3f23df21ff34166da0d6d328d83e34774068b1b42dc62fde1ad8226fb515347a377a390c43160ee9c250628f0e545350e3e938be024
-
Filesize
508KB
MD542471a09ff6214244c8cdfcbadae2930
SHA13d9d229091565ae569051d49cfe9d41668d0f7bf
SHA2569f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644
SHA512b463afa0b0e9e74e32afd3f23df21ff34166da0d6d328d83e34774068b1b42dc62fde1ad8226fb515347a377a390c43160ee9c250628f0e545350e3e938be024
-
Filesize
508KB
MD542471a09ff6214244c8cdfcbadae2930
SHA13d9d229091565ae569051d49cfe9d41668d0f7bf
SHA2569f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644
SHA512b463afa0b0e9e74e32afd3f23df21ff34166da0d6d328d83e34774068b1b42dc62fde1ad8226fb515347a377a390c43160ee9c250628f0e545350e3e938be024
-
Filesize
508KB
MD542471a09ff6214244c8cdfcbadae2930
SHA13d9d229091565ae569051d49cfe9d41668d0f7bf
SHA2569f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644
SHA512b463afa0b0e9e74e32afd3f23df21ff34166da0d6d328d83e34774068b1b42dc62fde1ad8226fb515347a377a390c43160ee9c250628f0e545350e3e938be024
-
Filesize
508KB
MD542471a09ff6214244c8cdfcbadae2930
SHA13d9d229091565ae569051d49cfe9d41668d0f7bf
SHA2569f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644
SHA512b463afa0b0e9e74e32afd3f23df21ff34166da0d6d328d83e34774068b1b42dc62fde1ad8226fb515347a377a390c43160ee9c250628f0e545350e3e938be024
-
Filesize
508KB
MD542471a09ff6214244c8cdfcbadae2930
SHA13d9d229091565ae569051d49cfe9d41668d0f7bf
SHA2569f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644
SHA512b463afa0b0e9e74e32afd3f23df21ff34166da0d6d328d83e34774068b1b42dc62fde1ad8226fb515347a377a390c43160ee9c250628f0e545350e3e938be024
-
Filesize
508KB
MD542471a09ff6214244c8cdfcbadae2930
SHA13d9d229091565ae569051d49cfe9d41668d0f7bf
SHA2569f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644
SHA512b463afa0b0e9e74e32afd3f23df21ff34166da0d6d328d83e34774068b1b42dc62fde1ad8226fb515347a377a390c43160ee9c250628f0e545350e3e938be024
-
Filesize
508KB
MD542471a09ff6214244c8cdfcbadae2930
SHA13d9d229091565ae569051d49cfe9d41668d0f7bf
SHA2569f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644
SHA512b463afa0b0e9e74e32afd3f23df21ff34166da0d6d328d83e34774068b1b42dc62fde1ad8226fb515347a377a390c43160ee9c250628f0e545350e3e938be024
-
Filesize
508KB
MD542471a09ff6214244c8cdfcbadae2930
SHA13d9d229091565ae569051d49cfe9d41668d0f7bf
SHA2569f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644
SHA512b463afa0b0e9e74e32afd3f23df21ff34166da0d6d328d83e34774068b1b42dc62fde1ad8226fb515347a377a390c43160ee9c250628f0e545350e3e938be024
-
Filesize
508KB
MD542471a09ff6214244c8cdfcbadae2930
SHA13d9d229091565ae569051d49cfe9d41668d0f7bf
SHA2569f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644
SHA512b463afa0b0e9e74e32afd3f23df21ff34166da0d6d328d83e34774068b1b42dc62fde1ad8226fb515347a377a390c43160ee9c250628f0e545350e3e938be024
-
Filesize
508KB
MD542471a09ff6214244c8cdfcbadae2930
SHA13d9d229091565ae569051d49cfe9d41668d0f7bf
SHA2569f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644
SHA512b463afa0b0e9e74e32afd3f23df21ff34166da0d6d328d83e34774068b1b42dc62fde1ad8226fb515347a377a390c43160ee9c250628f0e545350e3e938be024
-
Filesize
508KB
MD542471a09ff6214244c8cdfcbadae2930
SHA13d9d229091565ae569051d49cfe9d41668d0f7bf
SHA2569f07451c3210594924df6133a9c6ae6d887cbbc60c1fcb7151504cb167cea644
SHA512b463afa0b0e9e74e32afd3f23df21ff34166da0d6d328d83e34774068b1b42dc62fde1ad8226fb515347a377a390c43160ee9c250628f0e545350e3e938be024
-
Filesize
320KB
MD58c12cbf7fb3f2689738ffcca259d485f
SHA164075a6b617f9e8e9711221ef38ade21de62c3f2
SHA256f99e6be28ff4bb77d6233f8d5269120dae9ce6ac84e8ca941b0153bac8754064
SHA512fd5295fbbfced3b688cac6c499fbb21e5e4ff682e5f45603b948964de7f33533c7cc36268ec8458003e2877d47413f8c06c2bfef197966adb3afebbe421544ec
-
Filesize
320KB
MD58c12cbf7fb3f2689738ffcca259d485f
SHA164075a6b617f9e8e9711221ef38ade21de62c3f2
SHA256f99e6be28ff4bb77d6233f8d5269120dae9ce6ac84e8ca941b0153bac8754064
SHA512fd5295fbbfced3b688cac6c499fbb21e5e4ff682e5f45603b948964de7f33533c7cc36268ec8458003e2877d47413f8c06c2bfef197966adb3afebbe421544ec
-
Filesize
692KB
MD5a1fc47dd507f86c54372b5f76bb58cb1
SHA1c431b2f24b98169b6b3ed5bfd2cd2f6f6de78c66
SHA256b9909809ed3ddd9f53ef519a599dc928a7a7fbf99412ffe67bd471abb704eade
SHA512d128386bc80388c74c85d1a1bea55ed639dd807eb1dbbedd46f264d80c8435d4b8e73afbef7d3974912e1011d144141db219c842dee025d13b88ea30e9b819c6
-
Filesize
692KB
MD5a1fc47dd507f86c54372b5f76bb58cb1
SHA1c431b2f24b98169b6b3ed5bfd2cd2f6f6de78c66
SHA256b9909809ed3ddd9f53ef519a599dc928a7a7fbf99412ffe67bd471abb704eade
SHA512d128386bc80388c74c85d1a1bea55ed639dd807eb1dbbedd46f264d80c8435d4b8e73afbef7d3974912e1011d144141db219c842dee025d13b88ea30e9b819c6
-
Filesize
692KB
MD5a1fc47dd507f86c54372b5f76bb58cb1
SHA1c431b2f24b98169b6b3ed5bfd2cd2f6f6de78c66
SHA256b9909809ed3ddd9f53ef519a599dc928a7a7fbf99412ffe67bd471abb704eade
SHA512d128386bc80388c74c85d1a1bea55ed639dd807eb1dbbedd46f264d80c8435d4b8e73afbef7d3974912e1011d144141db219c842dee025d13b88ea30e9b819c6
-
Filesize
692KB
MD5a1fc47dd507f86c54372b5f76bb58cb1
SHA1c431b2f24b98169b6b3ed5bfd2cd2f6f6de78c66
SHA256b9909809ed3ddd9f53ef519a599dc928a7a7fbf99412ffe67bd471abb704eade
SHA512d128386bc80388c74c85d1a1bea55ed639dd807eb1dbbedd46f264d80c8435d4b8e73afbef7d3974912e1011d144141db219c842dee025d13b88ea30e9b819c6