Analysis
-
max time kernel
158s -
max time network
206s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
20/10/2022, 18:53
Static task
static1
Behavioral task
behavioral1
Sample
d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
General
-
Target
d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe
-
Size
540KB
-
MD5
9628af18d03c96e47efb01afcb84a3a0
-
SHA1
28757a74f60e4ae9977ac7688355c8bcd2eb1cb8
-
SHA256
d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5
-
SHA512
0edcc22f4d826e4d981b77587ac91996af70d013634d5903d620f089e420302eef73a3d9f8499414b7de6853988bc287fbf5713f172829fd3241af531012ad5f
-
SSDEEP
12288:2gkDxdkL+6JNgKVcRa+fpHyWs3OBH4pU5:gxsKXa+hHyWseBgE
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" yborjrewily.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" bfhlq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" bfhlq.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" yborjrewily.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" yborjrewily.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" yborjrewily.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" bfhlq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" bfhlq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" bfhlq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" bfhlq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" bfhlq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" bfhlq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" bfhlq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" bfhlq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" yborjrewily.exe -
Adds policy Run key to start application 2 TTPs 28 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qdobpexnviflbh = "ofuldwtnzqrbvfetnm.exe" bfhlq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qdobpexnviflbh = "bvnhcyyvkeivsfhzwypjb.exe" bfhlq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\tdlvgsivake = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zrhzsmkfskmxsddtood.exe" yborjrewily.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\tdlvgsivake = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bvnhcyyvkeivsfhzwypjb.exe" bfhlq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qdobpexnviflbh = "ynapfwrjtihphpmz.exe" bfhlq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qdobpexnviflbh = "zrhzsmkfskmxsddtood.exe" bfhlq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\tdlvgsivake = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ofuldwtnzqrbvfetnm.exe" bfhlq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\tdlvgsivake = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ynapfwrjtihphpmz.exe" bfhlq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\tdlvgsivake = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mfwpjedzngjvrdevrsib.exe" bfhlq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run yborjrewily.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qdobpexnviflbh = "ynapfwrjtihphpmz.exe" yborjrewily.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qdobpexnviflbh = "fvjzqiexiyyhajhvo.exe" bfhlq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qdobpexnviflbh = "fvjzqiexiyyhajhvo.exe" yborjrewily.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qdobpexnviflbh = "zrhzsmkfskmxsddtood.exe" yborjrewily.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run bfhlq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qdobpexnviflbh = "zrhzsmkfskmxsddtood.exe" bfhlq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qdobpexnviflbh = "fvjzqiexiyyhajhvo.exe" bfhlq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qdobpexnviflbh = "mfwpjedzngjvrdevrsib.exe" bfhlq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\tdlvgsivake = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fvjzqiexiyyhajhvo.exe" bfhlq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qdobpexnviflbh = "bvnhcyyvkeivsfhzwypjb.exe" bfhlq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qdobpexnviflbh = "ynapfwrjtihphpmz.exe" bfhlq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\tdlvgsivake = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ofuldwtnzqrbvfetnm.exe" bfhlq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\tdlvgsivake = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fvjzqiexiyyhajhvo.exe" yborjrewily.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\tdlvgsivake = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fvjzqiexiyyhajhvo.exe" bfhlq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run bfhlq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\tdlvgsivake = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bvnhcyyvkeivsfhzwypjb.exe" bfhlq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qdobpexnviflbh = "mfwpjedzngjvrdevrsib.exe" bfhlq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\tdlvgsivake = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zrhzsmkfskmxsddtood.exe" bfhlq.exe -
Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" bfhlq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" bfhlq.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" yborjrewily.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" yborjrewily.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" bfhlq.exe Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" bfhlq.exe -
Executes dropped EXE 3 IoCs
pid Process 4768 yborjrewily.exe 1700 bfhlq.exe 4388 bfhlq.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation yborjrewily.exe -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ynapfwrjtihphpmz = "fvjzqiexiyyhajhvo.exe ." yborjrewily.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qbkvhulzfqlp = "mfwpjedzngjvrdevrsib.exe" bfhlq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ofuldwtnzqrbvfetnm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zrhzsmkfskmxsddtood.exe" bfhlq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\pblxkyqfmyuzo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bvnhcyyvkeivsfhzwypjb.exe ." bfhlq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qbkvhulzfqlp = "ofuldwtnzqrbvfetnm.exe" bfhlq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pblxkyqfmyuzo = "ofuldwtnzqrbvfetnm.exe ." yborjrewily.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ofuldwtnzqrbvfetnm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fvjzqiexiyyhajhvo.exe" bfhlq.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce bfhlq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\pblxkyqfmyuzo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fvjzqiexiyyhajhvo.exe ." bfhlq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ynapfwrjtihphpmz = "mfwpjedzngjvrdevrsib.exe ." bfhlq.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce yborjrewily.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qbkvhulzfqlp = "mfwpjedzngjvrdevrsib.exe" yborjrewily.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce bfhlq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ynapfwrjtihphpmz = "bvnhcyyvkeivsfhzwypjb.exe ." bfhlq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qbkvhulzfqlp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zrhzsmkfskmxsddtood.exe" bfhlq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ofuldwtnzqrbvfetnm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bvnhcyyvkeivsfhzwypjb.exe" bfhlq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ofuldwtnzqrbvfetnm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fvjzqiexiyyhajhvo.exe" bfhlq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fvjzqiexiyyhajhvo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ofuldwtnzqrbvfetnm.exe ." bfhlq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\pblxkyqfmyuzo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zrhzsmkfskmxsddtood.exe ." bfhlq.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run bfhlq.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce bfhlq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\pblxkyqfmyuzo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ynapfwrjtihphpmz.exe ." bfhlq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ththwmgxguszqxt = "fvjzqiexiyyhajhvo.exe" bfhlq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ththwmgxguszqxt = "mfwpjedzngjvrdevrsib.exe" yborjrewily.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fvjzqiexiyyhajhvo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mfwpjedzngjvrdevrsib.exe ." bfhlq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qbkvhulzfqlp = "fvjzqiexiyyhajhvo.exe" bfhlq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qbkvhulzfqlp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zrhzsmkfskmxsddtood.exe" bfhlq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qbkvhulzfqlp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fvjzqiexiyyhajhvo.exe" yborjrewily.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run bfhlq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qbkvhulzfqlp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fvjzqiexiyyhajhvo.exe" bfhlq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fvjzqiexiyyhajhvo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ofuldwtnzqrbvfetnm.exe ." bfhlq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ofuldwtnzqrbvfetnm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ofuldwtnzqrbvfetnm.exe" bfhlq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ofuldwtnzqrbvfetnm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bvnhcyyvkeivsfhzwypjb.exe" yborjrewily.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\pblxkyqfmyuzo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fvjzqiexiyyhajhvo.exe ." yborjrewily.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ofuldwtnzqrbvfetnm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mfwpjedzngjvrdevrsib.exe" bfhlq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pblxkyqfmyuzo = "ofuldwtnzqrbvfetnm.exe ." bfhlq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pblxkyqfmyuzo = "mfwpjedzngjvrdevrsib.exe ." bfhlq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qbkvhulzfqlp = "mfwpjedzngjvrdevrsib.exe" bfhlq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ththwmgxguszqxt = "mfwpjedzngjvrdevrsib.exe" bfhlq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qbkvhulzfqlp = "bvnhcyyvkeivsfhzwypjb.exe" bfhlq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ofuldwtnzqrbvfetnm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mfwpjedzngjvrdevrsib.exe" bfhlq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pblxkyqfmyuzo = "bvnhcyyvkeivsfhzwypjb.exe ." bfhlq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qbkvhulzfqlp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fvjzqiexiyyhajhvo.exe" bfhlq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fvjzqiexiyyhajhvo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bvnhcyyvkeivsfhzwypjb.exe ." bfhlq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ynapfwrjtihphpmz = "fvjzqiexiyyhajhvo.exe ." bfhlq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fvjzqiexiyyhajhvo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fvjzqiexiyyhajhvo.exe ." bfhlq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pblxkyqfmyuzo = "fvjzqiexiyyhajhvo.exe ." bfhlq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ofuldwtnzqrbvfetnm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zrhzsmkfskmxsddtood.exe" bfhlq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ththwmgxguszqxt = "zrhzsmkfskmxsddtood.exe" bfhlq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ynapfwrjtihphpmz = "zrhzsmkfskmxsddtood.exe ." bfhlq.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce yborjrewily.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ththwmgxguszqxt = "ynapfwrjtihphpmz.exe" yborjrewily.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ynapfwrjtihphpmz = "fvjzqiexiyyhajhvo.exe ." bfhlq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ofuldwtnzqrbvfetnm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ofuldwtnzqrbvfetnm.exe" bfhlq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ththwmgxguszqxt = "mfwpjedzngjvrdevrsib.exe" bfhlq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ththwmgxguszqxt = "ofuldwtnzqrbvfetnm.exe" bfhlq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pblxkyqfmyuzo = "zrhzsmkfskmxsddtood.exe ." bfhlq.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run yborjrewily.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qbkvhulzfqlp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ofuldwtnzqrbvfetnm.exe" yborjrewily.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qbkvhulzfqlp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bvnhcyyvkeivsfhzwypjb.exe" bfhlq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ynapfwrjtihphpmz = "mfwpjedzngjvrdevrsib.exe ." yborjrewily.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ththwmgxguszqxt = "bvnhcyyvkeivsfhzwypjb.exe" bfhlq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qbkvhulzfqlp = "ynapfwrjtihphpmz.exe" bfhlq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ththwmgxguszqxt = "bvnhcyyvkeivsfhzwypjb.exe" bfhlq.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" yborjrewily.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA yborjrewily.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" bfhlq.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA bfhlq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" bfhlq.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA bfhlq.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 23 www.showmyipaddress.com 26 whatismyip.everdot.org 28 whatismyipaddress.com -
Drops file in System32 directory 25 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ynapfwrjtihphpmz.exe bfhlq.exe File opened for modification C:\Windows\SysWOW64\fvjzqiexiyyhajhvo.exe bfhlq.exe File opened for modification C:\Windows\SysWOW64\ofuldwtnzqrbvfetnm.exe bfhlq.exe File opened for modification C:\Windows\SysWOW64\mfwpjedzngjvrdevrsib.exe bfhlq.exe File opened for modification C:\Windows\SysWOW64\ynapfwrjtihphpmz.exe yborjrewily.exe File opened for modification C:\Windows\SysWOW64\zrhzsmkfskmxsddtood.exe yborjrewily.exe File opened for modification C:\Windows\SysWOW64\ofuldwtnzqrbvfetnm.exe bfhlq.exe File opened for modification C:\Windows\SysWOW64\zrhzsmkfskmxsddtood.exe bfhlq.exe File opened for modification C:\Windows\SysWOW64\bvnhcyyvkeivsfhzwypjb.exe bfhlq.exe File created C:\Windows\SysWOW64\ghghjmtxtufzdxgfjsqrqrtw.hde bfhlq.exe File opened for modification C:\Windows\SysWOW64\pblxkyqfmyuzotnxmgpblxkyqfmyuzotnxm.pbl bfhlq.exe File created C:\Windows\SysWOW64\pblxkyqfmyuzotnxmgpblxkyqfmyuzotnxm.pbl bfhlq.exe File opened for modification C:\Windows\SysWOW64\fvjzqiexiyyhajhvo.exe yborjrewily.exe File opened for modification C:\Windows\SysWOW64\ofuldwtnzqrbvfetnm.exe yborjrewily.exe File opened for modification C:\Windows\SysWOW64\bvnhcyyvkeivsfhzwypjb.exe yborjrewily.exe File opened for modification C:\Windows\SysWOW64\mfwpjedzngjvrdevrsib.exe bfhlq.exe File opened for modification C:\Windows\SysWOW64\sngbxuvtjejxvjmfdgytmh.exe yborjrewily.exe File opened for modification C:\Windows\SysWOW64\fvjzqiexiyyhajhvo.exe bfhlq.exe File opened for modification C:\Windows\SysWOW64\sngbxuvtjejxvjmfdgytmh.exe bfhlq.exe File opened for modification C:\Windows\SysWOW64\ghghjmtxtufzdxgfjsqrqrtw.hde bfhlq.exe File opened for modification C:\Windows\SysWOW64\zrhzsmkfskmxsddtood.exe bfhlq.exe File opened for modification C:\Windows\SysWOW64\mfwpjedzngjvrdevrsib.exe yborjrewily.exe File opened for modification C:\Windows\SysWOW64\ynapfwrjtihphpmz.exe bfhlq.exe File opened for modification C:\Windows\SysWOW64\bvnhcyyvkeivsfhzwypjb.exe bfhlq.exe File opened for modification C:\Windows\SysWOW64\sngbxuvtjejxvjmfdgytmh.exe bfhlq.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\ghghjmtxtufzdxgfjsqrqrtw.hde bfhlq.exe File created C:\Program Files (x86)\ghghjmtxtufzdxgfjsqrqrtw.hde bfhlq.exe File opened for modification C:\Program Files (x86)\pblxkyqfmyuzotnxmgpblxkyqfmyuzotnxm.pbl bfhlq.exe File created C:\Program Files (x86)\pblxkyqfmyuzotnxmgpblxkyqfmyuzotnxm.pbl bfhlq.exe -
Drops file in Windows directory 25 IoCs
description ioc Process File opened for modification C:\Windows\ofuldwtnzqrbvfetnm.exe bfhlq.exe File opened for modification C:\Windows\ghghjmtxtufzdxgfjsqrqrtw.hde bfhlq.exe File opened for modification C:\Windows\fvjzqiexiyyhajhvo.exe bfhlq.exe File opened for modification C:\Windows\fvjzqiexiyyhajhvo.exe yborjrewily.exe File opened for modification C:\Windows\mfwpjedzngjvrdevrsib.exe yborjrewily.exe File opened for modification C:\Windows\bvnhcyyvkeivsfhzwypjb.exe yborjrewily.exe File opened for modification C:\Windows\sngbxuvtjejxvjmfdgytmh.exe yborjrewily.exe File opened for modification C:\Windows\fvjzqiexiyyhajhvo.exe bfhlq.exe File opened for modification C:\Windows\zrhzsmkfskmxsddtood.exe bfhlq.exe File opened for modification C:\Windows\sngbxuvtjejxvjmfdgytmh.exe bfhlq.exe File created C:\Windows\ghghjmtxtufzdxgfjsqrqrtw.hde bfhlq.exe File opened for modification C:\Windows\pblxkyqfmyuzotnxmgpblxkyqfmyuzotnxm.pbl bfhlq.exe File opened for modification C:\Windows\zrhzsmkfskmxsddtood.exe yborjrewily.exe File opened for modification C:\Windows\mfwpjedzngjvrdevrsib.exe bfhlq.exe File opened for modification C:\Windows\bvnhcyyvkeivsfhzwypjb.exe bfhlq.exe File opened for modification C:\Windows\ofuldwtnzqrbvfetnm.exe bfhlq.exe File opened for modification C:\Windows\bvnhcyyvkeivsfhzwypjb.exe bfhlq.exe File opened for modification C:\Windows\sngbxuvtjejxvjmfdgytmh.exe bfhlq.exe File opened for modification C:\Windows\ynapfwrjtihphpmz.exe yborjrewily.exe File opened for modification C:\Windows\ofuldwtnzqrbvfetnm.exe yborjrewily.exe File opened for modification C:\Windows\ynapfwrjtihphpmz.exe bfhlq.exe File opened for modification C:\Windows\ynapfwrjtihphpmz.exe bfhlq.exe File opened for modification C:\Windows\zrhzsmkfskmxsddtood.exe bfhlq.exe File opened for modification C:\Windows\mfwpjedzngjvrdevrsib.exe bfhlq.exe File created C:\Windows\pblxkyqfmyuzotnxmgpblxkyqfmyuzotnxm.pbl bfhlq.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4412 d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe 4412 d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe 4412 d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe 4412 d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe 4412 d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe 4412 d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe 4412 d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe 4412 d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe 4412 d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe 4412 d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe 4412 d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe 4412 d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe 4412 d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe 4412 d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe 4412 d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe 4412 d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe 4412 d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe 4412 d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe 4412 d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe 4412 d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe 4412 d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe 4412 d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe 4412 d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe 4412 d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe 4412 d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe 4412 d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe 4412 d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe 4412 d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe 4412 d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe 4412 d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe 4412 d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe 4412 d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe 4412 d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe 4412 d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe 4412 d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe 4412 d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe 4412 d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe 4412 d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe 4412 d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe 4412 d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe 4412 d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe 4412 d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe 4412 d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe 4412 d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe 4412 d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe 4412 d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe 4412 d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe 4412 d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe 4412 d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe 4412 d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe 1700 bfhlq.exe 1700 bfhlq.exe 4412 d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe 4412 d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe 4412 d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe 4412 d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe 4412 d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe 4412 d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe 4412 d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe 4412 d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe 4412 d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe 4412 d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe 4412 d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe 4412 d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1700 bfhlq.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4412 wrote to memory of 4768 4412 d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe 80 PID 4412 wrote to memory of 4768 4412 d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe 80 PID 4412 wrote to memory of 4768 4412 d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe 80 PID 4768 wrote to memory of 1700 4768 yborjrewily.exe 83 PID 4768 wrote to memory of 1700 4768 yborjrewily.exe 83 PID 4768 wrote to memory of 1700 4768 yborjrewily.exe 83 PID 4768 wrote to memory of 4388 4768 yborjrewily.exe 84 PID 4768 wrote to memory of 4388 4768 yborjrewily.exe 84 PID 4768 wrote to memory of 4388 4768 yborjrewily.exe 84 -
System policy modification 1 TTPs 39 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" yborjrewily.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" yborjrewily.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" bfhlq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" bfhlq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" bfhlq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" bfhlq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" bfhlq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" yborjrewily.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" yborjrewily.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" bfhlq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" bfhlq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer bfhlq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" yborjrewily.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" yborjrewily.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" yborjrewily.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" yborjrewily.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" bfhlq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" bfhlq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" bfhlq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" yborjrewily.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" bfhlq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" bfhlq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" bfhlq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" bfhlq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" yborjrewily.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" bfhlq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" bfhlq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" bfhlq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" yborjrewily.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System bfhlq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" bfhlq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" bfhlq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System bfhlq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer bfhlq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System yborjrewily.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer yborjrewily.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" bfhlq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" bfhlq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" bfhlq.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe"C:\Users\Admin\AppData\Local\Temp\d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\yborjrewily.exe"C:\Users\Admin\AppData\Local\Temp\yborjrewily.exe" "c:\users\admin\appdata\local\temp\d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5.exe*"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\bfhlq.exe"C:\Users\Admin\AppData\Local\Temp\bfhlq.exe" "-C:\Users\Admin\AppData\Local\Temp\ynapfwrjtihphpmz.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:1700
-
-
C:\Users\Admin\AppData\Local\Temp\bfhlq.exe"C:\Users\Admin\AppData\Local\Temp\bfhlq.exe" "-C:\Users\Admin\AppData\Local\Temp\ynapfwrjtihphpmz.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- System policy modification
PID:4388
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
696KB
MD5be58c1a792dfedca8b96619742d5be2d
SHA1637341ec8f8d0ddf8783adf80e2b2c9951449774
SHA25626c4113737665fe68647797eb8f938e0e668275adb5487117d52554278105cd6
SHA512cc2ba636949ed8fdd3ce0db489a10a1af57bbe1d581e80e6e6c3fffa9514c78fdd475119500b0601615e6e9ccbab75e6d9376fdb62df901812e8db4a9a3fd257
-
Filesize
696KB
MD5be58c1a792dfedca8b96619742d5be2d
SHA1637341ec8f8d0ddf8783adf80e2b2c9951449774
SHA25626c4113737665fe68647797eb8f938e0e668275adb5487117d52554278105cd6
SHA512cc2ba636949ed8fdd3ce0db489a10a1af57bbe1d581e80e6e6c3fffa9514c78fdd475119500b0601615e6e9ccbab75e6d9376fdb62df901812e8db4a9a3fd257
-
Filesize
696KB
MD5be58c1a792dfedca8b96619742d5be2d
SHA1637341ec8f8d0ddf8783adf80e2b2c9951449774
SHA25626c4113737665fe68647797eb8f938e0e668275adb5487117d52554278105cd6
SHA512cc2ba636949ed8fdd3ce0db489a10a1af57bbe1d581e80e6e6c3fffa9514c78fdd475119500b0601615e6e9ccbab75e6d9376fdb62df901812e8db4a9a3fd257
-
Filesize
540KB
MD59628af18d03c96e47efb01afcb84a3a0
SHA128757a74f60e4ae9977ac7688355c8bcd2eb1cb8
SHA256d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5
SHA5120edcc22f4d826e4d981b77587ac91996af70d013634d5903d620f089e420302eef73a3d9f8499414b7de6853988bc287fbf5713f172829fd3241af531012ad5f
-
Filesize
540KB
MD59628af18d03c96e47efb01afcb84a3a0
SHA128757a74f60e4ae9977ac7688355c8bcd2eb1cb8
SHA256d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5
SHA5120edcc22f4d826e4d981b77587ac91996af70d013634d5903d620f089e420302eef73a3d9f8499414b7de6853988bc287fbf5713f172829fd3241af531012ad5f
-
Filesize
540KB
MD59628af18d03c96e47efb01afcb84a3a0
SHA128757a74f60e4ae9977ac7688355c8bcd2eb1cb8
SHA256d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5
SHA5120edcc22f4d826e4d981b77587ac91996af70d013634d5903d620f089e420302eef73a3d9f8499414b7de6853988bc287fbf5713f172829fd3241af531012ad5f
-
Filesize
540KB
MD59628af18d03c96e47efb01afcb84a3a0
SHA128757a74f60e4ae9977ac7688355c8bcd2eb1cb8
SHA256d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5
SHA5120edcc22f4d826e4d981b77587ac91996af70d013634d5903d620f089e420302eef73a3d9f8499414b7de6853988bc287fbf5713f172829fd3241af531012ad5f
-
Filesize
540KB
MD59628af18d03c96e47efb01afcb84a3a0
SHA128757a74f60e4ae9977ac7688355c8bcd2eb1cb8
SHA256d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5
SHA5120edcc22f4d826e4d981b77587ac91996af70d013634d5903d620f089e420302eef73a3d9f8499414b7de6853988bc287fbf5713f172829fd3241af531012ad5f
-
Filesize
320KB
MD51dd5dd5561723f37ccc81e15ecdbf830
SHA1eeb9131c8d276ceb710d163e89fdc62b3e111971
SHA256c8c542ac3f6526d1501c2b9d6262bfa029a1ac0d9dd6b3c1965977abdd8bd126
SHA512b4881d7cd0c2ceeba067e13d23763e739389108d1269acd6c343dd308aa1fedde89da696a8482944342f44ea1094ea6b50021a15d4c6d03762ba032a9598bba5
-
Filesize
320KB
MD51dd5dd5561723f37ccc81e15ecdbf830
SHA1eeb9131c8d276ceb710d163e89fdc62b3e111971
SHA256c8c542ac3f6526d1501c2b9d6262bfa029a1ac0d9dd6b3c1965977abdd8bd126
SHA512b4881d7cd0c2ceeba067e13d23763e739389108d1269acd6c343dd308aa1fedde89da696a8482944342f44ea1094ea6b50021a15d4c6d03762ba032a9598bba5
-
Filesize
540KB
MD59628af18d03c96e47efb01afcb84a3a0
SHA128757a74f60e4ae9977ac7688355c8bcd2eb1cb8
SHA256d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5
SHA5120edcc22f4d826e4d981b77587ac91996af70d013634d5903d620f089e420302eef73a3d9f8499414b7de6853988bc287fbf5713f172829fd3241af531012ad5f
-
Filesize
540KB
MD59628af18d03c96e47efb01afcb84a3a0
SHA128757a74f60e4ae9977ac7688355c8bcd2eb1cb8
SHA256d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5
SHA5120edcc22f4d826e4d981b77587ac91996af70d013634d5903d620f089e420302eef73a3d9f8499414b7de6853988bc287fbf5713f172829fd3241af531012ad5f
-
Filesize
540KB
MD59628af18d03c96e47efb01afcb84a3a0
SHA128757a74f60e4ae9977ac7688355c8bcd2eb1cb8
SHA256d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5
SHA5120edcc22f4d826e4d981b77587ac91996af70d013634d5903d620f089e420302eef73a3d9f8499414b7de6853988bc287fbf5713f172829fd3241af531012ad5f
-
Filesize
540KB
MD59628af18d03c96e47efb01afcb84a3a0
SHA128757a74f60e4ae9977ac7688355c8bcd2eb1cb8
SHA256d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5
SHA5120edcc22f4d826e4d981b77587ac91996af70d013634d5903d620f089e420302eef73a3d9f8499414b7de6853988bc287fbf5713f172829fd3241af531012ad5f
-
Filesize
540KB
MD59628af18d03c96e47efb01afcb84a3a0
SHA128757a74f60e4ae9977ac7688355c8bcd2eb1cb8
SHA256d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5
SHA5120edcc22f4d826e4d981b77587ac91996af70d013634d5903d620f089e420302eef73a3d9f8499414b7de6853988bc287fbf5713f172829fd3241af531012ad5f
-
Filesize
540KB
MD59628af18d03c96e47efb01afcb84a3a0
SHA128757a74f60e4ae9977ac7688355c8bcd2eb1cb8
SHA256d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5
SHA5120edcc22f4d826e4d981b77587ac91996af70d013634d5903d620f089e420302eef73a3d9f8499414b7de6853988bc287fbf5713f172829fd3241af531012ad5f
-
Filesize
540KB
MD59628af18d03c96e47efb01afcb84a3a0
SHA128757a74f60e4ae9977ac7688355c8bcd2eb1cb8
SHA256d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5
SHA5120edcc22f4d826e4d981b77587ac91996af70d013634d5903d620f089e420302eef73a3d9f8499414b7de6853988bc287fbf5713f172829fd3241af531012ad5f
-
Filesize
540KB
MD59628af18d03c96e47efb01afcb84a3a0
SHA128757a74f60e4ae9977ac7688355c8bcd2eb1cb8
SHA256d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5
SHA5120edcc22f4d826e4d981b77587ac91996af70d013634d5903d620f089e420302eef73a3d9f8499414b7de6853988bc287fbf5713f172829fd3241af531012ad5f
-
Filesize
540KB
MD59628af18d03c96e47efb01afcb84a3a0
SHA128757a74f60e4ae9977ac7688355c8bcd2eb1cb8
SHA256d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5
SHA5120edcc22f4d826e4d981b77587ac91996af70d013634d5903d620f089e420302eef73a3d9f8499414b7de6853988bc287fbf5713f172829fd3241af531012ad5f
-
Filesize
540KB
MD59628af18d03c96e47efb01afcb84a3a0
SHA128757a74f60e4ae9977ac7688355c8bcd2eb1cb8
SHA256d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5
SHA5120edcc22f4d826e4d981b77587ac91996af70d013634d5903d620f089e420302eef73a3d9f8499414b7de6853988bc287fbf5713f172829fd3241af531012ad5f
-
Filesize
540KB
MD59628af18d03c96e47efb01afcb84a3a0
SHA128757a74f60e4ae9977ac7688355c8bcd2eb1cb8
SHA256d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5
SHA5120edcc22f4d826e4d981b77587ac91996af70d013634d5903d620f089e420302eef73a3d9f8499414b7de6853988bc287fbf5713f172829fd3241af531012ad5f
-
Filesize
540KB
MD59628af18d03c96e47efb01afcb84a3a0
SHA128757a74f60e4ae9977ac7688355c8bcd2eb1cb8
SHA256d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5
SHA5120edcc22f4d826e4d981b77587ac91996af70d013634d5903d620f089e420302eef73a3d9f8499414b7de6853988bc287fbf5713f172829fd3241af531012ad5f
-
Filesize
540KB
MD59628af18d03c96e47efb01afcb84a3a0
SHA128757a74f60e4ae9977ac7688355c8bcd2eb1cb8
SHA256d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5
SHA5120edcc22f4d826e4d981b77587ac91996af70d013634d5903d620f089e420302eef73a3d9f8499414b7de6853988bc287fbf5713f172829fd3241af531012ad5f
-
Filesize
540KB
MD59628af18d03c96e47efb01afcb84a3a0
SHA128757a74f60e4ae9977ac7688355c8bcd2eb1cb8
SHA256d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5
SHA5120edcc22f4d826e4d981b77587ac91996af70d013634d5903d620f089e420302eef73a3d9f8499414b7de6853988bc287fbf5713f172829fd3241af531012ad5f
-
Filesize
540KB
MD59628af18d03c96e47efb01afcb84a3a0
SHA128757a74f60e4ae9977ac7688355c8bcd2eb1cb8
SHA256d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5
SHA5120edcc22f4d826e4d981b77587ac91996af70d013634d5903d620f089e420302eef73a3d9f8499414b7de6853988bc287fbf5713f172829fd3241af531012ad5f
-
Filesize
540KB
MD59628af18d03c96e47efb01afcb84a3a0
SHA128757a74f60e4ae9977ac7688355c8bcd2eb1cb8
SHA256d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5
SHA5120edcc22f4d826e4d981b77587ac91996af70d013634d5903d620f089e420302eef73a3d9f8499414b7de6853988bc287fbf5713f172829fd3241af531012ad5f
-
Filesize
540KB
MD59628af18d03c96e47efb01afcb84a3a0
SHA128757a74f60e4ae9977ac7688355c8bcd2eb1cb8
SHA256d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5
SHA5120edcc22f4d826e4d981b77587ac91996af70d013634d5903d620f089e420302eef73a3d9f8499414b7de6853988bc287fbf5713f172829fd3241af531012ad5f
-
Filesize
540KB
MD59628af18d03c96e47efb01afcb84a3a0
SHA128757a74f60e4ae9977ac7688355c8bcd2eb1cb8
SHA256d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5
SHA5120edcc22f4d826e4d981b77587ac91996af70d013634d5903d620f089e420302eef73a3d9f8499414b7de6853988bc287fbf5713f172829fd3241af531012ad5f
-
Filesize
540KB
MD59628af18d03c96e47efb01afcb84a3a0
SHA128757a74f60e4ae9977ac7688355c8bcd2eb1cb8
SHA256d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5
SHA5120edcc22f4d826e4d981b77587ac91996af70d013634d5903d620f089e420302eef73a3d9f8499414b7de6853988bc287fbf5713f172829fd3241af531012ad5f
-
Filesize
540KB
MD59628af18d03c96e47efb01afcb84a3a0
SHA128757a74f60e4ae9977ac7688355c8bcd2eb1cb8
SHA256d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5
SHA5120edcc22f4d826e4d981b77587ac91996af70d013634d5903d620f089e420302eef73a3d9f8499414b7de6853988bc287fbf5713f172829fd3241af531012ad5f
-
Filesize
540KB
MD59628af18d03c96e47efb01afcb84a3a0
SHA128757a74f60e4ae9977ac7688355c8bcd2eb1cb8
SHA256d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5
SHA5120edcc22f4d826e4d981b77587ac91996af70d013634d5903d620f089e420302eef73a3d9f8499414b7de6853988bc287fbf5713f172829fd3241af531012ad5f
-
Filesize
540KB
MD59628af18d03c96e47efb01afcb84a3a0
SHA128757a74f60e4ae9977ac7688355c8bcd2eb1cb8
SHA256d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5
SHA5120edcc22f4d826e4d981b77587ac91996af70d013634d5903d620f089e420302eef73a3d9f8499414b7de6853988bc287fbf5713f172829fd3241af531012ad5f
-
Filesize
540KB
MD59628af18d03c96e47efb01afcb84a3a0
SHA128757a74f60e4ae9977ac7688355c8bcd2eb1cb8
SHA256d4b77f68ccd743fe0bf243652150eb8e3dc618d0a73f01da631a05ac247060e5
SHA5120edcc22f4d826e4d981b77587ac91996af70d013634d5903d620f089e420302eef73a3d9f8499414b7de6853988bc287fbf5713f172829fd3241af531012ad5f