4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f

Analysis

max time kernel
152s
max time network
156s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
21/10/2022, 03:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
Size

1016KB
MD5

78faaaf754300195e42338290beef920
SHA1

6e35d65b45bbd635018e87574f6d95a44720d4f2
SHA256

4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f
SHA512

f98fc7fc80a570f4c6bde5f4a26b748295c7b377429f4d619d6c910ae086e93d22e4187a4e9a99500c309eca867414c4ed81fd47525e20d76c3098510feda577
SSDEEP

6144:PIXsL0tvrSVz1DnemeYbpsnEf78AoXh6KkiD0OofzA+/VygHU:PIXsgtvm1De5YlOx6lzBH46U

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	vsmxiywcfcw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	vffls.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	vffls.exe

UAC bypass 3 TTPs 10 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	vffls.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	vffls.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	vffls.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	vffls.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	vffls.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	vsmxiywcfcw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	vffls.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	vsmxiywcfcw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	vffls.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	vffls.exe

Adds policy Run key to start application 2 TTPs 16 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\znrbmukmu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ifslfwvgxrostldafs.exe"	vffls.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kbivjunsdrig = "trfzummyqljoqjcagux.exe"	vffls.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kbivjunsdrig = "gfuplefslhgmpjdcjycb.exe"	vsmxiywcfcw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\znrbmukmu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zvhzsigqgzvyypgcg.exe"	vsmxiywcfcw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	vffls.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\znrbmukmu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ifslfwvgxrostldafs.exe"	vffls.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kbivjunsdrig = "ifslfwvgxrostldafs.exe"	vffls.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\znrbmukmu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zvhzsigqgzvyypgcg.exe"	vffls.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	vsmxiywcfcw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	vffls.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\znrbmukmu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zvhzsigqgzvyypgcg.exe"	vffls.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kbivjunsdrig = "snyphwtcrjegfvlg.exe"	vffls.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\znrbmukmu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gfuplefslhgmpjdcjycb.exe"	vffls.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\znrbmukmu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gfuplefslhgmpjdcjycb.exe"	vffls.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kbivjunsdrig = "zvhzsigqgzvyypgcg.exe"	vffls.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kbivjunsdrig = "vvlheyaoiffmqlggoejjz.exe"	vffls.exe

Disables RegEdit via registry modification 6 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	vffls.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	vffls.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	vffls.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	vsmxiywcfcw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	vsmxiywcfcw.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	vffls.exe

Executes dropped EXE 3 IoCs

pid	Process
1640	vsmxiywcfcw.exe
1224	vffls.exe
1532	vffls.exe

Loads dropped DLL 6 IoCs

pid	Process
1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
1640	vsmxiywcfcw.exe
1640	vsmxiywcfcw.exe
1640	vsmxiywcfcw.exe
1640	vsmxiywcfcw.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	vffls.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\snyphwtcrjegfvlg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zvhzsigqgzvyypgcg.exe"	vffls.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\shmxjsjmvh = "trfzummyqljoqjcagux.exe"	vsmxiywcfcw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\kdmbrezgtjcczn = "snyphwtcrjegfvlg.exe ."	vffls.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\shmxjsjmvh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gfuplefslhgmpjdcjycb.exe"	vffls.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ndjviskoylb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zvhzsigqgzvyypgcg.exe ."	vffls.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nhrhymiqevpqods = "C:\\Users\\Admin\\AppData\\Local\\Temp\\snyphwtcrjegfvlg.exe ."	vffls.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nhrhymiqevpqods = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zvhzsigqgzvyypgcg.exe ."	vffls.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ndjviskoylb = "ifslfwvgxrostldafs.exe ."	vffls.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\snyphwtcrjegfvlg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\trfzummyqljoqjcagux.exe"	vsmxiywcfcw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	vffls.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\kdmbrezgtjcczn = "vvlheyaoiffmqlggoejjz.exe ."	vffls.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ndjviskoylb = "vvlheyaoiffmqlggoejjz.exe ."	vffls.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\kdmbrezgtjcczn = "ifslfwvgxrostldafs.exe ."	vffls.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nhrhymiqevpqods = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ifslfwvgxrostldafs.exe ."	vffls.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\snyphwtcrjegfvlg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gfuplefslhgmpjdcjycb.exe"	vffls.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ndjviskoylb = "trfzummyqljoqjcagux.exe ."	vffls.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\jbjxmysykzrqm = "gfuplefslhgmpjdcjycb.exe"	vffls.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\shmxjsjmvh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ifslfwvgxrostldafs.exe"	vffls.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\jbjxmysykzrqm = "trfzummyqljoqjcagux.exe"	vffls.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	vffls.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\jbjxmysykzrqm = "trfzummyqljoqjcagux.exe"	vffls.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	vffls.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	vffls.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\kdmbrezgtjcczn = "trfzummyqljoqjcagux.exe ."	vffls.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\shmxjsjmvh = "snyphwtcrjegfvlg.exe"	vffls.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\shmxjsjmvh = "snyphwtcrjegfvlg.exe"	vffls.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\snyphwtcrjegfvlg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vvlheyaoiffmqlggoejjz.exe"	vffls.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	vsmxiywcfcw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ndjviskoylb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gfuplefslhgmpjdcjycb.exe ."	vffls.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\jbjxmysykzrqm = "ifslfwvgxrostldafs.exe"	vffls.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\shmxjsjmvh = "trfzummyqljoqjcagux.exe"	vffls.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\kdmbrezgtjcczn = "trfzummyqljoqjcagux.exe ."	vffls.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ndjviskoylb = "vvlheyaoiffmqlggoejjz.exe ."	vsmxiywcfcw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ndjviskoylb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zvhzsigqgzvyypgcg.exe ."	vsmxiywcfcw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	vffls.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ndjviskoylb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\trfzummyqljoqjcagux.exe ."	vffls.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ndjviskoylb = "snyphwtcrjegfvlg.exe ."	vffls.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\snyphwtcrjegfvlg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\trfzummyqljoqjcagux.exe"	vffls.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nhrhymiqevpqods = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zvhzsigqgzvyypgcg.exe ."	vffls.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	vsmxiywcfcw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\kdmbrezgtjcczn = "trfzummyqljoqjcagux.exe ."	vsmxiywcfcw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nhrhymiqevpqods = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vvlheyaoiffmqlggoejjz.exe ."	vsmxiywcfcw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ndjviskoylb = "zvhzsigqgzvyypgcg.exe ."	vffls.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\snyphwtcrjegfvlg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\snyphwtcrjegfvlg.exe"	vffls.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	vsmxiywcfcw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\shmxjsjmvh = "ifslfwvgxrostldafs.exe"	vffls.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\shmxjsjmvh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\trfzummyqljoqjcagux.exe"	vffls.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\jbjxmysykzrqm = "gfuplefslhgmpjdcjycb.exe"	vsmxiywcfcw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nhrhymiqevpqods = "C:\\Users\\Admin\\AppData\\Local\\Temp\\trfzummyqljoqjcagux.exe ."	vffls.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\shmxjsjmvh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\snyphwtcrjegfvlg.exe"	vffls.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\snyphwtcrjegfvlg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ifslfwvgxrostldafs.exe"	vffls.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\jbjxmysykzrqm = "zvhzsigqgzvyypgcg.exe"	vffls.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	vffls.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\shmxjsjmvh = "zvhzsigqgzvyypgcg.exe"	vffls.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ndjviskoylb = "vvlheyaoiffmqlggoejjz.exe ."	vffls.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\jbjxmysykzrqm = "snyphwtcrjegfvlg.exe"	vffls.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nhrhymiqevpqods = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vvlheyaoiffmqlggoejjz.exe ."	vffls.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\shmxjsjmvh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zvhzsigqgzvyypgcg.exe"	vsmxiywcfcw.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	vffls.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\kdmbrezgtjcczn = "zvhzsigqgzvyypgcg.exe ."	vffls.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	vsmxiywcfcw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\jbjxmysykzrqm = "ifslfwvgxrostldafs.exe"	vffls.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nhrhymiqevpqods = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vvlheyaoiffmqlggoejjz.exe ."	vffls.exe

Checks whether UAC is enabled 1 TTPs 6 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	vffls.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	vsmxiywcfcw.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	vsmxiywcfcw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	vffls.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	vffls.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	vffls.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	whatismyipaddress.com
6	www.showmyipaddress.com
12	whatismyip.everdot.org

Drops file in System32 directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\zvhzsigqgzvyypgcg.exe	vffls.exe
File opened for modification	C:\Windows\SysWOW64\ifslfwvgxrostldafs.exe	vffls.exe
File opened for modification	C:\Windows\SysWOW64\snyphwtcrjegfvlg.exe	vsmxiywcfcw.exe
File opened for modification	C:\Windows\SysWOW64\trfzummyqljoqjcagux.exe	vsmxiywcfcw.exe
File opened for modification	C:\Windows\SysWOW64\gfuplefslhgmpjdcjycb.exe	vsmxiywcfcw.exe
File opened for modification	C:\Windows\SysWOW64\vvlheyaoiffmqlggoejjz.exe	vsmxiywcfcw.exe
File opened for modification	C:\Windows\SysWOW64\ifslfwvgxrostldafs.exe	vffls.exe
File opened for modification	C:\Windows\SysWOW64\trfzummyqljoqjcagux.exe	vffls.exe
File opened for modification	C:\Windows\SysWOW64\mnebzuxmhfgotplmvmstkh.exe	vffls.exe
File created	C:\Windows\SysWOW64\vfflswigkrbsglqasshrrxeiusw.nes	vffls.exe
File opened for modification	C:\Windows\SysWOW64\ifslfwvgxrostldafs.exe	vsmxiywcfcw.exe
File opened for modification	C:\Windows\SysWOW64\snyphwtcrjegfvlg.exe	vffls.exe
File opened for modification	C:\Windows\SysWOW64\vvlheyaoiffmqlggoejjz.exe	vffls.exe
File opened for modification	C:\Windows\SysWOW64\trfzummyqljoqjcagux.exe	vffls.exe
File opened for modification	C:\Windows\SysWOW64\vvlheyaoiffmqlggoejjz.exe	vffls.exe
File created	C:\Windows\SysWOW64\snyphwtcrjegfvlgjuuparjyvetlgihxnilwwr.tla	vffls.exe
File opened for modification	C:\Windows\SysWOW64\vfflswigkrbsglqasshrrxeiusw.nes	vffls.exe
File opened for modification	C:\Windows\SysWOW64\snyphwtcrjegfvlgjuuparjyvetlgihxnilwwr.tla	vffls.exe
File opened for modification	C:\Windows\SysWOW64\zvhzsigqgzvyypgcg.exe	vsmxiywcfcw.exe
File opened for modification	C:\Windows\SysWOW64\mnebzuxmhfgotplmvmstkh.exe	vsmxiywcfcw.exe
File opened for modification	C:\Windows\SysWOW64\zvhzsigqgzvyypgcg.exe	vffls.exe
File opened for modification	C:\Windows\SysWOW64\mnebzuxmhfgotplmvmstkh.exe	vffls.exe
File opened for modification	C:\Windows\SysWOW64\snyphwtcrjegfvlg.exe	vffls.exe
File opened for modification	C:\Windows\SysWOW64\gfuplefslhgmpjdcjycb.exe	vffls.exe
File opened for modification	C:\Windows\SysWOW64\gfuplefslhgmpjdcjycb.exe	vffls.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\vfflswigkrbsglqasshrrxeiusw.nes	vffls.exe
File created	C:\Program Files (x86)\vfflswigkrbsglqasshrrxeiusw.nes	vffls.exe
File opened for modification	C:\Program Files (x86)\snyphwtcrjegfvlgjuuparjyvetlgihxnilwwr.tla	vffls.exe
File created	C:\Program Files (x86)\snyphwtcrjegfvlgjuuparjyvetlgihxnilwwr.tla	vffls.exe

Drops file in Windows directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\gfuplefslhgmpjdcjycb.exe	vffls.exe
File opened for modification	C:\Windows\mnebzuxmhfgotplmvmstkh.exe	vffls.exe
File created	C:\Windows\vfflswigkrbsglqasshrrxeiusw.nes	vffls.exe
File opened for modification	C:\Windows\snyphwtcrjegfvlg.exe	vsmxiywcfcw.exe
File opened for modification	C:\Windows\ifslfwvgxrostldafs.exe	vffls.exe
File opened for modification	C:\Windows\snyphwtcrjegfvlg.exe	vffls.exe
File opened for modification	C:\Windows\zvhzsigqgzvyypgcg.exe	vffls.exe
File opened for modification	C:\Windows\trfzummyqljoqjcagux.exe	vffls.exe
File opened for modification	C:\Windows\ifslfwvgxrostldafs.exe	vffls.exe
File opened for modification	C:\Windows\snyphwtcrjegfvlgjuuparjyvetlgihxnilwwr.tla	vffls.exe
File created	C:\Windows\snyphwtcrjegfvlgjuuparjyvetlgihxnilwwr.tla	vffls.exe
File opened for modification	C:\Windows\zvhzsigqgzvyypgcg.exe	vsmxiywcfcw.exe
File opened for modification	C:\Windows\ifslfwvgxrostldafs.exe	vsmxiywcfcw.exe
File opened for modification	C:\Windows\vvlheyaoiffmqlggoejjz.exe	vsmxiywcfcw.exe
File opened for modification	C:\Windows\mnebzuxmhfgotplmvmstkh.exe	vsmxiywcfcw.exe
File opened for modification	C:\Windows\zvhzsigqgzvyypgcg.exe	vffls.exe
File opened for modification	C:\Windows\trfzummyqljoqjcagux.exe	vsmxiywcfcw.exe
File opened for modification	C:\Windows\gfuplefslhgmpjdcjycb.exe	vsmxiywcfcw.exe
File opened for modification	C:\Windows\vfflswigkrbsglqasshrrxeiusw.nes	vffls.exe
File opened for modification	C:\Windows\vvlheyaoiffmqlggoejjz.exe	vffls.exe
File opened for modification	C:\Windows\snyphwtcrjegfvlg.exe	vffls.exe
File opened for modification	C:\Windows\trfzummyqljoqjcagux.exe	vffls.exe
File opened for modification	C:\Windows\gfuplefslhgmpjdcjycb.exe	vffls.exe
File opened for modification	C:\Windows\vvlheyaoiffmqlggoejjz.exe	vffls.exe
File opened for modification	C:\Windows\mnebzuxmhfgotplmvmstkh.exe	vffls.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
1224	vffls.exe
1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
1224	vffls.exe
1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1224	vffls.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1428 wrote to memory of 1640	1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe	27
PID 1428 wrote to memory of 1640	1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe	27
PID 1428 wrote to memory of 1640	1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe	27
PID 1428 wrote to memory of 1640	1428	4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe	27
PID 1640 wrote to memory of 1224	1640	vsmxiywcfcw.exe	28
PID 1640 wrote to memory of 1224	1640	vsmxiywcfcw.exe	28
PID 1640 wrote to memory of 1224	1640	vsmxiywcfcw.exe	28
PID 1640 wrote to memory of 1224	1640	vsmxiywcfcw.exe	28
PID 1640 wrote to memory of 1532	1640	vsmxiywcfcw.exe	29
PID 1640 wrote to memory of 1532	1640	vsmxiywcfcw.exe	29
PID 1640 wrote to memory of 1532	1640	vsmxiywcfcw.exe	29
PID 1640 wrote to memory of 1532	1640	vsmxiywcfcw.exe	29

System policy modification 1 TTPs 30 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	vffls.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	vffls.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	vffls.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	vsmxiywcfcw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	vffls.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	vffls.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	vffls.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	vffls.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	vffls.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	vsmxiywcfcw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	vffls.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	vffls.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	vffls.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	vffls.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	vffls.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	vffls.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	vffls.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	vffls.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	vffls.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	vffls.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	vffls.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	vffls.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	vsmxiywcfcw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	vffls.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	vffls.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	vffls.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	vffls.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	vffls.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	vffls.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	vsmxiywcfcw.exe

C:\Users\Admin\AppData\Local\Temp\4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe
"C:\Users\Admin\AppData\Local\Temp\4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1428
- C:\Users\Admin\AppData\Local\Temp\vsmxiywcfcw.exe
  "C:\Users\Admin\AppData\Local\Temp\vsmxiywcfcw.exe" "c:\users\admin\appdata\local\temp\4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f.exe*"
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Adds policy Run key to start application
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1640
- - C:\Users\Admin\AppData\Local\Temp\vffls.exe
    "C:\Users\Admin\AppData\Local\Temp\vffls.exe" "-C:\Users\Admin\AppData\Local\Temp\snyphwtcrjegfvlg.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - System policy modification
    PID:1224
- - C:\Users\Admin\AppData\Local\Temp\vffls.exe
    "C:\Users\Admin\AppData\Local\Temp\vffls.exe" "-C:\Users\Admin\AppData\Local\Temp\snyphwtcrjegfvlg.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System policy modification
    PID:1532

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\gfuplefslhgmpjdcjycb.exe

Filesize
1016KB

MD5
78faaaf754300195e42338290beef920

SHA1
6e35d65b45bbd635018e87574f6d95a44720d4f2

SHA256
4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f

SHA512
f98fc7fc80a570f4c6bde5f4a26b748295c7b377429f4d619d6c910ae086e93d22e4187a4e9a99500c309eca867414c4ed81fd47525e20d76c3098510feda577

Download Submit
C:\Users\Admin\AppData\Local\Temp\ifslfwvgxrostldafs.exe

Filesize
1016KB

MD5
78faaaf754300195e42338290beef920

SHA1
6e35d65b45bbd635018e87574f6d95a44720d4f2

SHA256
4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f

SHA512
f98fc7fc80a570f4c6bde5f4a26b748295c7b377429f4d619d6c910ae086e93d22e4187a4e9a99500c309eca867414c4ed81fd47525e20d76c3098510feda577

Download Submit
C:\Users\Admin\AppData\Local\Temp\mnebzuxmhfgotplmvmstkh.exe

Filesize
1016KB

MD5
78faaaf754300195e42338290beef920

SHA1
6e35d65b45bbd635018e87574f6d95a44720d4f2

SHA256
4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f

SHA512
f98fc7fc80a570f4c6bde5f4a26b748295c7b377429f4d619d6c910ae086e93d22e4187a4e9a99500c309eca867414c4ed81fd47525e20d76c3098510feda577

Download Submit
C:\Users\Admin\AppData\Local\Temp\snyphwtcrjegfvlg.exe

Filesize
1016KB

MD5
78faaaf754300195e42338290beef920

SHA1
6e35d65b45bbd635018e87574f6d95a44720d4f2

SHA256
4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f

SHA512
f98fc7fc80a570f4c6bde5f4a26b748295c7b377429f4d619d6c910ae086e93d22e4187a4e9a99500c309eca867414c4ed81fd47525e20d76c3098510feda577

Download Submit
C:\Users\Admin\AppData\Local\Temp\trfzummyqljoqjcagux.exe

Filesize
1016KB

MD5
78faaaf754300195e42338290beef920

SHA1
6e35d65b45bbd635018e87574f6d95a44720d4f2

SHA256
4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f

SHA512
f98fc7fc80a570f4c6bde5f4a26b748295c7b377429f4d619d6c910ae086e93d22e4187a4e9a99500c309eca867414c4ed81fd47525e20d76c3098510feda577

Download Submit
C:\Users\Admin\AppData\Local\Temp\vffls.exe

Filesize
696KB

MD5
de8c7bdbffe855957ff590c857144127

SHA1
003c9d4fae68ea2bd102d3630f58c7617071bfc5

SHA256
ac35ada39134060663f85ff297cd658594ac916682536b55e20c5de80cf6a9cc

SHA512
d02d16dbe074443aef0365bb3b8a89c2179462af0ed26eb12e1cc004450db0344a43b0a3390b9e7b1caa518e15fbd82c20fde743dc4df9824d56d43644d7b0bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\vffls.exe

Filesize
696KB

MD5
de8c7bdbffe855957ff590c857144127

SHA1
003c9d4fae68ea2bd102d3630f58c7617071bfc5

SHA256
ac35ada39134060663f85ff297cd658594ac916682536b55e20c5de80cf6a9cc

SHA512
d02d16dbe074443aef0365bb3b8a89c2179462af0ed26eb12e1cc004450db0344a43b0a3390b9e7b1caa518e15fbd82c20fde743dc4df9824d56d43644d7b0bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\vsmxiywcfcw.exe

Filesize
320KB

MD5
d8d7ab30a88a6429ec323bc3551165b6

SHA1
6288fbd01bab82996fddb551aea9c193388b1ce2

SHA256
4bd8cd6961da30d36ebb8b4fa71f2f69aeb25e102cdffbda43e7c67beaa160f6

SHA512
5ea89ae405920de3b416aac4434ae17a296563e5154430e7adc2d1c243cd7bdc82d2a525beeb9a69cfa3fe040c8e17dd6339e6a091df0340b3098998758efeec

Download Submit
C:\Users\Admin\AppData\Local\Temp\vsmxiywcfcw.exe

Filesize
320KB

MD5
d8d7ab30a88a6429ec323bc3551165b6

SHA1
6288fbd01bab82996fddb551aea9c193388b1ce2

SHA256
4bd8cd6961da30d36ebb8b4fa71f2f69aeb25e102cdffbda43e7c67beaa160f6

SHA512
5ea89ae405920de3b416aac4434ae17a296563e5154430e7adc2d1c243cd7bdc82d2a525beeb9a69cfa3fe040c8e17dd6339e6a091df0340b3098998758efeec

Download Submit
C:\Users\Admin\AppData\Local\Temp\vvlheyaoiffmqlggoejjz.exe

Filesize
1016KB

MD5
78faaaf754300195e42338290beef920

SHA1
6e35d65b45bbd635018e87574f6d95a44720d4f2

SHA256
4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f

SHA512
f98fc7fc80a570f4c6bde5f4a26b748295c7b377429f4d619d6c910ae086e93d22e4187a4e9a99500c309eca867414c4ed81fd47525e20d76c3098510feda577

Download Submit
C:\Users\Admin\AppData\Local\Temp\zvhzsigqgzvyypgcg.exe

Filesize
1016KB

MD5
78faaaf754300195e42338290beef920

SHA1
6e35d65b45bbd635018e87574f6d95a44720d4f2

SHA256
4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f

SHA512
f98fc7fc80a570f4c6bde5f4a26b748295c7b377429f4d619d6c910ae086e93d22e4187a4e9a99500c309eca867414c4ed81fd47525e20d76c3098510feda577

Download Submit
C:\Windows\SysWOW64\gfuplefslhgmpjdcjycb.exe

Filesize
1016KB

MD5
78faaaf754300195e42338290beef920

SHA1
6e35d65b45bbd635018e87574f6d95a44720d4f2

SHA256
4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f

SHA512
f98fc7fc80a570f4c6bde5f4a26b748295c7b377429f4d619d6c910ae086e93d22e4187a4e9a99500c309eca867414c4ed81fd47525e20d76c3098510feda577

Download Submit
C:\Windows\SysWOW64\ifslfwvgxrostldafs.exe

Filesize
1016KB

MD5
78faaaf754300195e42338290beef920

SHA1
6e35d65b45bbd635018e87574f6d95a44720d4f2

SHA256
4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f

SHA512
f98fc7fc80a570f4c6bde5f4a26b748295c7b377429f4d619d6c910ae086e93d22e4187a4e9a99500c309eca867414c4ed81fd47525e20d76c3098510feda577

Download Submit
C:\Windows\SysWOW64\mnebzuxmhfgotplmvmstkh.exe

Filesize
1016KB

MD5
78faaaf754300195e42338290beef920

SHA1
6e35d65b45bbd635018e87574f6d95a44720d4f2

SHA256
4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f

SHA512
f98fc7fc80a570f4c6bde5f4a26b748295c7b377429f4d619d6c910ae086e93d22e4187a4e9a99500c309eca867414c4ed81fd47525e20d76c3098510feda577

Download Submit
C:\Windows\SysWOW64\snyphwtcrjegfvlg.exe

Filesize
1016KB

MD5
78faaaf754300195e42338290beef920

SHA1
6e35d65b45bbd635018e87574f6d95a44720d4f2

SHA256
4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f

SHA512
f98fc7fc80a570f4c6bde5f4a26b748295c7b377429f4d619d6c910ae086e93d22e4187a4e9a99500c309eca867414c4ed81fd47525e20d76c3098510feda577

Download Submit
C:\Windows\SysWOW64\trfzummyqljoqjcagux.exe

Filesize
1016KB

MD5
78faaaf754300195e42338290beef920

SHA1
6e35d65b45bbd635018e87574f6d95a44720d4f2

SHA256
4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f

SHA512
f98fc7fc80a570f4c6bde5f4a26b748295c7b377429f4d619d6c910ae086e93d22e4187a4e9a99500c309eca867414c4ed81fd47525e20d76c3098510feda577

Download Submit
C:\Windows\SysWOW64\vvlheyaoiffmqlggoejjz.exe

Filesize
1016KB

MD5
78faaaf754300195e42338290beef920

SHA1
6e35d65b45bbd635018e87574f6d95a44720d4f2

SHA256
4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f

SHA512
f98fc7fc80a570f4c6bde5f4a26b748295c7b377429f4d619d6c910ae086e93d22e4187a4e9a99500c309eca867414c4ed81fd47525e20d76c3098510feda577

Download Submit
C:\Windows\SysWOW64\zvhzsigqgzvyypgcg.exe

Filesize
1016KB

MD5
78faaaf754300195e42338290beef920

SHA1
6e35d65b45bbd635018e87574f6d95a44720d4f2

SHA256
4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f

SHA512
f98fc7fc80a570f4c6bde5f4a26b748295c7b377429f4d619d6c910ae086e93d22e4187a4e9a99500c309eca867414c4ed81fd47525e20d76c3098510feda577

Download Submit
C:\Windows\gfuplefslhgmpjdcjycb.exe

Filesize
1016KB

MD5
78faaaf754300195e42338290beef920

SHA1
6e35d65b45bbd635018e87574f6d95a44720d4f2

SHA256
4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f

SHA512
f98fc7fc80a570f4c6bde5f4a26b748295c7b377429f4d619d6c910ae086e93d22e4187a4e9a99500c309eca867414c4ed81fd47525e20d76c3098510feda577

Download Submit
C:\Windows\gfuplefslhgmpjdcjycb.exe

Filesize
1016KB

MD5
78faaaf754300195e42338290beef920

SHA1
6e35d65b45bbd635018e87574f6d95a44720d4f2

SHA256
4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f

SHA512
f98fc7fc80a570f4c6bde5f4a26b748295c7b377429f4d619d6c910ae086e93d22e4187a4e9a99500c309eca867414c4ed81fd47525e20d76c3098510feda577

Download Submit
C:\Windows\ifslfwvgxrostldafs.exe

Filesize
1016KB

MD5
78faaaf754300195e42338290beef920

SHA1
6e35d65b45bbd635018e87574f6d95a44720d4f2

SHA256
4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f

SHA512
f98fc7fc80a570f4c6bde5f4a26b748295c7b377429f4d619d6c910ae086e93d22e4187a4e9a99500c309eca867414c4ed81fd47525e20d76c3098510feda577

Download Submit
C:\Windows\ifslfwvgxrostldafs.exe

Filesize
1016KB

MD5
78faaaf754300195e42338290beef920

SHA1
6e35d65b45bbd635018e87574f6d95a44720d4f2

SHA256
4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f

SHA512
f98fc7fc80a570f4c6bde5f4a26b748295c7b377429f4d619d6c910ae086e93d22e4187a4e9a99500c309eca867414c4ed81fd47525e20d76c3098510feda577

Download Submit
C:\Windows\mnebzuxmhfgotplmvmstkh.exe

Filesize
1016KB

MD5
78faaaf754300195e42338290beef920

SHA1
6e35d65b45bbd635018e87574f6d95a44720d4f2

SHA256
4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f

SHA512
f98fc7fc80a570f4c6bde5f4a26b748295c7b377429f4d619d6c910ae086e93d22e4187a4e9a99500c309eca867414c4ed81fd47525e20d76c3098510feda577

Download Submit
C:\Windows\mnebzuxmhfgotplmvmstkh.exe

Filesize
1016KB

MD5
78faaaf754300195e42338290beef920

SHA1
6e35d65b45bbd635018e87574f6d95a44720d4f2

SHA256
4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f

SHA512
f98fc7fc80a570f4c6bde5f4a26b748295c7b377429f4d619d6c910ae086e93d22e4187a4e9a99500c309eca867414c4ed81fd47525e20d76c3098510feda577

Download Submit
C:\Windows\snyphwtcrjegfvlg.exe

Filesize
1016KB

MD5
78faaaf754300195e42338290beef920

SHA1
6e35d65b45bbd635018e87574f6d95a44720d4f2

SHA256
4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f

SHA512
f98fc7fc80a570f4c6bde5f4a26b748295c7b377429f4d619d6c910ae086e93d22e4187a4e9a99500c309eca867414c4ed81fd47525e20d76c3098510feda577

Download Submit
C:\Windows\snyphwtcrjegfvlg.exe

Filesize
1016KB

MD5
78faaaf754300195e42338290beef920

SHA1
6e35d65b45bbd635018e87574f6d95a44720d4f2

SHA256
4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f

SHA512
f98fc7fc80a570f4c6bde5f4a26b748295c7b377429f4d619d6c910ae086e93d22e4187a4e9a99500c309eca867414c4ed81fd47525e20d76c3098510feda577

Download Submit
C:\Windows\trfzummyqljoqjcagux.exe

Filesize
1016KB

MD5
78faaaf754300195e42338290beef920

SHA1
6e35d65b45bbd635018e87574f6d95a44720d4f2

SHA256
4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f

SHA512
f98fc7fc80a570f4c6bde5f4a26b748295c7b377429f4d619d6c910ae086e93d22e4187a4e9a99500c309eca867414c4ed81fd47525e20d76c3098510feda577

Download Submit
C:\Windows\trfzummyqljoqjcagux.exe

Filesize
1016KB

MD5
78faaaf754300195e42338290beef920

SHA1
6e35d65b45bbd635018e87574f6d95a44720d4f2

SHA256
4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f

SHA512
f98fc7fc80a570f4c6bde5f4a26b748295c7b377429f4d619d6c910ae086e93d22e4187a4e9a99500c309eca867414c4ed81fd47525e20d76c3098510feda577

Download Submit
C:\Windows\vvlheyaoiffmqlggoejjz.exe

Filesize
1016KB

MD5
78faaaf754300195e42338290beef920

SHA1
6e35d65b45bbd635018e87574f6d95a44720d4f2

SHA256
4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f

SHA512
f98fc7fc80a570f4c6bde5f4a26b748295c7b377429f4d619d6c910ae086e93d22e4187a4e9a99500c309eca867414c4ed81fd47525e20d76c3098510feda577

Download Submit
C:\Windows\vvlheyaoiffmqlggoejjz.exe

Filesize
1016KB

MD5
78faaaf754300195e42338290beef920

SHA1
6e35d65b45bbd635018e87574f6d95a44720d4f2

SHA256
4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f

SHA512
f98fc7fc80a570f4c6bde5f4a26b748295c7b377429f4d619d6c910ae086e93d22e4187a4e9a99500c309eca867414c4ed81fd47525e20d76c3098510feda577

Download Submit
C:\Windows\zvhzsigqgzvyypgcg.exe

Filesize
1016KB

MD5
78faaaf754300195e42338290beef920

SHA1
6e35d65b45bbd635018e87574f6d95a44720d4f2

SHA256
4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f

SHA512
f98fc7fc80a570f4c6bde5f4a26b748295c7b377429f4d619d6c910ae086e93d22e4187a4e9a99500c309eca867414c4ed81fd47525e20d76c3098510feda577

Download Submit
C:\Windows\zvhzsigqgzvyypgcg.exe

Filesize
1016KB

MD5
78faaaf754300195e42338290beef920

SHA1
6e35d65b45bbd635018e87574f6d95a44720d4f2

SHA256
4630b8dd5ddb97c98593cc32c87e5eca194571d089d72c947318638b3d9c249f

SHA512
f98fc7fc80a570f4c6bde5f4a26b748295c7b377429f4d619d6c910ae086e93d22e4187a4e9a99500c309eca867414c4ed81fd47525e20d76c3098510feda577

Download Submit
\Users\Admin\AppData\Local\Temp\vffls.exe

Filesize
696KB

MD5
de8c7bdbffe855957ff590c857144127

SHA1
003c9d4fae68ea2bd102d3630f58c7617071bfc5

SHA256
ac35ada39134060663f85ff297cd658594ac916682536b55e20c5de80cf6a9cc

SHA512
d02d16dbe074443aef0365bb3b8a89c2179462af0ed26eb12e1cc004450db0344a43b0a3390b9e7b1caa518e15fbd82c20fde743dc4df9824d56d43644d7b0bc

Download Submit
\Users\Admin\AppData\Local\Temp\vffls.exe

Filesize
696KB

MD5
de8c7bdbffe855957ff590c857144127

SHA1
003c9d4fae68ea2bd102d3630f58c7617071bfc5

SHA256
ac35ada39134060663f85ff297cd658594ac916682536b55e20c5de80cf6a9cc

SHA512
d02d16dbe074443aef0365bb3b8a89c2179462af0ed26eb12e1cc004450db0344a43b0a3390b9e7b1caa518e15fbd82c20fde743dc4df9824d56d43644d7b0bc

Download Submit
\Users\Admin\AppData\Local\Temp\vffls.exe

Filesize
696KB

MD5
de8c7bdbffe855957ff590c857144127

SHA1
003c9d4fae68ea2bd102d3630f58c7617071bfc5

SHA256
ac35ada39134060663f85ff297cd658594ac916682536b55e20c5de80cf6a9cc

SHA512
d02d16dbe074443aef0365bb3b8a89c2179462af0ed26eb12e1cc004450db0344a43b0a3390b9e7b1caa518e15fbd82c20fde743dc4df9824d56d43644d7b0bc

Download Submit
\Users\Admin\AppData\Local\Temp\vffls.exe

Filesize
696KB

MD5
de8c7bdbffe855957ff590c857144127

SHA1
003c9d4fae68ea2bd102d3630f58c7617071bfc5

SHA256
ac35ada39134060663f85ff297cd658594ac916682536b55e20c5de80cf6a9cc

SHA512
d02d16dbe074443aef0365bb3b8a89c2179462af0ed26eb12e1cc004450db0344a43b0a3390b9e7b1caa518e15fbd82c20fde743dc4df9824d56d43644d7b0bc

Download Submit
\Users\Admin\AppData\Local\Temp\vsmxiywcfcw.exe

Filesize
320KB

MD5
d8d7ab30a88a6429ec323bc3551165b6

SHA1
6288fbd01bab82996fddb551aea9c193388b1ce2

SHA256
4bd8cd6961da30d36ebb8b4fa71f2f69aeb25e102cdffbda43e7c67beaa160f6

SHA512
5ea89ae405920de3b416aac4434ae17a296563e5154430e7adc2d1c243cd7bdc82d2a525beeb9a69cfa3fe040c8e17dd6339e6a091df0340b3098998758efeec

Download Submit
\Users\Admin\AppData\Local\Temp\vsmxiywcfcw.exe

Filesize
320KB

MD5
d8d7ab30a88a6429ec323bc3551165b6

SHA1
6288fbd01bab82996fddb551aea9c193388b1ce2

SHA256
4bd8cd6961da30d36ebb8b4fa71f2f69aeb25e102cdffbda43e7c67beaa160f6

SHA512
5ea89ae405920de3b416aac4434ae17a296563e5154430e7adc2d1c243cd7bdc82d2a525beeb9a69cfa3fe040c8e17dd6339e6a091df0340b3098998758efeec

Download Submit
memory/1428-54-0x0000000075071000-0x0000000075073000-memory.dmp

Filesize
8KB

Download