7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372

Analysis

max time kernel
178s
max time network
191s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
21-10-2022 03:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe
Size

1016KB
MD5

7b392c5d219968a687bbcd35f46a9840
SHA1

88352c30b47b8791ee0b6269c665f617dd8dd4e2
SHA256

7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372
SHA512

b265c01b82bac0f7131bcdc60815c292e60b2a94a27aea6c67f66dca27c3b8c370258c3f5e6d45a8bf4be1929a1fc1b13541bca703a6ed7b09a7772089f06070
SSDEEP

6144:yIXsL0tvrSVz1DnemeYbpsnEf78AoXh6KkiD0OofzA+/VygHUKz:yIXsgtvm1De5YlOx6lzBH46Us

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	jryegm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	jryegm.exe

UAC bypass 3 TTPs 13 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	jryegm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	jryegm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	jryegm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	jryegm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	jryegm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	jryegm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	jryegm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	jryegm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	yborjrewily.exe

Adds policy Run key to start application 2 TTPs 29 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cnxglujlb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jfaukeersfjvrdevrsfb.exe"	jryegm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cnxglujlb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jfaukeersfjvrdevrsfb.exe"	jryegm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nboaiumrkplp = "vneugwsbyhhphpmz.exe"	jryegm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cnxglujlb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wrletmlxxjmxsddtooa.exe"	jryegm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nboaiumrkplp = "vneugwsbyhhphpmz.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nboaiumrkplp = "wrletmlxxjmxsddtooa.exe"	jryegm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cnxglujlb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cvnerifpnxyhajhvo.exe"	jryegm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cnxglujlb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yvrmdyznpdivsfhzwymjf.exe"	jryegm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nboaiumrkplp = "cvnerifpnxyhajhvo.exe"	jryegm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	jryegm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	jryegm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nboaiumrkplp = "yvrmdyznpdivsfhzwymjf.exe"	jryegm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cnxglujlb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vneugwsbyhhphpmz.exe"	jryegm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nboaiumrkplp = "yvrmdyznpdivsfhzwymjf.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cnxglujlb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vneugwsbyhhphpmz.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nboaiumrkplp = "jfaukeersfjvrdevrsfb.exe"	jryegm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cnxglujlb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lfyqewufeprbvfetnm.exe"	jryegm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nboaiumrkplp = "lfyqewufeprbvfetnm.exe"	jryegm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nboaiumrkplp = "cvnerifpnxyhajhvo.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cnxglujlb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cvnerifpnxyhajhvo.exe"	jryegm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nboaiumrkplp = "cvnerifpnxyhajhvo.exe"	jryegm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nboaiumrkplp = "yvrmdyznpdivsfhzwymjf.exe"	jryegm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	yborjrewily.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cnxglujlb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cvnerifpnxyhajhvo.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nboaiumrkplp = "vneugwsbyhhphpmz.exe"	jryegm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nboaiumrkplp = "lfyqewufeprbvfetnm.exe"	jryegm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cnxglujlb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vneugwsbyhhphpmz.exe"	jryegm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cnxglujlb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cvnerifpnxyhajhvo.exe"	yborjrewily.exe

Disables RegEdit via registry modification 6 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	yborjrewily.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	jryegm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	jryegm.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	jryegm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	jryegm.exe

Executes dropped EXE 4 IoCs

pid	Process
4188	yborjrewily.exe
4704	jryegm.exe
4576	jryegm.exe
1940	yborjrewily.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	yborjrewily.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	yborjrewily.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mbpclyrxrxuzo = "cvnerifpnxyhajhvo.exe"	jryegm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ndsgqeyfahflbh = "wrletmlxxjmxsddtooa.exe ."	jryegm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qhxmxmhpltszqxt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vneugwsbyhhphpmz.exe ."	jryegm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vhscisilcf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yvrmdyznpdivsfhzwymjf.exe"	jryegm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qhxmxmhpltszqxt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wrletmlxxjmxsddtooa.exe ."	yborjrewily.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\qdpahsjnfje = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vneugwsbyhhphpmz.exe ."	yborjrewily.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mbpclyrxrxuzo = "wrletmlxxjmxsddtooa.exe"	jryegm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vhscisilcf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vneugwsbyhhphpmz.exe"	jryegm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qdpahsjnfje = "jfaukeersfjvrdevrsfb.exe ."	jryegm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ndsgqeyfahflbh = "wrletmlxxjmxsddtooa.exe ."	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qdpahsjnfje = "cvnerifpnxyhajhvo.exe ."	yborjrewily.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ndsgqeyfahflbh = "yvrmdyznpdivsfhzwymjf.exe ."	jryegm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vhscisilcf = "jfaukeersfjvrdevrsfb.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vhscisilcf = "yvrmdyznpdivsfhzwymjf.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vhscisilcf = "cvnerifpnxyhajhvo.exe"	jryegm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vhscisilcf = "jfaukeersfjvrdevrsfb.exe"	jryegm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\qdpahsjnfje = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cvnerifpnxyhajhvo.exe ."	jryegm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\qdpahsjnfje = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jfaukeersfjvrdevrsfb.exe ."	yborjrewily.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vhscisilcf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yvrmdyznpdivsfhzwymjf.exe"	jryegm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\qdpahsjnfje = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cvnerifpnxyhajhvo.exe ."	jryegm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vneugwsbyhhphpmz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lfyqewufeprbvfetnm.exe"	jryegm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ndsgqeyfahflbh = "vneugwsbyhhphpmz.exe ."	jryegm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	yborjrewily.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ndsgqeyfahflbh = "yvrmdyznpdivsfhzwymjf.exe ."	yborjrewily.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	jryegm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\qdpahsjnfje = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yvrmdyznpdivsfhzwymjf.exe ."	jryegm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\qdpahsjnfje = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vneugwsbyhhphpmz.exe ."	jryegm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ndsgqeyfahflbh = "jfaukeersfjvrdevrsfb.exe ."	jryegm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vhscisilcf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cvnerifpnxyhajhvo.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vhscisilcf = "wrletmlxxjmxsddtooa.exe"	jryegm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ndsgqeyfahflbh = "wrletmlxxjmxsddtooa.exe ."	jryegm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	yborjrewily.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	jryegm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qdpahsjnfje = "cvnerifpnxyhajhvo.exe ."	jryegm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vneugwsbyhhphpmz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yvrmdyznpdivsfhzwymjf.exe"	jryegm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qhxmxmhpltszqxt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wrletmlxxjmxsddtooa.exe ."	jryegm.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	yborjrewily.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vhscisilcf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wrletmlxxjmxsddtooa.exe"	yborjrewily.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	jryegm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\qdpahsjnfje = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jfaukeersfjvrdevrsfb.exe ."	jryegm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vhscisilcf = "cvnerifpnxyhajhvo.exe"	jryegm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ndsgqeyfahflbh = "vneugwsbyhhphpmz.exe ."	jryegm.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	yborjrewily.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mbpclyrxrxuzo = "lfyqewufeprbvfetnm.exe"	jryegm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qhxmxmhpltszqxt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cvnerifpnxyhajhvo.exe ."	jryegm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mbpclyrxrxuzo = "cvnerifpnxyhajhvo.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qhxmxmhpltszqxt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lfyqewufeprbvfetnm.exe ."	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qhxmxmhpltszqxt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lfyqewufeprbvfetnm.exe ."	jryegm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qhxmxmhpltszqxt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wrletmlxxjmxsddtooa.exe ."	jryegm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qdpahsjnfje = "lfyqewufeprbvfetnm.exe ."	jryegm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mbpclyrxrxuzo = "vneugwsbyhhphpmz.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ndsgqeyfahflbh = "wrletmlxxjmxsddtooa.exe ."	yborjrewily.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\qdpahsjnfje = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lfyqewufeprbvfetnm.exe ."	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vneugwsbyhhphpmz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jfaukeersfjvrdevrsfb.exe"	jryegm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qhxmxmhpltszqxt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jfaukeersfjvrdevrsfb.exe ."	jryegm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vhscisilcf = "jfaukeersfjvrdevrsfb.exe"	jryegm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vhscisilcf = "jfaukeersfjvrdevrsfb.exe"	yborjrewily.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qhxmxmhpltszqxt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yvrmdyznpdivsfhzwymjf.exe ."	jryegm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qdpahsjnfje = "lfyqewufeprbvfetnm.exe ."	yborjrewily.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	jryegm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qhxmxmhpltszqxt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lfyqewufeprbvfetnm.exe ."	jryegm.exe

Checks whether UAC is enabled 1 TTPs 8 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	yborjrewily.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	jryegm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	jryegm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	jryegm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	jryegm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	yborjrewily.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	yborjrewily.exe

Looks up external IP address via web service 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
24	whatismyip.everdot.org
31	whatismyipaddress.com
42	whatismyipaddress.com
46	whatismyip.everdot.org
62	www.showmyipaddress.com

Drops file in System32 directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\lfyqewufeprbvfetnm.exe	jryegm.exe
File opened for modification	C:\Windows\SysWOW64\wrletmlxxjmxsddtooa.exe	jryegm.exe
File opened for modification	C:\Windows\SysWOW64\pnkgyuwlodjxvjmfdgvtqm.exe	jryegm.exe
File opened for modification	C:\Windows\SysWOW64\wrletmlxxjmxsddtooa.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\yvrmdyznpdivsfhzwymjf.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\pnkgyuwlodjxvjmfdgvtqm.exe	jryegm.exe
File created	C:\Windows\SysWOW64\dhkmkmupytfzdxgfjsnruwuw.zid	jryegm.exe
File opened for modification	C:\Windows\SysWOW64\cvnerifpnxyhajhvo.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\cvnerifpnxyhajhvo.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\vneugwsbyhhphpmz.exe	jryegm.exe
File opened for modification	C:\Windows\SysWOW64\lfyqewufeprbvfetnm.exe	jryegm.exe
File opened for modification	C:\Windows\SysWOW64\wrletmlxxjmxsddtooa.exe	jryegm.exe
File opened for modification	C:\Windows\SysWOW64\lfyqewufeprbvfetnm.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\wrletmlxxjmxsddtooa.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\pnkgyuwlodjxvjmfdgvtqm.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\cvnerifpnxyhajhvo.exe	jryegm.exe
File opened for modification	C:\Windows\SysWOW64\cvnerifpnxyhajhvo.exe	jryegm.exe
File opened for modification	C:\Windows\SysWOW64\mbpclyrxrxuzotnxmgmbpclyrxrxuzotnxm.mbp	jryegm.exe
File opened for modification	C:\Windows\SysWOW64\vneugwsbyhhphpmz.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\vneugwsbyhhphpmz.exe	jryegm.exe
File opened for modification	C:\Windows\SysWOW64\yvrmdyznpdivsfhzwymjf.exe	jryegm.exe
File opened for modification	C:\Windows\SysWOW64\jfaukeersfjvrdevrsfb.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\vneugwsbyhhphpmz.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\lfyqewufeprbvfetnm.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\yvrmdyznpdivsfhzwymjf.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\jfaukeersfjvrdevrsfb.exe	jryegm.exe
File opened for modification	C:\Windows\SysWOW64\dhkmkmupytfzdxgfjsnruwuw.zid	jryegm.exe
File created	C:\Windows\SysWOW64\mbpclyrxrxuzotnxmgmbpclyrxrxuzotnxm.mbp	jryegm.exe
File opened for modification	C:\Windows\SysWOW64\pnkgyuwlodjxvjmfdgvtqm.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\jfaukeersfjvrdevrsfb.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\jfaukeersfjvrdevrsfb.exe	jryegm.exe
File opened for modification	C:\Windows\SysWOW64\yvrmdyznpdivsfhzwymjf.exe	jryegm.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\mbpclyrxrxuzotnxmgmbpclyrxrxuzotnxm.mbp	jryegm.exe
File opened for modification	C:\Program Files (x86)\dhkmkmupytfzdxgfjsnruwuw.zid	jryegm.exe
File created	C:\Program Files (x86)\dhkmkmupytfzdxgfjsnruwuw.zid	jryegm.exe
File opened for modification	C:\Program Files (x86)\mbpclyrxrxuzotnxmgmbpclyrxrxuzotnxm.mbp	jryegm.exe

Drops file in Windows directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Windows\wrletmlxxjmxsddtooa.exe	jryegm.exe
File opened for modification	C:\Windows\jfaukeersfjvrdevrsfb.exe	jryegm.exe
File opened for modification	C:\Windows\mbpclyrxrxuzotnxmgmbpclyrxrxuzotnxm.mbp	jryegm.exe
File opened for modification	C:\Windows\lfyqewufeprbvfetnm.exe	yborjrewily.exe
File opened for modification	C:\Windows\vneugwsbyhhphpmz.exe	jryegm.exe
File opened for modification	C:\Windows\pnkgyuwlodjxvjmfdgvtqm.exe	jryegm.exe
File opened for modification	C:\Windows\wrletmlxxjmxsddtooa.exe	yborjrewily.exe
File opened for modification	C:\Windows\jfaukeersfjvrdevrsfb.exe	jryegm.exe
File opened for modification	C:\Windows\jfaukeersfjvrdevrsfb.exe	yborjrewily.exe
File opened for modification	C:\Windows\pnkgyuwlodjxvjmfdgvtqm.exe	yborjrewily.exe
File opened for modification	C:\Windows\pnkgyuwlodjxvjmfdgvtqm.exe	jryegm.exe
File created	C:\Windows\dhkmkmupytfzdxgfjsnruwuw.zid	jryegm.exe
File opened for modification	C:\Windows\yvrmdyznpdivsfhzwymjf.exe	yborjrewily.exe
File opened for modification	C:\Windows\vneugwsbyhhphpmz.exe	jryegm.exe
File opened for modification	C:\Windows\lfyqewufeprbvfetnm.exe	jryegm.exe
File opened for modification	C:\Windows\yvrmdyznpdivsfhzwymjf.exe	jryegm.exe
File opened for modification	C:\Windows\jfaukeersfjvrdevrsfb.exe	yborjrewily.exe
File opened for modification	C:\Windows\cvnerifpnxyhajhvo.exe	jryegm.exe
File opened for modification	C:\Windows\cvnerifpnxyhajhvo.exe	jryegm.exe
File opened for modification	C:\Windows\lfyqewufeprbvfetnm.exe	yborjrewily.exe
File opened for modification	C:\Windows\yvrmdyznpdivsfhzwymjf.exe	yborjrewily.exe
File opened for modification	C:\Windows\wrletmlxxjmxsddtooa.exe	yborjrewily.exe
File opened for modification	C:\Windows\wrletmlxxjmxsddtooa.exe	jryegm.exe
File created	C:\Windows\mbpclyrxrxuzotnxmgmbpclyrxrxuzotnxm.mbp	jryegm.exe
File opened for modification	C:\Windows\cvnerifpnxyhajhvo.exe	yborjrewily.exe
File opened for modification	C:\Windows\pnkgyuwlodjxvjmfdgvtqm.exe	yborjrewily.exe
File opened for modification	C:\Windows\yvrmdyznpdivsfhzwymjf.exe	jryegm.exe
File opened for modification	C:\Windows\vneugwsbyhhphpmz.exe	yborjrewily.exe
File opened for modification	C:\Windows\cvnerifpnxyhajhvo.exe	yborjrewily.exe
File opened for modification	C:\Windows\vneugwsbyhhphpmz.exe	yborjrewily.exe
File opened for modification	C:\Windows\lfyqewufeprbvfetnm.exe	jryegm.exe
File opened for modification	C:\Windows\dhkmkmupytfzdxgfjsnruwuw.zid	jryegm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe
4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe
4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe
4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe
4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe
4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe
4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe
4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe
4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe
4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe
4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe
4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe
4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe
4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe
4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe
4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe
4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe
4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe
4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe
4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe
4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe
4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe
4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe
4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe
4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe
4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe
4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe
4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe
4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe
4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe
4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe
4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe
4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe
4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe
4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe
4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe
4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe
4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe
4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe
4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe
4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe
4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe
4704	jryegm.exe
4704	jryegm.exe
4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe
4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe
4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe
4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe
4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe
4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe
4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe
4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe
4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe
4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe
4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe
4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe
4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe
4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe
4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe
4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe
4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe
4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe
4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe
4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4704	jryegm.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4080 wrote to memory of 4188	4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe	82
PID 4080 wrote to memory of 4188	4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe	82
PID 4080 wrote to memory of 4188	4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe	82
PID 4188 wrote to memory of 4704	4188	yborjrewily.exe	83
PID 4188 wrote to memory of 4704	4188	yborjrewily.exe	83
PID 4188 wrote to memory of 4704	4188	yborjrewily.exe	83
PID 4188 wrote to memory of 4576	4188	yborjrewily.exe	84
PID 4188 wrote to memory of 4576	4188	yborjrewily.exe	84
PID 4188 wrote to memory of 4576	4188	yborjrewily.exe	84
PID 4080 wrote to memory of 1940	4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe	92
PID 4080 wrote to memory of 1940	4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe	92
PID 4080 wrote to memory of 1940	4080	7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe	92

System policy modification 1 TTPs 41 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	jryegm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	jryegm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	jryegm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	jryegm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	yborjrewily.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	jryegm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	jryegm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	jryegm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	jryegm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	jryegm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	jryegm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	jryegm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	jryegm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	jryegm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	yborjrewily.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	jryegm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	jryegm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	jryegm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	jryegm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	jryegm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	jryegm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	jryegm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	jryegm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	jryegm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	jryegm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	jryegm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	jryegm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	yborjrewily.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	jryegm.exe

C:\Users\Admin\AppData\Local\Temp\7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe
"C:\Users\Admin\AppData\Local\Temp\7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4080
- C:\Users\Admin\AppData\Local\Temp\yborjrewily.exe
  "C:\Users\Admin\AppData\Local\Temp\yborjrewily.exe" "c:\users\admin\appdata\local\temp\7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe*"
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Adds policy Run key to start application
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Checks computer location settings
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4188
- - C:\Users\Admin\AppData\Local\Temp\jryegm.exe
    "C:\Users\Admin\AppData\Local\Temp\jryegm.exe" "-C:\Users\Admin\AppData\Local\Temp\vneugwsbyhhphpmz.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - System policy modification
    PID:4704
- - C:\Users\Admin\AppData\Local\Temp\jryegm.exe
    "C:\Users\Admin\AppData\Local\Temp\jryegm.exe" "-C:\Users\Admin\AppData\Local\Temp\vneugwsbyhhphpmz.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System policy modification
    PID:4576
- C:\Users\Admin\AppData\Local\Temp\yborjrewily.exe
  "C:\Users\Admin\AppData\Local\Temp\yborjrewily.exe" "c:\users\admin\appdata\local\temp\7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372.exe"
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Adds policy Run key to start application
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System policy modification
  PID:1940

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cvnerifpnxyhajhvo.exe

Filesize
1016KB

MD5
7b392c5d219968a687bbcd35f46a9840

SHA1
88352c30b47b8791ee0b6269c665f617dd8dd4e2

SHA256
7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372

SHA512
b265c01b82bac0f7131bcdc60815c292e60b2a94a27aea6c67f66dca27c3b8c370258c3f5e6d45a8bf4be1929a1fc1b13541bca703a6ed7b09a7772089f06070

Download Submit
C:\Users\Admin\AppData\Local\Temp\jfaukeersfjvrdevrsfb.exe

Filesize
1016KB

MD5
7b392c5d219968a687bbcd35f46a9840

SHA1
88352c30b47b8791ee0b6269c665f617dd8dd4e2

SHA256
7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372

SHA512
b265c01b82bac0f7131bcdc60815c292e60b2a94a27aea6c67f66dca27c3b8c370258c3f5e6d45a8bf4be1929a1fc1b13541bca703a6ed7b09a7772089f06070

Download Submit
C:\Users\Admin\AppData\Local\Temp\jryegm.exe

Filesize
716KB

MD5
edfeeb073348e3bb8e0e2b8f41b0db79

SHA1
ef624fdaa7227bc7d412baec7f1088b5dfb92974

SHA256
b47b7cdc24777c727091f953540b47ed5354d1d1d080ac2229a34b0b72e5fe93

SHA512
cde4033c7d14daaa4c41d51025086f2318d4d3b26440f167bda5f4adb8c5ca3592f54a46b94587ad16ddf238010c05b214745ff05886ba18707de898e6802dd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\jryegm.exe

Filesize
716KB

MD5
edfeeb073348e3bb8e0e2b8f41b0db79

SHA1
ef624fdaa7227bc7d412baec7f1088b5dfb92974

SHA256
b47b7cdc24777c727091f953540b47ed5354d1d1d080ac2229a34b0b72e5fe93

SHA512
cde4033c7d14daaa4c41d51025086f2318d4d3b26440f167bda5f4adb8c5ca3592f54a46b94587ad16ddf238010c05b214745ff05886ba18707de898e6802dd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\jryegm.exe

Filesize
716KB

MD5
edfeeb073348e3bb8e0e2b8f41b0db79

SHA1
ef624fdaa7227bc7d412baec7f1088b5dfb92974

SHA256
b47b7cdc24777c727091f953540b47ed5354d1d1d080ac2229a34b0b72e5fe93

SHA512
cde4033c7d14daaa4c41d51025086f2318d4d3b26440f167bda5f4adb8c5ca3592f54a46b94587ad16ddf238010c05b214745ff05886ba18707de898e6802dd2

Download Submit
C:\Users\Admin\AppData\Local\Temp\lfyqewufeprbvfetnm.exe

Filesize
1016KB

MD5
7b392c5d219968a687bbcd35f46a9840

SHA1
88352c30b47b8791ee0b6269c665f617dd8dd4e2

SHA256
7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372

SHA512
b265c01b82bac0f7131bcdc60815c292e60b2a94a27aea6c67f66dca27c3b8c370258c3f5e6d45a8bf4be1929a1fc1b13541bca703a6ed7b09a7772089f06070

Download Submit
C:\Users\Admin\AppData\Local\Temp\pnkgyuwlodjxvjmfdgvtqm.exe

Filesize
1016KB

MD5
7b392c5d219968a687bbcd35f46a9840

SHA1
88352c30b47b8791ee0b6269c665f617dd8dd4e2

SHA256
7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372

SHA512
b265c01b82bac0f7131bcdc60815c292e60b2a94a27aea6c67f66dca27c3b8c370258c3f5e6d45a8bf4be1929a1fc1b13541bca703a6ed7b09a7772089f06070

Download Submit
C:\Users\Admin\AppData\Local\Temp\vneugwsbyhhphpmz.exe

Filesize
1016KB

MD5
7b392c5d219968a687bbcd35f46a9840

SHA1
88352c30b47b8791ee0b6269c665f617dd8dd4e2

SHA256
7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372

SHA512
b265c01b82bac0f7131bcdc60815c292e60b2a94a27aea6c67f66dca27c3b8c370258c3f5e6d45a8bf4be1929a1fc1b13541bca703a6ed7b09a7772089f06070

Download Submit
C:\Users\Admin\AppData\Local\Temp\wrletmlxxjmxsddtooa.exe

Filesize
1016KB

MD5
7b392c5d219968a687bbcd35f46a9840

SHA1
88352c30b47b8791ee0b6269c665f617dd8dd4e2

SHA256
7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372

SHA512
b265c01b82bac0f7131bcdc60815c292e60b2a94a27aea6c67f66dca27c3b8c370258c3f5e6d45a8bf4be1929a1fc1b13541bca703a6ed7b09a7772089f06070

Download Submit
C:\Users\Admin\AppData\Local\Temp\yborjrewily.exe

Filesize
320KB

MD5
84430b3c9e730b55e2c1950d60f730f8

SHA1
995ad5c2ebc426218f63141da3f86a9e54e65712

SHA256
e60091c34badb5637a8318882247746ba31d5f96738e94d460162f2a1487f37e

SHA512
e6b7a7f920611cf5f6d47275f219be671d74c7fa6cb33f5b368623cd1f788ba3c05ac98a0976be59176ea6321c7fa32d10c3b0e3c71a6f27a636b808b41863dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\yborjrewily.exe

Filesize
320KB

MD5
84430b3c9e730b55e2c1950d60f730f8

SHA1
995ad5c2ebc426218f63141da3f86a9e54e65712

SHA256
e60091c34badb5637a8318882247746ba31d5f96738e94d460162f2a1487f37e

SHA512
e6b7a7f920611cf5f6d47275f219be671d74c7fa6cb33f5b368623cd1f788ba3c05ac98a0976be59176ea6321c7fa32d10c3b0e3c71a6f27a636b808b41863dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\yborjrewily.exe

Filesize
320KB

MD5
84430b3c9e730b55e2c1950d60f730f8

SHA1
995ad5c2ebc426218f63141da3f86a9e54e65712

SHA256
e60091c34badb5637a8318882247746ba31d5f96738e94d460162f2a1487f37e

SHA512
e6b7a7f920611cf5f6d47275f219be671d74c7fa6cb33f5b368623cd1f788ba3c05ac98a0976be59176ea6321c7fa32d10c3b0e3c71a6f27a636b808b41863dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\yvrmdyznpdivsfhzwymjf.exe

Filesize
1016KB

MD5
7b392c5d219968a687bbcd35f46a9840

SHA1
88352c30b47b8791ee0b6269c665f617dd8dd4e2

SHA256
7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372

SHA512
b265c01b82bac0f7131bcdc60815c292e60b2a94a27aea6c67f66dca27c3b8c370258c3f5e6d45a8bf4be1929a1fc1b13541bca703a6ed7b09a7772089f06070

Download Submit
C:\Windows\SysWOW64\cvnerifpnxyhajhvo.exe

Filesize
1016KB

MD5
7b392c5d219968a687bbcd35f46a9840

SHA1
88352c30b47b8791ee0b6269c665f617dd8dd4e2

SHA256
7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372

SHA512
b265c01b82bac0f7131bcdc60815c292e60b2a94a27aea6c67f66dca27c3b8c370258c3f5e6d45a8bf4be1929a1fc1b13541bca703a6ed7b09a7772089f06070

Download Submit
C:\Windows\SysWOW64\jfaukeersfjvrdevrsfb.exe

Filesize
1016KB

MD5
7b392c5d219968a687bbcd35f46a9840

SHA1
88352c30b47b8791ee0b6269c665f617dd8dd4e2

SHA256
7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372

SHA512
b265c01b82bac0f7131bcdc60815c292e60b2a94a27aea6c67f66dca27c3b8c370258c3f5e6d45a8bf4be1929a1fc1b13541bca703a6ed7b09a7772089f06070

Download Submit
C:\Windows\SysWOW64\lfyqewufeprbvfetnm.exe

Filesize
1016KB

MD5
7b392c5d219968a687bbcd35f46a9840

SHA1
88352c30b47b8791ee0b6269c665f617dd8dd4e2

SHA256
7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372

SHA512
b265c01b82bac0f7131bcdc60815c292e60b2a94a27aea6c67f66dca27c3b8c370258c3f5e6d45a8bf4be1929a1fc1b13541bca703a6ed7b09a7772089f06070

Download Submit
C:\Windows\SysWOW64\pnkgyuwlodjxvjmfdgvtqm.exe

Filesize
1016KB

MD5
7b392c5d219968a687bbcd35f46a9840

SHA1
88352c30b47b8791ee0b6269c665f617dd8dd4e2

SHA256
7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372

SHA512
b265c01b82bac0f7131bcdc60815c292e60b2a94a27aea6c67f66dca27c3b8c370258c3f5e6d45a8bf4be1929a1fc1b13541bca703a6ed7b09a7772089f06070

Download Submit
C:\Windows\SysWOW64\vneugwsbyhhphpmz.exe

Filesize
1016KB

MD5
7b392c5d219968a687bbcd35f46a9840

SHA1
88352c30b47b8791ee0b6269c665f617dd8dd4e2

SHA256
7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372

SHA512
b265c01b82bac0f7131bcdc60815c292e60b2a94a27aea6c67f66dca27c3b8c370258c3f5e6d45a8bf4be1929a1fc1b13541bca703a6ed7b09a7772089f06070

Download Submit
C:\Windows\SysWOW64\wrletmlxxjmxsddtooa.exe

Filesize
1016KB

MD5
7b392c5d219968a687bbcd35f46a9840

SHA1
88352c30b47b8791ee0b6269c665f617dd8dd4e2

SHA256
7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372

SHA512
b265c01b82bac0f7131bcdc60815c292e60b2a94a27aea6c67f66dca27c3b8c370258c3f5e6d45a8bf4be1929a1fc1b13541bca703a6ed7b09a7772089f06070

Download Submit
C:\Windows\SysWOW64\yvrmdyznpdivsfhzwymjf.exe

Filesize
1016KB

MD5
7b392c5d219968a687bbcd35f46a9840

SHA1
88352c30b47b8791ee0b6269c665f617dd8dd4e2

SHA256
7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372

SHA512
b265c01b82bac0f7131bcdc60815c292e60b2a94a27aea6c67f66dca27c3b8c370258c3f5e6d45a8bf4be1929a1fc1b13541bca703a6ed7b09a7772089f06070

Download Submit
C:\Windows\cvnerifpnxyhajhvo.exe

Filesize
1016KB

MD5
7b392c5d219968a687bbcd35f46a9840

SHA1
88352c30b47b8791ee0b6269c665f617dd8dd4e2

SHA256
7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372

SHA512
b265c01b82bac0f7131bcdc60815c292e60b2a94a27aea6c67f66dca27c3b8c370258c3f5e6d45a8bf4be1929a1fc1b13541bca703a6ed7b09a7772089f06070

Download Submit
C:\Windows\cvnerifpnxyhajhvo.exe

Filesize
1016KB

MD5
7b392c5d219968a687bbcd35f46a9840

SHA1
88352c30b47b8791ee0b6269c665f617dd8dd4e2

SHA256
7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372

SHA512
b265c01b82bac0f7131bcdc60815c292e60b2a94a27aea6c67f66dca27c3b8c370258c3f5e6d45a8bf4be1929a1fc1b13541bca703a6ed7b09a7772089f06070

Download Submit
C:\Windows\jfaukeersfjvrdevrsfb.exe

Filesize
1016KB

MD5
7b392c5d219968a687bbcd35f46a9840

SHA1
88352c30b47b8791ee0b6269c665f617dd8dd4e2

SHA256
7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372

SHA512
b265c01b82bac0f7131bcdc60815c292e60b2a94a27aea6c67f66dca27c3b8c370258c3f5e6d45a8bf4be1929a1fc1b13541bca703a6ed7b09a7772089f06070

Download Submit
C:\Windows\jfaukeersfjvrdevrsfb.exe

Filesize
1016KB

MD5
7b392c5d219968a687bbcd35f46a9840

SHA1
88352c30b47b8791ee0b6269c665f617dd8dd4e2

SHA256
7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372

SHA512
b265c01b82bac0f7131bcdc60815c292e60b2a94a27aea6c67f66dca27c3b8c370258c3f5e6d45a8bf4be1929a1fc1b13541bca703a6ed7b09a7772089f06070

Download Submit
C:\Windows\jfaukeersfjvrdevrsfb.exe

Filesize
1016KB

MD5
7b392c5d219968a687bbcd35f46a9840

SHA1
88352c30b47b8791ee0b6269c665f617dd8dd4e2

SHA256
7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372

SHA512
b265c01b82bac0f7131bcdc60815c292e60b2a94a27aea6c67f66dca27c3b8c370258c3f5e6d45a8bf4be1929a1fc1b13541bca703a6ed7b09a7772089f06070

Download Submit
C:\Windows\lfyqewufeprbvfetnm.exe

Filesize
1016KB

MD5
7b392c5d219968a687bbcd35f46a9840

SHA1
88352c30b47b8791ee0b6269c665f617dd8dd4e2

SHA256
7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372

SHA512
b265c01b82bac0f7131bcdc60815c292e60b2a94a27aea6c67f66dca27c3b8c370258c3f5e6d45a8bf4be1929a1fc1b13541bca703a6ed7b09a7772089f06070

Download Submit
C:\Windows\lfyqewufeprbvfetnm.exe

Filesize
1016KB

MD5
7b392c5d219968a687bbcd35f46a9840

SHA1
88352c30b47b8791ee0b6269c665f617dd8dd4e2

SHA256
7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372

SHA512
b265c01b82bac0f7131bcdc60815c292e60b2a94a27aea6c67f66dca27c3b8c370258c3f5e6d45a8bf4be1929a1fc1b13541bca703a6ed7b09a7772089f06070

Download Submit
C:\Windows\lfyqewufeprbvfetnm.exe

Filesize
1016KB

MD5
7b392c5d219968a687bbcd35f46a9840

SHA1
88352c30b47b8791ee0b6269c665f617dd8dd4e2

SHA256
7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372

SHA512
b265c01b82bac0f7131bcdc60815c292e60b2a94a27aea6c67f66dca27c3b8c370258c3f5e6d45a8bf4be1929a1fc1b13541bca703a6ed7b09a7772089f06070

Download Submit
C:\Windows\pnkgyuwlodjxvjmfdgvtqm.exe

Filesize
1016KB

MD5
7b392c5d219968a687bbcd35f46a9840

SHA1
88352c30b47b8791ee0b6269c665f617dd8dd4e2

SHA256
7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372

SHA512
b265c01b82bac0f7131bcdc60815c292e60b2a94a27aea6c67f66dca27c3b8c370258c3f5e6d45a8bf4be1929a1fc1b13541bca703a6ed7b09a7772089f06070

Download Submit
C:\Windows\pnkgyuwlodjxvjmfdgvtqm.exe

Filesize
1016KB

MD5
7b392c5d219968a687bbcd35f46a9840

SHA1
88352c30b47b8791ee0b6269c665f617dd8dd4e2

SHA256
7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372

SHA512
b265c01b82bac0f7131bcdc60815c292e60b2a94a27aea6c67f66dca27c3b8c370258c3f5e6d45a8bf4be1929a1fc1b13541bca703a6ed7b09a7772089f06070

Download Submit
C:\Windows\pnkgyuwlodjxvjmfdgvtqm.exe

Filesize
1016KB

MD5
7b392c5d219968a687bbcd35f46a9840

SHA1
88352c30b47b8791ee0b6269c665f617dd8dd4e2

SHA256
7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372

SHA512
b265c01b82bac0f7131bcdc60815c292e60b2a94a27aea6c67f66dca27c3b8c370258c3f5e6d45a8bf4be1929a1fc1b13541bca703a6ed7b09a7772089f06070

Download Submit
C:\Windows\vneugwsbyhhphpmz.exe

Filesize
1016KB

MD5
7b392c5d219968a687bbcd35f46a9840

SHA1
88352c30b47b8791ee0b6269c665f617dd8dd4e2

SHA256
7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372

SHA512
b265c01b82bac0f7131bcdc60815c292e60b2a94a27aea6c67f66dca27c3b8c370258c3f5e6d45a8bf4be1929a1fc1b13541bca703a6ed7b09a7772089f06070

Download Submit
C:\Windows\vneugwsbyhhphpmz.exe

Filesize
1016KB

MD5
7b392c5d219968a687bbcd35f46a9840

SHA1
88352c30b47b8791ee0b6269c665f617dd8dd4e2

SHA256
7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372

SHA512
b265c01b82bac0f7131bcdc60815c292e60b2a94a27aea6c67f66dca27c3b8c370258c3f5e6d45a8bf4be1929a1fc1b13541bca703a6ed7b09a7772089f06070

Download Submit
C:\Windows\vneugwsbyhhphpmz.exe

Filesize
1016KB

MD5
7b392c5d219968a687bbcd35f46a9840

SHA1
88352c30b47b8791ee0b6269c665f617dd8dd4e2

SHA256
7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372

SHA512
b265c01b82bac0f7131bcdc60815c292e60b2a94a27aea6c67f66dca27c3b8c370258c3f5e6d45a8bf4be1929a1fc1b13541bca703a6ed7b09a7772089f06070

Download Submit
C:\Windows\wrletmlxxjmxsddtooa.exe

Filesize
1016KB

MD5
7b392c5d219968a687bbcd35f46a9840

SHA1
88352c30b47b8791ee0b6269c665f617dd8dd4e2

SHA256
7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372

SHA512
b265c01b82bac0f7131bcdc60815c292e60b2a94a27aea6c67f66dca27c3b8c370258c3f5e6d45a8bf4be1929a1fc1b13541bca703a6ed7b09a7772089f06070

Download Submit
C:\Windows\wrletmlxxjmxsddtooa.exe

Filesize
1016KB

MD5
7b392c5d219968a687bbcd35f46a9840

SHA1
88352c30b47b8791ee0b6269c665f617dd8dd4e2

SHA256
7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372

SHA512
b265c01b82bac0f7131bcdc60815c292e60b2a94a27aea6c67f66dca27c3b8c370258c3f5e6d45a8bf4be1929a1fc1b13541bca703a6ed7b09a7772089f06070

Download Submit
C:\Windows\wrletmlxxjmxsddtooa.exe

Filesize
1016KB

MD5
7b392c5d219968a687bbcd35f46a9840

SHA1
88352c30b47b8791ee0b6269c665f617dd8dd4e2

SHA256
7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372

SHA512
b265c01b82bac0f7131bcdc60815c292e60b2a94a27aea6c67f66dca27c3b8c370258c3f5e6d45a8bf4be1929a1fc1b13541bca703a6ed7b09a7772089f06070

Download Submit
C:\Windows\yvrmdyznpdivsfhzwymjf.exe

Filesize
1016KB

MD5
7b392c5d219968a687bbcd35f46a9840

SHA1
88352c30b47b8791ee0b6269c665f617dd8dd4e2

SHA256
7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372

SHA512
b265c01b82bac0f7131bcdc60815c292e60b2a94a27aea6c67f66dca27c3b8c370258c3f5e6d45a8bf4be1929a1fc1b13541bca703a6ed7b09a7772089f06070

Download Submit
C:\Windows\yvrmdyznpdivsfhzwymjf.exe

Filesize
1016KB

MD5
7b392c5d219968a687bbcd35f46a9840

SHA1
88352c30b47b8791ee0b6269c665f617dd8dd4e2

SHA256
7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372

SHA512
b265c01b82bac0f7131bcdc60815c292e60b2a94a27aea6c67f66dca27c3b8c370258c3f5e6d45a8bf4be1929a1fc1b13541bca703a6ed7b09a7772089f06070

Download Submit
C:\Windows\yvrmdyznpdivsfhzwymjf.exe

Filesize
1016KB

MD5
7b392c5d219968a687bbcd35f46a9840

SHA1
88352c30b47b8791ee0b6269c665f617dd8dd4e2

SHA256
7f54f866cb45a430e2d725b6998b710a6c71472f56e07aa50f043899a2962372

SHA512
b265c01b82bac0f7131bcdc60815c292e60b2a94a27aea6c67f66dca27c3b8c370258c3f5e6d45a8bf4be1929a1fc1b13541bca703a6ed7b09a7772089f06070

Download Submit
memory/1940-168-0x0000000000000000-mapping.dmp

Download
memory/4188-132-0x0000000000000000-mapping.dmp

Download
memory/4576-138-0x0000000000000000-mapping.dmp

Download
memory/4704-135-0x0000000000000000-mapping.dmp

Download