787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733

Analysis

max time kernel
190s
max time network
195s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/10/2022, 19:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe
Size

1016KB
MD5

523c87bf5018c5910e80db98fb470380
SHA1

57b16953d631c70acc2a0f6d03f648e18b65df4c
SHA256

787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733
SHA512

5dbff5bae2cf94045ebdb37c612a79852cfb0357827689b64d3bf547b3f736eeefcaa4e90d7f15b4955bee6d92ebbcb7ac16c1ece0df556fb1d09ea90b1b13e3
SSDEEP

6144:HIXsL0tvrSVz1DnemeYbpsnEf78AoXh6KkiD0OofzA+/VygHUzx84a2lXUW:HIXsgtvm1De5YlOx6lzBH46Uzf7lXUW

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	kntfno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	kntfno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	yborjrewily.exe

UAC bypass 3 TTPs 13 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	kntfno.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	kntfno.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	kntfno.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	kntfno.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	kntfno.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	kntfno.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	kntfno.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	kntfno.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	yborjrewily.exe

Adds policy Run key to start application 2 TTPs 31 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zbgry = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wjzvnyrgsjhphpmz.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mrznxals = "drifykeuhzyhajhvo.exe"	kntfno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zbgry = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xngfaokcrlmxsddtoob.exe"	kntfno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zbgry = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mbtrlytkyrrbvfetnm.exe"	kntfno.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mrznxals = "xngfaokcrlmxsddtoob.exe"	kntfno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zbgry = "C:\\Users\\Admin\\AppData\\Local\\Temp\\drifykeuhzyhajhvo.exe"	kntfno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zbgry = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wjzvnyrgsjhphpmz.exe"	kntfno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mrznxals = "mbtrlytkyrrbvfetnm.exe"	kntfno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mrznxals = "drifykeuhzyhajhvo.exe"	yborjrewily.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	kntfno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zbgry = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mbtrlytkyrrbvfetnm.exe"	kntfno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mrznxals = "xngfaokcrlmxsddtoob.exe"	kntfno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zbgry = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kbvvrgdwmhjvrdevrsgx.exe"	kntfno.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zbgry = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kbvvrgdwmhjvrdevrsgx.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mrznxals = "kbvvrgdwmhjvrdevrsgx.exe"	kntfno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mrznxals = "mbtrlytkyrrbvfetnm.exe"	kntfno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mrznxals = "mbtrlytkyrrbvfetnm.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mrznxals = "drifykeuhzyhajhvo.exe"	kntfno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mrznxals = "kbvvrgdwmhjvrdevrsgx.exe"	yborjrewily.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	kntfno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mrznxals = "kbvvrgdwmhjvrdevrsgx.exe"	kntfno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zbgry = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xngfaokcrlmxsddtoob.exe"	kntfno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mrznxals = "wjzvnyrgsjhphpmz.exe"	kntfno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mrznxals = "wjzvnyrgsjhphpmz.exe"	kntfno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mrznxals = "zrmnkaysjfivsfhzwynfa.exe"	kntfno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zbgry = "C:\\Users\\Admin\\AppData\\Local\\Temp\\drifykeuhzyhajhvo.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zbgry = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zrmnkaysjfivsfhzwynfa.exe"	kntfno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mrznxals = "zrmnkaysjfivsfhzwynfa.exe"	kntfno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zbgry = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wjzvnyrgsjhphpmz.exe"	kntfno.exe

Disables RegEdit via registry modification 6 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	yborjrewily.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	kntfno.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	kntfno.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	kntfno.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	kntfno.exe

Executes dropped EXE 4 IoCs

pid	Process
1292	yborjrewily.exe
5104	kntfno.exe
2332	kntfno.exe
4256	yborjrewily.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	yborjrewily.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\djshswiqv = "xngfaokcrlmxsddtoob.exe"	kntfno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rzkbouiszle = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mbtrlytkyrrbvfetnm.exe ."	kntfno.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\xbivegq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\drifykeuhzyhajhvo.exe ."	kntfno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kntfno = "wjzvnyrgsjhphpmz.exe"	kntfno.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kntfno = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kbvvrgdwmhjvrdevrsgx.exe"	kntfno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oxjbpwlwerlp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mbtrlytkyrrbvfetnm.exe"	kntfno.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	yborjrewily.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	yborjrewily.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wdndpuhqwh = "kbvvrgdwmhjvrdevrsgx.exe ."	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xbivegq = "drifykeuhzyhajhvo.exe ."	kntfno.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wdndpuhqwh = "kbvvrgdwmhjvrdevrsgx.exe ."	kntfno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rzkbouiszle = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xngfaokcrlmxsddtoob.exe ."	kntfno.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\djshswiqv = "wjzvnyrgsjhphpmz.exe"	kntfno.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\xbivegq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kbvvrgdwmhjvrdevrsgx.exe ."	kntfno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kntfno = "kbvvrgdwmhjvrdevrsgx.exe"	kntfno.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kntfno = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wjzvnyrgsjhphpmz.exe"	kntfno.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\xbivegq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wjzvnyrgsjhphpmz.exe ."	kntfno.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wdndpuhqwh = "kbvvrgdwmhjvrdevrsgx.exe ."	kntfno.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kntfno = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wjzvnyrgsjhphpmz.exe"	kntfno.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kntfno = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zrmnkaysjfivsfhzwynfa.exe"	kntfno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oxjbpwlwerlp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zrmnkaysjfivsfhzwynfa.exe"	kntfno.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\djshswiqv = "mbtrlytkyrrbvfetnm.exe"	kntfno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kntfno = "wjzvnyrgsjhphpmz.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\djshswiqv = "kbvvrgdwmhjvrdevrsgx.exe"	kntfno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rzkbouiszle = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zrmnkaysjfivsfhzwynfa.exe ."	kntfno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oxjbpwlwerlp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\drifykeuhzyhajhvo.exe"	kntfno.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	yborjrewily.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kntfno = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zrmnkaysjfivsfhzwynfa.exe"	kntfno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xbivegq = "mbtrlytkyrrbvfetnm.exe ."	yborjrewily.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	kntfno.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\djshswiqv = "xngfaokcrlmxsddtoob.exe"	kntfno.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wdndpuhqwh = "mbtrlytkyrrbvfetnm.exe ."	kntfno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xbivegq = "zrmnkaysjfivsfhzwynfa.exe ."	kntfno.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	kntfno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oxjbpwlwerlp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wjzvnyrgsjhphpmz.exe"	kntfno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xbivegq = "mbtrlytkyrrbvfetnm.exe ."	kntfno.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wdndpuhqwh = "drifykeuhzyhajhvo.exe ."	kntfno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kntfno = "wjzvnyrgsjhphpmz.exe"	kntfno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rzkbouiszle = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wjzvnyrgsjhphpmz.exe ."	kntfno.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kntfno = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wjzvnyrgsjhphpmz.exe"	yborjrewily.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	kntfno.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\xbivegq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xngfaokcrlmxsddtoob.exe ."	kntfno.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\djshswiqv = "wjzvnyrgsjhphpmz.exe"	kntfno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kntfno = "drifykeuhzyhajhvo.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xbivegq = "kbvvrgdwmhjvrdevrsgx.exe ."	kntfno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rzkbouiszle = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kbvvrgdwmhjvrdevrsgx.exe ."	kntfno.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	yborjrewily.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kntfno = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mbtrlytkyrrbvfetnm.exe"	yborjrewily.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	kntfno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kntfno = "drifykeuhzyhajhvo.exe"	kntfno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rzkbouiszle = "C:\\Users\\Admin\\AppData\\Local\\Temp\\drifykeuhzyhajhvo.exe ."	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oxjbpwlwerlp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xngfaokcrlmxsddtoob.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\xbivegq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zrmnkaysjfivsfhzwynfa.exe ."	yborjrewily.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	kntfno.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\xbivegq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wjzvnyrgsjhphpmz.exe ."	kntfno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xbivegq = "drifykeuhzyhajhvo.exe ."	kntfno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xbivegq = "zrmnkaysjfivsfhzwynfa.exe ."	kntfno.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wdndpuhqwh = "wjzvnyrgsjhphpmz.exe ."	kntfno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oxjbpwlwerlp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zrmnkaysjfivsfhzwynfa.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oxjbpwlwerlp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zrmnkaysjfivsfhzwynfa.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wdndpuhqwh = "xngfaokcrlmxsddtoob.exe ."	kntfno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oxjbpwlwerlp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wjzvnyrgsjhphpmz.exe"	kntfno.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\djshswiqv = "zrmnkaysjfivsfhzwynfa.exe"	kntfno.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rzkbouiszle = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xngfaokcrlmxsddtoob.exe ."	kntfno.exe

Checks whether UAC is enabled 1 TTPs 8 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	kntfno.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	kntfno.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	kntfno.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	kntfno.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	yborjrewily.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	yborjrewily.exe

Looks up external IP address via web service 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
39	www.showmyipaddress.com
70	whatismyip.everdot.org
77	whatismyip.everdot.org
33	whatismyip.everdot.org
36	whatismyipaddress.com

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\autorun.inf	kntfno.exe
File created	C:\autorun.inf	kntfno.exe

Drops file in System32 directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\kbvvrgdwmhjvrdevrsgx.exe	kntfno.exe
File opened for modification	C:\Windows\SysWOW64\drifykeuhzyhajhvo.exe	kntfno.exe
File opened for modification	C:\Windows\SysWOW64\mbtrlytkyrrbvfetnm.exe	kntfno.exe
File opened for modification	C:\Windows\SysWOW64\xngfaokcrlmxsddtoob.exe	kntfno.exe
File opened for modification	C:\Windows\SysWOW64\mbtrlytkyrrbvfetnm.exe	kntfno.exe
File opened for modification	C:\Windows\SysWOW64\drifykeuhzyhajhvo.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\drifykeuhzyhajhvo.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\zrmnkaysjfivsfhzwynfa.exe	kntfno.exe
File opened for modification	C:\Windows\SysWOW64\zrmnkaysjfivsfhzwynfa.exe	kntfno.exe
File opened for modification	C:\Windows\SysWOW64\oxjbpwlwerlpdhajxqwfrjxetemztxlpir.yen	kntfno.exe
File created	C:\Windows\SysWOW64\oxjbpwlwerlpdhajxqwfrjxetemztxlpir.yen	kntfno.exe
File opened for modification	C:\Windows\SysWOW64\zrmnkaysjfivsfhzwynfa.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\drifykeuhzyhajhvo.exe	kntfno.exe
File opened for modification	C:\Windows\SysWOW64\xngfaokcrlmxsddtoob.exe	kntfno.exe
File opened for modification	C:\Windows\SysWOW64\kbvvrgdwmhjvrdevrsgx.exe	kntfno.exe
File opened for modification	C:\Windows\SysWOW64\bzahkgkkhjslohpnqytrszc.ccz	kntfno.exe
File opened for modification	C:\Windows\SysWOW64\xngfaokcrlmxsddtoob.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\kbvvrgdwmhjvrdevrsgx.exe	yborjrewily.exe
File created	C:\Windows\SysWOW64\bzahkgkkhjslohpnqytrszc.ccz	kntfno.exe
File opened for modification	C:\Windows\SysWOW64\mbtrlytkyrrbvfetnm.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\zrmnkaysjfivsfhzwynfa.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\wjzvnyrgsjhphpmz.exe	kntfno.exe
File opened for modification	C:\Windows\SysWOW64\qjfhfwvqifjxvjmfdgwpln.exe	kntfno.exe
File opened for modification	C:\Windows\SysWOW64\mbtrlytkyrrbvfetnm.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\xngfaokcrlmxsddtoob.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\wjzvnyrgsjhphpmz.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\kbvvrgdwmhjvrdevrsgx.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\wjzvnyrgsjhphpmz.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\qjfhfwvqifjxvjmfdgwpln.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\qjfhfwvqifjxvjmfdgwpln.exe	kntfno.exe
File opened for modification	C:\Windows\SysWOW64\wjzvnyrgsjhphpmz.exe	kntfno.exe
File opened for modification	C:\Windows\SysWOW64\qjfhfwvqifjxvjmfdgwpln.exe	yborjrewily.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\oxjbpwlwerlpdhajxqwfrjxetemztxlpir.yen	kntfno.exe
File opened for modification	C:\Program Files (x86)\bzahkgkkhjslohpnqytrszc.ccz	kntfno.exe
File created	C:\Program Files (x86)\bzahkgkkhjslohpnqytrszc.ccz	kntfno.exe
File opened for modification	C:\Program Files (x86)\oxjbpwlwerlpdhajxqwfrjxetemztxlpir.yen	kntfno.exe

Drops file in Windows directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Windows\wjzvnyrgsjhphpmz.exe	yborjrewily.exe
File opened for modification	C:\Windows\kbvvrgdwmhjvrdevrsgx.exe	kntfno.exe
File opened for modification	C:\Windows\drifykeuhzyhajhvo.exe	kntfno.exe
File opened for modification	C:\Windows\zrmnkaysjfivsfhzwynfa.exe	kntfno.exe
File opened for modification	C:\Windows\qjfhfwvqifjxvjmfdgwpln.exe	kntfno.exe
File created	C:\Windows\bzahkgkkhjslohpnqytrszc.ccz	kntfno.exe
File opened for modification	C:\Windows\drifykeuhzyhajhvo.exe	kntfno.exe
File opened for modification	C:\Windows\xngfaokcrlmxsddtoob.exe	kntfno.exe
File opened for modification	C:\Windows\zrmnkaysjfivsfhzwynfa.exe	kntfno.exe
File opened for modification	C:\Windows\wjzvnyrgsjhphpmz.exe	kntfno.exe
File opened for modification	C:\Windows\mbtrlytkyrrbvfetnm.exe	kntfno.exe
File opened for modification	C:\Windows\qjfhfwvqifjxvjmfdgwpln.exe	yborjrewily.exe
File opened for modification	C:\Windows\mbtrlytkyrrbvfetnm.exe	yborjrewily.exe
File opened for modification	C:\Windows\xngfaokcrlmxsddtoob.exe	yborjrewily.exe
File opened for modification	C:\Windows\mbtrlytkyrrbvfetnm.exe	yborjrewily.exe
File opened for modification	C:\Windows\xngfaokcrlmxsddtoob.exe	yborjrewily.exe
File opened for modification	C:\Windows\zrmnkaysjfivsfhzwynfa.exe	yborjrewily.exe
File opened for modification	C:\Windows\kbvvrgdwmhjvrdevrsgx.exe	kntfno.exe
File opened for modification	C:\Windows\wjzvnyrgsjhphpmz.exe	yborjrewily.exe
File opened for modification	C:\Windows\mbtrlytkyrrbvfetnm.exe	kntfno.exe
File opened for modification	C:\Windows\xngfaokcrlmxsddtoob.exe	kntfno.exe
File opened for modification	C:\Windows\bzahkgkkhjslohpnqytrszc.ccz	kntfno.exe
File created	C:\Windows\oxjbpwlwerlpdhajxqwfrjxetemztxlpir.yen	kntfno.exe
File opened for modification	C:\Windows\wjzvnyrgsjhphpmz.exe	kntfno.exe
File opened for modification	C:\Windows\zrmnkaysjfivsfhzwynfa.exe	yborjrewily.exe
File opened for modification	C:\Windows\kbvvrgdwmhjvrdevrsgx.exe	yborjrewily.exe
File opened for modification	C:\Windows\drifykeuhzyhajhvo.exe	yborjrewily.exe
File opened for modification	C:\Windows\kbvvrgdwmhjvrdevrsgx.exe	yborjrewily.exe
File opened for modification	C:\Windows\qjfhfwvqifjxvjmfdgwpln.exe	kntfno.exe
File opened for modification	C:\Windows\drifykeuhzyhajhvo.exe	yborjrewily.exe
File opened for modification	C:\Windows\qjfhfwvqifjxvjmfdgwpln.exe	yborjrewily.exe
File opened for modification	C:\Windows\oxjbpwlwerlpdhajxqwfrjxetemztxlpir.yen	kntfno.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
624	787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe
624	787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe
624	787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe
624	787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe
624	787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe
624	787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe
624	787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe
624	787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe
624	787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe
624	787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe
624	787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe
624	787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe
624	787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe
624	787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe
624	787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe
624	787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe
624	787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe
624	787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe
624	787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe
624	787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe
624	787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe
624	787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe
624	787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe
624	787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe
624	787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe
624	787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe
624	787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe
624	787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe
624	787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe
624	787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe
5104	kntfno.exe
5104	kntfno.exe
624	787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe
624	787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe
624	787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe
624	787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe
624	787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe
624	787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe
624	787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe
624	787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe
624	787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe
624	787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe
624	787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe
624	787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe
624	787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe
624	787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe
624	787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe
624	787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe
624	787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe
624	787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe
624	787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe
624	787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe
624	787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe
624	787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe
624	787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe
624	787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe
5104	kntfno.exe
5104	kntfno.exe
624	787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe
624	787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe
624	787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe
624	787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe
624	787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe
624	787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5104	kntfno.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 624 wrote to memory of 1292	624	787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe	84
PID 624 wrote to memory of 1292	624	787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe	84
PID 624 wrote to memory of 1292	624	787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe	84
PID 1292 wrote to memory of 5104	1292	yborjrewily.exe	85
PID 1292 wrote to memory of 5104	1292	yborjrewily.exe	85
PID 1292 wrote to memory of 5104	1292	yborjrewily.exe	85
PID 1292 wrote to memory of 2332	1292	yborjrewily.exe	86
PID 1292 wrote to memory of 2332	1292	yborjrewily.exe	86
PID 1292 wrote to memory of 2332	1292	yborjrewily.exe	86
PID 624 wrote to memory of 4256	624	787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe	94
PID 624 wrote to memory of 4256	624	787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe	94
PID 624 wrote to memory of 4256	624	787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe	94

System policy modification 1 TTPs 41 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	kntfno.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	kntfno.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	kntfno.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	kntfno.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	kntfno.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	kntfno.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	yborjrewily.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	kntfno.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	kntfno.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	kntfno.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	kntfno.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	yborjrewily.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	kntfno.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	kntfno.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	kntfno.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	kntfno.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	yborjrewily.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	kntfno.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	kntfno.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	kntfno.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	kntfno.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	kntfno.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	kntfno.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	kntfno.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	kntfno.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	kntfno.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	kntfno.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	kntfno.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	kntfno.exe

C:\Users\Admin\AppData\Local\Temp\787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe
"C:\Users\Admin\AppData\Local\Temp\787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:624
- C:\Users\Admin\AppData\Local\Temp\yborjrewily.exe
  "C:\Users\Admin\AppData\Local\Temp\yborjrewily.exe" "c:\users\admin\appdata\local\temp\787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe*"
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Adds policy Run key to start application
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Checks computer location settings
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1292
- - C:\Users\Admin\AppData\Local\Temp\kntfno.exe
    "C:\Users\Admin\AppData\Local\Temp\kntfno.exe" "-C:\Users\Admin\AppData\Local\Temp\wjzvnyrgsjhphpmz.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops autorun.inf file
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - System policy modification
    PID:5104
- - C:\Users\Admin\AppData\Local\Temp\kntfno.exe
    "C:\Users\Admin\AppData\Local\Temp\kntfno.exe" "-C:\Users\Admin\AppData\Local\Temp\wjzvnyrgsjhphpmz.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System policy modification
    PID:2332
- C:\Users\Admin\AppData\Local\Temp\yborjrewily.exe
  "C:\Users\Admin\AppData\Local\Temp\yborjrewily.exe" "c:\users\admin\appdata\local\temp\787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733.exe"
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Adds policy Run key to start application
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System policy modification
  PID:4256

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\drifykeuhzyhajhvo.exe

Filesize
1016KB

MD5
523c87bf5018c5910e80db98fb470380

SHA1
57b16953d631c70acc2a0f6d03f648e18b65df4c

SHA256
787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733

SHA512
5dbff5bae2cf94045ebdb37c612a79852cfb0357827689b64d3bf547b3f736eeefcaa4e90d7f15b4955bee6d92ebbcb7ac16c1ece0df556fb1d09ea90b1b13e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\kbvvrgdwmhjvrdevrsgx.exe

Filesize
1016KB

MD5
523c87bf5018c5910e80db98fb470380

SHA1
57b16953d631c70acc2a0f6d03f648e18b65df4c

SHA256
787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733

SHA512
5dbff5bae2cf94045ebdb37c612a79852cfb0357827689b64d3bf547b3f736eeefcaa4e90d7f15b4955bee6d92ebbcb7ac16c1ece0df556fb1d09ea90b1b13e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\kntfno.exe

Filesize
712KB

MD5
ceebf09268394a0edff87be7b8c09a1a

SHA1
3d3f05b81903387e69f03a698ff77ea0f3ceb0e4

SHA256
6b3090185ba1cc9822b5d5a1a1a653685eb623e432aba21e1b25205bd41f38b5

SHA512
e8c5ebcc5d65a78a30712a6783c66e6a0d82dc6ce5a4adec5a591da4257ade5be052eb930460741711360407fe762f8071c83c14cfb0fe756efc9b3475b3e2b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\kntfno.exe

Filesize
712KB

MD5
ceebf09268394a0edff87be7b8c09a1a

SHA1
3d3f05b81903387e69f03a698ff77ea0f3ceb0e4

SHA256
6b3090185ba1cc9822b5d5a1a1a653685eb623e432aba21e1b25205bd41f38b5

SHA512
e8c5ebcc5d65a78a30712a6783c66e6a0d82dc6ce5a4adec5a591da4257ade5be052eb930460741711360407fe762f8071c83c14cfb0fe756efc9b3475b3e2b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\kntfno.exe

Filesize
712KB

MD5
ceebf09268394a0edff87be7b8c09a1a

SHA1
3d3f05b81903387e69f03a698ff77ea0f3ceb0e4

SHA256
6b3090185ba1cc9822b5d5a1a1a653685eb623e432aba21e1b25205bd41f38b5

SHA512
e8c5ebcc5d65a78a30712a6783c66e6a0d82dc6ce5a4adec5a591da4257ade5be052eb930460741711360407fe762f8071c83c14cfb0fe756efc9b3475b3e2b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\mbtrlytkyrrbvfetnm.exe

Filesize
1016KB

MD5
523c87bf5018c5910e80db98fb470380

SHA1
57b16953d631c70acc2a0f6d03f648e18b65df4c

SHA256
787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733

SHA512
5dbff5bae2cf94045ebdb37c612a79852cfb0357827689b64d3bf547b3f736eeefcaa4e90d7f15b4955bee6d92ebbcb7ac16c1ece0df556fb1d09ea90b1b13e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\qjfhfwvqifjxvjmfdgwpln.exe

Filesize
1016KB

MD5
523c87bf5018c5910e80db98fb470380

SHA1
57b16953d631c70acc2a0f6d03f648e18b65df4c

SHA256
787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733

SHA512
5dbff5bae2cf94045ebdb37c612a79852cfb0357827689b64d3bf547b3f736eeefcaa4e90d7f15b4955bee6d92ebbcb7ac16c1ece0df556fb1d09ea90b1b13e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\wjzvnyrgsjhphpmz.exe

Filesize
1016KB

MD5
523c87bf5018c5910e80db98fb470380

SHA1
57b16953d631c70acc2a0f6d03f648e18b65df4c

SHA256
787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733

SHA512
5dbff5bae2cf94045ebdb37c612a79852cfb0357827689b64d3bf547b3f736eeefcaa4e90d7f15b4955bee6d92ebbcb7ac16c1ece0df556fb1d09ea90b1b13e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\xngfaokcrlmxsddtoob.exe

Filesize
1016KB

MD5
523c87bf5018c5910e80db98fb470380

SHA1
57b16953d631c70acc2a0f6d03f648e18b65df4c

SHA256
787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733

SHA512
5dbff5bae2cf94045ebdb37c612a79852cfb0357827689b64d3bf547b3f736eeefcaa4e90d7f15b4955bee6d92ebbcb7ac16c1ece0df556fb1d09ea90b1b13e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\yborjrewily.exe

Filesize
320KB

MD5
361d19c016921bc880cc344276927ad2

SHA1
b20d2a1334fa419ffd6b943e848edfe04850e3f9

SHA256
d3e0b36db13f24964e4a8c20826015e46d7bfc6fdbe2e5c92c00b28b0f2bccff

SHA512
9e54afc047e5c8248b525bddf90f47447509e469fb175d041873218fffc5f507bf06d379ff4db87692c4bf93bddf4248527ed06513d14fdee496a31738611b68

Download Submit
C:\Users\Admin\AppData\Local\Temp\yborjrewily.exe

Filesize
320KB

MD5
361d19c016921bc880cc344276927ad2

SHA1
b20d2a1334fa419ffd6b943e848edfe04850e3f9

SHA256
d3e0b36db13f24964e4a8c20826015e46d7bfc6fdbe2e5c92c00b28b0f2bccff

SHA512
9e54afc047e5c8248b525bddf90f47447509e469fb175d041873218fffc5f507bf06d379ff4db87692c4bf93bddf4248527ed06513d14fdee496a31738611b68

Download Submit
C:\Users\Admin\AppData\Local\Temp\yborjrewily.exe

Filesize
320KB

MD5
361d19c016921bc880cc344276927ad2

SHA1
b20d2a1334fa419ffd6b943e848edfe04850e3f9

SHA256
d3e0b36db13f24964e4a8c20826015e46d7bfc6fdbe2e5c92c00b28b0f2bccff

SHA512
9e54afc047e5c8248b525bddf90f47447509e469fb175d041873218fffc5f507bf06d379ff4db87692c4bf93bddf4248527ed06513d14fdee496a31738611b68

Download Submit
C:\Users\Admin\AppData\Local\Temp\zrmnkaysjfivsfhzwynfa.exe

Filesize
1016KB

MD5
523c87bf5018c5910e80db98fb470380

SHA1
57b16953d631c70acc2a0f6d03f648e18b65df4c

SHA256
787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733

SHA512
5dbff5bae2cf94045ebdb37c612a79852cfb0357827689b64d3bf547b3f736eeefcaa4e90d7f15b4955bee6d92ebbcb7ac16c1ece0df556fb1d09ea90b1b13e3

Download Submit
C:\Windows\SysWOW64\drifykeuhzyhajhvo.exe

Filesize
1016KB

MD5
523c87bf5018c5910e80db98fb470380

SHA1
57b16953d631c70acc2a0f6d03f648e18b65df4c

SHA256
787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733

SHA512
5dbff5bae2cf94045ebdb37c612a79852cfb0357827689b64d3bf547b3f736eeefcaa4e90d7f15b4955bee6d92ebbcb7ac16c1ece0df556fb1d09ea90b1b13e3

Download Submit
C:\Windows\SysWOW64\kbvvrgdwmhjvrdevrsgx.exe

Filesize
1016KB

MD5
523c87bf5018c5910e80db98fb470380

SHA1
57b16953d631c70acc2a0f6d03f648e18b65df4c

SHA256
787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733

SHA512
5dbff5bae2cf94045ebdb37c612a79852cfb0357827689b64d3bf547b3f736eeefcaa4e90d7f15b4955bee6d92ebbcb7ac16c1ece0df556fb1d09ea90b1b13e3

Download Submit
C:\Windows\SysWOW64\mbtrlytkyrrbvfetnm.exe

Filesize
1016KB

MD5
523c87bf5018c5910e80db98fb470380

SHA1
57b16953d631c70acc2a0f6d03f648e18b65df4c

SHA256
787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733

SHA512
5dbff5bae2cf94045ebdb37c612a79852cfb0357827689b64d3bf547b3f736eeefcaa4e90d7f15b4955bee6d92ebbcb7ac16c1ece0df556fb1d09ea90b1b13e3

Download Submit
C:\Windows\SysWOW64\qjfhfwvqifjxvjmfdgwpln.exe

Filesize
1016KB

MD5
523c87bf5018c5910e80db98fb470380

SHA1
57b16953d631c70acc2a0f6d03f648e18b65df4c

SHA256
787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733

SHA512
5dbff5bae2cf94045ebdb37c612a79852cfb0357827689b64d3bf547b3f736eeefcaa4e90d7f15b4955bee6d92ebbcb7ac16c1ece0df556fb1d09ea90b1b13e3

Download Submit
C:\Windows\SysWOW64\wjzvnyrgsjhphpmz.exe

Filesize
1016KB

MD5
523c87bf5018c5910e80db98fb470380

SHA1
57b16953d631c70acc2a0f6d03f648e18b65df4c

SHA256
787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733

SHA512
5dbff5bae2cf94045ebdb37c612a79852cfb0357827689b64d3bf547b3f736eeefcaa4e90d7f15b4955bee6d92ebbcb7ac16c1ece0df556fb1d09ea90b1b13e3

Download Submit
C:\Windows\SysWOW64\xngfaokcrlmxsddtoob.exe

Filesize
1016KB

MD5
523c87bf5018c5910e80db98fb470380

SHA1
57b16953d631c70acc2a0f6d03f648e18b65df4c

SHA256
787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733

SHA512
5dbff5bae2cf94045ebdb37c612a79852cfb0357827689b64d3bf547b3f736eeefcaa4e90d7f15b4955bee6d92ebbcb7ac16c1ece0df556fb1d09ea90b1b13e3

Download Submit
C:\Windows\SysWOW64\zrmnkaysjfivsfhzwynfa.exe

Filesize
1016KB

MD5
523c87bf5018c5910e80db98fb470380

SHA1
57b16953d631c70acc2a0f6d03f648e18b65df4c

SHA256
787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733

SHA512
5dbff5bae2cf94045ebdb37c612a79852cfb0357827689b64d3bf547b3f736eeefcaa4e90d7f15b4955bee6d92ebbcb7ac16c1ece0df556fb1d09ea90b1b13e3

Download Submit
C:\Windows\drifykeuhzyhajhvo.exe

Filesize
1016KB

MD5
523c87bf5018c5910e80db98fb470380

SHA1
57b16953d631c70acc2a0f6d03f648e18b65df4c

SHA256
787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733

SHA512
5dbff5bae2cf94045ebdb37c612a79852cfb0357827689b64d3bf547b3f736eeefcaa4e90d7f15b4955bee6d92ebbcb7ac16c1ece0df556fb1d09ea90b1b13e3

Download Submit
C:\Windows\drifykeuhzyhajhvo.exe

Filesize
1016KB

MD5
523c87bf5018c5910e80db98fb470380

SHA1
57b16953d631c70acc2a0f6d03f648e18b65df4c

SHA256
787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733

SHA512
5dbff5bae2cf94045ebdb37c612a79852cfb0357827689b64d3bf547b3f736eeefcaa4e90d7f15b4955bee6d92ebbcb7ac16c1ece0df556fb1d09ea90b1b13e3

Download Submit
C:\Windows\drifykeuhzyhajhvo.exe

Filesize
1016KB

MD5
523c87bf5018c5910e80db98fb470380

SHA1
57b16953d631c70acc2a0f6d03f648e18b65df4c

SHA256
787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733

SHA512
5dbff5bae2cf94045ebdb37c612a79852cfb0357827689b64d3bf547b3f736eeefcaa4e90d7f15b4955bee6d92ebbcb7ac16c1ece0df556fb1d09ea90b1b13e3

Download Submit
C:\Windows\kbvvrgdwmhjvrdevrsgx.exe

Filesize
1016KB

MD5
523c87bf5018c5910e80db98fb470380

SHA1
57b16953d631c70acc2a0f6d03f648e18b65df4c

SHA256
787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733

SHA512
5dbff5bae2cf94045ebdb37c612a79852cfb0357827689b64d3bf547b3f736eeefcaa4e90d7f15b4955bee6d92ebbcb7ac16c1ece0df556fb1d09ea90b1b13e3

Download Submit
C:\Windows\kbvvrgdwmhjvrdevrsgx.exe

Filesize
1016KB

MD5
523c87bf5018c5910e80db98fb470380

SHA1
57b16953d631c70acc2a0f6d03f648e18b65df4c

SHA256
787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733

SHA512
5dbff5bae2cf94045ebdb37c612a79852cfb0357827689b64d3bf547b3f736eeefcaa4e90d7f15b4955bee6d92ebbcb7ac16c1ece0df556fb1d09ea90b1b13e3

Download Submit
C:\Windows\kbvvrgdwmhjvrdevrsgx.exe

Filesize
1016KB

MD5
523c87bf5018c5910e80db98fb470380

SHA1
57b16953d631c70acc2a0f6d03f648e18b65df4c

SHA256
787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733

SHA512
5dbff5bae2cf94045ebdb37c612a79852cfb0357827689b64d3bf547b3f736eeefcaa4e90d7f15b4955bee6d92ebbcb7ac16c1ece0df556fb1d09ea90b1b13e3

Download Submit
C:\Windows\mbtrlytkyrrbvfetnm.exe

Filesize
1016KB

MD5
523c87bf5018c5910e80db98fb470380

SHA1
57b16953d631c70acc2a0f6d03f648e18b65df4c

SHA256
787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733

SHA512
5dbff5bae2cf94045ebdb37c612a79852cfb0357827689b64d3bf547b3f736eeefcaa4e90d7f15b4955bee6d92ebbcb7ac16c1ece0df556fb1d09ea90b1b13e3

Download Submit
C:\Windows\mbtrlytkyrrbvfetnm.exe

Filesize
1016KB

MD5
523c87bf5018c5910e80db98fb470380

SHA1
57b16953d631c70acc2a0f6d03f648e18b65df4c

SHA256
787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733

SHA512
5dbff5bae2cf94045ebdb37c612a79852cfb0357827689b64d3bf547b3f736eeefcaa4e90d7f15b4955bee6d92ebbcb7ac16c1ece0df556fb1d09ea90b1b13e3

Download Submit
C:\Windows\mbtrlytkyrrbvfetnm.exe

Filesize
1016KB

MD5
523c87bf5018c5910e80db98fb470380

SHA1
57b16953d631c70acc2a0f6d03f648e18b65df4c

SHA256
787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733

SHA512
5dbff5bae2cf94045ebdb37c612a79852cfb0357827689b64d3bf547b3f736eeefcaa4e90d7f15b4955bee6d92ebbcb7ac16c1ece0df556fb1d09ea90b1b13e3

Download Submit
C:\Windows\qjfhfwvqifjxvjmfdgwpln.exe

Filesize
1016KB

MD5
523c87bf5018c5910e80db98fb470380

SHA1
57b16953d631c70acc2a0f6d03f648e18b65df4c

SHA256
787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733

SHA512
5dbff5bae2cf94045ebdb37c612a79852cfb0357827689b64d3bf547b3f736eeefcaa4e90d7f15b4955bee6d92ebbcb7ac16c1ece0df556fb1d09ea90b1b13e3

Download Submit
C:\Windows\qjfhfwvqifjxvjmfdgwpln.exe

Filesize
1016KB

MD5
523c87bf5018c5910e80db98fb470380

SHA1
57b16953d631c70acc2a0f6d03f648e18b65df4c

SHA256
787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733

SHA512
5dbff5bae2cf94045ebdb37c612a79852cfb0357827689b64d3bf547b3f736eeefcaa4e90d7f15b4955bee6d92ebbcb7ac16c1ece0df556fb1d09ea90b1b13e3

Download Submit
C:\Windows\qjfhfwvqifjxvjmfdgwpln.exe

Filesize
1016KB

MD5
523c87bf5018c5910e80db98fb470380

SHA1
57b16953d631c70acc2a0f6d03f648e18b65df4c

SHA256
787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733

SHA512
5dbff5bae2cf94045ebdb37c612a79852cfb0357827689b64d3bf547b3f736eeefcaa4e90d7f15b4955bee6d92ebbcb7ac16c1ece0df556fb1d09ea90b1b13e3

Download Submit
C:\Windows\wjzvnyrgsjhphpmz.exe

Filesize
1016KB

MD5
523c87bf5018c5910e80db98fb470380

SHA1
57b16953d631c70acc2a0f6d03f648e18b65df4c

SHA256
787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733

SHA512
5dbff5bae2cf94045ebdb37c612a79852cfb0357827689b64d3bf547b3f736eeefcaa4e90d7f15b4955bee6d92ebbcb7ac16c1ece0df556fb1d09ea90b1b13e3

Download Submit
C:\Windows\wjzvnyrgsjhphpmz.exe

Filesize
1016KB

MD5
523c87bf5018c5910e80db98fb470380

SHA1
57b16953d631c70acc2a0f6d03f648e18b65df4c

SHA256
787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733

SHA512
5dbff5bae2cf94045ebdb37c612a79852cfb0357827689b64d3bf547b3f736eeefcaa4e90d7f15b4955bee6d92ebbcb7ac16c1ece0df556fb1d09ea90b1b13e3

Download Submit
C:\Windows\wjzvnyrgsjhphpmz.exe

Filesize
1016KB

MD5
523c87bf5018c5910e80db98fb470380

SHA1
57b16953d631c70acc2a0f6d03f648e18b65df4c

SHA256
787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733

SHA512
5dbff5bae2cf94045ebdb37c612a79852cfb0357827689b64d3bf547b3f736eeefcaa4e90d7f15b4955bee6d92ebbcb7ac16c1ece0df556fb1d09ea90b1b13e3

Download Submit
C:\Windows\xngfaokcrlmxsddtoob.exe

Filesize
1016KB

MD5
523c87bf5018c5910e80db98fb470380

SHA1
57b16953d631c70acc2a0f6d03f648e18b65df4c

SHA256
787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733

SHA512
5dbff5bae2cf94045ebdb37c612a79852cfb0357827689b64d3bf547b3f736eeefcaa4e90d7f15b4955bee6d92ebbcb7ac16c1ece0df556fb1d09ea90b1b13e3

Download Submit
C:\Windows\xngfaokcrlmxsddtoob.exe

Filesize
1016KB

MD5
523c87bf5018c5910e80db98fb470380

SHA1
57b16953d631c70acc2a0f6d03f648e18b65df4c

SHA256
787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733

SHA512
5dbff5bae2cf94045ebdb37c612a79852cfb0357827689b64d3bf547b3f736eeefcaa4e90d7f15b4955bee6d92ebbcb7ac16c1ece0df556fb1d09ea90b1b13e3

Download Submit
C:\Windows\xngfaokcrlmxsddtoob.exe

Filesize
1016KB

MD5
523c87bf5018c5910e80db98fb470380

SHA1
57b16953d631c70acc2a0f6d03f648e18b65df4c

SHA256
787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733

SHA512
5dbff5bae2cf94045ebdb37c612a79852cfb0357827689b64d3bf547b3f736eeefcaa4e90d7f15b4955bee6d92ebbcb7ac16c1ece0df556fb1d09ea90b1b13e3

Download Submit
C:\Windows\zrmnkaysjfivsfhzwynfa.exe

Filesize
1016KB

MD5
523c87bf5018c5910e80db98fb470380

SHA1
57b16953d631c70acc2a0f6d03f648e18b65df4c

SHA256
787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733

SHA512
5dbff5bae2cf94045ebdb37c612a79852cfb0357827689b64d3bf547b3f736eeefcaa4e90d7f15b4955bee6d92ebbcb7ac16c1ece0df556fb1d09ea90b1b13e3

Download Submit
C:\Windows\zrmnkaysjfivsfhzwynfa.exe

Filesize
1016KB

MD5
523c87bf5018c5910e80db98fb470380

SHA1
57b16953d631c70acc2a0f6d03f648e18b65df4c

SHA256
787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733

SHA512
5dbff5bae2cf94045ebdb37c612a79852cfb0357827689b64d3bf547b3f736eeefcaa4e90d7f15b4955bee6d92ebbcb7ac16c1ece0df556fb1d09ea90b1b13e3

Download Submit
C:\Windows\zrmnkaysjfivsfhzwynfa.exe

Filesize
1016KB

MD5
523c87bf5018c5910e80db98fb470380

SHA1
57b16953d631c70acc2a0f6d03f648e18b65df4c

SHA256
787924f9f1fc2ab829f494f33414da98849acf0484e3602448aec68abeb3e733

SHA512
5dbff5bae2cf94045ebdb37c612a79852cfb0357827689b64d3bf547b3f736eeefcaa4e90d7f15b4955bee6d92ebbcb7ac16c1ece0df556fb1d09ea90b1b13e3

Download Submit