d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521

Analysis

max time kernel
151s
max time network
156s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 19:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe
Size

1016KB
MD5

a376e6995a4a3bfaecbb0fa8c444c4a0
SHA1

ca185ede4981a792dd1fc3e7222c3ebd89733ddf
SHA256

d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521
SHA512

7316171cc7a4cb36f277cad818dd66a1da0c32991f8b684b592b021e758ea81fa0e7d49ef5ec4453d8964c99a8149f9df6fe0be464030abd825766b0f58e8f6b
SSDEEP

6144:CIXsL0tvrSVz1DnemeYbpsnEf78AoXh6KkiD0OofzA+/VygHUmDa1is0f:CIXsgtvm1De5YlOx6lzBH46Umu1q

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	gokvcejrqyu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	bhotzjn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	bhotzjn.exe

UAC bypass 3 TTPs 9 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	gokvcejrqyu.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	bhotzjn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	bhotzjn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	bhotzjn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	bhotzjn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	bhotzjn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	bhotzjn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	bhotzjn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	bhotzjn.exe

Adds policy Run key to start application 2 TTPs 19 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nps = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qhzpgbqkbrzorjxgsh.exe"	bhotzjn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\otzdir = "dxslfdvsmfqiojambtrlg.exe"	bhotzjn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\otzdir = "ohbtmjawphrinhxiwnkd.exe"	bhotzjn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	bhotzjn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nps = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ohbtmjawphrinhxiwnkd.exe"	bhotzjn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nps = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hxodtnbukzguwnait.exe"	bhotzjn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\otzdir = "qhzpgbqkbrzorjxgsh.exe"	bhotzjn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nps = "C:\\Users\\Admin\\AppData\\Local\\Temp\\btmdvrhculukohwgtjf.exe"	bhotzjn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nps = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dxslfdvsmfqiojambtrlg.exe"	bhotzjn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nps = "C:\\Users\\Admin\\AppData\\Local\\Temp\\btmdvrhculukohwgtjf.exe"	gokvcejrqyu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nps = "C:\\Users\\Admin\\AppData\\Local\\Temp\\apftibogvjpcdtfm.exe"	bhotzjn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\otzdir = "dxslfdvsmfqiojambtrlg.exe"	bhotzjn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	gokvcejrqyu.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	bhotzjn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nps = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qhzpgbqkbrzorjxgsh.exe"	bhotzjn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\otzdir = "dxslfdvsmfqiojambtrlg.exe"	gokvcejrqyu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\otzdir = "btmdvrhculukohwgtjf.exe"	bhotzjn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\otzdir = "hxodtnbukzguwnait.exe"	bhotzjn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\otzdir = "qhzpgbqkbrzorjxgsh.exe"	bhotzjn.exe

Disables RegEdit via registry modification 6 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	bhotzjn.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	gokvcejrqyu.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	gokvcejrqyu.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	bhotzjn.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	bhotzjn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	bhotzjn.exe

Executes dropped EXE 3 IoCs

pid	Process
2004	gokvcejrqyu.exe
1716	bhotzjn.exe
1948	bhotzjn.exe

Loads dropped DLL 6 IoCs

pid	Process
1512	d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe
1512	d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe
2004	gokvcejrqyu.exe
2004	gokvcejrqyu.exe
2004	gokvcejrqyu.exe
2004	gokvcejrqyu.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ajtbkxeqzh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qhzpgbqkbrzorjxgsh.exe"	bhotzjn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\bhotzjn = "qhzpgbqkbrzorjxgsh.exe"	gokvcejrqyu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\uxbd = "btmdvrhculukohwgtjf.exe"	bhotzjn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\dhmpt = "btmdvrhculukohwgtjf.exe ."	bhotzjn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\uxbd = "ohbtmjawphrinhxiwnkd.exe"	bhotzjn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\uxbd = "qhzpgbqkbrzorjxgsh.exe"	bhotzjn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\bhotzjn = "apftibogvjpcdtfm.exe"	bhotzjn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\uxbd = "dxslfdvsmfqiojambtrlg.exe"	bhotzjn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\uxbd = "apftibogvjpcdtfm.exe"	bhotzjn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\dhmpt = "btmdvrhculukohwgtjf.exe ."	bhotzjn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\uxbd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hxodtnbukzguwnait.exe"	bhotzjn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\bhotzjn = "apftibogvjpcdtfm.exe"	bhotzjn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\qxflsdis = "qhzpgbqkbrzorjxgsh.exe ."	bhotzjn.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	gokvcejrqyu.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	bhotzjn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\qxflsdis = "apftibogvjpcdtfm.exe ."	bhotzjn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\dhmpt = "qhzpgbqkbrzorjxgsh.exe ."	bhotzjn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\qxflsdis = "dxslfdvsmfqiojambtrlg.exe ."	bhotzjn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\uxbd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hxodtnbukzguwnait.exe"	bhotzjn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\uxbd = "btmdvrhculukohwgtjf.exe"	gokvcejrqyu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\bhotzjn = "dxslfdvsmfqiojambtrlg.exe"	bhotzjn.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	bhotzjn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\hpyfnzfqy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dxslfdvsmfqiojambtrlg.exe ."	bhotzjn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ajtbkxeqzh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qhzpgbqkbrzorjxgsh.exe"	gokvcejrqyu.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	bhotzjn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\uxbd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\apftibogvjpcdtfm.exe"	bhotzjn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	gokvcejrqyu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\dhmpt = "ohbtmjawphrinhxiwnkd.exe ."	bhotzjn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\hpyfnzfqy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ohbtmjawphrinhxiwnkd.exe ."	bhotzjn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\dhmpt = "ohbtmjawphrinhxiwnkd.exe ."	bhotzjn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\bhotzjn = "dxslfdvsmfqiojambtrlg.exe"	bhotzjn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\uxbd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qhzpgbqkbrzorjxgsh.exe"	bhotzjn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\hpyfnzfqy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hxodtnbukzguwnait.exe ."	gokvcejrqyu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\hpyfnzfqy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\apftibogvjpcdtfm.exe ."	bhotzjn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ajtbkxeqzh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\apftibogvjpcdtfm.exe"	bhotzjn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ajtbkxeqzh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\apftibogvjpcdtfm.exe"	bhotzjn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\uxbd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dxslfdvsmfqiojambtrlg.exe"	gokvcejrqyu.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	bhotzjn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\qxflsdis = "ohbtmjawphrinhxiwnkd.exe ."	bhotzjn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\dhmpt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\btmdvrhculukohwgtjf.exe ."	bhotzjn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\uxbd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dxslfdvsmfqiojambtrlg.exe"	bhotzjn.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	gokvcejrqyu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\dhmpt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ohbtmjawphrinhxiwnkd.exe ."	gokvcejrqyu.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	bhotzjn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\hpyfnzfqy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hxodtnbukzguwnait.exe ."	bhotzjn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\dhmpt = "ohbtmjawphrinhxiwnkd.exe ."	gokvcejrqyu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\hpyfnzfqy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\apftibogvjpcdtfm.exe ."	bhotzjn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\uxbd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ohbtmjawphrinhxiwnkd.exe"	bhotzjn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\qxflsdis = "qhzpgbqkbrzorjxgsh.exe ."	bhotzjn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\hpyfnzfqy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ohbtmjawphrinhxiwnkd.exe ."	bhotzjn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\dhmpt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\btmdvrhculukohwgtjf.exe ."	bhotzjn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\dhmpt = "hxodtnbukzguwnait.exe ."	bhotzjn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\dhmpt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hxodtnbukzguwnait.exe ."	bhotzjn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	gokvcejrqyu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\qxflsdis = "ohbtmjawphrinhxiwnkd.exe ."	gokvcejrqyu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\uxbd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\btmdvrhculukohwgtjf.exe"	bhotzjn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ajtbkxeqzh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dxslfdvsmfqiojambtrlg.exe"	bhotzjn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\dhmpt = "apftibogvjpcdtfm.exe ."	bhotzjn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\qxflsdis = "btmdvrhculukohwgtjf.exe ."	bhotzjn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	bhotzjn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\dhmpt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qhzpgbqkbrzorjxgsh.exe ."	bhotzjn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\uxbd = "btmdvrhculukohwgtjf.exe"	bhotzjn.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	bhotzjn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\uxbd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dxslfdvsmfqiojambtrlg.exe"	bhotzjn.exe

Checks whether UAC is enabled 1 TTPs 6 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	bhotzjn.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	bhotzjn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	bhotzjn.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	bhotzjn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	gokvcejrqyu.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	gokvcejrqyu.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	www.showmyipaddress.com
10	whatismyipaddress.com
13	whatismyip.everdot.org

Drops file in System32 directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\ohbtmjawphrinhxiwnkd.exe	bhotzjn.exe
File opened for modification	C:\Windows\SysWOW64\dxslfdvsmfqiojambtrlg.exe	bhotzjn.exe
File opened for modification	C:\Windows\SysWOW64\uplfazsqlfrkrnfsibavrl.exe	bhotzjn.exe
File opened for modification	C:\Windows\SysWOW64\btmdvrhculukohwgtjf.exe	gokvcejrqyu.exe
File opened for modification	C:\Windows\SysWOW64\dxslfdvsmfqiojambtrlg.exe	gokvcejrqyu.exe
File opened for modification	C:\Windows\SysWOW64\uplfazsqlfrkrnfsibavrl.exe	gokvcejrqyu.exe
File opened for modification	C:\Windows\SysWOW64\qhzpgbqkbrzorjxgsh.exe	bhotzjn.exe
File opened for modification	C:\Windows\SysWOW64\btmdvrhculukohwgtjf.exe	bhotzjn.exe
File opened for modification	C:\Windows\SysWOW64\qhzpgbqkbrzorjxgsh.exe	bhotzjn.exe
File opened for modification	C:\Windows\SysWOW64\ohbtmjawphrinhxiwnkd.exe	bhotzjn.exe
File opened for modification	C:\Windows\SysWOW64\dxslfdvsmfqiojambtrlg.exe	bhotzjn.exe
File opened for modification	C:\Windows\SysWOW64\ohbtmjawphrinhxiwnkd.exe	gokvcejrqyu.exe
File opened for modification	C:\Windows\SysWOW64\apftibogvjpcdtfmwjcrhvkdqixlrefvhoylet.xmf	bhotzjn.exe
File opened for modification	C:\Windows\SysWOW64\dhmptbdkormoejkgfhptybfnpwa.yaq	bhotzjn.exe
File opened for modification	C:\Windows\SysWOW64\hxodtnbukzguwnait.exe	gokvcejrqyu.exe
File opened for modification	C:\Windows\SysWOW64\qhzpgbqkbrzorjxgsh.exe	gokvcejrqyu.exe
File opened for modification	C:\Windows\SysWOW64\hxodtnbukzguwnait.exe	bhotzjn.exe
File opened for modification	C:\Windows\SysWOW64\btmdvrhculukohwgtjf.exe	bhotzjn.exe
File created	C:\Windows\SysWOW64\apftibogvjpcdtfmwjcrhvkdqixlrefvhoylet.xmf	bhotzjn.exe
File opened for modification	C:\Windows\SysWOW64\apftibogvjpcdtfm.exe	gokvcejrqyu.exe
File opened for modification	C:\Windows\SysWOW64\uplfazsqlfrkrnfsibavrl.exe	bhotzjn.exe
File opened for modification	C:\Windows\SysWOW64\apftibogvjpcdtfm.exe	bhotzjn.exe
File opened for modification	C:\Windows\SysWOW64\hxodtnbukzguwnait.exe	bhotzjn.exe
File created	C:\Windows\SysWOW64\dhmptbdkormoejkgfhptybfnpwa.yaq	bhotzjn.exe
File opened for modification	C:\Windows\SysWOW64\apftibogvjpcdtfm.exe	bhotzjn.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\dhmptbdkormoejkgfhptybfnpwa.yaq	bhotzjn.exe
File opened for modification	C:\Program Files (x86)\apftibogvjpcdtfmwjcrhvkdqixlrefvhoylet.xmf	bhotzjn.exe
File created	C:\Program Files (x86)\apftibogvjpcdtfmwjcrhvkdqixlrefvhoylet.xmf	bhotzjn.exe
File opened for modification	C:\Program Files (x86)\dhmptbdkormoejkgfhptybfnpwa.yaq	bhotzjn.exe

Drops file in Windows directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ohbtmjawphrinhxiwnkd.exe	bhotzjn.exe
File opened for modification	C:\Windows\apftibogvjpcdtfm.exe	bhotzjn.exe
File created	C:\Windows\dhmptbdkormoejkgfhptybfnpwa.yaq	bhotzjn.exe
File opened for modification	C:\Windows\apftibogvjpcdtfmwjcrhvkdqixlrefvhoylet.xmf	bhotzjn.exe
File opened for modification	C:\Windows\apftibogvjpcdtfm.exe	gokvcejrqyu.exe
File opened for modification	C:\Windows\hxodtnbukzguwnait.exe	gokvcejrqyu.exe
File opened for modification	C:\Windows\dxslfdvsmfqiojambtrlg.exe	gokvcejrqyu.exe
File opened for modification	C:\Windows\qhzpgbqkbrzorjxgsh.exe	bhotzjn.exe
File opened for modification	C:\Windows\uplfazsqlfrkrnfsibavrl.exe	bhotzjn.exe
File opened for modification	C:\Windows\qhzpgbqkbrzorjxgsh.exe	bhotzjn.exe
File opened for modification	C:\Windows\dhmptbdkormoejkgfhptybfnpwa.yaq	bhotzjn.exe
File opened for modification	C:\Windows\hxodtnbukzguwnait.exe	bhotzjn.exe
File opened for modification	C:\Windows\btmdvrhculukohwgtjf.exe	bhotzjn.exe
File opened for modification	C:\Windows\dxslfdvsmfqiojambtrlg.exe	bhotzjn.exe
File opened for modification	C:\Windows\btmdvrhculukohwgtjf.exe	bhotzjn.exe
File opened for modification	C:\Windows\dxslfdvsmfqiojambtrlg.exe	bhotzjn.exe
File opened for modification	C:\Windows\qhzpgbqkbrzorjxgsh.exe	gokvcejrqyu.exe
File opened for modification	C:\Windows\btmdvrhculukohwgtjf.exe	gokvcejrqyu.exe
File opened for modification	C:\Windows\ohbtmjawphrinhxiwnkd.exe	gokvcejrqyu.exe
File opened for modification	C:\Windows\uplfazsqlfrkrnfsibavrl.exe	gokvcejrqyu.exe
File opened for modification	C:\Windows\apftibogvjpcdtfm.exe	bhotzjn.exe
File opened for modification	C:\Windows\hxodtnbukzguwnait.exe	bhotzjn.exe
File opened for modification	C:\Windows\ohbtmjawphrinhxiwnkd.exe	bhotzjn.exe
File opened for modification	C:\Windows\uplfazsqlfrkrnfsibavrl.exe	bhotzjn.exe
File created	C:\Windows\apftibogvjpcdtfmwjcrhvkdqixlrefvhoylet.xmf	bhotzjn.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1512	d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe
1512	d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe
1512	d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe
1512	d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe
1512	d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe
1512	d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe
1512	d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe
1512	d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe
1512	d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe
1512	d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe
1512	d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe
1512	d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe
1512	d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe
1512	d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe
1512	d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe
1512	d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe
1512	d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe
1512	d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe
1512	d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe
1512	d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe
1512	d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe
1512	d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe
1512	d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe
1512	d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe
1716	bhotzjn.exe
1512	d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe
1512	d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe
1512	d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe
1512	d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe
1512	d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe
1512	d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe
1512	d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe
1512	d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe
1512	d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe
1512	d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe
1512	d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe
1512	d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe
1512	d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe
1512	d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe
1512	d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe
1512	d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe
1512	d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe
1512	d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe
1512	d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe
1512	d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe
1512	d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe
1512	d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe
1512	d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe
1512	d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe
1512	d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe
1512	d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe
1512	d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe
1512	d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe
1512	d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe
1512	d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe
1512	d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe
1512	d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe
1716	bhotzjn.exe
1716	bhotzjn.exe
1512	d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe
1512	d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe
1512	d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe
1512	d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe
1512	d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1716	bhotzjn.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 2004	1512	d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe	27
PID 1512 wrote to memory of 2004	1512	d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe	27
PID 1512 wrote to memory of 2004	1512	d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe	27
PID 1512 wrote to memory of 2004	1512	d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe	27
PID 2004 wrote to memory of 1716	2004	gokvcejrqyu.exe	28
PID 2004 wrote to memory of 1716	2004	gokvcejrqyu.exe	28
PID 2004 wrote to memory of 1716	2004	gokvcejrqyu.exe	28
PID 2004 wrote to memory of 1716	2004	gokvcejrqyu.exe	28
PID 2004 wrote to memory of 1948	2004	gokvcejrqyu.exe	29
PID 2004 wrote to memory of 1948	2004	gokvcejrqyu.exe	29
PID 2004 wrote to memory of 1948	2004	gokvcejrqyu.exe	29
PID 2004 wrote to memory of 1948	2004	gokvcejrqyu.exe	29

System policy modification 1 TTPs 29 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	bhotzjn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	bhotzjn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	bhotzjn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	bhotzjn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	bhotzjn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	bhotzjn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	gokvcejrqyu.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	bhotzjn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	bhotzjn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	bhotzjn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	bhotzjn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	bhotzjn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	bhotzjn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	bhotzjn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	bhotzjn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	bhotzjn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	bhotzjn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	gokvcejrqyu.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	bhotzjn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	bhotzjn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	bhotzjn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	gokvcejrqyu.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	bhotzjn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	bhotzjn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	bhotzjn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	bhotzjn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	bhotzjn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	bhotzjn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	bhotzjn.exe

C:\Users\Admin\AppData\Local\Temp\d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe
"C:\Users\Admin\AppData\Local\Temp\d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Users\Admin\AppData\Local\Temp\gokvcejrqyu.exe
  "C:\Users\Admin\AppData\Local\Temp\gokvcejrqyu.exe" "c:\users\admin\appdata\local\temp\d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521.exe*"
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Adds policy Run key to start application
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2004
- - C:\Users\Admin\AppData\Local\Temp\bhotzjn.exe
    "C:\Users\Admin\AppData\Local\Temp\bhotzjn.exe" "-C:\Users\Admin\AppData\Local\Temp\apftibogvjpcdtfm.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - System policy modification
    PID:1716
- - C:\Users\Admin\AppData\Local\Temp\bhotzjn.exe
    "C:\Users\Admin\AppData\Local\Temp\bhotzjn.exe" "-C:\Users\Admin\AppData\Local\Temp\apftibogvjpcdtfm.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System policy modification
    PID:1948

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\apftibogvjpcdtfm.exe

Filesize
1016KB

MD5
a376e6995a4a3bfaecbb0fa8c444c4a0

SHA1
ca185ede4981a792dd1fc3e7222c3ebd89733ddf

SHA256
d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521

SHA512
7316171cc7a4cb36f277cad818dd66a1da0c32991f8b684b592b021e758ea81fa0e7d49ef5ec4453d8964c99a8149f9df6fe0be464030abd825766b0f58e8f6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\bhotzjn.exe

Filesize
724KB

MD5
f84e0940673deeed11c36ecfe282ccb1

SHA1
ac42a1a1bed4b17b47e38182072f317bc204efad

SHA256
2fbf6ef385aa951435464c7cb6f6b815ecae66e5b484e8adff2d9c416484834d

SHA512
f0df014f9895bb7408e4cba7825ff03737bc990057732b4a41a342157432b4b542138e8f1baf593e0bc90e79ff79c2394b8a178f224eb0d3fd0bd81c1edeaa1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\bhotzjn.exe

Filesize
724KB

MD5
f84e0940673deeed11c36ecfe282ccb1

SHA1
ac42a1a1bed4b17b47e38182072f317bc204efad

SHA256
2fbf6ef385aa951435464c7cb6f6b815ecae66e5b484e8adff2d9c416484834d

SHA512
f0df014f9895bb7408e4cba7825ff03737bc990057732b4a41a342157432b4b542138e8f1baf593e0bc90e79ff79c2394b8a178f224eb0d3fd0bd81c1edeaa1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\btmdvrhculukohwgtjf.exe

Filesize
1016KB

MD5
a376e6995a4a3bfaecbb0fa8c444c4a0

SHA1
ca185ede4981a792dd1fc3e7222c3ebd89733ddf

SHA256
d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521

SHA512
7316171cc7a4cb36f277cad818dd66a1da0c32991f8b684b592b021e758ea81fa0e7d49ef5ec4453d8964c99a8149f9df6fe0be464030abd825766b0f58e8f6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\dxslfdvsmfqiojambtrlg.exe

Filesize
1016KB

MD5
a376e6995a4a3bfaecbb0fa8c444c4a0

SHA1
ca185ede4981a792dd1fc3e7222c3ebd89733ddf

SHA256
d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521

SHA512
7316171cc7a4cb36f277cad818dd66a1da0c32991f8b684b592b021e758ea81fa0e7d49ef5ec4453d8964c99a8149f9df6fe0be464030abd825766b0f58e8f6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\gokvcejrqyu.exe

Filesize
320KB

MD5
5bab849ca3dd260e9e3547bc8e64f9c6

SHA1
457211d0f5cbed03d6d298bf154a15d31eed88b5

SHA256
23d166048eb9467502967b928a86b7bf389b0fe515993f25c7dd48c72b6a6502

SHA512
c5ade02800fb1fcb2f8a24c092a1cdcf80f2989496abd2779918932315bd66844ad7d458279d14a46bf713aff3cb903c6ad0b3a6a8c05249f8a0ea401d34622d

Download Submit
C:\Users\Admin\AppData\Local\Temp\gokvcejrqyu.exe

Filesize
320KB

MD5
5bab849ca3dd260e9e3547bc8e64f9c6

SHA1
457211d0f5cbed03d6d298bf154a15d31eed88b5

SHA256
23d166048eb9467502967b928a86b7bf389b0fe515993f25c7dd48c72b6a6502

SHA512
c5ade02800fb1fcb2f8a24c092a1cdcf80f2989496abd2779918932315bd66844ad7d458279d14a46bf713aff3cb903c6ad0b3a6a8c05249f8a0ea401d34622d

Download Submit
C:\Users\Admin\AppData\Local\Temp\hxodtnbukzguwnait.exe

Filesize
1016KB

MD5
a376e6995a4a3bfaecbb0fa8c444c4a0

SHA1
ca185ede4981a792dd1fc3e7222c3ebd89733ddf

SHA256
d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521

SHA512
7316171cc7a4cb36f277cad818dd66a1da0c32991f8b684b592b021e758ea81fa0e7d49ef5ec4453d8964c99a8149f9df6fe0be464030abd825766b0f58e8f6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\ohbtmjawphrinhxiwnkd.exe

Filesize
1016KB

MD5
a376e6995a4a3bfaecbb0fa8c444c4a0

SHA1
ca185ede4981a792dd1fc3e7222c3ebd89733ddf

SHA256
d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521

SHA512
7316171cc7a4cb36f277cad818dd66a1da0c32991f8b684b592b021e758ea81fa0e7d49ef5ec4453d8964c99a8149f9df6fe0be464030abd825766b0f58e8f6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\qhzpgbqkbrzorjxgsh.exe

Filesize
1016KB

MD5
a376e6995a4a3bfaecbb0fa8c444c4a0

SHA1
ca185ede4981a792dd1fc3e7222c3ebd89733ddf

SHA256
d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521

SHA512
7316171cc7a4cb36f277cad818dd66a1da0c32991f8b684b592b021e758ea81fa0e7d49ef5ec4453d8964c99a8149f9df6fe0be464030abd825766b0f58e8f6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\uplfazsqlfrkrnfsibavrl.exe

Filesize
1016KB

MD5
a376e6995a4a3bfaecbb0fa8c444c4a0

SHA1
ca185ede4981a792dd1fc3e7222c3ebd89733ddf

SHA256
d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521

SHA512
7316171cc7a4cb36f277cad818dd66a1da0c32991f8b684b592b021e758ea81fa0e7d49ef5ec4453d8964c99a8149f9df6fe0be464030abd825766b0f58e8f6b

Download Submit
C:\Windows\SysWOW64\apftibogvjpcdtfm.exe

Filesize
1016KB

MD5
a376e6995a4a3bfaecbb0fa8c444c4a0

SHA1
ca185ede4981a792dd1fc3e7222c3ebd89733ddf

SHA256
d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521

SHA512
7316171cc7a4cb36f277cad818dd66a1da0c32991f8b684b592b021e758ea81fa0e7d49ef5ec4453d8964c99a8149f9df6fe0be464030abd825766b0f58e8f6b

Download Submit
C:\Windows\SysWOW64\btmdvrhculukohwgtjf.exe

Filesize
1016KB

MD5
a376e6995a4a3bfaecbb0fa8c444c4a0

SHA1
ca185ede4981a792dd1fc3e7222c3ebd89733ddf

SHA256
d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521

SHA512
7316171cc7a4cb36f277cad818dd66a1da0c32991f8b684b592b021e758ea81fa0e7d49ef5ec4453d8964c99a8149f9df6fe0be464030abd825766b0f58e8f6b

Download Submit
C:\Windows\SysWOW64\dxslfdvsmfqiojambtrlg.exe

Filesize
1016KB

MD5
a376e6995a4a3bfaecbb0fa8c444c4a0

SHA1
ca185ede4981a792dd1fc3e7222c3ebd89733ddf

SHA256
d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521

SHA512
7316171cc7a4cb36f277cad818dd66a1da0c32991f8b684b592b021e758ea81fa0e7d49ef5ec4453d8964c99a8149f9df6fe0be464030abd825766b0f58e8f6b

Download Submit
C:\Windows\SysWOW64\hxodtnbukzguwnait.exe

Filesize
1016KB

MD5
a376e6995a4a3bfaecbb0fa8c444c4a0

SHA1
ca185ede4981a792dd1fc3e7222c3ebd89733ddf

SHA256
d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521

SHA512
7316171cc7a4cb36f277cad818dd66a1da0c32991f8b684b592b021e758ea81fa0e7d49ef5ec4453d8964c99a8149f9df6fe0be464030abd825766b0f58e8f6b

Download Submit
C:\Windows\SysWOW64\ohbtmjawphrinhxiwnkd.exe

Filesize
1016KB

MD5
a376e6995a4a3bfaecbb0fa8c444c4a0

SHA1
ca185ede4981a792dd1fc3e7222c3ebd89733ddf

SHA256
d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521

SHA512
7316171cc7a4cb36f277cad818dd66a1da0c32991f8b684b592b021e758ea81fa0e7d49ef5ec4453d8964c99a8149f9df6fe0be464030abd825766b0f58e8f6b

Download Submit
C:\Windows\SysWOW64\qhzpgbqkbrzorjxgsh.exe

Filesize
1016KB

MD5
a376e6995a4a3bfaecbb0fa8c444c4a0

SHA1
ca185ede4981a792dd1fc3e7222c3ebd89733ddf

SHA256
d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521

SHA512
7316171cc7a4cb36f277cad818dd66a1da0c32991f8b684b592b021e758ea81fa0e7d49ef5ec4453d8964c99a8149f9df6fe0be464030abd825766b0f58e8f6b

Download Submit
C:\Windows\SysWOW64\uplfazsqlfrkrnfsibavrl.exe

Filesize
1016KB

MD5
a376e6995a4a3bfaecbb0fa8c444c4a0

SHA1
ca185ede4981a792dd1fc3e7222c3ebd89733ddf

SHA256
d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521

SHA512
7316171cc7a4cb36f277cad818dd66a1da0c32991f8b684b592b021e758ea81fa0e7d49ef5ec4453d8964c99a8149f9df6fe0be464030abd825766b0f58e8f6b

Download Submit
C:\Windows\apftibogvjpcdtfm.exe

Filesize
1016KB

MD5
a376e6995a4a3bfaecbb0fa8c444c4a0

SHA1
ca185ede4981a792dd1fc3e7222c3ebd89733ddf

SHA256
d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521

SHA512
7316171cc7a4cb36f277cad818dd66a1da0c32991f8b684b592b021e758ea81fa0e7d49ef5ec4453d8964c99a8149f9df6fe0be464030abd825766b0f58e8f6b

Download Submit
C:\Windows\apftibogvjpcdtfm.exe

Filesize
1016KB

MD5
a376e6995a4a3bfaecbb0fa8c444c4a0

SHA1
ca185ede4981a792dd1fc3e7222c3ebd89733ddf

SHA256
d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521

SHA512
7316171cc7a4cb36f277cad818dd66a1da0c32991f8b684b592b021e758ea81fa0e7d49ef5ec4453d8964c99a8149f9df6fe0be464030abd825766b0f58e8f6b

Download Submit
C:\Windows\btmdvrhculukohwgtjf.exe

Filesize
1016KB

MD5
a376e6995a4a3bfaecbb0fa8c444c4a0

SHA1
ca185ede4981a792dd1fc3e7222c3ebd89733ddf

SHA256
d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521

SHA512
7316171cc7a4cb36f277cad818dd66a1da0c32991f8b684b592b021e758ea81fa0e7d49ef5ec4453d8964c99a8149f9df6fe0be464030abd825766b0f58e8f6b

Download Submit
C:\Windows\btmdvrhculukohwgtjf.exe

Filesize
1016KB

MD5
a376e6995a4a3bfaecbb0fa8c444c4a0

SHA1
ca185ede4981a792dd1fc3e7222c3ebd89733ddf

SHA256
d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521

SHA512
7316171cc7a4cb36f277cad818dd66a1da0c32991f8b684b592b021e758ea81fa0e7d49ef5ec4453d8964c99a8149f9df6fe0be464030abd825766b0f58e8f6b

Download Submit
C:\Windows\dxslfdvsmfqiojambtrlg.exe

Filesize
1016KB

MD5
a376e6995a4a3bfaecbb0fa8c444c4a0

SHA1
ca185ede4981a792dd1fc3e7222c3ebd89733ddf

SHA256
d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521

SHA512
7316171cc7a4cb36f277cad818dd66a1da0c32991f8b684b592b021e758ea81fa0e7d49ef5ec4453d8964c99a8149f9df6fe0be464030abd825766b0f58e8f6b

Download Submit
C:\Windows\dxslfdvsmfqiojambtrlg.exe

Filesize
1016KB

MD5
a376e6995a4a3bfaecbb0fa8c444c4a0

SHA1
ca185ede4981a792dd1fc3e7222c3ebd89733ddf

SHA256
d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521

SHA512
7316171cc7a4cb36f277cad818dd66a1da0c32991f8b684b592b021e758ea81fa0e7d49ef5ec4453d8964c99a8149f9df6fe0be464030abd825766b0f58e8f6b

Download Submit
C:\Windows\hxodtnbukzguwnait.exe

Filesize
1016KB

MD5
a376e6995a4a3bfaecbb0fa8c444c4a0

SHA1
ca185ede4981a792dd1fc3e7222c3ebd89733ddf

SHA256
d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521

SHA512
7316171cc7a4cb36f277cad818dd66a1da0c32991f8b684b592b021e758ea81fa0e7d49ef5ec4453d8964c99a8149f9df6fe0be464030abd825766b0f58e8f6b

Download Submit
C:\Windows\hxodtnbukzguwnait.exe

Filesize
1016KB

MD5
a376e6995a4a3bfaecbb0fa8c444c4a0

SHA1
ca185ede4981a792dd1fc3e7222c3ebd89733ddf

SHA256
d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521

SHA512
7316171cc7a4cb36f277cad818dd66a1da0c32991f8b684b592b021e758ea81fa0e7d49ef5ec4453d8964c99a8149f9df6fe0be464030abd825766b0f58e8f6b

Download Submit
C:\Windows\ohbtmjawphrinhxiwnkd.exe

Filesize
1016KB

MD5
a376e6995a4a3bfaecbb0fa8c444c4a0

SHA1
ca185ede4981a792dd1fc3e7222c3ebd89733ddf

SHA256
d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521

SHA512
7316171cc7a4cb36f277cad818dd66a1da0c32991f8b684b592b021e758ea81fa0e7d49ef5ec4453d8964c99a8149f9df6fe0be464030abd825766b0f58e8f6b

Download Submit
C:\Windows\ohbtmjawphrinhxiwnkd.exe

Filesize
1016KB

MD5
a376e6995a4a3bfaecbb0fa8c444c4a0

SHA1
ca185ede4981a792dd1fc3e7222c3ebd89733ddf

SHA256
d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521

SHA512
7316171cc7a4cb36f277cad818dd66a1da0c32991f8b684b592b021e758ea81fa0e7d49ef5ec4453d8964c99a8149f9df6fe0be464030abd825766b0f58e8f6b

Download Submit
C:\Windows\qhzpgbqkbrzorjxgsh.exe

Filesize
1016KB

MD5
a376e6995a4a3bfaecbb0fa8c444c4a0

SHA1
ca185ede4981a792dd1fc3e7222c3ebd89733ddf

SHA256
d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521

SHA512
7316171cc7a4cb36f277cad818dd66a1da0c32991f8b684b592b021e758ea81fa0e7d49ef5ec4453d8964c99a8149f9df6fe0be464030abd825766b0f58e8f6b

Download Submit
C:\Windows\qhzpgbqkbrzorjxgsh.exe

Filesize
1016KB

MD5
a376e6995a4a3bfaecbb0fa8c444c4a0

SHA1
ca185ede4981a792dd1fc3e7222c3ebd89733ddf

SHA256
d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521

SHA512
7316171cc7a4cb36f277cad818dd66a1da0c32991f8b684b592b021e758ea81fa0e7d49ef5ec4453d8964c99a8149f9df6fe0be464030abd825766b0f58e8f6b

Download Submit
C:\Windows\uplfazsqlfrkrnfsibavrl.exe

Filesize
1016KB

MD5
a376e6995a4a3bfaecbb0fa8c444c4a0

SHA1
ca185ede4981a792dd1fc3e7222c3ebd89733ddf

SHA256
d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521

SHA512
7316171cc7a4cb36f277cad818dd66a1da0c32991f8b684b592b021e758ea81fa0e7d49ef5ec4453d8964c99a8149f9df6fe0be464030abd825766b0f58e8f6b

Download Submit
C:\Windows\uplfazsqlfrkrnfsibavrl.exe

Filesize
1016KB

MD5
a376e6995a4a3bfaecbb0fa8c444c4a0

SHA1
ca185ede4981a792dd1fc3e7222c3ebd89733ddf

SHA256
d20cdf0a9602c8503270e51bac60f2c755e8b5a54a4ce0646cf8cc61caef2521

SHA512
7316171cc7a4cb36f277cad818dd66a1da0c32991f8b684b592b021e758ea81fa0e7d49ef5ec4453d8964c99a8149f9df6fe0be464030abd825766b0f58e8f6b

Download Submit
\Users\Admin\AppData\Local\Temp\bhotzjn.exe

Filesize
724KB

MD5
f84e0940673deeed11c36ecfe282ccb1

SHA1
ac42a1a1bed4b17b47e38182072f317bc204efad

SHA256
2fbf6ef385aa951435464c7cb6f6b815ecae66e5b484e8adff2d9c416484834d

SHA512
f0df014f9895bb7408e4cba7825ff03737bc990057732b4a41a342157432b4b542138e8f1baf593e0bc90e79ff79c2394b8a178f224eb0d3fd0bd81c1edeaa1a

Download Submit
\Users\Admin\AppData\Local\Temp\bhotzjn.exe

Filesize
724KB

MD5
f84e0940673deeed11c36ecfe282ccb1

SHA1
ac42a1a1bed4b17b47e38182072f317bc204efad

SHA256
2fbf6ef385aa951435464c7cb6f6b815ecae66e5b484e8adff2d9c416484834d

SHA512
f0df014f9895bb7408e4cba7825ff03737bc990057732b4a41a342157432b4b542138e8f1baf593e0bc90e79ff79c2394b8a178f224eb0d3fd0bd81c1edeaa1a

Download Submit
\Users\Admin\AppData\Local\Temp\bhotzjn.exe

Filesize
724KB

MD5
f84e0940673deeed11c36ecfe282ccb1

SHA1
ac42a1a1bed4b17b47e38182072f317bc204efad

SHA256
2fbf6ef385aa951435464c7cb6f6b815ecae66e5b484e8adff2d9c416484834d

SHA512
f0df014f9895bb7408e4cba7825ff03737bc990057732b4a41a342157432b4b542138e8f1baf593e0bc90e79ff79c2394b8a178f224eb0d3fd0bd81c1edeaa1a

Download Submit
\Users\Admin\AppData\Local\Temp\bhotzjn.exe

Filesize
724KB

MD5
f84e0940673deeed11c36ecfe282ccb1

SHA1
ac42a1a1bed4b17b47e38182072f317bc204efad

SHA256
2fbf6ef385aa951435464c7cb6f6b815ecae66e5b484e8adff2d9c416484834d

SHA512
f0df014f9895bb7408e4cba7825ff03737bc990057732b4a41a342157432b4b542138e8f1baf593e0bc90e79ff79c2394b8a178f224eb0d3fd0bd81c1edeaa1a

Download Submit
\Users\Admin\AppData\Local\Temp\gokvcejrqyu.exe

Filesize
320KB

MD5
5bab849ca3dd260e9e3547bc8e64f9c6

SHA1
457211d0f5cbed03d6d298bf154a15d31eed88b5

SHA256
23d166048eb9467502967b928a86b7bf389b0fe515993f25c7dd48c72b6a6502

SHA512
c5ade02800fb1fcb2f8a24c092a1cdcf80f2989496abd2779918932315bd66844ad7d458279d14a46bf713aff3cb903c6ad0b3a6a8c05249f8a0ea401d34622d

Download Submit
\Users\Admin\AppData\Local\Temp\gokvcejrqyu.exe

Filesize
320KB

MD5
5bab849ca3dd260e9e3547bc8e64f9c6

SHA1
457211d0f5cbed03d6d298bf154a15d31eed88b5

SHA256
23d166048eb9467502967b928a86b7bf389b0fe515993f25c7dd48c72b6a6502

SHA512
c5ade02800fb1fcb2f8a24c092a1cdcf80f2989496abd2779918932315bd66844ad7d458279d14a46bf713aff3cb903c6ad0b3a6a8c05249f8a0ea401d34622d

Download Submit
memory/1512-54-0x00000000756A1000-0x00000000756A3000-memory.dmp

Filesize
8KB

Download