cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c

Analysis

max time kernel
167s
max time network
187s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/10/2022, 19:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe
Size

1016KB
MD5

a396a0009784ee0192acf125e20fb760
SHA1

4105ec517274774fc607f8e3ade5a48ec433ea5e
SHA256

cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c
SHA512

37d2346a1e7db358868afdf57ee184865b2a8fb15b48d01bad73bbbc81aa6ce2572a925982f7eb1a9abd2438890bc935bf022f11a313a5618c8ec3c42f4fd31f
SSDEEP

6144:sIXsL0tvrSVz1DnemeYbpsnEf78AoXh6KkiD0OofzA+/VygHU7gueru1t1Ud+Ud:sIXsgtvm1De5YlOx6lzBH46U7vecaF

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	grrfdxtjqbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	jtyanm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	jtyanm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	grrfdxtjqbb.exe

UAC bypass 3 TTPs 13 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	grrfdxtjqbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	jtyanm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	jtyanm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	jtyanm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	jtyanm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	grrfdxtjqbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	grrfdxtjqbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	grrfdxtjqbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	grrfdxtjqbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	jtyanm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	jtyanm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	jtyanm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	jtyanm.exe

Adds policy Run key to start application 2 TTPs 25 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\whnqees = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cxnayigvypvpttvro.exe"	jtyanm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\whnqees = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lhymlwvlphojopspnj.exe"	jtyanm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\whnqees = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wtlaammdibjflnrpold.exe"	jtyanm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\whnqees = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jhaqrefxdxgdknsrrpiy.exe"	jtyanm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vjsypsjrnx = "lhymlwvlphojopspnj.exe"	jtyanm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	jtyanm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vjsypsjrnx = "yxrikyatavfdlpvvwvpgi.exe"	jtyanm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vjsypsjrnx = "yxrikyatavfdlpvvwvpgi.exe"	jtyanm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vjsypsjrnx = "vpeqnwthjzexazav.exe"	jtyanm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	grrfdxtjqbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vjsypsjrnx = "jhaqrefxdxgdknsrrpiy.exe"	jtyanm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	grrfdxtjqbb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	jtyanm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\whnqees = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lhymlwvlphojopspnj.exe"	jtyanm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vjsypsjrnx = "jhaqrefxdxgdknsrrpiy.exe"	jtyanm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vjsypsjrnx = "wtlaammdibjflnrpold.exe"	jtyanm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vjsypsjrnx = "jhaqrefxdxgdknsrrpiy.exe"	grrfdxtjqbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\whnqees = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jhaqrefxdxgdknsrrpiy.exe"	jtyanm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vjsypsjrnx = "jhaqrefxdxgdknsrrpiy.exe"	grrfdxtjqbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\whnqees = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vpeqnwthjzexazav.exe"	grrfdxtjqbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vjsypsjrnx = "lhymlwvlphojopspnj.exe"	jtyanm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\whnqees = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yxrikyatavfdlpvvwvpgi.exe"	jtyanm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\whnqees = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yxrikyatavfdlpvvwvpgi.exe"	jtyanm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vjsypsjrnx = "cxnayigvypvpttvro.exe"	jtyanm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\whnqees = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vpeqnwthjzexazav.exe"	grrfdxtjqbb.exe

Disables RegEdit via registry modification 6 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	jtyanm.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	jtyanm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	jtyanm.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	grrfdxtjqbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	grrfdxtjqbb.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	jtyanm.exe

Executes dropped EXE 4 IoCs

pid	Process
4912	grrfdxtjqbb.exe
1740	jtyanm.exe
5004	jtyanm.exe
540	grrfdxtjqbb.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	grrfdxtjqbb.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\mdpysysdcprhh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cxnayigvypvpttvro.exe ."	jtyanm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lxeixynt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cxnayigvypvpttvro.exe"	jtyanm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\cpxcsukrm = "wtlaammdibjflnrpold.exe ."	jtyanm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\cpxcsukrm = "lhymlwvlphojopspnj.exe ."	jtyanm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\cpxcsukrm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yxrikyatavfdlpvvwvpgi.exe ."	jtyanm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ndowpunxvhix = "wtlaammdibjflnrpold.exe ."	grrfdxtjqbb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\cpxcsukrm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wtlaammdibjflnrpold.exe ."	jtyanm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lxeixynt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yxrikyatavfdlpvvwvpgi.exe"	jtyanm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\lxeixynt = "jhaqrefxdxgdknsrrpiy.exe"	jtyanm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	grrfdxtjqbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\nfscxezllzctur = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cxnayigvypvpttvro.exe"	grrfdxtjqbb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ndowpunxvhix = "vpeqnwthjzexazav.exe ."	jtyanm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lxeixynt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jhaqrefxdxgdknsrrpiy.exe"	jtyanm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lxeixynt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vpeqnwthjzexazav.exe"	jtyanm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\cpxcsukrm = "yxrikyatavfdlpvvwvpgi.exe ."	jtyanm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ndowpunxvhix = "yxrikyatavfdlpvvwvpgi.exe ."	jtyanm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qfpwosktqbb = "vpeqnwthjzexazav.exe"	jtyanm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qfpwosktqbb = "wtlaammdibjflnrpold.exe"	jtyanm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lxeixynt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wtlaammdibjflnrpold.exe"	jtyanm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	jtyanm.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	jtyanm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qfpwosktqbb = "cxnayigvypvpttvro.exe"	jtyanm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\mdpysysdcprhh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vpeqnwthjzexazav.exe ."	jtyanm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\mdpysysdcprhh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wtlaammdibjflnrpold.exe ."	jtyanm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\mdpysysdcprhh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yxrikyatavfdlpvvwvpgi.exe ."	jtyanm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\nfscxezllzctur = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vpeqnwthjzexazav.exe"	grrfdxtjqbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\nfscxezllzctur = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lhymlwvlphojopspnj.exe"	jtyanm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\cpxcsukrm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vpeqnwthjzexazav.exe ."	jtyanm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\lxeixynt = "jhaqrefxdxgdknsrrpiy.exe"	grrfdxtjqbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\cpxcsukrm = "jhaqrefxdxgdknsrrpiy.exe ."	grrfdxtjqbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\lxeixynt = "yxrikyatavfdlpvvwvpgi.exe"	jtyanm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qfpwosktqbb = "cxnayigvypvpttvro.exe"	jtyanm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lxeixynt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vpeqnwthjzexazav.exe"	jtyanm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\nfscxezllzctur = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yxrikyatavfdlpvvwvpgi.exe"	jtyanm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\mdpysysdcprhh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yxrikyatavfdlpvvwvpgi.exe ."	grrfdxtjqbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\nfscxezllzctur = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cxnayigvypvpttvro.exe"	jtyanm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\mdpysysdcprhh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lhymlwvlphojopspnj.exe ."	grrfdxtjqbb.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	jtyanm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ndowpunxvhix = "jhaqrefxdxgdknsrrpiy.exe ."	jtyanm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\cpxcsukrm = "vpeqnwthjzexazav.exe ."	grrfdxtjqbb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\cpxcsukrm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cxnayigvypvpttvro.exe ."	grrfdxtjqbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\lxeixynt = "lhymlwvlphojopspnj.exe"	jtyanm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\mdpysysdcprhh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cxnayigvypvpttvro.exe ."	jtyanm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\nfscxezllzctur = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yxrikyatavfdlpvvwvpgi.exe"	jtyanm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\lxeixynt = "cxnayigvypvpttvro.exe"	jtyanm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\mdpysysdcprhh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lhymlwvlphojopspnj.exe ."	jtyanm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qfpwosktqbb = "lhymlwvlphojopspnj.exe"	jtyanm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qfpwosktqbb = "vpeqnwthjzexazav.exe"	jtyanm.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	jtyanm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lxeixynt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jhaqrefxdxgdknsrrpiy.exe"	jtyanm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\cpxcsukrm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lhymlwvlphojopspnj.exe ."	grrfdxtjqbb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\lxeixynt = "lhymlwvlphojopspnj.exe"	jtyanm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\cpxcsukrm = "vpeqnwthjzexazav.exe ."	jtyanm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\cpxcsukrm = "lhymlwvlphojopspnj.exe ."	jtyanm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\mdpysysdcprhh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lhymlwvlphojopspnj.exe ."	jtyanm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\lxeixynt = "vpeqnwthjzexazav.exe"	jtyanm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\cpxcsukrm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jhaqrefxdxgdknsrrpiy.exe ."	jtyanm.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	grrfdxtjqbb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qfpwosktqbb = "jhaqrefxdxgdknsrrpiy.exe"	jtyanm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qfpwosktqbb = "yxrikyatavfdlpvvwvpgi.exe"	jtyanm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ndowpunxvhix = "cxnayigvypvpttvro.exe ."	jtyanm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qfpwosktqbb = "cxnayigvypvpttvro.exe"	grrfdxtjqbb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	grrfdxtjqbb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ndowpunxvhix = "wtlaammdibjflnrpold.exe ."	jtyanm.exe

Checks whether UAC is enabled 1 TTPs 8 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	jtyanm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	jtyanm.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	jtyanm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	grrfdxtjqbb.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	grrfdxtjqbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	grrfdxtjqbb.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	grrfdxtjqbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	jtyanm.exe

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
26	www.showmyipaddress.com
31	whatismyip.everdot.org
32	whatismyipaddress.com
43	whatismyip.everdot.org

Drops file in System32 directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\cxnayigvypvpttvro.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\SysWOW64\yxrikyatavfdlpvvwvpgi.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\SysWOW64\vpeqnwthjzexazav.exe	jtyanm.exe
File opened for modification	C:\Windows\SysWOW64\yxrikyatavfdlpvvwvpgi.exe	jtyanm.exe
File opened for modification	C:\Windows\SysWOW64\wtlaammdibjflnrpold.exe	jtyanm.exe
File opened for modification	C:\Windows\SysWOW64\affckemlyzpthrdjqvvsauc.opf	jtyanm.exe
File opened for modification	C:\Windows\SysWOW64\wtlaammdibjflnrpold.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\SysWOW64\cxnayigvypvpttvro.exe	jtyanm.exe
File created	C:\Windows\SysWOW64\affckemlyzpthrdjqvvsauc.opf	jtyanm.exe
File opened for modification	C:\Windows\SysWOW64\lhymlwvlphojopspnj.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\SysWOW64\cxnayigvypvpttvro.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\SysWOW64\wtlaammdibjflnrpold.exe	jtyanm.exe
File created	C:\Windows\SysWOW64\ndowpunxvhixwrofxnygzexhfrshgbyphx.qjo	jtyanm.exe
File opened for modification	C:\Windows\SysWOW64\vpeqnwthjzexazav.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\SysWOW64\jhaqrefxdxgdknsrrpiy.exe	jtyanm.exe
File opened for modification	C:\Windows\SysWOW64\vpeqnwthjzexazav.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\SysWOW64\yxrikyatavfdlpvvwvpgi.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\SysWOW64\ppkcfuxrzvgfotabddyqti.exe	jtyanm.exe
File opened for modification	C:\Windows\SysWOW64\lhymlwvlphojopspnj.exe	jtyanm.exe
File opened for modification	C:\Windows\SysWOW64\lhymlwvlphojopspnj.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\SysWOW64\jhaqrefxdxgdknsrrpiy.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\SysWOW64\lhymlwvlphojopspnj.exe	jtyanm.exe
File opened for modification	C:\Windows\SysWOW64\ppkcfuxrzvgfotabddyqti.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\SysWOW64\ppkcfuxrzvgfotabddyqti.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\SysWOW64\yxrikyatavfdlpvvwvpgi.exe	jtyanm.exe
File opened for modification	C:\Windows\SysWOW64\ppkcfuxrzvgfotabddyqti.exe	jtyanm.exe
File opened for modification	C:\Windows\SysWOW64\ndowpunxvhixwrofxnygzexhfrshgbyphx.qjo	jtyanm.exe
File opened for modification	C:\Windows\SysWOW64\wtlaammdibjflnrpold.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\SysWOW64\jhaqrefxdxgdknsrrpiy.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\SysWOW64\cxnayigvypvpttvro.exe	jtyanm.exe
File opened for modification	C:\Windows\SysWOW64\jhaqrefxdxgdknsrrpiy.exe	jtyanm.exe
File opened for modification	C:\Windows\SysWOW64\vpeqnwthjzexazav.exe	jtyanm.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\ndowpunxvhixwrofxnygzexhfrshgbyphx.qjo	jtyanm.exe
File created	C:\Program Files (x86)\ndowpunxvhixwrofxnygzexhfrshgbyphx.qjo	jtyanm.exe
File opened for modification	C:\Program Files (x86)\affckemlyzpthrdjqvvsauc.opf	jtyanm.exe
File created	C:\Program Files (x86)\affckemlyzpthrdjqvvsauc.opf	jtyanm.exe

Drops file in Windows directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Windows\affckemlyzpthrdjqvvsauc.opf	jtyanm.exe
File opened for modification	C:\Windows\lhymlwvlphojopspnj.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\yxrikyatavfdlpvvwvpgi.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\cxnayigvypvpttvro.exe	jtyanm.exe
File opened for modification	C:\Windows\wtlaammdibjflnrpold.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\jhaqrefxdxgdknsrrpiy.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\jhaqrefxdxgdknsrrpiy.exe	jtyanm.exe
File opened for modification	C:\Windows\ppkcfuxrzvgfotabddyqti.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\vpeqnwthjzexazav.exe	jtyanm.exe
File opened for modification	C:\Windows\cxnayigvypvpttvro.exe	jtyanm.exe
File opened for modification	C:\Windows\ppkcfuxrzvgfotabddyqti.exe	jtyanm.exe
File opened for modification	C:\Windows\cxnayigvypvpttvro.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\wtlaammdibjflnrpold.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\ppkcfuxrzvgfotabddyqti.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\yxrikyatavfdlpvvwvpgi.exe	jtyanm.exe
File opened for modification	C:\Windows\lhymlwvlphojopspnj.exe	jtyanm.exe
File opened for modification	C:\Windows\yxrikyatavfdlpvvwvpgi.exe	jtyanm.exe
File created	C:\Windows\affckemlyzpthrdjqvvsauc.opf	jtyanm.exe
File opened for modification	C:\Windows\ndowpunxvhixwrofxnygzexhfrshgbyphx.qjo	jtyanm.exe
File opened for modification	C:\Windows\vpeqnwthjzexazav.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\vpeqnwthjzexazav.exe	jtyanm.exe
File opened for modification	C:\Windows\wtlaammdibjflnrpold.exe	jtyanm.exe
File opened for modification	C:\Windows\ppkcfuxrzvgfotabddyqti.exe	jtyanm.exe
File opened for modification	C:\Windows\jhaqrefxdxgdknsrrpiy.exe	jtyanm.exe
File opened for modification	C:\Windows\jhaqrefxdxgdknsrrpiy.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\vpeqnwthjzexazav.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\wtlaammdibjflnrpold.exe	jtyanm.exe
File opened for modification	C:\Windows\cxnayigvypvpttvro.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\yxrikyatavfdlpvvwvpgi.exe	grrfdxtjqbb.exe
File opened for modification	C:\Windows\lhymlwvlphojopspnj.exe	jtyanm.exe
File created	C:\Windows\ndowpunxvhixwrofxnygzexhfrshgbyphx.qjo	jtyanm.exe
File opened for modification	C:\Windows\lhymlwvlphojopspnj.exe	grrfdxtjqbb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1788	cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe
1788	cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe
1788	cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe
1788	cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe
1788	cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe
1788	cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe
1788	cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe
1788	cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe
1788	cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe
1788	cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe
1788	cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe
1788	cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe
1788	cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe
1788	cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe
1788	cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe
1788	cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe
1788	cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe
1788	cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe
1788	cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe
1788	cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe
1788	cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe
1788	cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe
1788	cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe
1788	cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe
1788	cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe
1788	cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe
1788	cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe
1788	cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe
1788	cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe
1788	cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe
1788	cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe
1788	cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe
1788	cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe
1788	cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe
1740	jtyanm.exe
1740	jtyanm.exe
1788	cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe
1788	cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe
1788	cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe
1788	cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe
1788	cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe
1788	cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe
1788	cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe
1788	cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe
1788	cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe
1788	cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe
1788	cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe
1788	cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe
1788	cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe
1788	cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe
1788	cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe
1788	cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe
1788	cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe
1788	cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe
1788	cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe
1788	cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe
1788	cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe
1788	cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe
1788	cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe
1788	cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe
1788	cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe
1788	cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe
1740	jtyanm.exe
1740	jtyanm.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1740	jtyanm.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 4912	1788	cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe	81
PID 1788 wrote to memory of 4912	1788	cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe	81
PID 1788 wrote to memory of 4912	1788	cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe	81
PID 4912 wrote to memory of 1740	4912	grrfdxtjqbb.exe	82
PID 4912 wrote to memory of 1740	4912	grrfdxtjqbb.exe	82
PID 4912 wrote to memory of 1740	4912	grrfdxtjqbb.exe	82
PID 4912 wrote to memory of 5004	4912	grrfdxtjqbb.exe	83
PID 4912 wrote to memory of 5004	4912	grrfdxtjqbb.exe	83
PID 4912 wrote to memory of 5004	4912	grrfdxtjqbb.exe	83
PID 1788 wrote to memory of 540	1788	cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe	93
PID 1788 wrote to memory of 540	1788	cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe	93
PID 1788 wrote to memory of 540	1788	cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe	93

System policy modification 1 TTPs 41 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	grrfdxtjqbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	grrfdxtjqbb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	jtyanm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	jtyanm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	grrfdxtjqbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	grrfdxtjqbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	jtyanm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	jtyanm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	jtyanm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	jtyanm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	jtyanm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	grrfdxtjqbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	grrfdxtjqbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	jtyanm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	jtyanm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	grrfdxtjqbb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	jtyanm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	jtyanm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	jtyanm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	jtyanm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	jtyanm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	jtyanm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	jtyanm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	grrfdxtjqbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	grrfdxtjqbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	grrfdxtjqbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	jtyanm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	grrfdxtjqbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	jtyanm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	jtyanm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	grrfdxtjqbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	grrfdxtjqbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	jtyanm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	jtyanm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	jtyanm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	grrfdxtjqbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	grrfdxtjqbb.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	jtyanm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	jtyanm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	jtyanm.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	jtyanm.exe

C:\Users\Admin\AppData\Local\Temp\cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe
"C:\Users\Admin\AppData\Local\Temp\cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Users\Admin\AppData\Local\Temp\grrfdxtjqbb.exe
  "C:\Users\Admin\AppData\Local\Temp\grrfdxtjqbb.exe" "c:\users\admin\appdata\local\temp\cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe*"
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Adds policy Run key to start application
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Checks computer location settings
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4912
- - C:\Users\Admin\AppData\Local\Temp\jtyanm.exe
    "C:\Users\Admin\AppData\Local\Temp\jtyanm.exe" "-C:\Users\Admin\AppData\Local\Temp\vpeqnwthjzexazav.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - System policy modification
    PID:1740
- - C:\Users\Admin\AppData\Local\Temp\jtyanm.exe
    "C:\Users\Admin\AppData\Local\Temp\jtyanm.exe" "-C:\Users\Admin\AppData\Local\Temp\vpeqnwthjzexazav.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System policy modification
    PID:5004
- C:\Users\Admin\AppData\Local\Temp\grrfdxtjqbb.exe
  "C:\Users\Admin\AppData\Local\Temp\grrfdxtjqbb.exe" "c:\users\admin\appdata\local\temp\cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c.exe"
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Adds policy Run key to start application
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System policy modification
  PID:540

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cxnayigvypvpttvro.exe

Filesize
1016KB

MD5
a396a0009784ee0192acf125e20fb760

SHA1
4105ec517274774fc607f8e3ade5a48ec433ea5e

SHA256
cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c

SHA512
37d2346a1e7db358868afdf57ee184865b2a8fb15b48d01bad73bbbc81aa6ce2572a925982f7eb1a9abd2438890bc935bf022f11a313a5618c8ec3c42f4fd31f

Download Submit
C:\Users\Admin\AppData\Local\Temp\grrfdxtjqbb.exe

Filesize
320KB

MD5
eeac4f301971d49713d8532f36b3d73c

SHA1
83fa27a6977e7110aa7a7812f294607628088cc3

SHA256
f8773094a59a66d853a07d4d2f1ef2d8b2b288461f11a08f5e46943137b24ddc

SHA512
f6ce00f792eeb29ef894da0b0064d2c91f0b20f2977d91e4ce4aa5ba42b1ec43c78ad3accf56cde20d06c494415b08cd43578538d239f6e96b707880cd3e4e23

Download Submit
C:\Users\Admin\AppData\Local\Temp\grrfdxtjqbb.exe

Filesize
320KB

MD5
eeac4f301971d49713d8532f36b3d73c

SHA1
83fa27a6977e7110aa7a7812f294607628088cc3

SHA256
f8773094a59a66d853a07d4d2f1ef2d8b2b288461f11a08f5e46943137b24ddc

SHA512
f6ce00f792eeb29ef894da0b0064d2c91f0b20f2977d91e4ce4aa5ba42b1ec43c78ad3accf56cde20d06c494415b08cd43578538d239f6e96b707880cd3e4e23

Download Submit
C:\Users\Admin\AppData\Local\Temp\grrfdxtjqbb.exe

Filesize
320KB

MD5
eeac4f301971d49713d8532f36b3d73c

SHA1
83fa27a6977e7110aa7a7812f294607628088cc3

SHA256
f8773094a59a66d853a07d4d2f1ef2d8b2b288461f11a08f5e46943137b24ddc

SHA512
f6ce00f792eeb29ef894da0b0064d2c91f0b20f2977d91e4ce4aa5ba42b1ec43c78ad3accf56cde20d06c494415b08cd43578538d239f6e96b707880cd3e4e23

Download Submit
C:\Users\Admin\AppData\Local\Temp\jhaqrefxdxgdknsrrpiy.exe

Filesize
1016KB

MD5
a396a0009784ee0192acf125e20fb760

SHA1
4105ec517274774fc607f8e3ade5a48ec433ea5e

SHA256
cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c

SHA512
37d2346a1e7db358868afdf57ee184865b2a8fb15b48d01bad73bbbc81aa6ce2572a925982f7eb1a9abd2438890bc935bf022f11a313a5618c8ec3c42f4fd31f

Download Submit
C:\Users\Admin\AppData\Local\Temp\jtyanm.exe

Filesize
712KB

MD5
e175490711a9326dcf1018048a45cb59

SHA1
607732bd001dd13e267cbc646fd6e772ba4c970a

SHA256
489ca6384bc2c39605ce36784d7a7033c00d43211ab76bfdcbad359fe109678f

SHA512
dcd4aa3d14d20d9207336c1e9e66102af53342c837b173ab85b547e7566f18c2894475e4f4a0f6754e5f566bf97222bd1cda4a18eb73f01f3adc87cba106976c

Download Submit
C:\Users\Admin\AppData\Local\Temp\jtyanm.exe

Filesize
712KB

MD5
e175490711a9326dcf1018048a45cb59

SHA1
607732bd001dd13e267cbc646fd6e772ba4c970a

SHA256
489ca6384bc2c39605ce36784d7a7033c00d43211ab76bfdcbad359fe109678f

SHA512
dcd4aa3d14d20d9207336c1e9e66102af53342c837b173ab85b547e7566f18c2894475e4f4a0f6754e5f566bf97222bd1cda4a18eb73f01f3adc87cba106976c

Download Submit
C:\Users\Admin\AppData\Local\Temp\jtyanm.exe

Filesize
712KB

MD5
e175490711a9326dcf1018048a45cb59

SHA1
607732bd001dd13e267cbc646fd6e772ba4c970a

SHA256
489ca6384bc2c39605ce36784d7a7033c00d43211ab76bfdcbad359fe109678f

SHA512
dcd4aa3d14d20d9207336c1e9e66102af53342c837b173ab85b547e7566f18c2894475e4f4a0f6754e5f566bf97222bd1cda4a18eb73f01f3adc87cba106976c

Download Submit
C:\Users\Admin\AppData\Local\Temp\lhymlwvlphojopspnj.exe

Filesize
1016KB

MD5
a396a0009784ee0192acf125e20fb760

SHA1
4105ec517274774fc607f8e3ade5a48ec433ea5e

SHA256
cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c

SHA512
37d2346a1e7db358868afdf57ee184865b2a8fb15b48d01bad73bbbc81aa6ce2572a925982f7eb1a9abd2438890bc935bf022f11a313a5618c8ec3c42f4fd31f

Download Submit
C:\Users\Admin\AppData\Local\Temp\ppkcfuxrzvgfotabddyqti.exe

Filesize
1016KB

MD5
a396a0009784ee0192acf125e20fb760

SHA1
4105ec517274774fc607f8e3ade5a48ec433ea5e

SHA256
cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c

SHA512
37d2346a1e7db358868afdf57ee184865b2a8fb15b48d01bad73bbbc81aa6ce2572a925982f7eb1a9abd2438890bc935bf022f11a313a5618c8ec3c42f4fd31f

Download Submit
C:\Users\Admin\AppData\Local\Temp\ppkcfuxrzvgfotabddyqti.exe

Filesize
1016KB

MD5
a396a0009784ee0192acf125e20fb760

SHA1
4105ec517274774fc607f8e3ade5a48ec433ea5e

SHA256
cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c

SHA512
37d2346a1e7db358868afdf57ee184865b2a8fb15b48d01bad73bbbc81aa6ce2572a925982f7eb1a9abd2438890bc935bf022f11a313a5618c8ec3c42f4fd31f

Download Submit
C:\Users\Admin\AppData\Local\Temp\vpeqnwthjzexazav.exe

Filesize
1016KB

MD5
a396a0009784ee0192acf125e20fb760

SHA1
4105ec517274774fc607f8e3ade5a48ec433ea5e

SHA256
cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c

SHA512
37d2346a1e7db358868afdf57ee184865b2a8fb15b48d01bad73bbbc81aa6ce2572a925982f7eb1a9abd2438890bc935bf022f11a313a5618c8ec3c42f4fd31f

Download Submit
C:\Users\Admin\AppData\Local\Temp\wtlaammdibjflnrpold.exe

Filesize
1016KB

MD5
a396a0009784ee0192acf125e20fb760

SHA1
4105ec517274774fc607f8e3ade5a48ec433ea5e

SHA256
cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c

SHA512
37d2346a1e7db358868afdf57ee184865b2a8fb15b48d01bad73bbbc81aa6ce2572a925982f7eb1a9abd2438890bc935bf022f11a313a5618c8ec3c42f4fd31f

Download Submit
C:\Users\Admin\AppData\Local\Temp\yxrikyatavfdlpvvwvpgi.exe

Filesize
1016KB

MD5
a396a0009784ee0192acf125e20fb760

SHA1
4105ec517274774fc607f8e3ade5a48ec433ea5e

SHA256
cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c

SHA512
37d2346a1e7db358868afdf57ee184865b2a8fb15b48d01bad73bbbc81aa6ce2572a925982f7eb1a9abd2438890bc935bf022f11a313a5618c8ec3c42f4fd31f

Download Submit
C:\Users\Admin\AppData\Local\Temp\yxrikyatavfdlpvvwvpgi.exe

Filesize
1016KB

MD5
a396a0009784ee0192acf125e20fb760

SHA1
4105ec517274774fc607f8e3ade5a48ec433ea5e

SHA256
cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c

SHA512
37d2346a1e7db358868afdf57ee184865b2a8fb15b48d01bad73bbbc81aa6ce2572a925982f7eb1a9abd2438890bc935bf022f11a313a5618c8ec3c42f4fd31f

Download Submit
C:\Windows\SysWOW64\cxnayigvypvpttvro.exe

Filesize
1016KB

MD5
a396a0009784ee0192acf125e20fb760

SHA1
4105ec517274774fc607f8e3ade5a48ec433ea5e

SHA256
cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c

SHA512
37d2346a1e7db358868afdf57ee184865b2a8fb15b48d01bad73bbbc81aa6ce2572a925982f7eb1a9abd2438890bc935bf022f11a313a5618c8ec3c42f4fd31f

Download Submit
C:\Windows\SysWOW64\jhaqrefxdxgdknsrrpiy.exe

Filesize
1016KB

MD5
a396a0009784ee0192acf125e20fb760

SHA1
4105ec517274774fc607f8e3ade5a48ec433ea5e

SHA256
cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c

SHA512
37d2346a1e7db358868afdf57ee184865b2a8fb15b48d01bad73bbbc81aa6ce2572a925982f7eb1a9abd2438890bc935bf022f11a313a5618c8ec3c42f4fd31f

Download Submit
C:\Windows\SysWOW64\lhymlwvlphojopspnj.exe

Filesize
1016KB

MD5
a396a0009784ee0192acf125e20fb760

SHA1
4105ec517274774fc607f8e3ade5a48ec433ea5e

SHA256
cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c

SHA512
37d2346a1e7db358868afdf57ee184865b2a8fb15b48d01bad73bbbc81aa6ce2572a925982f7eb1a9abd2438890bc935bf022f11a313a5618c8ec3c42f4fd31f

Download Submit
C:\Windows\SysWOW64\ppkcfuxrzvgfotabddyqti.exe

Filesize
1016KB

MD5
a396a0009784ee0192acf125e20fb760

SHA1
4105ec517274774fc607f8e3ade5a48ec433ea5e

SHA256
cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c

SHA512
37d2346a1e7db358868afdf57ee184865b2a8fb15b48d01bad73bbbc81aa6ce2572a925982f7eb1a9abd2438890bc935bf022f11a313a5618c8ec3c42f4fd31f

Download Submit
C:\Windows\SysWOW64\vpeqnwthjzexazav.exe

Filesize
1016KB

MD5
a396a0009784ee0192acf125e20fb760

SHA1
4105ec517274774fc607f8e3ade5a48ec433ea5e

SHA256
cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c

SHA512
37d2346a1e7db358868afdf57ee184865b2a8fb15b48d01bad73bbbc81aa6ce2572a925982f7eb1a9abd2438890bc935bf022f11a313a5618c8ec3c42f4fd31f

Download Submit
C:\Windows\SysWOW64\wtlaammdibjflnrpold.exe

Filesize
1016KB

MD5
a396a0009784ee0192acf125e20fb760

SHA1
4105ec517274774fc607f8e3ade5a48ec433ea5e

SHA256
cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c

SHA512
37d2346a1e7db358868afdf57ee184865b2a8fb15b48d01bad73bbbc81aa6ce2572a925982f7eb1a9abd2438890bc935bf022f11a313a5618c8ec3c42f4fd31f

Download Submit
C:\Windows\SysWOW64\yxrikyatavfdlpvvwvpgi.exe

Filesize
1016KB

MD5
a396a0009784ee0192acf125e20fb760

SHA1
4105ec517274774fc607f8e3ade5a48ec433ea5e

SHA256
cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c

SHA512
37d2346a1e7db358868afdf57ee184865b2a8fb15b48d01bad73bbbc81aa6ce2572a925982f7eb1a9abd2438890bc935bf022f11a313a5618c8ec3c42f4fd31f

Download Submit
C:\Windows\cxnayigvypvpttvro.exe

Filesize
1016KB

MD5
a396a0009784ee0192acf125e20fb760

SHA1
4105ec517274774fc607f8e3ade5a48ec433ea5e

SHA256
cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c

SHA512
37d2346a1e7db358868afdf57ee184865b2a8fb15b48d01bad73bbbc81aa6ce2572a925982f7eb1a9abd2438890bc935bf022f11a313a5618c8ec3c42f4fd31f

Download Submit
C:\Windows\cxnayigvypvpttvro.exe

Filesize
1016KB

MD5
a396a0009784ee0192acf125e20fb760

SHA1
4105ec517274774fc607f8e3ade5a48ec433ea5e

SHA256
cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c

SHA512
37d2346a1e7db358868afdf57ee184865b2a8fb15b48d01bad73bbbc81aa6ce2572a925982f7eb1a9abd2438890bc935bf022f11a313a5618c8ec3c42f4fd31f

Download Submit
C:\Windows\cxnayigvypvpttvro.exe

Filesize
1016KB

MD5
a396a0009784ee0192acf125e20fb760

SHA1
4105ec517274774fc607f8e3ade5a48ec433ea5e

SHA256
cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c

SHA512
37d2346a1e7db358868afdf57ee184865b2a8fb15b48d01bad73bbbc81aa6ce2572a925982f7eb1a9abd2438890bc935bf022f11a313a5618c8ec3c42f4fd31f

Download Submit
C:\Windows\jhaqrefxdxgdknsrrpiy.exe

Filesize
1016KB

MD5
a396a0009784ee0192acf125e20fb760

SHA1
4105ec517274774fc607f8e3ade5a48ec433ea5e

SHA256
cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c

SHA512
37d2346a1e7db358868afdf57ee184865b2a8fb15b48d01bad73bbbc81aa6ce2572a925982f7eb1a9abd2438890bc935bf022f11a313a5618c8ec3c42f4fd31f

Download Submit
C:\Windows\jhaqrefxdxgdknsrrpiy.exe

Filesize
1016KB

MD5
a396a0009784ee0192acf125e20fb760

SHA1
4105ec517274774fc607f8e3ade5a48ec433ea5e

SHA256
cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c

SHA512
37d2346a1e7db358868afdf57ee184865b2a8fb15b48d01bad73bbbc81aa6ce2572a925982f7eb1a9abd2438890bc935bf022f11a313a5618c8ec3c42f4fd31f

Download Submit
C:\Windows\jhaqrefxdxgdknsrrpiy.exe

Filesize
1016KB

MD5
a396a0009784ee0192acf125e20fb760

SHA1
4105ec517274774fc607f8e3ade5a48ec433ea5e

SHA256
cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c

SHA512
37d2346a1e7db358868afdf57ee184865b2a8fb15b48d01bad73bbbc81aa6ce2572a925982f7eb1a9abd2438890bc935bf022f11a313a5618c8ec3c42f4fd31f

Download Submit
C:\Windows\lhymlwvlphojopspnj.exe

Filesize
1016KB

MD5
a396a0009784ee0192acf125e20fb760

SHA1
4105ec517274774fc607f8e3ade5a48ec433ea5e

SHA256
cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c

SHA512
37d2346a1e7db358868afdf57ee184865b2a8fb15b48d01bad73bbbc81aa6ce2572a925982f7eb1a9abd2438890bc935bf022f11a313a5618c8ec3c42f4fd31f

Download Submit
C:\Windows\lhymlwvlphojopspnj.exe

Filesize
1016KB

MD5
a396a0009784ee0192acf125e20fb760

SHA1
4105ec517274774fc607f8e3ade5a48ec433ea5e

SHA256
cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c

SHA512
37d2346a1e7db358868afdf57ee184865b2a8fb15b48d01bad73bbbc81aa6ce2572a925982f7eb1a9abd2438890bc935bf022f11a313a5618c8ec3c42f4fd31f

Download Submit
C:\Windows\lhymlwvlphojopspnj.exe

Filesize
1016KB

MD5
a396a0009784ee0192acf125e20fb760

SHA1
4105ec517274774fc607f8e3ade5a48ec433ea5e

SHA256
cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c

SHA512
37d2346a1e7db358868afdf57ee184865b2a8fb15b48d01bad73bbbc81aa6ce2572a925982f7eb1a9abd2438890bc935bf022f11a313a5618c8ec3c42f4fd31f

Download Submit
C:\Windows\ppkcfuxrzvgfotabddyqti.exe

Filesize
1016KB

MD5
a396a0009784ee0192acf125e20fb760

SHA1
4105ec517274774fc607f8e3ade5a48ec433ea5e

SHA256
cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c

SHA512
37d2346a1e7db358868afdf57ee184865b2a8fb15b48d01bad73bbbc81aa6ce2572a925982f7eb1a9abd2438890bc935bf022f11a313a5618c8ec3c42f4fd31f

Download Submit
C:\Windows\ppkcfuxrzvgfotabddyqti.exe

Filesize
1016KB

MD5
a396a0009784ee0192acf125e20fb760

SHA1
4105ec517274774fc607f8e3ade5a48ec433ea5e

SHA256
cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c

SHA512
37d2346a1e7db358868afdf57ee184865b2a8fb15b48d01bad73bbbc81aa6ce2572a925982f7eb1a9abd2438890bc935bf022f11a313a5618c8ec3c42f4fd31f

Download Submit
C:\Windows\ppkcfuxrzvgfotabddyqti.exe

Filesize
1016KB

MD5
a396a0009784ee0192acf125e20fb760

SHA1
4105ec517274774fc607f8e3ade5a48ec433ea5e

SHA256
cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c

SHA512
37d2346a1e7db358868afdf57ee184865b2a8fb15b48d01bad73bbbc81aa6ce2572a925982f7eb1a9abd2438890bc935bf022f11a313a5618c8ec3c42f4fd31f

Download Submit
C:\Windows\vpeqnwthjzexazav.exe

Filesize
1016KB

MD5
a396a0009784ee0192acf125e20fb760

SHA1
4105ec517274774fc607f8e3ade5a48ec433ea5e

SHA256
cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c

SHA512
37d2346a1e7db358868afdf57ee184865b2a8fb15b48d01bad73bbbc81aa6ce2572a925982f7eb1a9abd2438890bc935bf022f11a313a5618c8ec3c42f4fd31f

Download Submit
C:\Windows\vpeqnwthjzexazav.exe

Filesize
1016KB

MD5
a396a0009784ee0192acf125e20fb760

SHA1
4105ec517274774fc607f8e3ade5a48ec433ea5e

SHA256
cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c

SHA512
37d2346a1e7db358868afdf57ee184865b2a8fb15b48d01bad73bbbc81aa6ce2572a925982f7eb1a9abd2438890bc935bf022f11a313a5618c8ec3c42f4fd31f

Download Submit
C:\Windows\vpeqnwthjzexazav.exe

Filesize
1016KB

MD5
a396a0009784ee0192acf125e20fb760

SHA1
4105ec517274774fc607f8e3ade5a48ec433ea5e

SHA256
cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c

SHA512
37d2346a1e7db358868afdf57ee184865b2a8fb15b48d01bad73bbbc81aa6ce2572a925982f7eb1a9abd2438890bc935bf022f11a313a5618c8ec3c42f4fd31f

Download Submit
C:\Windows\wtlaammdibjflnrpold.exe

Filesize
1016KB

MD5
a396a0009784ee0192acf125e20fb760

SHA1
4105ec517274774fc607f8e3ade5a48ec433ea5e

SHA256
cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c

SHA512
37d2346a1e7db358868afdf57ee184865b2a8fb15b48d01bad73bbbc81aa6ce2572a925982f7eb1a9abd2438890bc935bf022f11a313a5618c8ec3c42f4fd31f

Download Submit
C:\Windows\wtlaammdibjflnrpold.exe

Filesize
1016KB

MD5
a396a0009784ee0192acf125e20fb760

SHA1
4105ec517274774fc607f8e3ade5a48ec433ea5e

SHA256
cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c

SHA512
37d2346a1e7db358868afdf57ee184865b2a8fb15b48d01bad73bbbc81aa6ce2572a925982f7eb1a9abd2438890bc935bf022f11a313a5618c8ec3c42f4fd31f

Download Submit
C:\Windows\wtlaammdibjflnrpold.exe

Filesize
1016KB

MD5
a396a0009784ee0192acf125e20fb760

SHA1
4105ec517274774fc607f8e3ade5a48ec433ea5e

SHA256
cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c

SHA512
37d2346a1e7db358868afdf57ee184865b2a8fb15b48d01bad73bbbc81aa6ce2572a925982f7eb1a9abd2438890bc935bf022f11a313a5618c8ec3c42f4fd31f

Download Submit
C:\Windows\yxrikyatavfdlpvvwvpgi.exe

Filesize
1016KB

MD5
a396a0009784ee0192acf125e20fb760

SHA1
4105ec517274774fc607f8e3ade5a48ec433ea5e

SHA256
cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c

SHA512
37d2346a1e7db358868afdf57ee184865b2a8fb15b48d01bad73bbbc81aa6ce2572a925982f7eb1a9abd2438890bc935bf022f11a313a5618c8ec3c42f4fd31f

Download Submit
C:\Windows\yxrikyatavfdlpvvwvpgi.exe

Filesize
1016KB

MD5
a396a0009784ee0192acf125e20fb760

SHA1
4105ec517274774fc607f8e3ade5a48ec433ea5e

SHA256
cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c

SHA512
37d2346a1e7db358868afdf57ee184865b2a8fb15b48d01bad73bbbc81aa6ce2572a925982f7eb1a9abd2438890bc935bf022f11a313a5618c8ec3c42f4fd31f

Download Submit
C:\Windows\yxrikyatavfdlpvvwvpgi.exe

Filesize
1016KB

MD5
a396a0009784ee0192acf125e20fb760

SHA1
4105ec517274774fc607f8e3ade5a48ec433ea5e

SHA256
cb424c382b7fbd1c23e7dd06a109155f6e57a88bc57df04d978f99c69cd8b04c

SHA512
37d2346a1e7db358868afdf57ee184865b2a8fb15b48d01bad73bbbc81aa6ce2572a925982f7eb1a9abd2438890bc935bf022f11a313a5618c8ec3c42f4fd31f

Download Submit