1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 17:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe
Size

1016KB
MD5

44393b585c395c719d5253ee3c31a620
SHA1

2e67a1959239c38212d2535b14933ca0509aaac1
SHA256

1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca
SHA512

52327d3b305ff2c42ceec683dd2778f965cf62348fc1177e4506266b2fd6ba0bc7ed9ff8ef8e0b677ba7b4e5c17e42e471610faefdc5edc5b5d39883447c4b65
SSDEEP

6144:KIXsL0tvrSVz1DnemeYbpsnEf78AoXh6KkiD0OofzA+/VygHUmDa1is0f:KIXsgtvm1De5YlOx6lzBH46Umu1q

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

hptygr.exehptygr.exeyborjrewily.exeyborjrewily.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	hptygr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	hptygr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	yborjrewily.exe

UAC bypass 3 TTPs 13 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

yborjrewily.exehptygr.exehptygr.exeyborjrewily.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	hptygr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	hptygr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	hptygr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	hptygr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	hptygr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	hptygr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	hptygr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	hptygr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	yborjrewily.exe

Adds policy Run key to start application 2 TTPs 28 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

hptygr.exehptygr.exeyborjrewily.exeyborjrewily.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ofsgxrcumuszqxt = "hdvokjzwtgjvrdevrsdz.exe"	hptygr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ofsgxrcumuszqxt = "hdvokjzwtgjvrdevrsdz.exe"	hptygr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ofsgxrcumuszqxt = "wtmgddusqeivsfhzwykha.exe"	hptygr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ofsgxrcumuszqxt = "hdvokjzwtgjvrdevrsdz.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ofsgxrcumuszqxt = "jdtkebpkfqrbvfetnm.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lzjuizhwlqlp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hdvokjzwtgjvrdevrsdz.exe"	hptygr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lzjuizhwlqlp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jdtkebpkfqrbvfetnm.exe"	hptygr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lzjuizhwlqlp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tlzogbngzihphpmz.exe"	hptygr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lzjuizhwlqlp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\atiyrnauoyyhajhvo.exe"	hptygr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	yborjrewily.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	hptygr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lzjuizhwlqlp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wtmgddusqeivsfhzwykha.exe"	hptygr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ofsgxrcumuszqxt = "tlzogbngzihphpmz.exe"	hptygr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lzjuizhwlqlp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\upgytrgcykmxsddtooy.exe"	hptygr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lzjuizhwlqlp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hdvokjzwtgjvrdevrsdz.exe"	hptygr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ofsgxrcumuszqxt = "upgytrgcykmxsddtooy.exe"	hptygr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ofsgxrcumuszqxt = "atiyrnauoyyhajhvo.exe"	hptygr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lzjuizhwlqlp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\atiyrnauoyyhajhvo.exe"	hptygr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lzjuizhwlqlp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hdvokjzwtgjvrdevrsdz.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lzjuizhwlqlp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tlzogbngzihphpmz.exe"	hptygr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ofsgxrcumuszqxt = "jdtkebpkfqrbvfetnm.exe"	hptygr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ofsgxrcumuszqxt = "jdtkebpkfqrbvfetnm.exe"	hptygr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lzjuizhwlqlp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wtmgddusqeivsfhzwykha.exe"	hptygr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lzjuizhwlqlp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hdvokjzwtgjvrdevrsdz.exe"	yborjrewily.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	hptygr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ofsgxrcumuszqxt = "atiyrnauoyyhajhvo.exe"	hptygr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ofsgxrcumuszqxt = "tlzogbngzihphpmz.exe"	hptygr.exe

Disables RegEdit via registry modification 6 IoCs

evasion

Processes:

hptygr.exehptygr.exeyborjrewily.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	hptygr.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	hptygr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	hptygr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	hptygr.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	yborjrewily.exe

Executes dropped EXE 4 IoCs

Processes:

yborjrewily.exehptygr.exehptygr.exeyborjrewily.exe

pid process

516 yborjrewily.exe
4228 hptygr.exe
3476 hptygr.exe
2544 yborjrewily.exe

pid	process
516	yborjrewily.exe
4228	hptygr.exe
3476	hptygr.exe
2544	yborjrewily.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exeyborjrewily.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	yborjrewily.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

hptygr.exehptygr.exeyborjrewily.exeyborjrewily.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\upgytrgcykmxsddtooy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hdvokjzwtgjvrdevrsdz.exe"	hptygr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\upgytrgcykmxsddtooy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jdtkebpkfqrbvfetnm.exe"	hptygr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kzkwldmcsyuzo = "hdvokjzwtgjvrdevrsdz.exe"	hptygr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\lbnaqjtkbiflbh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hdvokjzwtgjvrdevrsdz.exe ."	hptygr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\jdtkebpkfqrbvfetnm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hdvokjzwtgjvrdevrsdz.exe ."	hptygr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lbnaqjtkbiflbh = "atiyrnauoyyhajhvo.exe ."	hptygr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lbnaqjtkbiflbh = "jdtkebpkfqrbvfetnm.exe ."	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lbnaqjtkbiflbh = "wtmgddusqeivsfhzwykha.exe ."	hptygr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tlzogbngzihphpmz = "upgytrgcykmxsddtooy.exe"	hptygr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kzkwldmcsyuzo = "upgytrgcykmxsddtooy.exe"	hptygr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\lbnaqjtkbiflbh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wtmgddusqeivsfhzwykha.exe ."	hptygr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kzkwldmcsyuzo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jdtkebpkfqrbvfetnm.exe"	hptygr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\jdtkebpkfqrbvfetnm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\atiyrnauoyyhajhvo.exe ."	hptygr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tlzogbngzihphpmz = "hdvokjzwtgjvrdevrsdz.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\jdtkebpkfqrbvfetnm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wtmgddusqeivsfhzwykha.exe ."	hptygr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kzkwldmcsyuzo = "atiyrnauoyyhajhvo.exe"	hptygr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\upgytrgcykmxsddtooy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jdtkebpkfqrbvfetnm.exe"	hptygr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\atiyrnauoyyhajhvo = "upgytrgcykmxsddtooy.exe ."	hptygr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kzkwldmcsyuzo = "tlzogbngzihphpmz.exe"	hptygr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lbnaqjtkbiflbh = "upgytrgcykmxsddtooy.exe ."	hptygr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\lbnaqjtkbiflbh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hdvokjzwtgjvrdevrsdz.exe ."	yborjrewily.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\atiyrnauoyyhajhvo = "hdvokjzwtgjvrdevrsdz.exe ."	hptygr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tlzogbngzihphpmz = "upgytrgcykmxsddtooy.exe"	hptygr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kzkwldmcsyuzo = "hdvokjzwtgjvrdevrsdz.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kzkwldmcsyuzo = "wtmgddusqeivsfhzwykha.exe"	hptygr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\upgytrgcykmxsddtooy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wtmgddusqeivsfhzwykha.exe"	hptygr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\lbnaqjtkbiflbh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tlzogbngzihphpmz.exe ."	hptygr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lbnaqjtkbiflbh = "tlzogbngzihphpmz.exe ."	hptygr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lbnaqjtkbiflbh = "tlzogbngzihphpmz.exe ."	hptygr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\atiyrnauoyyhajhvo = "hdvokjzwtgjvrdevrsdz.exe ."	hptygr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\atiyrnauoyyhajhvo = "wtmgddusqeivsfhzwykha.exe ."	hptygr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\jdtkebpkfqrbvfetnm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jdtkebpkfqrbvfetnm.exe ."	hptygr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\lbnaqjtkbiflbh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\atiyrnauoyyhajhvo.exe ."	hptygr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\upgytrgcykmxsddtooy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\atiyrnauoyyhajhvo.exe"	hptygr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\atiyrnauoyyhajhvo = "atiyrnauoyyhajhvo.exe ."	hptygr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\upgytrgcykmxsddtooy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\upgytrgcykmxsddtooy.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kzkwldmcsyuzo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tlzogbngzihphpmz.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kzkwldmcsyuzo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tlzogbngzihphpmz.exe"	hptygr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lbnaqjtkbiflbh = "wtmgddusqeivsfhzwykha.exe ."	hptygr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\jdtkebpkfqrbvfetnm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tlzogbngzihphpmz.exe ."	hptygr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kzkwldmcsyuzo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jdtkebpkfqrbvfetnm.exe"	hptygr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kzkwldmcsyuzo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wtmgddusqeivsfhzwykha.exe"	hptygr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lbnaqjtkbiflbh = "hdvokjzwtgjvrdevrsdz.exe ."	hptygr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\lbnaqjtkbiflbh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jdtkebpkfqrbvfetnm.exe ."	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\upgytrgcykmxsddtooy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hdvokjzwtgjvrdevrsdz.exe"	hptygr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kzkwldmcsyuzo = "tlzogbngzihphpmz.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\upgytrgcykmxsddtooy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\atiyrnauoyyhajhvo.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lbnaqjtkbiflbh = "jdtkebpkfqrbvfetnm.exe ."	hptygr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\lbnaqjtkbiflbh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jdtkebpkfqrbvfetnm.exe ."	hptygr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\atiyrnauoyyhajhvo = "tlzogbngzihphpmz.exe ."	hptygr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\upgytrgcykmxsddtooy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\upgytrgcykmxsddtooy.exe"	hptygr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tlzogbngzihphpmz = "atiyrnauoyyhajhvo.exe"	hptygr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\atiyrnauoyyhajhvo = "jdtkebpkfqrbvfetnm.exe ."	hptygr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\atiyrnauoyyhajhvo = "upgytrgcykmxsddtooy.exe ."	hptygr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	hptygr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\jdtkebpkfqrbvfetnm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\upgytrgcykmxsddtooy.exe ."	hptygr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\lbnaqjtkbiflbh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tlzogbngzihphpmz.exe ."	hptygr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\upgytrgcykmxsddtooy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\atiyrnauoyyhajhvo.exe"	hptygr.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\jdtkebpkfqrbvfetnm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\upgytrgcykmxsddtooy.exe ."	yborjrewily.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tlzogbngzihphpmz = "wtmgddusqeivsfhzwykha.exe"	hptygr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tlzogbngzihphpmz = "jdtkebpkfqrbvfetnm.exe"	hptygr.exe

Checks whether UAC is enabled 1 TTPs 8 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

yborjrewily.exeyborjrewily.exehptygr.exehptygr.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	yborjrewily.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	yborjrewily.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	hptygr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	hptygr.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	hptygr.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	hptygr.exe

Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

12 whatismyipaddress.com
15 whatismyip.everdot.org
24 www.showmyipaddress.com
58 whatismyip.everdot.org
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media
T1091

Processes:

hptygr.exe

description ioc process

File opened for modification C:\autorun.inf hptygr.exe
File created C:\autorun.inf hptygr.exe

flow	ioc
12	whatismyipaddress.com
15	whatismyip.everdot.org
24	www.showmyipaddress.com
58	whatismyip.everdot.org

description	ioc	process
File opened for modification	C:\autorun.inf	hptygr.exe
File created	C:\autorun.inf	hptygr.exe

Drops file in System32 directory 32 IoCs

Processes:

yborjrewily.exehptygr.exeyborjrewily.exehptygr.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\hdvokjzwtgjvrdevrsdz.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\wtmgddusqeivsfhzwykha.exe	hptygr.exe
File opened for modification	C:\Windows\SysWOW64\jdtkebpkfqrbvfetnm.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\nlfayzrqpejxvjmfdgtrlg.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\tlzogbngzihphpmz.exe	hptygr.exe
File opened for modification	C:\Windows\SysWOW64\upgytrgcykmxsddtooy.exe	hptygr.exe
File opened for modification	C:\Windows\SysWOW64\jdtkebpkfqrbvfetnm.exe	hptygr.exe
File opened for modification	C:\Windows\SysWOW64\tlzogbngzihphpmz.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\atiyrnauoyyhajhvo.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\nlfayzrqpejxvjmfdgtrlg.exe	hptygr.exe
File opened for modification	C:\Windows\SysWOW64\glmotbagmiupupzzeoinoqvdc.okw	hptygr.exe
File opened for modification	C:\Windows\SysWOW64\atiyrnauoyyhajhvo.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\tlzogbngzihphpmz.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\jdtkebpkfqrbvfetnm.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\jdtkebpkfqrbvfetnm.exe	hptygr.exe
File opened for modification	C:\Windows\SysWOW64\hdvokjzwtgjvrdevrsdz.exe	hptygr.exe
File created	C:\Windows\SysWOW64\glmotbagmiupupzzeoinoqvdc.okw	hptygr.exe
File opened for modification	C:\Windows\SysWOW64\wtmgddusqeivsfhzwykha.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\wtmgddusqeivsfhzwykha.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\tlzogbngzihphpmz.exe	hptygr.exe
File opened for modification	C:\Windows\SysWOW64\hdvokjzwtgjvrdevrsdz.exe	hptygr.exe
File opened for modification	C:\Windows\SysWOW64\lbnaqjtkbiflbhcndydtfsiblctaxdtzufvq.lxk	hptygr.exe
File opened for modification	C:\Windows\SysWOW64\upgytrgcykmxsddtooy.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\atiyrnauoyyhajhvo.exe	hptygr.exe
File opened for modification	C:\Windows\SysWOW64\wtmgddusqeivsfhzwykha.exe	hptygr.exe
File opened for modification	C:\Windows\SysWOW64\hdvokjzwtgjvrdevrsdz.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\upgytrgcykmxsddtooy.exe	hptygr.exe
File opened for modification	C:\Windows\SysWOW64\nlfayzrqpejxvjmfdgtrlg.exe	hptygr.exe
File opened for modification	C:\Windows\SysWOW64\upgytrgcykmxsddtooy.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\atiyrnauoyyhajhvo.exe	hptygr.exe
File created	C:\Windows\SysWOW64\lbnaqjtkbiflbhcndydtfsiblctaxdtzufvq.lxk	hptygr.exe
File opened for modification	C:\Windows\SysWOW64\nlfayzrqpejxvjmfdgtrlg.exe	yborjrewily.exe

Drops file in Program Files directory 4 IoCs

Processes:

hptygr.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\glmotbagmiupupzzeoinoqvdc.okw	hptygr.exe
File created	C:\Program Files (x86)\glmotbagmiupupzzeoinoqvdc.okw	hptygr.exe
File opened for modification	C:\Program Files (x86)\lbnaqjtkbiflbhcndydtfsiblctaxdtzufvq.lxk	hptygr.exe
File created	C:\Program Files (x86)\lbnaqjtkbiflbhcndydtfsiblctaxdtzufvq.lxk	hptygr.exe

Drops file in Windows directory 32 IoCs

Processes:

hptygr.exehptygr.exeyborjrewily.exeyborjrewily.exe

description	ioc	process
File opened for modification	C:\Windows\hdvokjzwtgjvrdevrsdz.exe	hptygr.exe
File opened for modification	C:\Windows\lbnaqjtkbiflbhcndydtfsiblctaxdtzufvq.lxk	hptygr.exe
File opened for modification	C:\Windows\wtmgddusqeivsfhzwykha.exe	yborjrewily.exe
File opened for modification	C:\Windows\hdvokjzwtgjvrdevrsdz.exe	yborjrewily.exe
File opened for modification	C:\Windows\atiyrnauoyyhajhvo.exe	hptygr.exe
File opened for modification	C:\Windows\upgytrgcykmxsddtooy.exe	hptygr.exe
File created	C:\Windows\glmotbagmiupupzzeoinoqvdc.okw	hptygr.exe
File opened for modification	C:\Windows\hdvokjzwtgjvrdevrsdz.exe	yborjrewily.exe
File opened for modification	C:\Windows\jdtkebpkfqrbvfetnm.exe	yborjrewily.exe
File opened for modification	C:\Windows\nlfayzrqpejxvjmfdgtrlg.exe	yborjrewily.exe
File opened for modification	C:\Windows\hdvokjzwtgjvrdevrsdz.exe	hptygr.exe
File opened for modification	C:\Windows\wtmgddusqeivsfhzwykha.exe	hptygr.exe
File opened for modification	C:\Windows\tlzogbngzihphpmz.exe	yborjrewily.exe
File opened for modification	C:\Windows\nlfayzrqpejxvjmfdgtrlg.exe	yborjrewily.exe
File opened for modification	C:\Windows\upgytrgcykmxsddtooy.exe	yborjrewily.exe
File opened for modification	C:\Windows\tlzogbngzihphpmz.exe	hptygr.exe
File opened for modification	C:\Windows\upgytrgcykmxsddtooy.exe	hptygr.exe
File opened for modification	C:\Windows\nlfayzrqpejxvjmfdgtrlg.exe	hptygr.exe
File created	C:\Windows\lbnaqjtkbiflbhcndydtfsiblctaxdtzufvq.lxk	hptygr.exe
File opened for modification	C:\Windows\jdtkebpkfqrbvfetnm.exe	yborjrewily.exe
File opened for modification	C:\Windows\jdtkebpkfqrbvfetnm.exe	hptygr.exe
File opened for modification	C:\Windows\jdtkebpkfqrbvfetnm.exe	hptygr.exe
File opened for modification	C:\Windows\nlfayzrqpejxvjmfdgtrlg.exe	hptygr.exe
File opened for modification	C:\Windows\tlzogbngzihphpmz.exe	yborjrewily.exe
File opened for modification	C:\Windows\tlzogbngzihphpmz.exe	hptygr.exe
File opened for modification	C:\Windows\upgytrgcykmxsddtooy.exe	yborjrewily.exe
File opened for modification	C:\Windows\wtmgddusqeivsfhzwykha.exe	yborjrewily.exe
File opened for modification	C:\Windows\atiyrnauoyyhajhvo.exe	hptygr.exe
File opened for modification	C:\Windows\glmotbagmiupupzzeoinoqvdc.okw	hptygr.exe
File opened for modification	C:\Windows\atiyrnauoyyhajhvo.exe	yborjrewily.exe
File opened for modification	C:\Windows\wtmgddusqeivsfhzwykha.exe	hptygr.exe
File opened for modification	C:\Windows\atiyrnauoyyhajhvo.exe	yborjrewily.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exehptygr.exe

pid	process
2112	1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe
2112	1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe
2112	1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe
2112	1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe
2112	1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe
2112	1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe
2112	1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe
2112	1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe
2112	1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe
2112	1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe
2112	1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe
2112	1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe
2112	1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe
2112	1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe
2112	1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe
2112	1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe
4228	hptygr.exe
4228	hptygr.exe
2112	1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe
2112	1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe
2112	1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe
2112	1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe
2112	1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe
2112	1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe
2112	1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe
2112	1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe
2112	1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe
2112	1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe
2112	1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe
2112	1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe
2112	1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe
2112	1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe
2112	1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe
2112	1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe
2112	1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe
2112	1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe
2112	1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe
2112	1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe
2112	1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe
2112	1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe
2112	1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe
2112	1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe
2112	1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe
2112	1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe
2112	1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe
2112	1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe
4228	hptygr.exe
4228	hptygr.exe
2112	1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe
2112	1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe
2112	1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe
2112	1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe
2112	1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe
2112	1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe
2112	1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe
2112	1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe
2112	1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe
2112	1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe
2112	1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe
2112	1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe
2112	1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe
2112	1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe
2112	1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe
2112	1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

hptygr.exe

description pid process

Token: SeDebugPrivilege 4228 hptygr.exe

description	pid	process
Token: SeDebugPrivilege	4228	hptygr.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exeyborjrewily.exe

description	pid	process	target process
PID 2112 wrote to memory of 516	2112	1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe	yborjrewily.exe
PID 2112 wrote to memory of 516	2112	1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe	yborjrewily.exe
PID 2112 wrote to memory of 516	2112	1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe	yborjrewily.exe
PID 516 wrote to memory of 4228	516	yborjrewily.exe	hptygr.exe
PID 516 wrote to memory of 4228	516	yborjrewily.exe	hptygr.exe
PID 516 wrote to memory of 4228	516	yborjrewily.exe	hptygr.exe
PID 516 wrote to memory of 3476	516	yborjrewily.exe	hptygr.exe
PID 516 wrote to memory of 3476	516	yborjrewily.exe	hptygr.exe
PID 516 wrote to memory of 3476	516	yborjrewily.exe	hptygr.exe
PID 2112 wrote to memory of 2544	2112	1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe	yborjrewily.exe
PID 2112 wrote to memory of 2544	2112	1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe	yborjrewily.exe
PID 2112 wrote to memory of 2544	2112	1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe	yborjrewily.exe

System policy modification 1 TTPs 41 IoCs

evasion

Modify Registry

T1112

Processes:

hptygr.exehptygr.exeyborjrewily.exeyborjrewily.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	hptygr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	hptygr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	hptygr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	hptygr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	hptygr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	hptygr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	hptygr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	hptygr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	hptygr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	hptygr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	hptygr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	hptygr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	yborjrewily.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	hptygr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	hptygr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	hptygr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	hptygr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	hptygr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	hptygr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	hptygr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	hptygr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	hptygr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	hptygr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	hptygr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	hptygr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	hptygr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	hptygr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	yborjrewily.exe

C:\Users\Admin\AppData\Local\Temp\1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe
"C:\Users\Admin\AppData\Local\Temp\1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Users\Admin\AppData\Local\Temp\yborjrewily.exe
  "C:\Users\Admin\AppData\Local\Temp\yborjrewily.exe" "c:\users\admin\appdata\local\temp\1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe*"
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Adds policy Run key to start application
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Checks computer location settings
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:516
- - C:\Users\Admin\AppData\Local\Temp\hptygr.exe
    "C:\Users\Admin\AppData\Local\Temp\hptygr.exe" "-C:\Users\Admin\AppData\Local\Temp\tlzogbngzihphpmz.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops autorun.inf file
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - System policy modification
    PID:4228
- - C:\Users\Admin\AppData\Local\Temp\hptygr.exe
    "C:\Users\Admin\AppData\Local\Temp\hptygr.exe" "-C:\Users\Admin\AppData\Local\Temp\tlzogbngzihphpmz.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System policy modification
    PID:3476
- C:\Users\Admin\AppData\Local\Temp\yborjrewily.exe
  "C:\Users\Admin\AppData\Local\Temp\yborjrewily.exe" "c:\users\admin\appdata\local\temp\1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca.exe"
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Adds policy Run key to start application
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System policy modification
  PID:2544

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\atiyrnauoyyhajhvo.exe

Filesize
1016KB

MD5
44393b585c395c719d5253ee3c31a620

SHA1
2e67a1959239c38212d2535b14933ca0509aaac1

SHA256
1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca

SHA512
52327d3b305ff2c42ceec683dd2778f965cf62348fc1177e4506266b2fd6ba0bc7ed9ff8ef8e0b677ba7b4e5c17e42e471610faefdc5edc5b5d39883447c4b65

Download Submit
C:\Users\Admin\AppData\Local\Temp\hdvokjzwtgjvrdevrsdz.exe

Filesize
1016KB

MD5
44393b585c395c719d5253ee3c31a620

SHA1
2e67a1959239c38212d2535b14933ca0509aaac1

SHA256
1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca

SHA512
52327d3b305ff2c42ceec683dd2778f965cf62348fc1177e4506266b2fd6ba0bc7ed9ff8ef8e0b677ba7b4e5c17e42e471610faefdc5edc5b5d39883447c4b65

Download Submit
C:\Users\Admin\AppData\Local\Temp\hptygr.exe

Filesize
716KB

MD5
874154a26120f4f0c7c065f13663fdd1

SHA1
c97dfd31f4cfc694789e0b0f07dda20508f5160c

SHA256
f9c707fa5a9e52c49d1f8744648f18cb8907eb3679964e1fd02985dceca48738

SHA512
bdb0044a63d25ce8cdb097bce1a56864663938c2f22eb6080229590b244d6f4d84189e67684f8f0a2d5d3d21ce86e836ea5b0a7346e97a3f92ff78d6aa42c080

Download Submit
C:\Users\Admin\AppData\Local\Temp\hptygr.exe

Filesize
716KB

MD5
874154a26120f4f0c7c065f13663fdd1

SHA1
c97dfd31f4cfc694789e0b0f07dda20508f5160c

SHA256
f9c707fa5a9e52c49d1f8744648f18cb8907eb3679964e1fd02985dceca48738

SHA512
bdb0044a63d25ce8cdb097bce1a56864663938c2f22eb6080229590b244d6f4d84189e67684f8f0a2d5d3d21ce86e836ea5b0a7346e97a3f92ff78d6aa42c080

Download Submit
C:\Users\Admin\AppData\Local\Temp\hptygr.exe

Filesize
716KB

MD5
874154a26120f4f0c7c065f13663fdd1

SHA1
c97dfd31f4cfc694789e0b0f07dda20508f5160c

SHA256
f9c707fa5a9e52c49d1f8744648f18cb8907eb3679964e1fd02985dceca48738

SHA512
bdb0044a63d25ce8cdb097bce1a56864663938c2f22eb6080229590b244d6f4d84189e67684f8f0a2d5d3d21ce86e836ea5b0a7346e97a3f92ff78d6aa42c080

Download Submit
C:\Users\Admin\AppData\Local\Temp\jdtkebpkfqrbvfetnm.exe

Filesize
1016KB

MD5
44393b585c395c719d5253ee3c31a620

SHA1
2e67a1959239c38212d2535b14933ca0509aaac1

SHA256
1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca

SHA512
52327d3b305ff2c42ceec683dd2778f965cf62348fc1177e4506266b2fd6ba0bc7ed9ff8ef8e0b677ba7b4e5c17e42e471610faefdc5edc5b5d39883447c4b65

Download Submit
C:\Users\Admin\AppData\Local\Temp\nlfayzrqpejxvjmfdgtrlg.exe

Filesize
1016KB

MD5
44393b585c395c719d5253ee3c31a620

SHA1
2e67a1959239c38212d2535b14933ca0509aaac1

SHA256
1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca

SHA512
52327d3b305ff2c42ceec683dd2778f965cf62348fc1177e4506266b2fd6ba0bc7ed9ff8ef8e0b677ba7b4e5c17e42e471610faefdc5edc5b5d39883447c4b65

Download Submit
C:\Users\Admin\AppData\Local\Temp\tlzogbngzihphpmz.exe

Filesize
1016KB

MD5
44393b585c395c719d5253ee3c31a620

SHA1
2e67a1959239c38212d2535b14933ca0509aaac1

SHA256
1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca

SHA512
52327d3b305ff2c42ceec683dd2778f965cf62348fc1177e4506266b2fd6ba0bc7ed9ff8ef8e0b677ba7b4e5c17e42e471610faefdc5edc5b5d39883447c4b65

Download Submit
C:\Users\Admin\AppData\Local\Temp\upgytrgcykmxsddtooy.exe

Filesize
1016KB

MD5
44393b585c395c719d5253ee3c31a620

SHA1
2e67a1959239c38212d2535b14933ca0509aaac1

SHA256
1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca

SHA512
52327d3b305ff2c42ceec683dd2778f965cf62348fc1177e4506266b2fd6ba0bc7ed9ff8ef8e0b677ba7b4e5c17e42e471610faefdc5edc5b5d39883447c4b65

Download Submit
C:\Users\Admin\AppData\Local\Temp\wtmgddusqeivsfhzwykha.exe

Filesize
1016KB

MD5
44393b585c395c719d5253ee3c31a620

SHA1
2e67a1959239c38212d2535b14933ca0509aaac1

SHA256
1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca

SHA512
52327d3b305ff2c42ceec683dd2778f965cf62348fc1177e4506266b2fd6ba0bc7ed9ff8ef8e0b677ba7b4e5c17e42e471610faefdc5edc5b5d39883447c4b65

Download Submit
C:\Users\Admin\AppData\Local\Temp\yborjrewily.exe

Filesize
320KB

MD5
f435b85d334673df22adbe7d6b84e3ed

SHA1
d943726545462fa3f291c8e8a9c4d998e3548a10

SHA256
0a4d0de76787ea999dd880bd7ed46721f56c551b984b6efe34a7f881877aa81d

SHA512
d890059b23fdf02c49bdb90b1f727090351d5c148c843de0c5c290971f4e99a507a98fe214bff104f2e3e89019d2b89154bd13b5aabbd3f08d926dc27d7bcd72

Download Submit
C:\Users\Admin\AppData\Local\Temp\yborjrewily.exe

Filesize
320KB

MD5
f435b85d334673df22adbe7d6b84e3ed

SHA1
d943726545462fa3f291c8e8a9c4d998e3548a10

SHA256
0a4d0de76787ea999dd880bd7ed46721f56c551b984b6efe34a7f881877aa81d

SHA512
d890059b23fdf02c49bdb90b1f727090351d5c148c843de0c5c290971f4e99a507a98fe214bff104f2e3e89019d2b89154bd13b5aabbd3f08d926dc27d7bcd72

Download Submit
C:\Users\Admin\AppData\Local\Temp\yborjrewily.exe

Filesize
320KB

MD5
f435b85d334673df22adbe7d6b84e3ed

SHA1
d943726545462fa3f291c8e8a9c4d998e3548a10

SHA256
0a4d0de76787ea999dd880bd7ed46721f56c551b984b6efe34a7f881877aa81d

SHA512
d890059b23fdf02c49bdb90b1f727090351d5c148c843de0c5c290971f4e99a507a98fe214bff104f2e3e89019d2b89154bd13b5aabbd3f08d926dc27d7bcd72

Download Submit
C:\Windows\SysWOW64\atiyrnauoyyhajhvo.exe

Filesize
1016KB

MD5
44393b585c395c719d5253ee3c31a620

SHA1
2e67a1959239c38212d2535b14933ca0509aaac1

SHA256
1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca

SHA512
52327d3b305ff2c42ceec683dd2778f965cf62348fc1177e4506266b2fd6ba0bc7ed9ff8ef8e0b677ba7b4e5c17e42e471610faefdc5edc5b5d39883447c4b65

Download Submit
C:\Windows\SysWOW64\hdvokjzwtgjvrdevrsdz.exe

Filesize
1016KB

MD5
44393b585c395c719d5253ee3c31a620

SHA1
2e67a1959239c38212d2535b14933ca0509aaac1

SHA256
1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca

SHA512
52327d3b305ff2c42ceec683dd2778f965cf62348fc1177e4506266b2fd6ba0bc7ed9ff8ef8e0b677ba7b4e5c17e42e471610faefdc5edc5b5d39883447c4b65

Download Submit
C:\Windows\SysWOW64\jdtkebpkfqrbvfetnm.exe

Filesize
1016KB

MD5
44393b585c395c719d5253ee3c31a620

SHA1
2e67a1959239c38212d2535b14933ca0509aaac1

SHA256
1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca

SHA512
52327d3b305ff2c42ceec683dd2778f965cf62348fc1177e4506266b2fd6ba0bc7ed9ff8ef8e0b677ba7b4e5c17e42e471610faefdc5edc5b5d39883447c4b65

Download Submit
C:\Windows\SysWOW64\nlfayzrqpejxvjmfdgtrlg.exe

Filesize
1016KB

MD5
44393b585c395c719d5253ee3c31a620

SHA1
2e67a1959239c38212d2535b14933ca0509aaac1

SHA256
1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca

SHA512
52327d3b305ff2c42ceec683dd2778f965cf62348fc1177e4506266b2fd6ba0bc7ed9ff8ef8e0b677ba7b4e5c17e42e471610faefdc5edc5b5d39883447c4b65

Download Submit
C:\Windows\SysWOW64\tlzogbngzihphpmz.exe

Filesize
1016KB

MD5
44393b585c395c719d5253ee3c31a620

SHA1
2e67a1959239c38212d2535b14933ca0509aaac1

SHA256
1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca

SHA512
52327d3b305ff2c42ceec683dd2778f965cf62348fc1177e4506266b2fd6ba0bc7ed9ff8ef8e0b677ba7b4e5c17e42e471610faefdc5edc5b5d39883447c4b65

Download Submit
C:\Windows\SysWOW64\upgytrgcykmxsddtooy.exe

Filesize
1016KB

MD5
44393b585c395c719d5253ee3c31a620

SHA1
2e67a1959239c38212d2535b14933ca0509aaac1

SHA256
1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca

SHA512
52327d3b305ff2c42ceec683dd2778f965cf62348fc1177e4506266b2fd6ba0bc7ed9ff8ef8e0b677ba7b4e5c17e42e471610faefdc5edc5b5d39883447c4b65

Download Submit
C:\Windows\SysWOW64\wtmgddusqeivsfhzwykha.exe

Filesize
1016KB

MD5
44393b585c395c719d5253ee3c31a620

SHA1
2e67a1959239c38212d2535b14933ca0509aaac1

SHA256
1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca

SHA512
52327d3b305ff2c42ceec683dd2778f965cf62348fc1177e4506266b2fd6ba0bc7ed9ff8ef8e0b677ba7b4e5c17e42e471610faefdc5edc5b5d39883447c4b65

Download Submit
C:\Windows\atiyrnauoyyhajhvo.exe

Filesize
1016KB

MD5
44393b585c395c719d5253ee3c31a620

SHA1
2e67a1959239c38212d2535b14933ca0509aaac1

SHA256
1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca

SHA512
52327d3b305ff2c42ceec683dd2778f965cf62348fc1177e4506266b2fd6ba0bc7ed9ff8ef8e0b677ba7b4e5c17e42e471610faefdc5edc5b5d39883447c4b65

Download Submit
C:\Windows\atiyrnauoyyhajhvo.exe

Filesize
1016KB

MD5
44393b585c395c719d5253ee3c31a620

SHA1
2e67a1959239c38212d2535b14933ca0509aaac1

SHA256
1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca

SHA512
52327d3b305ff2c42ceec683dd2778f965cf62348fc1177e4506266b2fd6ba0bc7ed9ff8ef8e0b677ba7b4e5c17e42e471610faefdc5edc5b5d39883447c4b65

Download Submit
C:\Windows\atiyrnauoyyhajhvo.exe

Filesize
1016KB

MD5
44393b585c395c719d5253ee3c31a620

SHA1
2e67a1959239c38212d2535b14933ca0509aaac1

SHA256
1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca

SHA512
52327d3b305ff2c42ceec683dd2778f965cf62348fc1177e4506266b2fd6ba0bc7ed9ff8ef8e0b677ba7b4e5c17e42e471610faefdc5edc5b5d39883447c4b65

Download Submit
C:\Windows\hdvokjzwtgjvrdevrsdz.exe

Filesize
1016KB

MD5
44393b585c395c719d5253ee3c31a620

SHA1
2e67a1959239c38212d2535b14933ca0509aaac1

SHA256
1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca

SHA512
52327d3b305ff2c42ceec683dd2778f965cf62348fc1177e4506266b2fd6ba0bc7ed9ff8ef8e0b677ba7b4e5c17e42e471610faefdc5edc5b5d39883447c4b65

Download Submit
C:\Windows\hdvokjzwtgjvrdevrsdz.exe

Filesize
1016KB

MD5
44393b585c395c719d5253ee3c31a620

SHA1
2e67a1959239c38212d2535b14933ca0509aaac1

SHA256
1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca

SHA512
52327d3b305ff2c42ceec683dd2778f965cf62348fc1177e4506266b2fd6ba0bc7ed9ff8ef8e0b677ba7b4e5c17e42e471610faefdc5edc5b5d39883447c4b65

Download Submit
C:\Windows\hdvokjzwtgjvrdevrsdz.exe

Filesize
1016KB

MD5
44393b585c395c719d5253ee3c31a620

SHA1
2e67a1959239c38212d2535b14933ca0509aaac1

SHA256
1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca

SHA512
52327d3b305ff2c42ceec683dd2778f965cf62348fc1177e4506266b2fd6ba0bc7ed9ff8ef8e0b677ba7b4e5c17e42e471610faefdc5edc5b5d39883447c4b65

Download Submit
C:\Windows\jdtkebpkfqrbvfetnm.exe

Filesize
1016KB

MD5
44393b585c395c719d5253ee3c31a620

SHA1
2e67a1959239c38212d2535b14933ca0509aaac1

SHA256
1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca

SHA512
52327d3b305ff2c42ceec683dd2778f965cf62348fc1177e4506266b2fd6ba0bc7ed9ff8ef8e0b677ba7b4e5c17e42e471610faefdc5edc5b5d39883447c4b65

Download Submit
C:\Windows\jdtkebpkfqrbvfetnm.exe

Filesize
1016KB

MD5
44393b585c395c719d5253ee3c31a620

SHA1
2e67a1959239c38212d2535b14933ca0509aaac1

SHA256
1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca

SHA512
52327d3b305ff2c42ceec683dd2778f965cf62348fc1177e4506266b2fd6ba0bc7ed9ff8ef8e0b677ba7b4e5c17e42e471610faefdc5edc5b5d39883447c4b65

Download Submit
C:\Windows\jdtkebpkfqrbvfetnm.exe

Filesize
1016KB

MD5
44393b585c395c719d5253ee3c31a620

SHA1
2e67a1959239c38212d2535b14933ca0509aaac1

SHA256
1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca

SHA512
52327d3b305ff2c42ceec683dd2778f965cf62348fc1177e4506266b2fd6ba0bc7ed9ff8ef8e0b677ba7b4e5c17e42e471610faefdc5edc5b5d39883447c4b65

Download Submit
C:\Windows\nlfayzrqpejxvjmfdgtrlg.exe

Filesize
1016KB

MD5
44393b585c395c719d5253ee3c31a620

SHA1
2e67a1959239c38212d2535b14933ca0509aaac1

SHA256
1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca

SHA512
52327d3b305ff2c42ceec683dd2778f965cf62348fc1177e4506266b2fd6ba0bc7ed9ff8ef8e0b677ba7b4e5c17e42e471610faefdc5edc5b5d39883447c4b65

Download Submit
C:\Windows\nlfayzrqpejxvjmfdgtrlg.exe

Filesize
1016KB

MD5
44393b585c395c719d5253ee3c31a620

SHA1
2e67a1959239c38212d2535b14933ca0509aaac1

SHA256
1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca

SHA512
52327d3b305ff2c42ceec683dd2778f965cf62348fc1177e4506266b2fd6ba0bc7ed9ff8ef8e0b677ba7b4e5c17e42e471610faefdc5edc5b5d39883447c4b65

Download Submit
C:\Windows\nlfayzrqpejxvjmfdgtrlg.exe

Filesize
1016KB

MD5
44393b585c395c719d5253ee3c31a620

SHA1
2e67a1959239c38212d2535b14933ca0509aaac1

SHA256
1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca

SHA512
52327d3b305ff2c42ceec683dd2778f965cf62348fc1177e4506266b2fd6ba0bc7ed9ff8ef8e0b677ba7b4e5c17e42e471610faefdc5edc5b5d39883447c4b65

Download Submit
C:\Windows\tlzogbngzihphpmz.exe

Filesize
1016KB

MD5
44393b585c395c719d5253ee3c31a620

SHA1
2e67a1959239c38212d2535b14933ca0509aaac1

SHA256
1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca

SHA512
52327d3b305ff2c42ceec683dd2778f965cf62348fc1177e4506266b2fd6ba0bc7ed9ff8ef8e0b677ba7b4e5c17e42e471610faefdc5edc5b5d39883447c4b65

Download Submit
C:\Windows\tlzogbngzihphpmz.exe

Filesize
1016KB

MD5
44393b585c395c719d5253ee3c31a620

SHA1
2e67a1959239c38212d2535b14933ca0509aaac1

SHA256
1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca

SHA512
52327d3b305ff2c42ceec683dd2778f965cf62348fc1177e4506266b2fd6ba0bc7ed9ff8ef8e0b677ba7b4e5c17e42e471610faefdc5edc5b5d39883447c4b65

Download Submit
C:\Windows\upgytrgcykmxsddtooy.exe

Filesize
1016KB

MD5
44393b585c395c719d5253ee3c31a620

SHA1
2e67a1959239c38212d2535b14933ca0509aaac1

SHA256
1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca

SHA512
52327d3b305ff2c42ceec683dd2778f965cf62348fc1177e4506266b2fd6ba0bc7ed9ff8ef8e0b677ba7b4e5c17e42e471610faefdc5edc5b5d39883447c4b65

Download Submit
C:\Windows\upgytrgcykmxsddtooy.exe

Filesize
1016KB

MD5
44393b585c395c719d5253ee3c31a620

SHA1
2e67a1959239c38212d2535b14933ca0509aaac1

SHA256
1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca

SHA512
52327d3b305ff2c42ceec683dd2778f965cf62348fc1177e4506266b2fd6ba0bc7ed9ff8ef8e0b677ba7b4e5c17e42e471610faefdc5edc5b5d39883447c4b65

Download Submit
C:\Windows\upgytrgcykmxsddtooy.exe

Filesize
1016KB

MD5
44393b585c395c719d5253ee3c31a620

SHA1
2e67a1959239c38212d2535b14933ca0509aaac1

SHA256
1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca

SHA512
52327d3b305ff2c42ceec683dd2778f965cf62348fc1177e4506266b2fd6ba0bc7ed9ff8ef8e0b677ba7b4e5c17e42e471610faefdc5edc5b5d39883447c4b65

Download Submit
C:\Windows\wtmgddusqeivsfhzwykha.exe

Filesize
1016KB

MD5
44393b585c395c719d5253ee3c31a620

SHA1
2e67a1959239c38212d2535b14933ca0509aaac1

SHA256
1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca

SHA512
52327d3b305ff2c42ceec683dd2778f965cf62348fc1177e4506266b2fd6ba0bc7ed9ff8ef8e0b677ba7b4e5c17e42e471610faefdc5edc5b5d39883447c4b65

Download Submit
C:\Windows\wtmgddusqeivsfhzwykha.exe

Filesize
1016KB

MD5
44393b585c395c719d5253ee3c31a620

SHA1
2e67a1959239c38212d2535b14933ca0509aaac1

SHA256
1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca

SHA512
52327d3b305ff2c42ceec683dd2778f965cf62348fc1177e4506266b2fd6ba0bc7ed9ff8ef8e0b677ba7b4e5c17e42e471610faefdc5edc5b5d39883447c4b65

Download Submit
C:\Windows\wtmgddusqeivsfhzwykha.exe

Filesize
1016KB

MD5
44393b585c395c719d5253ee3c31a620

SHA1
2e67a1959239c38212d2535b14933ca0509aaac1

SHA256
1e52a4e16dcf37f5b22980bf9f3821d36c7fc0f7194abb8dfeb56f11c511b6ca

SHA512
52327d3b305ff2c42ceec683dd2778f965cf62348fc1177e4506266b2fd6ba0bc7ed9ff8ef8e0b677ba7b4e5c17e42e471610faefdc5edc5b5d39883447c4b65

Download Submit
memory/516-132-0x0000000000000000-mapping.dmp

Download
memory/2544-168-0x0000000000000000-mapping.dmp

Download
memory/3476-138-0x0000000000000000-mapping.dmp

Download
memory/4228-135-0x0000000000000000-mapping.dmp

Download