9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 18:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe
Size

1016KB
MD5

57b396a2e8cf5f0df966da0db3b7d1b0
SHA1

ba2a472114c0a1fdf34413d8d9ec73347bccc693
SHA256

9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40
SHA512

87ddbd3accb40635ba6f3a5dd2f16bec58152ec70930e03031aedb42dc892581fa05b4a0f788302a1e3d05c237b18f8a4bd6ec94a4e1a84c9a058cba8f72c1af
SSDEEP

6144:jIXsL0tvrSVz1DnemeYbpsnEf78AoXh6KkiD0OofzA+/VygHUmDa1is0f:jIXsgtvm1De5YlOx6lzBH46Umu1q

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

biotw.exebiotw.exeyborjrewily.exeyborjrewily.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	biotw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	biotw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	yborjrewily.exe

UAC bypass 3 TTPs 13 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

biotw.exebiotw.exeyborjrewily.exeyborjrewily.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	biotw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	biotw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	biotw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	biotw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	biotw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	biotw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	biotw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	biotw.exe

Adds policy Run key to start application 2 TTPs 29 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

biotw.exebiotw.exeyborjrewily.exeyborjrewily.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ziqxcds = "C:\\Users\\Admin\\AppData\\Local\\Temp\\byupixamjnaxkmebdurni.exe"	biotw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ziqxcds = "C:\\Users\\Admin\\AppData\\Local\\Temp\\oibtjvveyzjdnmbvui.exe"	biotw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ykvfnrjkwp = "byupixamjnaxkmebdurni.exe"	biotw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ykvfnrjkwp = "midxpdfqmpbxjkbxyokf.exe"	biotw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ziqxcds = "C:\\Users\\Admin\\AppData\\Local\\Temp\\oibtjvveyzjdnmbvui.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ziqxcds = "C:\\Users\\Admin\\AppData\\Local\\Temp\\byupixamjnaxkmebdurni.exe"	biotw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ziqxcds = "C:\\Users\\Admin\\AppData\\Local\\Temp\\oibtjvveyzjdnmbvui.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ykvfnrjkwp = "byupixamjnaxkmebdurni.exe"	biotw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ziqxcds = "C:\\Users\\Admin\\AppData\\Local\\Temp\\midxpdfqmpbxjkbxyokf.exe"	biotw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ykvfnrjkwp = "oibtjvveyzjdnmbvui.exe"	biotw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	biotw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ykvfnrjkwp = "midxpdfqmpbxjkbxyokf.exe"	biotw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ykvfnrjkwp = "oibtjvveyzjdnmbvui.exe"	biotw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ykvfnrjkwp = "oibtjvveyzjdnmbvui.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ziqxcds = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zuohylmwrtezkkavvkf.exe"	biotw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ykvfnrjkwp = "yqhxlvtasrzrzwjb.exe"	biotw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ykvfnrjkwp = "fyqhwhgohhqjsqexv.exe"	biotw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ziqxcds = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zuohylmwrtezkkavvkf.exe"	biotw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ziqxcds = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fyqhwhgohhqjsqexv.exe"	biotw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ziqxcds = "C:\\Users\\Admin\\AppData\\Local\\Temp\\oibtjvveyzjdnmbvui.exe"	biotw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ziqxcds = "C:\\Users\\Admin\\AppData\\Local\\Temp\\midxpdfqmpbxjkbxyokf.exe"	biotw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ziqxcds = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fyqhwhgohhqjsqexv.exe"	biotw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ykvfnrjkwp = "yqhxlvtasrzrzwjb.exe"	biotw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ykvfnrjkwp = "fyqhwhgohhqjsqexv.exe"	biotw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	biotw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ykvfnrjkwp = "zuohylmwrtezkkavvkf.exe"	biotw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ykvfnrjkwp = "yqhxlvtasrzrzwjb.exe"	yborjrewily.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	yborjrewily.exe

Disables RegEdit via registry modification 6 IoCs

evasion

Processes:

biotw.exebiotw.exeyborjrewily.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	biotw.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	biotw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	biotw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	biotw.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	yborjrewily.exe

Executes dropped EXE 4 IoCs

Processes:

yborjrewily.exebiotw.exebiotw.exeyborjrewily.exe

pid process

5024 yborjrewily.exe
532 biotw.exe
2432 biotw.exe
4268 yborjrewily.exe

pid	process
5024	yborjrewily.exe
532	biotw.exe
2432	biotw.exe
4268	yborjrewily.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

yborjrewily.exe9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	yborjrewily.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

biotw.exeyborjrewily.exebiotw.exeyborjrewily.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fqajqtkkv = "zuohylmwrtezkkavvkf.exe ."	biotw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\qerdntnqezdr = "zuohylmwrtezkkavvkf.exe ."	biotw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tgsdmrkmztw = "fyqhwhgohhqjsqexv.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\fqajqtkkv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fyqhwhgohhqjsqexv.exe ."	biotw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fqajqtkkv = "midxpdfqmpbxjkbxyokf.exe ."	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fqajqtkkv = "byupixamjnaxkmebdurni.exe ."	biotw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qgvjvdzeurxnto = "C:\\Users\\Admin\\AppData\\Local\\Temp\\byupixamjnaxkmebdurni.exe"	biotw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\oyhpvxnm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zuohylmwrtezkkavvkf.exe"	biotw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\qerdntnqezdr = "byupixamjnaxkmebdurni.exe ."	yborjrewily.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\fqajqtkkv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\midxpdfqmpbxjkbxyokf.exe ."	biotw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oyhpvxnm = "midxpdfqmpbxjkbxyokf.exe"	biotw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qgvjvdzeurxnto = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fyqhwhgohhqjsqexv.exe"	biotw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tgsdmrkmztw = "zuohylmwrtezkkavvkf.exe"	biotw.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	yborjrewily.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tgsdmrkmztw = "oibtjvveyzjdnmbvui.exe"	biotw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fqajqtkkv = "fyqhwhgohhqjsqexv.exe ."	biotw.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	biotw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\oyhpvxnm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zuohylmwrtezkkavvkf.exe"	biotw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\qerdntnqezdr = "byupixamjnaxkmebdurni.exe ."	biotw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fqajqtkkv = "fyqhwhgohhqjsqexv.exe ."	biotw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oyhpvxnm = "midxpdfqmpbxjkbxyokf.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qgvjvdzeurxnto = "C:\\Users\\Admin\\AppData\\Local\\Temp\\midxpdfqmpbxjkbxyokf.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\qerdntnqezdr = "yqhxlvtasrzrzwjb.exe ."	biotw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pesfqxswlhmbg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yqhxlvtasrzrzwjb.exe ."	yborjrewily.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	yborjrewily.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tgsdmrkmztw = "midxpdfqmpbxjkbxyokf.exe"	biotw.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pesfqxswlhmbg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zuohylmwrtezkkavvkf.exe ."	biotw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oyhpvxnm = "byupixamjnaxkmebdurni.exe"	biotw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oyhpvxnm = "oibtjvveyzjdnmbvui.exe"	biotw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	yborjrewily.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	biotw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pesfqxswlhmbg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\byupixamjnaxkmebdurni.exe ."	biotw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fqajqtkkv = "midxpdfqmpbxjkbxyokf.exe ."	biotw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tgsdmrkmztw = "yqhxlvtasrzrzwjb.exe"	biotw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oyhpvxnm = "zuohylmwrtezkkavvkf.exe"	yborjrewily.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	biotw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pesfqxswlhmbg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fyqhwhgohhqjsqexv.exe ."	biotw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tgsdmrkmztw = "yqhxlvtasrzrzwjb.exe"	biotw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\fqajqtkkv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zuohylmwrtezkkavvkf.exe ."	biotw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\oyhpvxnm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fyqhwhgohhqjsqexv.exe"	biotw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pesfqxswlhmbg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\byupixamjnaxkmebdurni.exe ."	yborjrewily.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\fqajqtkkv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yqhxlvtasrzrzwjb.exe ."	biotw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\oyhpvxnm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\byupixamjnaxkmebdurni.exe"	biotw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fqajqtkkv = "yqhxlvtasrzrzwjb.exe ."	biotw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\oyhpvxnm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yqhxlvtasrzrzwjb.exe"	biotw.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	yborjrewily.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	biotw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pesfqxswlhmbg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\oibtjvveyzjdnmbvui.exe ."	biotw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fqajqtkkv = "midxpdfqmpbxjkbxyokf.exe ."	biotw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fqajqtkkv = "fyqhwhgohhqjsqexv.exe ."	yborjrewily.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	biotw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\qerdntnqezdr = "zuohylmwrtezkkavvkf.exe ."	biotw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\fqajqtkkv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\oibtjvveyzjdnmbvui.exe ."	biotw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qgvjvdzeurxnto = "C:\\Users\\Admin\\AppData\\Local\\Temp\\midxpdfqmpbxjkbxyokf.exe"	biotw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\qerdntnqezdr = "yqhxlvtasrzrzwjb.exe ."	biotw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tgsdmrkmztw = "fyqhwhgohhqjsqexv.exe"	biotw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\oyhpvxnm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\oibtjvveyzjdnmbvui.exe"	biotw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fqajqtkkv = "oibtjvveyzjdnmbvui.exe ."	biotw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tgsdmrkmztw = "byupixamjnaxkmebdurni.exe"	biotw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oyhpvxnm = "fyqhwhgohhqjsqexv.exe"	biotw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\fqajqtkkv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yqhxlvtasrzrzwjb.exe ."	biotw.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oyhpvxnm = "byupixamjnaxkmebdurni.exe"	biotw.exe

Checks whether UAC is enabled 1 TTPs 8 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

yborjrewily.exebiotw.exebiotw.exeyborjrewily.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	yborjrewily.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	biotw.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	biotw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	biotw.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	biotw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	yborjrewily.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	yborjrewily.exe

Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

11 www.showmyipaddress.com
29 whatismyip.everdot.org
42 whatismyipaddress.com
44 whatismyip.everdot.org
67 whatismyip.everdot.org

flow	ioc
11	www.showmyipaddress.com
29	whatismyip.everdot.org
42	whatismyipaddress.com
44	whatismyip.everdot.org
67	whatismyip.everdot.org

Drops file in System32 directory 32 IoCs

Processes:

yborjrewily.exebiotw.exebiotw.exeyborjrewily.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\fyqhwhgohhqjsqexv.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\oibtjvveyzjdnmbvui.exe	biotw.exe
File created	C:\Windows\SysWOW64\lquxyvgafrmrmwwblkptwxufz.qlq	biotw.exe
File created	C:\Windows\SysWOW64\qgvjvdzeurxntozpkukznzhdiyvbrxsdtoyo.rdl	biotw.exe
File opened for modification	C:\Windows\SysWOW64\zuohylmwrtezkkavvkf.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\oibtjvveyzjdnmbvui.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\fyqhwhgohhqjsqexv.exe	biotw.exe
File opened for modification	C:\Windows\SysWOW64\oibtjvveyzjdnmbvui.exe	biotw.exe
File opened for modification	C:\Windows\SysWOW64\sqnjdtxkinbznqjhkcaxtn.exe	biotw.exe
File opened for modification	C:\Windows\SysWOW64\fyqhwhgohhqjsqexv.exe	biotw.exe
File opened for modification	C:\Windows\SysWOW64\zuohylmwrtezkkavvkf.exe	biotw.exe
File opened for modification	C:\Windows\SysWOW64\zuohylmwrtezkkavvkf.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\sqnjdtxkinbznqjhkcaxtn.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\byupixamjnaxkmebdurni.exe	biotw.exe
File opened for modification	C:\Windows\SysWOW64\sqnjdtxkinbznqjhkcaxtn.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\yqhxlvtasrzrzwjb.exe	biotw.exe
File opened for modification	C:\Windows\SysWOW64\qgvjvdzeurxntozpkukznzhdiyvbrxsdtoyo.rdl	biotw.exe
File opened for modification	C:\Windows\SysWOW64\midxpdfqmpbxjkbxyokf.exe	biotw.exe
File opened for modification	C:\Windows\SysWOW64\oibtjvveyzjdnmbvui.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\yqhxlvtasrzrzwjb.exe	biotw.exe
File opened for modification	C:\Windows\SysWOW64\lquxyvgafrmrmwwblkptwxufz.qlq	biotw.exe
File opened for modification	C:\Windows\SysWOW64\yqhxlvtasrzrzwjb.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\yqhxlvtasrzrzwjb.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\midxpdfqmpbxjkbxyokf.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\byupixamjnaxkmebdurni.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\midxpdfqmpbxjkbxyokf.exe	biotw.exe
File opened for modification	C:\Windows\SysWOW64\fyqhwhgohhqjsqexv.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\midxpdfqmpbxjkbxyokf.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\zuohylmwrtezkkavvkf.exe	biotw.exe
File opened for modification	C:\Windows\SysWOW64\byupixamjnaxkmebdurni.exe	biotw.exe
File opened for modification	C:\Windows\SysWOW64\sqnjdtxkinbznqjhkcaxtn.exe	biotw.exe
File opened for modification	C:\Windows\SysWOW64\byupixamjnaxkmebdurni.exe	yborjrewily.exe

Drops file in Program Files directory 4 IoCs

Processes:

biotw.exe

description	ioc	process
File created	C:\Program Files (x86)\qgvjvdzeurxntozpkukznzhdiyvbrxsdtoyo.rdl	biotw.exe
File opened for modification	C:\Program Files (x86)\lquxyvgafrmrmwwblkptwxufz.qlq	biotw.exe
File created	C:\Program Files (x86)\lquxyvgafrmrmwwblkptwxufz.qlq	biotw.exe
File opened for modification	C:\Program Files (x86)\qgvjvdzeurxntozpkukznzhdiyvbrxsdtoyo.rdl	biotw.exe

Drops file in Windows directory 32 IoCs

Processes:

biotw.exebiotw.exeyborjrewily.exeyborjrewily.exe

description	ioc	process
File opened for modification	C:\Windows\oibtjvveyzjdnmbvui.exe	biotw.exe
File opened for modification	C:\Windows\zuohylmwrtezkkavvkf.exe	biotw.exe
File opened for modification	C:\Windows\midxpdfqmpbxjkbxyokf.exe	biotw.exe
File opened for modification	C:\Windows\oibtjvveyzjdnmbvui.exe	biotw.exe
File opened for modification	C:\Windows\sqnjdtxkinbznqjhkcaxtn.exe	biotw.exe
File opened for modification	C:\Windows\fyqhwhgohhqjsqexv.exe	biotw.exe
File opened for modification	C:\Windows\byupixamjnaxkmebdurni.exe	biotw.exe
File opened for modification	C:\Windows\zuohylmwrtezkkavvkf.exe	yborjrewily.exe
File opened for modification	C:\Windows\sqnjdtxkinbznqjhkcaxtn.exe	yborjrewily.exe
File opened for modification	C:\Windows\fyqhwhgohhqjsqexv.exe	yborjrewily.exe
File opened for modification	C:\Windows\fyqhwhgohhqjsqexv.exe	biotw.exe
File opened for modification	C:\Windows\qgvjvdzeurxntozpkukznzhdiyvbrxsdtoyo.rdl	biotw.exe
File created	C:\Windows\qgvjvdzeurxntozpkukznzhdiyvbrxsdtoyo.rdl	biotw.exe
File opened for modification	C:\Windows\yqhxlvtasrzrzwjb.exe	yborjrewily.exe
File opened for modification	C:\Windows\midxpdfqmpbxjkbxyokf.exe	yborjrewily.exe
File opened for modification	C:\Windows\zuohylmwrtezkkavvkf.exe	biotw.exe
File opened for modification	C:\Windows\oibtjvveyzjdnmbvui.exe	yborjrewily.exe
File opened for modification	C:\Windows\byupixamjnaxkmebdurni.exe	yborjrewily.exe
File opened for modification	C:\Windows\sqnjdtxkinbznqjhkcaxtn.exe	yborjrewily.exe
File opened for modification	C:\Windows\yqhxlvtasrzrzwjb.exe	yborjrewily.exe
File opened for modification	C:\Windows\yqhxlvtasrzrzwjb.exe	biotw.exe
File opened for modification	C:\Windows\fyqhwhgohhqjsqexv.exe	yborjrewily.exe
File opened for modification	C:\Windows\midxpdfqmpbxjkbxyokf.exe	biotw.exe
File opened for modification	C:\Windows\sqnjdtxkinbznqjhkcaxtn.exe	biotw.exe
File opened for modification	C:\Windows\lquxyvgafrmrmwwblkptwxufz.qlq	biotw.exe
File created	C:\Windows\lquxyvgafrmrmwwblkptwxufz.qlq	biotw.exe
File opened for modification	C:\Windows\oibtjvveyzjdnmbvui.exe	yborjrewily.exe
File opened for modification	C:\Windows\yqhxlvtasrzrzwjb.exe	biotw.exe
File opened for modification	C:\Windows\midxpdfqmpbxjkbxyokf.exe	yborjrewily.exe
File opened for modification	C:\Windows\byupixamjnaxkmebdurni.exe	yborjrewily.exe
File opened for modification	C:\Windows\zuohylmwrtezkkavvkf.exe	yborjrewily.exe
File opened for modification	C:\Windows\byupixamjnaxkmebdurni.exe	biotw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exebiotw.exe

pid	process
2248	9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe
2248	9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe
2248	9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe
2248	9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe
2248	9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe
2248	9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe
2248	9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe
2248	9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe
2248	9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe
2248	9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe
2248	9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe
2248	9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe
2248	9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe
2248	9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe
2248	9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe
2248	9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe
2248	9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe
2248	9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe
2248	9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe
2248	9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe
532	biotw.exe
532	biotw.exe
2248	9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe
2248	9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe
2248	9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe
2248	9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe
2248	9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe
2248	9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe
2248	9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe
2248	9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe
2248	9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe
2248	9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe
2248	9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe
2248	9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe
2248	9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe
2248	9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe
2248	9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe
2248	9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe
2248	9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe
2248	9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe
2248	9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe
2248	9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe
2248	9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe
2248	9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe
2248	9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe
2248	9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe
2248	9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe
2248	9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe
2248	9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe
2248	9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe
532	biotw.exe
532	biotw.exe
2248	9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe
2248	9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe
2248	9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe
2248	9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe
2248	9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe
2248	9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe
2248	9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe
2248	9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe
2248	9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe
2248	9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe
2248	9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe
2248	9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

biotw.exe

description pid process

Token: SeDebugPrivilege 532 biotw.exe

description	pid	process
Token: SeDebugPrivilege	532	biotw.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exeyborjrewily.exe

description	pid	process	target process
PID 2248 wrote to memory of 5024	2248	9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe	yborjrewily.exe
PID 2248 wrote to memory of 5024	2248	9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe	yborjrewily.exe
PID 2248 wrote to memory of 5024	2248	9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe	yborjrewily.exe
PID 5024 wrote to memory of 532	5024	yborjrewily.exe	biotw.exe
PID 5024 wrote to memory of 532	5024	yborjrewily.exe	biotw.exe
PID 5024 wrote to memory of 532	5024	yborjrewily.exe	biotw.exe
PID 5024 wrote to memory of 2432	5024	yborjrewily.exe	biotw.exe
PID 5024 wrote to memory of 2432	5024	yborjrewily.exe	biotw.exe
PID 5024 wrote to memory of 2432	5024	yborjrewily.exe	biotw.exe
PID 2248 wrote to memory of 4268	2248	9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe	yborjrewily.exe
PID 2248 wrote to memory of 4268	2248	9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe	yborjrewily.exe
PID 2248 wrote to memory of 4268	2248	9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe	yborjrewily.exe

System policy modification 1 TTPs 41 IoCs

evasion

Modify Registry

T1112

Processes:

yborjrewily.exebiotw.exeyborjrewily.exebiotw.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	yborjrewily.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	biotw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	yborjrewily.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	biotw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	biotw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	biotw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	yborjrewily.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	biotw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	biotw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	biotw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	biotw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	biotw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	biotw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	biotw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	biotw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	biotw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	biotw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	biotw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	biotw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	biotw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	biotw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	biotw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	biotw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	biotw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	biotw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	biotw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	biotw.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	biotw.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	yborjrewily.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	biotw.exe

C:\Users\Admin\AppData\Local\Temp\9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe
"C:\Users\Admin\AppData\Local\Temp\9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Users\Admin\AppData\Local\Temp\yborjrewily.exe
  "C:\Users\Admin\AppData\Local\Temp\yborjrewily.exe" "c:\users\admin\appdata\local\temp\9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe*"
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Adds policy Run key to start application
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Checks computer location settings
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:5024
- - C:\Users\Admin\AppData\Local\Temp\biotw.exe
    "C:\Users\Admin\AppData\Local\Temp\biotw.exe" "-C:\Users\Admin\AppData\Local\Temp\yqhxlvtasrzrzwjb.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - System policy modification
    PID:532
- - C:\Users\Admin\AppData\Local\Temp\biotw.exe
    "C:\Users\Admin\AppData\Local\Temp\biotw.exe" "-C:\Users\Admin\AppData\Local\Temp\yqhxlvtasrzrzwjb.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System policy modification
    PID:2432
- C:\Users\Admin\AppData\Local\Temp\yborjrewily.exe
  "C:\Users\Admin\AppData\Local\Temp\yborjrewily.exe" "c:\users\admin\appdata\local\temp\9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40.exe"
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Adds policy Run key to start application
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System policy modification
  PID:4268

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\biotw.exe

Filesize
708KB

MD5
2cbd1110544ef83e121aae751fd4cc45

SHA1
932692199ea5abd459fb8cbc89aeffe6869755b3

SHA256
e247b6e117218315fe7ba13f18051bd0018d8f820a81b226076837203afa215f

SHA512
303cad6c1cb97fba12c50f66f51bd5830a467706d217c4a1b6f227917e3c3af295d801196d6c1fe363f7cd9fc1a90af41723716f348de9e1250ba785038ff5a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\biotw.exe

Filesize
708KB

MD5
2cbd1110544ef83e121aae751fd4cc45

SHA1
932692199ea5abd459fb8cbc89aeffe6869755b3

SHA256
e247b6e117218315fe7ba13f18051bd0018d8f820a81b226076837203afa215f

SHA512
303cad6c1cb97fba12c50f66f51bd5830a467706d217c4a1b6f227917e3c3af295d801196d6c1fe363f7cd9fc1a90af41723716f348de9e1250ba785038ff5a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\biotw.exe

Filesize
708KB

MD5
2cbd1110544ef83e121aae751fd4cc45

SHA1
932692199ea5abd459fb8cbc89aeffe6869755b3

SHA256
e247b6e117218315fe7ba13f18051bd0018d8f820a81b226076837203afa215f

SHA512
303cad6c1cb97fba12c50f66f51bd5830a467706d217c4a1b6f227917e3c3af295d801196d6c1fe363f7cd9fc1a90af41723716f348de9e1250ba785038ff5a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\byupixamjnaxkmebdurni.exe

Filesize
1016KB

MD5
57b396a2e8cf5f0df966da0db3b7d1b0

SHA1
ba2a472114c0a1fdf34413d8d9ec73347bccc693

SHA256
9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40

SHA512
87ddbd3accb40635ba6f3a5dd2f16bec58152ec70930e03031aedb42dc892581fa05b4a0f788302a1e3d05c237b18f8a4bd6ec94a4e1a84c9a058cba8f72c1af

Download Submit
C:\Users\Admin\AppData\Local\Temp\fyqhwhgohhqjsqexv.exe

Filesize
1016KB

MD5
57b396a2e8cf5f0df966da0db3b7d1b0

SHA1
ba2a472114c0a1fdf34413d8d9ec73347bccc693

SHA256
9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40

SHA512
87ddbd3accb40635ba6f3a5dd2f16bec58152ec70930e03031aedb42dc892581fa05b4a0f788302a1e3d05c237b18f8a4bd6ec94a4e1a84c9a058cba8f72c1af

Download Submit
C:\Users\Admin\AppData\Local\Temp\midxpdfqmpbxjkbxyokf.exe

Filesize
1016KB

MD5
57b396a2e8cf5f0df966da0db3b7d1b0

SHA1
ba2a472114c0a1fdf34413d8d9ec73347bccc693

SHA256
9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40

SHA512
87ddbd3accb40635ba6f3a5dd2f16bec58152ec70930e03031aedb42dc892581fa05b4a0f788302a1e3d05c237b18f8a4bd6ec94a4e1a84c9a058cba8f72c1af

Download Submit
C:\Users\Admin\AppData\Local\Temp\oibtjvveyzjdnmbvui.exe

Filesize
1016KB

MD5
57b396a2e8cf5f0df966da0db3b7d1b0

SHA1
ba2a472114c0a1fdf34413d8d9ec73347bccc693

SHA256
9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40

SHA512
87ddbd3accb40635ba6f3a5dd2f16bec58152ec70930e03031aedb42dc892581fa05b4a0f788302a1e3d05c237b18f8a4bd6ec94a4e1a84c9a058cba8f72c1af

Download Submit
C:\Users\Admin\AppData\Local\Temp\sqnjdtxkinbznqjhkcaxtn.exe

Filesize
1016KB

MD5
57b396a2e8cf5f0df966da0db3b7d1b0

SHA1
ba2a472114c0a1fdf34413d8d9ec73347bccc693

SHA256
9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40

SHA512
87ddbd3accb40635ba6f3a5dd2f16bec58152ec70930e03031aedb42dc892581fa05b4a0f788302a1e3d05c237b18f8a4bd6ec94a4e1a84c9a058cba8f72c1af

Download Submit
C:\Users\Admin\AppData\Local\Temp\yborjrewily.exe

Filesize
320KB

MD5
03d8eadc04cfddaef8565da6643c5596

SHA1
bb84164217181ac92dee5952c14ab0c9902815dc

SHA256
0ca2b74ed766ba9cf8ddf1cb7153118a99a01126e9d41e9435fa8a9fbc537c77

SHA512
ffe19faeab56947dab56d4a2395d4dd919097d78bb1d44a6e37e2830ec002ff2951009361ec0976f8a2bec1fcca7bec2af4febc3c842e0445e5466c412855ffc

Download Submit
C:\Users\Admin\AppData\Local\Temp\yborjrewily.exe

Filesize
320KB

MD5
03d8eadc04cfddaef8565da6643c5596

SHA1
bb84164217181ac92dee5952c14ab0c9902815dc

SHA256
0ca2b74ed766ba9cf8ddf1cb7153118a99a01126e9d41e9435fa8a9fbc537c77

SHA512
ffe19faeab56947dab56d4a2395d4dd919097d78bb1d44a6e37e2830ec002ff2951009361ec0976f8a2bec1fcca7bec2af4febc3c842e0445e5466c412855ffc

Download Submit
C:\Users\Admin\AppData\Local\Temp\yborjrewily.exe

Filesize
320KB

MD5
03d8eadc04cfddaef8565da6643c5596

SHA1
bb84164217181ac92dee5952c14ab0c9902815dc

SHA256
0ca2b74ed766ba9cf8ddf1cb7153118a99a01126e9d41e9435fa8a9fbc537c77

SHA512
ffe19faeab56947dab56d4a2395d4dd919097d78bb1d44a6e37e2830ec002ff2951009361ec0976f8a2bec1fcca7bec2af4febc3c842e0445e5466c412855ffc

Download Submit
C:\Users\Admin\AppData\Local\Temp\yqhxlvtasrzrzwjb.exe

Filesize
1016KB

MD5
57b396a2e8cf5f0df966da0db3b7d1b0

SHA1
ba2a472114c0a1fdf34413d8d9ec73347bccc693

SHA256
9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40

SHA512
87ddbd3accb40635ba6f3a5dd2f16bec58152ec70930e03031aedb42dc892581fa05b4a0f788302a1e3d05c237b18f8a4bd6ec94a4e1a84c9a058cba8f72c1af

Download Submit
C:\Users\Admin\AppData\Local\Temp\zuohylmwrtezkkavvkf.exe

Filesize
1016KB

MD5
57b396a2e8cf5f0df966da0db3b7d1b0

SHA1
ba2a472114c0a1fdf34413d8d9ec73347bccc693

SHA256
9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40

SHA512
87ddbd3accb40635ba6f3a5dd2f16bec58152ec70930e03031aedb42dc892581fa05b4a0f788302a1e3d05c237b18f8a4bd6ec94a4e1a84c9a058cba8f72c1af

Download Submit
C:\Windows\SysWOW64\byupixamjnaxkmebdurni.exe

Filesize
1016KB

MD5
57b396a2e8cf5f0df966da0db3b7d1b0

SHA1
ba2a472114c0a1fdf34413d8d9ec73347bccc693

SHA256
9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40

SHA512
87ddbd3accb40635ba6f3a5dd2f16bec58152ec70930e03031aedb42dc892581fa05b4a0f788302a1e3d05c237b18f8a4bd6ec94a4e1a84c9a058cba8f72c1af

Download Submit
C:\Windows\SysWOW64\fyqhwhgohhqjsqexv.exe

Filesize
1016KB

MD5
57b396a2e8cf5f0df966da0db3b7d1b0

SHA1
ba2a472114c0a1fdf34413d8d9ec73347bccc693

SHA256
9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40

SHA512
87ddbd3accb40635ba6f3a5dd2f16bec58152ec70930e03031aedb42dc892581fa05b4a0f788302a1e3d05c237b18f8a4bd6ec94a4e1a84c9a058cba8f72c1af

Download Submit
C:\Windows\SysWOW64\midxpdfqmpbxjkbxyokf.exe

Filesize
1016KB

MD5
57b396a2e8cf5f0df966da0db3b7d1b0

SHA1
ba2a472114c0a1fdf34413d8d9ec73347bccc693

SHA256
9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40

SHA512
87ddbd3accb40635ba6f3a5dd2f16bec58152ec70930e03031aedb42dc892581fa05b4a0f788302a1e3d05c237b18f8a4bd6ec94a4e1a84c9a058cba8f72c1af

Download Submit
C:\Windows\SysWOW64\oibtjvveyzjdnmbvui.exe

Filesize
1016KB

MD5
57b396a2e8cf5f0df966da0db3b7d1b0

SHA1
ba2a472114c0a1fdf34413d8d9ec73347bccc693

SHA256
9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40

SHA512
87ddbd3accb40635ba6f3a5dd2f16bec58152ec70930e03031aedb42dc892581fa05b4a0f788302a1e3d05c237b18f8a4bd6ec94a4e1a84c9a058cba8f72c1af

Download Submit
C:\Windows\SysWOW64\sqnjdtxkinbznqjhkcaxtn.exe

Filesize
1016KB

MD5
57b396a2e8cf5f0df966da0db3b7d1b0

SHA1
ba2a472114c0a1fdf34413d8d9ec73347bccc693

SHA256
9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40

SHA512
87ddbd3accb40635ba6f3a5dd2f16bec58152ec70930e03031aedb42dc892581fa05b4a0f788302a1e3d05c237b18f8a4bd6ec94a4e1a84c9a058cba8f72c1af

Download Submit
C:\Windows\SysWOW64\yqhxlvtasrzrzwjb.exe

Filesize
1016KB

MD5
57b396a2e8cf5f0df966da0db3b7d1b0

SHA1
ba2a472114c0a1fdf34413d8d9ec73347bccc693

SHA256
9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40

SHA512
87ddbd3accb40635ba6f3a5dd2f16bec58152ec70930e03031aedb42dc892581fa05b4a0f788302a1e3d05c237b18f8a4bd6ec94a4e1a84c9a058cba8f72c1af

Download Submit
C:\Windows\SysWOW64\zuohylmwrtezkkavvkf.exe

Filesize
1016KB

MD5
57b396a2e8cf5f0df966da0db3b7d1b0

SHA1
ba2a472114c0a1fdf34413d8d9ec73347bccc693

SHA256
9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40

SHA512
87ddbd3accb40635ba6f3a5dd2f16bec58152ec70930e03031aedb42dc892581fa05b4a0f788302a1e3d05c237b18f8a4bd6ec94a4e1a84c9a058cba8f72c1af

Download Submit
C:\Windows\byupixamjnaxkmebdurni.exe

Filesize
1016KB

MD5
57b396a2e8cf5f0df966da0db3b7d1b0

SHA1
ba2a472114c0a1fdf34413d8d9ec73347bccc693

SHA256
9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40

SHA512
87ddbd3accb40635ba6f3a5dd2f16bec58152ec70930e03031aedb42dc892581fa05b4a0f788302a1e3d05c237b18f8a4bd6ec94a4e1a84c9a058cba8f72c1af

Download Submit
C:\Windows\byupixamjnaxkmebdurni.exe

Filesize
1016KB

MD5
57b396a2e8cf5f0df966da0db3b7d1b0

SHA1
ba2a472114c0a1fdf34413d8d9ec73347bccc693

SHA256
9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40

SHA512
87ddbd3accb40635ba6f3a5dd2f16bec58152ec70930e03031aedb42dc892581fa05b4a0f788302a1e3d05c237b18f8a4bd6ec94a4e1a84c9a058cba8f72c1af

Download Submit
C:\Windows\byupixamjnaxkmebdurni.exe

Filesize
1016KB

MD5
57b396a2e8cf5f0df966da0db3b7d1b0

SHA1
ba2a472114c0a1fdf34413d8d9ec73347bccc693

SHA256
9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40

SHA512
87ddbd3accb40635ba6f3a5dd2f16bec58152ec70930e03031aedb42dc892581fa05b4a0f788302a1e3d05c237b18f8a4bd6ec94a4e1a84c9a058cba8f72c1af

Download Submit
C:\Windows\fyqhwhgohhqjsqexv.exe

Filesize
1016KB

MD5
57b396a2e8cf5f0df966da0db3b7d1b0

SHA1
ba2a472114c0a1fdf34413d8d9ec73347bccc693

SHA256
9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40

SHA512
87ddbd3accb40635ba6f3a5dd2f16bec58152ec70930e03031aedb42dc892581fa05b4a0f788302a1e3d05c237b18f8a4bd6ec94a4e1a84c9a058cba8f72c1af

Download Submit
C:\Windows\fyqhwhgohhqjsqexv.exe

Filesize
1016KB

MD5
57b396a2e8cf5f0df966da0db3b7d1b0

SHA1
ba2a472114c0a1fdf34413d8d9ec73347bccc693

SHA256
9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40

SHA512
87ddbd3accb40635ba6f3a5dd2f16bec58152ec70930e03031aedb42dc892581fa05b4a0f788302a1e3d05c237b18f8a4bd6ec94a4e1a84c9a058cba8f72c1af

Download Submit
C:\Windows\fyqhwhgohhqjsqexv.exe

Filesize
1016KB

MD5
57b396a2e8cf5f0df966da0db3b7d1b0

SHA1
ba2a472114c0a1fdf34413d8d9ec73347bccc693

SHA256
9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40

SHA512
87ddbd3accb40635ba6f3a5dd2f16bec58152ec70930e03031aedb42dc892581fa05b4a0f788302a1e3d05c237b18f8a4bd6ec94a4e1a84c9a058cba8f72c1af

Download Submit
C:\Windows\midxpdfqmpbxjkbxyokf.exe

Filesize
1016KB

MD5
57b396a2e8cf5f0df966da0db3b7d1b0

SHA1
ba2a472114c0a1fdf34413d8d9ec73347bccc693

SHA256
9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40

SHA512
87ddbd3accb40635ba6f3a5dd2f16bec58152ec70930e03031aedb42dc892581fa05b4a0f788302a1e3d05c237b18f8a4bd6ec94a4e1a84c9a058cba8f72c1af

Download Submit
C:\Windows\midxpdfqmpbxjkbxyokf.exe

Filesize
1016KB

MD5
57b396a2e8cf5f0df966da0db3b7d1b0

SHA1
ba2a472114c0a1fdf34413d8d9ec73347bccc693

SHA256
9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40

SHA512
87ddbd3accb40635ba6f3a5dd2f16bec58152ec70930e03031aedb42dc892581fa05b4a0f788302a1e3d05c237b18f8a4bd6ec94a4e1a84c9a058cba8f72c1af

Download Submit
C:\Windows\midxpdfqmpbxjkbxyokf.exe

Filesize
1016KB

MD5
57b396a2e8cf5f0df966da0db3b7d1b0

SHA1
ba2a472114c0a1fdf34413d8d9ec73347bccc693

SHA256
9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40

SHA512
87ddbd3accb40635ba6f3a5dd2f16bec58152ec70930e03031aedb42dc892581fa05b4a0f788302a1e3d05c237b18f8a4bd6ec94a4e1a84c9a058cba8f72c1af

Download Submit
C:\Windows\oibtjvveyzjdnmbvui.exe

Filesize
1016KB

MD5
57b396a2e8cf5f0df966da0db3b7d1b0

SHA1
ba2a472114c0a1fdf34413d8d9ec73347bccc693

SHA256
9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40

SHA512
87ddbd3accb40635ba6f3a5dd2f16bec58152ec70930e03031aedb42dc892581fa05b4a0f788302a1e3d05c237b18f8a4bd6ec94a4e1a84c9a058cba8f72c1af

Download Submit
C:\Windows\oibtjvveyzjdnmbvui.exe

Filesize
1016KB

MD5
57b396a2e8cf5f0df966da0db3b7d1b0

SHA1
ba2a472114c0a1fdf34413d8d9ec73347bccc693

SHA256
9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40

SHA512
87ddbd3accb40635ba6f3a5dd2f16bec58152ec70930e03031aedb42dc892581fa05b4a0f788302a1e3d05c237b18f8a4bd6ec94a4e1a84c9a058cba8f72c1af

Download Submit
C:\Windows\oibtjvveyzjdnmbvui.exe

Filesize
1016KB

MD5
57b396a2e8cf5f0df966da0db3b7d1b0

SHA1
ba2a472114c0a1fdf34413d8d9ec73347bccc693

SHA256
9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40

SHA512
87ddbd3accb40635ba6f3a5dd2f16bec58152ec70930e03031aedb42dc892581fa05b4a0f788302a1e3d05c237b18f8a4bd6ec94a4e1a84c9a058cba8f72c1af

Download Submit
C:\Windows\sqnjdtxkinbznqjhkcaxtn.exe

Filesize
1016KB

MD5
57b396a2e8cf5f0df966da0db3b7d1b0

SHA1
ba2a472114c0a1fdf34413d8d9ec73347bccc693

SHA256
9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40

SHA512
87ddbd3accb40635ba6f3a5dd2f16bec58152ec70930e03031aedb42dc892581fa05b4a0f788302a1e3d05c237b18f8a4bd6ec94a4e1a84c9a058cba8f72c1af

Download Submit
C:\Windows\sqnjdtxkinbznqjhkcaxtn.exe

Filesize
1016KB

MD5
57b396a2e8cf5f0df966da0db3b7d1b0

SHA1
ba2a472114c0a1fdf34413d8d9ec73347bccc693

SHA256
9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40

SHA512
87ddbd3accb40635ba6f3a5dd2f16bec58152ec70930e03031aedb42dc892581fa05b4a0f788302a1e3d05c237b18f8a4bd6ec94a4e1a84c9a058cba8f72c1af

Download Submit
C:\Windows\sqnjdtxkinbznqjhkcaxtn.exe

Filesize
1016KB

MD5
57b396a2e8cf5f0df966da0db3b7d1b0

SHA1
ba2a472114c0a1fdf34413d8d9ec73347bccc693

SHA256
9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40

SHA512
87ddbd3accb40635ba6f3a5dd2f16bec58152ec70930e03031aedb42dc892581fa05b4a0f788302a1e3d05c237b18f8a4bd6ec94a4e1a84c9a058cba8f72c1af

Download Submit
C:\Windows\yqhxlvtasrzrzwjb.exe

Filesize
1016KB

MD5
57b396a2e8cf5f0df966da0db3b7d1b0

SHA1
ba2a472114c0a1fdf34413d8d9ec73347bccc693

SHA256
9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40

SHA512
87ddbd3accb40635ba6f3a5dd2f16bec58152ec70930e03031aedb42dc892581fa05b4a0f788302a1e3d05c237b18f8a4bd6ec94a4e1a84c9a058cba8f72c1af

Download Submit
C:\Windows\yqhxlvtasrzrzwjb.exe

Filesize
1016KB

MD5
57b396a2e8cf5f0df966da0db3b7d1b0

SHA1
ba2a472114c0a1fdf34413d8d9ec73347bccc693

SHA256
9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40

SHA512
87ddbd3accb40635ba6f3a5dd2f16bec58152ec70930e03031aedb42dc892581fa05b4a0f788302a1e3d05c237b18f8a4bd6ec94a4e1a84c9a058cba8f72c1af

Download Submit
C:\Windows\yqhxlvtasrzrzwjb.exe

Filesize
1016KB

MD5
57b396a2e8cf5f0df966da0db3b7d1b0

SHA1
ba2a472114c0a1fdf34413d8d9ec73347bccc693

SHA256
9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40

SHA512
87ddbd3accb40635ba6f3a5dd2f16bec58152ec70930e03031aedb42dc892581fa05b4a0f788302a1e3d05c237b18f8a4bd6ec94a4e1a84c9a058cba8f72c1af

Download Submit
C:\Windows\zuohylmwrtezkkavvkf.exe

Filesize
1016KB

MD5
57b396a2e8cf5f0df966da0db3b7d1b0

SHA1
ba2a472114c0a1fdf34413d8d9ec73347bccc693

SHA256
9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40

SHA512
87ddbd3accb40635ba6f3a5dd2f16bec58152ec70930e03031aedb42dc892581fa05b4a0f788302a1e3d05c237b18f8a4bd6ec94a4e1a84c9a058cba8f72c1af

Download Submit
C:\Windows\zuohylmwrtezkkavvkf.exe

Filesize
1016KB

MD5
57b396a2e8cf5f0df966da0db3b7d1b0

SHA1
ba2a472114c0a1fdf34413d8d9ec73347bccc693

SHA256
9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40

SHA512
87ddbd3accb40635ba6f3a5dd2f16bec58152ec70930e03031aedb42dc892581fa05b4a0f788302a1e3d05c237b18f8a4bd6ec94a4e1a84c9a058cba8f72c1af

Download Submit
C:\Windows\zuohylmwrtezkkavvkf.exe

Filesize
1016KB

MD5
57b396a2e8cf5f0df966da0db3b7d1b0

SHA1
ba2a472114c0a1fdf34413d8d9ec73347bccc693

SHA256
9128977b7210bfa829c23f8a1719b00fac2b1bbc8c5e2cb47ae23c51500f0b40

SHA512
87ddbd3accb40635ba6f3a5dd2f16bec58152ec70930e03031aedb42dc892581fa05b4a0f788302a1e3d05c237b18f8a4bd6ec94a4e1a84c9a058cba8f72c1af

Download Submit
memory/532-135-0x0000000000000000-mapping.dmp

Download
memory/2432-138-0x0000000000000000-mapping.dmp

Download
memory/4268-168-0x0000000000000000-mapping.dmp

Download
memory/5024-132-0x0000000000000000-mapping.dmp

Download