Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
184s -
max time network
211s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
29/11/2022, 12:26
Static task
static1
Behavioral task
behavioral1
Sample
4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe
Resource
win10v2004-20220812-en
General
-
Target
4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe
-
Size
528KB
-
MD5
0ba43ad94518674116e6a3695d127870
-
SHA1
11af98de9dc3371bbfd8b0b23cf3d2d947921341
-
SHA256
4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a
-
SHA512
f4b8f3a81c747f34af9cd21b3b23771ad4a42ff5ccc41828f871a4b2ae1e501ddaebb8c7876245d21d2bed1d7c04176e06c6ea62f98409295845ecfe4759c0a5
-
SSDEEP
6144:oKEGlVcJboOtGY8q75yKC2qJDrNRlpwPBYgZ9fVU93eJwN6QFbSpO4XcA2n4aA8x:oKr3QboC9qLGKgZKe4HYpHvcbTglxU
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" nmwhfp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" nmwhfp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" uvlgepmyefv.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" uvlgepmyefv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" uvlgepmyefv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" uvlgepmyefv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" uvlgepmyefv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" nmwhfp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" nmwhfp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" nmwhfp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" nmwhfp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" nmwhfp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" nmwhfp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" nmwhfp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" nmwhfp.exe -
Adds policy Run key to start application 2 TTPs 19 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zcqfhvfpdf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gqlhqlctoxubxyctw.exe" nmwhfp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zcqfhvfpdf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cqppcbwrqdeppucxeaqed.exe" nmwhfp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qwnfkbobsxqtl = "pawtdzrjfpnvsuzrvo.exe" nmwhfp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qwnfkbobsxqtl = "amjhspibyjirpsyrwqe.exe" nmwhfp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zcqfhvfpdf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zicxfzpfzhdjeehx.exe" nmwhfp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run nmwhfp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run uvlgepmyefv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qwnfkbobsxqtl = "pawtdzrjfpnvsuzrvo.exe" uvlgepmyefv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zcqfhvfpdf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nayxjhbvtffposztzujw.exe" uvlgepmyefv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run nmwhfp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qwnfkbobsxqtl = "amjhspibyjirpsyrwqe.exe" nmwhfp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zcqfhvfpdf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cqppcbwrqdeppucxeaqed.exe" nmwhfp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qwnfkbobsxqtl = "gqlhqlctoxubxyctw.exe" uvlgepmyefv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zcqfhvfpdf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pawtdzrjfpnvsuzrvo.exe" uvlgepmyefv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zcqfhvfpdf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nayxjhbvtffposztzujw.exe" nmwhfp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qwnfkbobsxqtl = "zicxfzpfzhdjeehx.exe" nmwhfp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qwnfkbobsxqtl = "cqppcbwrqdeppucxeaqed.exe" nmwhfp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qwnfkbobsxqtl = "gqlhqlctoxubxyctw.exe" nmwhfp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qwnfkbobsxqtl = "gqlhqlctoxubxyctw.exe" nmwhfp.exe -
Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" nmwhfp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" nmwhfp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" nmwhfp.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" uvlgepmyefv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" uvlgepmyefv.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" nmwhfp.exe -
Executes dropped EXE 3 IoCs
pid Process 1552 uvlgepmyefv.exe 1128 nmwhfp.exe 1168 nmwhfp.exe -
Loads dropped DLL 6 IoCs
pid Process 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 1552 uvlgepmyefv.exe 1552 uvlgepmyefv.exe 1552 uvlgepmyefv.exe 1552 uvlgepmyefv.exe -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\gqlhqlctoxubxyctw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pawtdzrjfpnvsuzrvo.exe" uvlgepmyefv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\rwmdhxjvlphj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zicxfzpfzhdjeehx.exe ." uvlgepmyefv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\ryqjphvjbhbfyw = "gqlhqlctoxubxyctw.exe" nmwhfp.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run nmwhfp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ucvpwpetmtotnmo = "nayxjhbvtffposztzujw.exe ." nmwhfp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\uyndgvgrgja = "amjhspibyjirpsyrwqe.exe" uvlgepmyefv.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run uvlgepmyefv.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce uvlgepmyefv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\uyndgvgrgja = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zicxfzpfzhdjeehx.exe" nmwhfp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\uyndgvgrgja = "zicxfzpfzhdjeehx.exe" nmwhfp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rwmdhxjvlphj = "gqlhqlctoxubxyctw.exe ." nmwhfp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\gqlhqlctoxubxyctw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cqppcbwrqdeppucxeaqed.exe" nmwhfp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rwmdhxjvlphj = "pawtdzrjfpnvsuzrvo.exe ." nmwhfp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run uvlgepmyefv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rwmdhxjvlphj = "pawtdzrjfpnvsuzrvo.exe ." uvlgepmyefv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rwmdhxjvlphj = "cqppcbwrqdeppucxeaqed.exe ." nmwhfp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rwmdhxjvlphj = "pawtdzrjfpnvsuzrvo.exe ." nmwhfp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ucvpwpetmtotnmo = "pawtdzrjfpnvsuzrvo.exe ." nmwhfp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zicxfzpfzhdjeehx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pawtdzrjfpnvsuzrvo.exe ." nmwhfp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\uyndgvgrgja = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gqlhqlctoxubxyctw.exe" nmwhfp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ucvpwpetmtotnmo = "cqppcbwrqdeppucxeaqed.exe ." nmwhfp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ucvpwpetmtotnmo = "cqppcbwrqdeppucxeaqed.exe ." nmwhfp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\gqlhqlctoxubxyctw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cqppcbwrqdeppucxeaqed.exe" nmwhfp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\gqlhqlctoxubxyctw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nayxjhbvtffposztzujw.exe" nmwhfp.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run nmwhfp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\gqlhqlctoxubxyctw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pawtdzrjfpnvsuzrvo.exe" nmwhfp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rwmdhxjvlphj = "cqppcbwrqdeppucxeaqed.exe ." uvlgepmyefv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\ryqjphvjbhbfyw = "pawtdzrjfpnvsuzrvo.exe" uvlgepmyefv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\rwmdhxjvlphj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\amjhspibyjirpsyrwqe.exe ." uvlgepmyefv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\uyndgvgrgja = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zicxfzpfzhdjeehx.exe" nmwhfp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\gqlhqlctoxubxyctw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zicxfzpfzhdjeehx.exe" nmwhfp.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce nmwhfp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\rwmdhxjvlphj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pawtdzrjfpnvsuzrvo.exe ." nmwhfp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\rwmdhxjvlphj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cqppcbwrqdeppucxeaqed.exe ." nmwhfp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\uyndgvgrgja = "amjhspibyjirpsyrwqe.exe" nmwhfp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ucvpwpetmtotnmo = "nayxjhbvtffposztzujw.exe ." uvlgepmyefv.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce nmwhfp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\ryqjphvjbhbfyw = "pawtdzrjfpnvsuzrvo.exe" nmwhfp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\uyndgvgrgja = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pawtdzrjfpnvsuzrvo.exe" nmwhfp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zicxfzpfzhdjeehx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\amjhspibyjirpsyrwqe.exe ." uvlgepmyefv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run nmwhfp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rwmdhxjvlphj = "nayxjhbvtffposztzujw.exe ." nmwhfp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\ryqjphvjbhbfyw = "amjhspibyjirpsyrwqe.exe" nmwhfp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\uyndgvgrgja = "amjhspibyjirpsyrwqe.exe" nmwhfp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zicxfzpfzhdjeehx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gqlhqlctoxubxyctw.exe ." nmwhfp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\uyndgvgrgja = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pawtdzrjfpnvsuzrvo.exe" nmwhfp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zicxfzpfzhdjeehx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nayxjhbvtffposztzujw.exe ." uvlgepmyefv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\uyndgvgrgja = "nayxjhbvtffposztzujw.exe" nmwhfp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\rwmdhxjvlphj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nayxjhbvtffposztzujw.exe ." nmwhfp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zicxfzpfzhdjeehx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nayxjhbvtffposztzujw.exe ." nmwhfp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zicxfzpfzhdjeehx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zicxfzpfzhdjeehx.exe ." nmwhfp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\uyndgvgrgja = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pawtdzrjfpnvsuzrvo.exe" uvlgepmyefv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\uyndgvgrgja = "C:\\Users\\Admin\\AppData\\Local\\Temp\\amjhspibyjirpsyrwqe.exe" uvlgepmyefv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce nmwhfp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rwmdhxjvlphj = "amjhspibyjirpsyrwqe.exe ." nmwhfp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\rwmdhxjvlphj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gqlhqlctoxubxyctw.exe ." nmwhfp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\gqlhqlctoxubxyctw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gqlhqlctoxubxyctw.exe" uvlgepmyefv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\gqlhqlctoxubxyctw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gqlhqlctoxubxyctw.exe" nmwhfp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\rwmdhxjvlphj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cqppcbwrqdeppucxeaqed.exe ." nmwhfp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce nmwhfp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rwmdhxjvlphj = "nayxjhbvtffposztzujw.exe ." nmwhfp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run nmwhfp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\ryqjphvjbhbfyw = "zicxfzpfzhdjeehx.exe" nmwhfp.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ucvpwpetmtotnmo = "pawtdzrjfpnvsuzrvo.exe ." nmwhfp.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA nmwhfp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" nmwhfp.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA nmwhfp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" uvlgepmyefv.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA uvlgepmyefv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" nmwhfp.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 10 whatismyip.everdot.org 4 whatismyipaddress.com 6 www.showmyipaddress.com -
Drops file in System32 directory 25 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\tiijxxtppdfrsyhdlizoop.exe nmwhfp.exe File opened for modification C:\Windows\SysWOW64\gqlhqlctoxubxyctw.exe uvlgepmyefv.exe File opened for modification C:\Windows\SysWOW64\pawtdzrjfpnvsuzrvo.exe uvlgepmyefv.exe File opened for modification C:\Windows\SysWOW64\nayxjhbvtffposztzujw.exe uvlgepmyefv.exe File opened for modification C:\Windows\SysWOW64\tiijxxtppdfrsyhdlizoop.exe uvlgepmyefv.exe File opened for modification C:\Windows\SysWOW64\zicxfzpfzhdjeehx.exe nmwhfp.exe File opened for modification C:\Windows\SysWOW64\cqppcbwrqdeppucxeaqed.exe nmwhfp.exe File opened for modification C:\Windows\SysWOW64\zicxfzpfzhdjeehx.exe nmwhfp.exe File opened for modification C:\Windows\SysWOW64\rwmdhxjvlphjawvhfszeulpfrdtxpriedp.ahm nmwhfp.exe File opened for modification C:\Windows\SysWOW64\zicxfzpfzhdjeehx.exe uvlgepmyefv.exe File opened for modification C:\Windows\SysWOW64\amjhspibyjirpsyrwqe.exe uvlgepmyefv.exe File opened for modification C:\Windows\SysWOW64\nayxjhbvtffposztzujw.exe nmwhfp.exe File opened for modification C:\Windows\SysWOW64\gqlhqlctoxubxyctw.exe nmwhfp.exe File opened for modification C:\Windows\SysWOW64\amjhspibyjirpsyrwqe.exe nmwhfp.exe File opened for modification C:\Windows\SysWOW64\tiijxxtppdfrsyhdlizoop.exe nmwhfp.exe File opened for modification C:\Windows\SysWOW64\gqlhqlctoxubxyctw.exe nmwhfp.exe File opened for modification C:\Windows\SysWOW64\amjhspibyjirpsyrwqe.exe nmwhfp.exe File created C:\Windows\SysWOW64\eydjchijohoflwklyawqvbu.abg nmwhfp.exe File created C:\Windows\SysWOW64\rwmdhxjvlphjawvhfszeulpfrdtxpriedp.ahm nmwhfp.exe File opened for modification C:\Windows\SysWOW64\cqppcbwrqdeppucxeaqed.exe uvlgepmyefv.exe File opened for modification C:\Windows\SysWOW64\pawtdzrjfpnvsuzrvo.exe nmwhfp.exe File opened for modification C:\Windows\SysWOW64\pawtdzrjfpnvsuzrvo.exe nmwhfp.exe File opened for modification C:\Windows\SysWOW64\nayxjhbvtffposztzujw.exe nmwhfp.exe File opened for modification C:\Windows\SysWOW64\cqppcbwrqdeppucxeaqed.exe nmwhfp.exe File opened for modification C:\Windows\SysWOW64\eydjchijohoflwklyawqvbu.abg nmwhfp.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\eydjchijohoflwklyawqvbu.abg nmwhfp.exe File created C:\Program Files (x86)\eydjchijohoflwklyawqvbu.abg nmwhfp.exe File opened for modification C:\Program Files (x86)\rwmdhxjvlphjawvhfszeulpfrdtxpriedp.ahm nmwhfp.exe File created C:\Program Files (x86)\rwmdhxjvlphjawvhfszeulpfrdtxpriedp.ahm nmwhfp.exe -
Drops file in Windows directory 25 IoCs
description ioc Process File opened for modification C:\Windows\tiijxxtppdfrsyhdlizoop.exe nmwhfp.exe File created C:\Windows\eydjchijohoflwklyawqvbu.abg nmwhfp.exe File opened for modification C:\Windows\rwmdhxjvlphjawvhfszeulpfrdtxpriedp.ahm nmwhfp.exe File opened for modification C:\Windows\pawtdzrjfpnvsuzrvo.exe uvlgepmyefv.exe File opened for modification C:\Windows\cqppcbwrqdeppucxeaqed.exe uvlgepmyefv.exe File opened for modification C:\Windows\gqlhqlctoxubxyctw.exe nmwhfp.exe File opened for modification C:\Windows\amjhspibyjirpsyrwqe.exe nmwhfp.exe File opened for modification C:\Windows\cqppcbwrqdeppucxeaqed.exe nmwhfp.exe File opened for modification C:\Windows\amjhspibyjirpsyrwqe.exe uvlgepmyefv.exe File opened for modification C:\Windows\pawtdzrjfpnvsuzrvo.exe nmwhfp.exe File opened for modification C:\Windows\amjhspibyjirpsyrwqe.exe nmwhfp.exe File opened for modification C:\Windows\nayxjhbvtffposztzujw.exe nmwhfp.exe File opened for modification C:\Windows\eydjchijohoflwklyawqvbu.abg nmwhfp.exe File opened for modification C:\Windows\zicxfzpfzhdjeehx.exe uvlgepmyefv.exe File opened for modification C:\Windows\zicxfzpfzhdjeehx.exe nmwhfp.exe File opened for modification C:\Windows\gqlhqlctoxubxyctw.exe nmwhfp.exe File opened for modification C:\Windows\pawtdzrjfpnvsuzrvo.exe nmwhfp.exe File opened for modification C:\Windows\cqppcbwrqdeppucxeaqed.exe nmwhfp.exe File opened for modification C:\Windows\gqlhqlctoxubxyctw.exe uvlgepmyefv.exe File opened for modification C:\Windows\nayxjhbvtffposztzujw.exe uvlgepmyefv.exe File opened for modification C:\Windows\tiijxxtppdfrsyhdlizoop.exe uvlgepmyefv.exe File opened for modification C:\Windows\zicxfzpfzhdjeehx.exe nmwhfp.exe File opened for modification C:\Windows\nayxjhbvtffposztzujw.exe nmwhfp.exe File opened for modification C:\Windows\tiijxxtppdfrsyhdlizoop.exe nmwhfp.exe File created C:\Windows\rwmdhxjvlphjawvhfszeulpfrdtxpriedp.ahm nmwhfp.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 1168 nmwhfp.exe 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1168 nmwhfp.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 976 wrote to memory of 1552 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 28 PID 976 wrote to memory of 1552 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 28 PID 976 wrote to memory of 1552 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 28 PID 976 wrote to memory of 1552 976 4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe 28 PID 1552 wrote to memory of 1128 1552 uvlgepmyefv.exe 29 PID 1552 wrote to memory of 1128 1552 uvlgepmyefv.exe 29 PID 1552 wrote to memory of 1128 1552 uvlgepmyefv.exe 29 PID 1552 wrote to memory of 1128 1552 uvlgepmyefv.exe 29 PID 1552 wrote to memory of 1168 1552 uvlgepmyefv.exe 30 PID 1552 wrote to memory of 1168 1552 uvlgepmyefv.exe 30 PID 1552 wrote to memory of 1168 1552 uvlgepmyefv.exe 30 PID 1552 wrote to memory of 1168 1552 uvlgepmyefv.exe 30 -
System policy modification 1 TTPs 39 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" uvlgepmyefv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System nmwhfp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" nmwhfp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" nmwhfp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" nmwhfp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" nmwhfp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" nmwhfp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" nmwhfp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" uvlgepmyefv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" uvlgepmyefv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System nmwhfp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" nmwhfp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" nmwhfp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" nmwhfp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" nmwhfp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" nmwhfp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" uvlgepmyefv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" uvlgepmyefv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" nmwhfp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" nmwhfp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System uvlgepmyefv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" nmwhfp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" nmwhfp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" nmwhfp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" nmwhfp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" uvlgepmyefv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" uvlgepmyefv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" nmwhfp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" nmwhfp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" uvlgepmyefv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" uvlgepmyefv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer nmwhfp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer nmwhfp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" uvlgepmyefv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" nmwhfp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" uvlgepmyefv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer uvlgepmyefv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" nmwhfp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" nmwhfp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe"C:\Users\Admin\AppData\Local\Temp\4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Users\Admin\AppData\Local\Temp\uvlgepmyefv.exe"C:\Users\Admin\AppData\Local\Temp\uvlgepmyefv.exe" "c:\users\admin\appdata\local\temp\4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe*"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\nmwhfp.exe"C:\Users\Admin\AppData\Local\Temp\nmwhfp.exe" "-C:\Users\Admin\AppData\Local\Temp\zicxfzpfzhdjeehx.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- System policy modification
PID:1128
-
-
C:\Users\Admin\AppData\Local\Temp\nmwhfp.exe"C:\Users\Admin\AppData\Local\Temp\nmwhfp.exe" "-C:\Users\Admin\AppData\Local\Temp\zicxfzpfzhdjeehx.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:1168
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
528KB
MD50ba43ad94518674116e6a3695d127870
SHA111af98de9dc3371bbfd8b0b23cf3d2d947921341
SHA2564c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a
SHA512f4b8f3a81c747f34af9cd21b3b23771ad4a42ff5ccc41828f871a4b2ae1e501ddaebb8c7876245d21d2bed1d7c04176e06c6ea62f98409295845ecfe4759c0a5
-
Filesize
528KB
MD50ba43ad94518674116e6a3695d127870
SHA111af98de9dc3371bbfd8b0b23cf3d2d947921341
SHA2564c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a
SHA512f4b8f3a81c747f34af9cd21b3b23771ad4a42ff5ccc41828f871a4b2ae1e501ddaebb8c7876245d21d2bed1d7c04176e06c6ea62f98409295845ecfe4759c0a5
-
Filesize
528KB
MD50ba43ad94518674116e6a3695d127870
SHA111af98de9dc3371bbfd8b0b23cf3d2d947921341
SHA2564c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a
SHA512f4b8f3a81c747f34af9cd21b3b23771ad4a42ff5ccc41828f871a4b2ae1e501ddaebb8c7876245d21d2bed1d7c04176e06c6ea62f98409295845ecfe4759c0a5
-
Filesize
528KB
MD50ba43ad94518674116e6a3695d127870
SHA111af98de9dc3371bbfd8b0b23cf3d2d947921341
SHA2564c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a
SHA512f4b8f3a81c747f34af9cd21b3b23771ad4a42ff5ccc41828f871a4b2ae1e501ddaebb8c7876245d21d2bed1d7c04176e06c6ea62f98409295845ecfe4759c0a5
-
Filesize
728KB
MD59f5d2c0a8d93dc307470b47e886b74e5
SHA1210e6505ff1bbb2e8ae80ec50b904f5be914a7de
SHA2566b66eb0ebde49ba51e74b11fb5a61b8be339a73665063b50a82cca3feb209cc7
SHA512e7a5a82678bc28eb40c34b5a0d61fde85505fdc4742480b5e2fdf17b5919145a750bbf6446fd7540060d8bb7b237372cf158a86cb741fc91ac63488ab56fd965
-
Filesize
728KB
MD59f5d2c0a8d93dc307470b47e886b74e5
SHA1210e6505ff1bbb2e8ae80ec50b904f5be914a7de
SHA2566b66eb0ebde49ba51e74b11fb5a61b8be339a73665063b50a82cca3feb209cc7
SHA512e7a5a82678bc28eb40c34b5a0d61fde85505fdc4742480b5e2fdf17b5919145a750bbf6446fd7540060d8bb7b237372cf158a86cb741fc91ac63488ab56fd965
-
Filesize
528KB
MD50ba43ad94518674116e6a3695d127870
SHA111af98de9dc3371bbfd8b0b23cf3d2d947921341
SHA2564c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a
SHA512f4b8f3a81c747f34af9cd21b3b23771ad4a42ff5ccc41828f871a4b2ae1e501ddaebb8c7876245d21d2bed1d7c04176e06c6ea62f98409295845ecfe4759c0a5
-
Filesize
528KB
MD50ba43ad94518674116e6a3695d127870
SHA111af98de9dc3371bbfd8b0b23cf3d2d947921341
SHA2564c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a
SHA512f4b8f3a81c747f34af9cd21b3b23771ad4a42ff5ccc41828f871a4b2ae1e501ddaebb8c7876245d21d2bed1d7c04176e06c6ea62f98409295845ecfe4759c0a5
-
Filesize
320KB
MD56cf1f1d4675466650ce80fb9f8a48ae7
SHA15adc350a2c1347f5e147f63e73d13910425ecc7b
SHA2562fa976317a6d0d23c14d57745852154f8de6b14a4de819142c0a582f51db0891
SHA512928f9009feb29d6e84fdcdf7485c06cf3c7d317957e393642dac4e656676403f7f25e290dec708df1004eab30fd13ea4e0ce3d48a46db27d6fe71f6fc58f647b
-
Filesize
320KB
MD56cf1f1d4675466650ce80fb9f8a48ae7
SHA15adc350a2c1347f5e147f63e73d13910425ecc7b
SHA2562fa976317a6d0d23c14d57745852154f8de6b14a4de819142c0a582f51db0891
SHA512928f9009feb29d6e84fdcdf7485c06cf3c7d317957e393642dac4e656676403f7f25e290dec708df1004eab30fd13ea4e0ce3d48a46db27d6fe71f6fc58f647b
-
Filesize
528KB
MD50ba43ad94518674116e6a3695d127870
SHA111af98de9dc3371bbfd8b0b23cf3d2d947921341
SHA2564c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a
SHA512f4b8f3a81c747f34af9cd21b3b23771ad4a42ff5ccc41828f871a4b2ae1e501ddaebb8c7876245d21d2bed1d7c04176e06c6ea62f98409295845ecfe4759c0a5
-
Filesize
528KB
MD50ba43ad94518674116e6a3695d127870
SHA111af98de9dc3371bbfd8b0b23cf3d2d947921341
SHA2564c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a
SHA512f4b8f3a81c747f34af9cd21b3b23771ad4a42ff5ccc41828f871a4b2ae1e501ddaebb8c7876245d21d2bed1d7c04176e06c6ea62f98409295845ecfe4759c0a5
-
Filesize
528KB
MD50ba43ad94518674116e6a3695d127870
SHA111af98de9dc3371bbfd8b0b23cf3d2d947921341
SHA2564c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a
SHA512f4b8f3a81c747f34af9cd21b3b23771ad4a42ff5ccc41828f871a4b2ae1e501ddaebb8c7876245d21d2bed1d7c04176e06c6ea62f98409295845ecfe4759c0a5
-
Filesize
528KB
MD50ba43ad94518674116e6a3695d127870
SHA111af98de9dc3371bbfd8b0b23cf3d2d947921341
SHA2564c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a
SHA512f4b8f3a81c747f34af9cd21b3b23771ad4a42ff5ccc41828f871a4b2ae1e501ddaebb8c7876245d21d2bed1d7c04176e06c6ea62f98409295845ecfe4759c0a5
-
Filesize
528KB
MD50ba43ad94518674116e6a3695d127870
SHA111af98de9dc3371bbfd8b0b23cf3d2d947921341
SHA2564c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a
SHA512f4b8f3a81c747f34af9cd21b3b23771ad4a42ff5ccc41828f871a4b2ae1e501ddaebb8c7876245d21d2bed1d7c04176e06c6ea62f98409295845ecfe4759c0a5
-
Filesize
528KB
MD50ba43ad94518674116e6a3695d127870
SHA111af98de9dc3371bbfd8b0b23cf3d2d947921341
SHA2564c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a
SHA512f4b8f3a81c747f34af9cd21b3b23771ad4a42ff5ccc41828f871a4b2ae1e501ddaebb8c7876245d21d2bed1d7c04176e06c6ea62f98409295845ecfe4759c0a5
-
Filesize
528KB
MD50ba43ad94518674116e6a3695d127870
SHA111af98de9dc3371bbfd8b0b23cf3d2d947921341
SHA2564c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a
SHA512f4b8f3a81c747f34af9cd21b3b23771ad4a42ff5ccc41828f871a4b2ae1e501ddaebb8c7876245d21d2bed1d7c04176e06c6ea62f98409295845ecfe4759c0a5
-
Filesize
528KB
MD50ba43ad94518674116e6a3695d127870
SHA111af98de9dc3371bbfd8b0b23cf3d2d947921341
SHA2564c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a
SHA512f4b8f3a81c747f34af9cd21b3b23771ad4a42ff5ccc41828f871a4b2ae1e501ddaebb8c7876245d21d2bed1d7c04176e06c6ea62f98409295845ecfe4759c0a5
-
Filesize
528KB
MD50ba43ad94518674116e6a3695d127870
SHA111af98de9dc3371bbfd8b0b23cf3d2d947921341
SHA2564c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a
SHA512f4b8f3a81c747f34af9cd21b3b23771ad4a42ff5ccc41828f871a4b2ae1e501ddaebb8c7876245d21d2bed1d7c04176e06c6ea62f98409295845ecfe4759c0a5
-
Filesize
528KB
MD50ba43ad94518674116e6a3695d127870
SHA111af98de9dc3371bbfd8b0b23cf3d2d947921341
SHA2564c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a
SHA512f4b8f3a81c747f34af9cd21b3b23771ad4a42ff5ccc41828f871a4b2ae1e501ddaebb8c7876245d21d2bed1d7c04176e06c6ea62f98409295845ecfe4759c0a5
-
Filesize
528KB
MD50ba43ad94518674116e6a3695d127870
SHA111af98de9dc3371bbfd8b0b23cf3d2d947921341
SHA2564c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a
SHA512f4b8f3a81c747f34af9cd21b3b23771ad4a42ff5ccc41828f871a4b2ae1e501ddaebb8c7876245d21d2bed1d7c04176e06c6ea62f98409295845ecfe4759c0a5
-
Filesize
528KB
MD50ba43ad94518674116e6a3695d127870
SHA111af98de9dc3371bbfd8b0b23cf3d2d947921341
SHA2564c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a
SHA512f4b8f3a81c747f34af9cd21b3b23771ad4a42ff5ccc41828f871a4b2ae1e501ddaebb8c7876245d21d2bed1d7c04176e06c6ea62f98409295845ecfe4759c0a5
-
Filesize
528KB
MD50ba43ad94518674116e6a3695d127870
SHA111af98de9dc3371bbfd8b0b23cf3d2d947921341
SHA2564c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a
SHA512f4b8f3a81c747f34af9cd21b3b23771ad4a42ff5ccc41828f871a4b2ae1e501ddaebb8c7876245d21d2bed1d7c04176e06c6ea62f98409295845ecfe4759c0a5
-
Filesize
528KB
MD50ba43ad94518674116e6a3695d127870
SHA111af98de9dc3371bbfd8b0b23cf3d2d947921341
SHA2564c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a
SHA512f4b8f3a81c747f34af9cd21b3b23771ad4a42ff5ccc41828f871a4b2ae1e501ddaebb8c7876245d21d2bed1d7c04176e06c6ea62f98409295845ecfe4759c0a5
-
Filesize
528KB
MD50ba43ad94518674116e6a3695d127870
SHA111af98de9dc3371bbfd8b0b23cf3d2d947921341
SHA2564c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a
SHA512f4b8f3a81c747f34af9cd21b3b23771ad4a42ff5ccc41828f871a4b2ae1e501ddaebb8c7876245d21d2bed1d7c04176e06c6ea62f98409295845ecfe4759c0a5
-
Filesize
528KB
MD50ba43ad94518674116e6a3695d127870
SHA111af98de9dc3371bbfd8b0b23cf3d2d947921341
SHA2564c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a
SHA512f4b8f3a81c747f34af9cd21b3b23771ad4a42ff5ccc41828f871a4b2ae1e501ddaebb8c7876245d21d2bed1d7c04176e06c6ea62f98409295845ecfe4759c0a5
-
Filesize
528KB
MD50ba43ad94518674116e6a3695d127870
SHA111af98de9dc3371bbfd8b0b23cf3d2d947921341
SHA2564c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a
SHA512f4b8f3a81c747f34af9cd21b3b23771ad4a42ff5ccc41828f871a4b2ae1e501ddaebb8c7876245d21d2bed1d7c04176e06c6ea62f98409295845ecfe4759c0a5
-
Filesize
528KB
MD50ba43ad94518674116e6a3695d127870
SHA111af98de9dc3371bbfd8b0b23cf3d2d947921341
SHA2564c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a
SHA512f4b8f3a81c747f34af9cd21b3b23771ad4a42ff5ccc41828f871a4b2ae1e501ddaebb8c7876245d21d2bed1d7c04176e06c6ea62f98409295845ecfe4759c0a5
-
Filesize
528KB
MD50ba43ad94518674116e6a3695d127870
SHA111af98de9dc3371bbfd8b0b23cf3d2d947921341
SHA2564c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a
SHA512f4b8f3a81c747f34af9cd21b3b23771ad4a42ff5ccc41828f871a4b2ae1e501ddaebb8c7876245d21d2bed1d7c04176e06c6ea62f98409295845ecfe4759c0a5
-
Filesize
528KB
MD50ba43ad94518674116e6a3695d127870
SHA111af98de9dc3371bbfd8b0b23cf3d2d947921341
SHA2564c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a
SHA512f4b8f3a81c747f34af9cd21b3b23771ad4a42ff5ccc41828f871a4b2ae1e501ddaebb8c7876245d21d2bed1d7c04176e06c6ea62f98409295845ecfe4759c0a5
-
Filesize
528KB
MD50ba43ad94518674116e6a3695d127870
SHA111af98de9dc3371bbfd8b0b23cf3d2d947921341
SHA2564c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a
SHA512f4b8f3a81c747f34af9cd21b3b23771ad4a42ff5ccc41828f871a4b2ae1e501ddaebb8c7876245d21d2bed1d7c04176e06c6ea62f98409295845ecfe4759c0a5
-
Filesize
528KB
MD50ba43ad94518674116e6a3695d127870
SHA111af98de9dc3371bbfd8b0b23cf3d2d947921341
SHA2564c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a
SHA512f4b8f3a81c747f34af9cd21b3b23771ad4a42ff5ccc41828f871a4b2ae1e501ddaebb8c7876245d21d2bed1d7c04176e06c6ea62f98409295845ecfe4759c0a5
-
Filesize
728KB
MD59f5d2c0a8d93dc307470b47e886b74e5
SHA1210e6505ff1bbb2e8ae80ec50b904f5be914a7de
SHA2566b66eb0ebde49ba51e74b11fb5a61b8be339a73665063b50a82cca3feb209cc7
SHA512e7a5a82678bc28eb40c34b5a0d61fde85505fdc4742480b5e2fdf17b5919145a750bbf6446fd7540060d8bb7b237372cf158a86cb741fc91ac63488ab56fd965
-
Filesize
728KB
MD59f5d2c0a8d93dc307470b47e886b74e5
SHA1210e6505ff1bbb2e8ae80ec50b904f5be914a7de
SHA2566b66eb0ebde49ba51e74b11fb5a61b8be339a73665063b50a82cca3feb209cc7
SHA512e7a5a82678bc28eb40c34b5a0d61fde85505fdc4742480b5e2fdf17b5919145a750bbf6446fd7540060d8bb7b237372cf158a86cb741fc91ac63488ab56fd965
-
Filesize
728KB
MD59f5d2c0a8d93dc307470b47e886b74e5
SHA1210e6505ff1bbb2e8ae80ec50b904f5be914a7de
SHA2566b66eb0ebde49ba51e74b11fb5a61b8be339a73665063b50a82cca3feb209cc7
SHA512e7a5a82678bc28eb40c34b5a0d61fde85505fdc4742480b5e2fdf17b5919145a750bbf6446fd7540060d8bb7b237372cf158a86cb741fc91ac63488ab56fd965
-
Filesize
728KB
MD59f5d2c0a8d93dc307470b47e886b74e5
SHA1210e6505ff1bbb2e8ae80ec50b904f5be914a7de
SHA2566b66eb0ebde49ba51e74b11fb5a61b8be339a73665063b50a82cca3feb209cc7
SHA512e7a5a82678bc28eb40c34b5a0d61fde85505fdc4742480b5e2fdf17b5919145a750bbf6446fd7540060d8bb7b237372cf158a86cb741fc91ac63488ab56fd965
-
Filesize
320KB
MD56cf1f1d4675466650ce80fb9f8a48ae7
SHA15adc350a2c1347f5e147f63e73d13910425ecc7b
SHA2562fa976317a6d0d23c14d57745852154f8de6b14a4de819142c0a582f51db0891
SHA512928f9009feb29d6e84fdcdf7485c06cf3c7d317957e393642dac4e656676403f7f25e290dec708df1004eab30fd13ea4e0ce3d48a46db27d6fe71f6fc58f647b
-
Filesize
320KB
MD56cf1f1d4675466650ce80fb9f8a48ae7
SHA15adc350a2c1347f5e147f63e73d13910425ecc7b
SHA2562fa976317a6d0d23c14d57745852154f8de6b14a4de819142c0a582f51db0891
SHA512928f9009feb29d6e84fdcdf7485c06cf3c7d317957e393642dac4e656676403f7f25e290dec708df1004eab30fd13ea4e0ce3d48a46db27d6fe71f6fc58f647b