4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a

Analysis

max time kernel
155s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29/11/2022, 12:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe
Size

528KB
MD5

0ba43ad94518674116e6a3695d127870
SHA1

11af98de9dc3371bbfd8b0b23cf3d2d947921341
SHA256

4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a
SHA512

f4b8f3a81c747f34af9cd21b3b23771ad4a42ff5ccc41828f871a4b2ae1e501ddaebb8c7876245d21d2bed1d7c04176e06c6ea62f98409295845ecfe4759c0a5
SSDEEP

6144:oKEGlVcJboOtGY8q75yKC2qJDrNRlpwPBYgZ9fVU93eJwN6QFbSpO4XcA2n4aA8x:oKr3QboC9qLGKgZKe4HYpHvcbTglxU

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	hkaqkpraruk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	jsyyes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	jsyyes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	hkaqkpraruk.exe

UAC bypass 3 TTPs 13 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	jsyyes.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	jsyyes.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	jsyyes.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	jsyyes.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	jsyyes.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	jsyyes.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	jsyyes.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	jsyyes.exe

Adds policy Run key to start application 2 TTPs 30 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ncouganzgruy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ywrgbeavlfreeeixjcmkf.exe"	jsyyes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ncouganzgruy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\voeoectjujqytonx.exe"	jsyyes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	jsyyes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qixgvsixhvbicwu = "cwnypogxjzhqmiitb.exe"	jsyyes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ncouganzgruy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lgykccvnarakhefraq.exe"	jsyyes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ncouganzgruy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wslyrsmftlvgecerbsa.exe"	jsyyes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ncouganzgruy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ywrgbeavlfreeeixjcmkf.exe"	jsyyes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qixgvsixhvbicwu = "wslyrsmftlvgecerbsa.exe"	hkaqkpraruk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ncouganzgruy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\voeoectjujqytonx.exe"	jsyyes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qixgvsixhvbicwu = "wslyrsmftlvgecerbsa.exe"	jsyyes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ncouganzgruy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cwnypogxjzhqmiitb.exe"	jsyyes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ncouganzgruy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jgaoikfzohsedcftewfc.exe"	jsyyes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ncouganzgruy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lgykccvnarakhefraq.exe"	jsyyes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ncouganzgruy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cwnypogxjzhqmiitb.exe"	hkaqkpraruk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qixgvsixhvbicwu = "voeoectjujqytonx.exe"	jsyyes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qixgvsixhvbicwu = "ywrgbeavlfreeeixjcmkf.exe"	jsyyes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qixgvsixhvbicwu = "lgykccvnarakhefraq.exe"	jsyyes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ncouganzgruy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jgaoikfzohsedcftewfc.exe"	jsyyes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qixgvsixhvbicwu = "cwnypogxjzhqmiitb.exe"	jsyyes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qixgvsixhvbicwu = "wslyrsmftlvgecerbsa.exe"	jsyyes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	hkaqkpraruk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ncouganzgruy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cwnypogxjzhqmiitb.exe"	jsyyes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qixgvsixhvbicwu = "ywrgbeavlfreeeixjcmkf.exe"	jsyyes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	hkaqkpraruk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ncouganzgruy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jgaoikfzohsedcftewfc.exe"	hkaqkpraruk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qixgvsixhvbicwu = "voeoectjujqytonx.exe"	jsyyes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qixgvsixhvbicwu = "lgykccvnarakhefraq.exe"	jsyyes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qixgvsixhvbicwu = "ywrgbeavlfreeeixjcmkf.exe"	hkaqkpraruk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qixgvsixhvbicwu = "jgaoikfzohsedcftewfc.exe"	hkaqkpraruk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	jsyyes.exe

Disables RegEdit via registry modification 6 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	hkaqkpraruk.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	jsyyes.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	jsyyes.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	jsyyes.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	jsyyes.exe

Executes dropped EXE 4 IoCs

pid	Process
4348	hkaqkpraruk.exe
4592	jsyyes.exe
4324	jsyyes.exe
740	hkaqkpraruk.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	hkaqkpraruk.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\cwnypogxjzhqmiitb = "wslyrsmftlvgecerbsa.exe ."	hkaqkpraruk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mcpwjesfnzdia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cwnypogxjzhqmiitb.exe"	jsyyes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lgykccvnarakhefraq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\voeoectjujqytonx.exe ."	jsyyes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mcpwjesfnzdia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cwnypogxjzhqmiitb.exe"	jsyyes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\voeoectjujqytonx = "wslyrsmftlvgecerbsa.exe"	jsyyes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\nesaokznwjoung = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cwnypogxjzhqmiitb.exe ."	hkaqkpraruk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lgykccvnarakhefraq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ywrgbeavlfreeeixjcmkf.exe ."	hkaqkpraruk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\voeoectjujqytonx = "cwnypogxjzhqmiitb.exe"	jsyyes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wslyrsmftlvgecerbsa = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cwnypogxjzhqmiitb.exe"	jsyyes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\voeoectjujqytonx = "voeoectjujqytonx.exe"	jsyyes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mcpwjesfnzdia = "ywrgbeavlfreeeixjcmkf.exe"	jsyyes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\nesaokznwjoung = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wslyrsmftlvgecerbsa.exe ."	jsyyes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wslyrsmftlvgecerbsa = "C:\\Users\\Admin\\AppData\\Local\\Temp\\voeoectjujqytonx.exe"	jsyyes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nesaokznwjoung = "cwnypogxjzhqmiitb.exe ."	jsyyes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\voeoectjujqytonx = "cwnypogxjzhqmiitb.exe"	hkaqkpraruk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	hkaqkpraruk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wslyrsmftlvgecerbsa = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wslyrsmftlvgecerbsa.exe"	jsyyes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\nesaokznwjoung = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lgykccvnarakhefraq.exe ."	jsyyes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nesaokznwjoung = "lgykccvnarakhefraq.exe ."	hkaqkpraruk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lgykccvnarakhefraq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wslyrsmftlvgecerbsa.exe ."	jsyyes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wslyrsmftlvgecerbsa = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cwnypogxjzhqmiitb.exe"	hkaqkpraruk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wslyrsmftlvgecerbsa = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ywrgbeavlfreeeixjcmkf.exe"	hkaqkpraruk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\nesaokznwjoung = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wslyrsmftlvgecerbsa.exe ."	jsyyes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nesaokznwjoung = "lgykccvnarakhefraq.exe ."	jsyyes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\voeoectjujqytonx = "jgaoikfzohsedcftewfc.exe"	jsyyes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nesaokznwjoung = "lgykccvnarakhefraq.exe ."	hkaqkpraruk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\cwnypogxjzhqmiitb = "voeoectjujqytonx.exe ."	jsyyes.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	jsyyes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mcpwjesfnzdia = "voeoectjujqytonx.exe"	jsyyes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\cwnypogxjzhqmiitb = "ywrgbeavlfreeeixjcmkf.exe ."	jsyyes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\voeoectjujqytonx = "voeoectjujqytonx.exe"	jsyyes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mcpwjesfnzdia = "jgaoikfzohsedcftewfc.exe"	jsyyes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nesaokznwjoung = "wslyrsmftlvgecerbsa.exe ."	jsyyes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wslyrsmftlvgecerbsa = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lgykccvnarakhefraq.exe"	jsyyes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mcpwjesfnzdia = "wslyrsmftlvgecerbsa.exe"	jsyyes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lgykccvnarakhefraq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jgaoikfzohsedcftewfc.exe ."	jsyyes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nesaokznwjoung = "cwnypogxjzhqmiitb.exe ."	jsyyes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wslyrsmftlvgecerbsa = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jgaoikfzohsedcftewfc.exe"	jsyyes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mcpwjesfnzdia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wslyrsmftlvgecerbsa.exe"	jsyyes.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	jsyyes.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	jsyyes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lgykccvnarakhefraq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jgaoikfzohsedcftewfc.exe ."	jsyyes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wslyrsmftlvgecerbsa = "C:\\Users\\Admin\\AppData\\Local\\Temp\\voeoectjujqytonx.exe"	jsyyes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	hkaqkpraruk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\nesaokznwjoung = "C:\\Users\\Admin\\AppData\\Local\\Temp\\voeoectjujqytonx.exe ."	jsyyes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lgykccvnarakhefraq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cwnypogxjzhqmiitb.exe ."	jsyyes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mcpwjesfnzdia = "ywrgbeavlfreeeixjcmkf.exe"	jsyyes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wslyrsmftlvgecerbsa = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ywrgbeavlfreeeixjcmkf.exe"	jsyyes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\cwnypogxjzhqmiitb = "jgaoikfzohsedcftewfc.exe ."	hkaqkpraruk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mcpwjesfnzdia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jgaoikfzohsedcftewfc.exe"	hkaqkpraruk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	jsyyes.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wslyrsmftlvgecerbsa = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wslyrsmftlvgecerbsa.exe"	jsyyes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\cwnypogxjzhqmiitb = "cwnypogxjzhqmiitb.exe ."	jsyyes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\voeoectjujqytonx = "lgykccvnarakhefraq.exe"	hkaqkpraruk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\nesaokznwjoung = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jgaoikfzohsedcftewfc.exe ."	jsyyes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mcpwjesfnzdia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\voeoectjujqytonx.exe"	jsyyes.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	hkaqkpraruk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lgykccvnarakhefraq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wslyrsmftlvgecerbsa.exe ."	hkaqkpraruk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mcpwjesfnzdia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ywrgbeavlfreeeixjcmkf.exe"	jsyyes.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	hkaqkpraruk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nesaokznwjoung = "ywrgbeavlfreeeixjcmkf.exe ."	jsyyes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mcpwjesfnzdia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ywrgbeavlfreeeixjcmkf.exe"	jsyyes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\cwnypogxjzhqmiitb = "jgaoikfzohsedcftewfc.exe ."	jsyyes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mcpwjesfnzdia = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jgaoikfzohsedcftewfc.exe"	jsyyes.exe

Checks whether UAC is enabled 1 TTPs 8 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	jsyyes.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	jsyyes.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	jsyyes.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	jsyyes.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	hkaqkpraruk.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	hkaqkpraruk.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	hkaqkpraruk.exe

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
21	www.showmyipaddress.com
26	whatismyip.everdot.org
43	whatismyipaddress.com
50	whatismyip.everdot.org

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	C:\autorun.inf	jsyyes.exe
File opened for modification	C:\autorun.inf	jsyyes.exe

Drops file in System32 directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\pokawaxtkfsghindqkvuqg.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\SysWOW64\voeoectjujqytonx.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\SysWOW64\ywrgbeavlfreeeixjcmkf.exe	jsyyes.exe
File opened for modification	C:\Windows\SysWOW64\lgykccvnarakhefraq.exe	jsyyes.exe
File opened for modification	C:\Windows\SysWOW64\wslyrsmftlvgecerbsa.exe	jsyyes.exe
File opened for modification	C:\Windows\SysWOW64\jgaoikfzohsedcftewfc.exe	jsyyes.exe
File opened for modification	C:\Windows\SysWOW64\aefabkmnjjbuagqldcswxst.efb	jsyyes.exe
File opened for modification	C:\Windows\SysWOW64\ywrgbeavlfreeeixjcmkf.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\SysWOW64\cwnypogxjzhqmiitb.exe	jsyyes.exe
File opened for modification	C:\Windows\SysWOW64\voeoectjujqytonx.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\SysWOW64\pokawaxtkfsghindqkvuqg.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\SysWOW64\voeoectjujqytonx.exe	jsyyes.exe
File opened for modification	C:\Windows\SysWOW64\lgykccvnarakhefraq.exe	jsyyes.exe
File opened for modification	C:\Windows\SysWOW64\pokawaxtkfsghindqkvuqg.exe	jsyyes.exe
File opened for modification	C:\Windows\SysWOW64\wslyrsmftlvgecerbsa.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\SysWOW64\cwnypogxjzhqmiitb.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\SysWOW64\wslyrsmftlvgecerbsa.exe	jsyyes.exe
File opened for modification	C:\Windows\SysWOW64\jgaoikfzohsedcftewfc.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\SysWOW64\voeoectjujqytonx.exe	jsyyes.exe
File opened for modification	C:\Windows\SysWOW64\cwnypogxjzhqmiitb.exe	jsyyes.exe
File opened for modification	C:\Windows\SysWOW64\ywrgbeavlfreeeixjcmkf.exe	jsyyes.exe
File created	C:\Windows\SysWOW64\ncouganzgruypgbhkuvkwcoivhozcgxojp.cds	jsyyes.exe
File opened for modification	C:\Windows\SysWOW64\wslyrsmftlvgecerbsa.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\SysWOW64\pokawaxtkfsghindqkvuqg.exe	jsyyes.exe
File created	C:\Windows\SysWOW64\aefabkmnjjbuagqldcswxst.efb	jsyyes.exe
File opened for modification	C:\Windows\SysWOW64\jgaoikfzohsedcftewfc.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\SysWOW64\ywrgbeavlfreeeixjcmkf.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\SysWOW64\lgykccvnarakhefraq.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\SysWOW64\jgaoikfzohsedcftewfc.exe	jsyyes.exe
File opened for modification	C:\Windows\SysWOW64\ncouganzgruypgbhkuvkwcoivhozcgxojp.cds	jsyyes.exe
File opened for modification	C:\Windows\SysWOW64\cwnypogxjzhqmiitb.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\SysWOW64\lgykccvnarakhefraq.exe	hkaqkpraruk.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\aefabkmnjjbuagqldcswxst.efb	jsyyes.exe
File created	C:\Program Files (x86)\aefabkmnjjbuagqldcswxst.efb	jsyyes.exe
File opened for modification	C:\Program Files (x86)\ncouganzgruypgbhkuvkwcoivhozcgxojp.cds	jsyyes.exe
File created	C:\Program Files (x86)\ncouganzgruypgbhkuvkwcoivhozcgxojp.cds	jsyyes.exe

Drops file in Windows directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Windows\wslyrsmftlvgecerbsa.exe	jsyyes.exe
File opened for modification	C:\Windows\jgaoikfzohsedcftewfc.exe	jsyyes.exe
File opened for modification	C:\Windows\lgykccvnarakhefraq.exe	jsyyes.exe
File created	C:\Windows\aefabkmnjjbuagqldcswxst.efb	jsyyes.exe
File opened for modification	C:\Windows\ywrgbeavlfreeeixjcmkf.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\voeoectjujqytonx.exe	jsyyes.exe
File opened for modification	C:\Windows\jgaoikfzohsedcftewfc.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\ywrgbeavlfreeeixjcmkf.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\lgykccvnarakhefraq.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\wslyrsmftlvgecerbsa.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\voeoectjujqytonx.exe	jsyyes.exe
File opened for modification	C:\Windows\ywrgbeavlfreeeixjcmkf.exe	jsyyes.exe
File opened for modification	C:\Windows\cwnypogxjzhqmiitb.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\jgaoikfzohsedcftewfc.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\voeoectjujqytonx.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\aefabkmnjjbuagqldcswxst.efb	jsyyes.exe
File opened for modification	C:\Windows\cwnypogxjzhqmiitb.exe	jsyyes.exe
File opened for modification	C:\Windows\pokawaxtkfsghindqkvuqg.exe	jsyyes.exe
File opened for modification	C:\Windows\ywrgbeavlfreeeixjcmkf.exe	jsyyes.exe
File opened for modification	C:\Windows\ncouganzgruypgbhkuvkwcoivhozcgxojp.cds	jsyyes.exe
File created	C:\Windows\ncouganzgruypgbhkuvkwcoivhozcgxojp.cds	jsyyes.exe
File opened for modification	C:\Windows\cwnypogxjzhqmiitb.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\voeoectjujqytonx.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\pokawaxtkfsghindqkvuqg.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\wslyrsmftlvgecerbsa.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\lgykccvnarakhefraq.exe	jsyyes.exe
File opened for modification	C:\Windows\wslyrsmftlvgecerbsa.exe	jsyyes.exe
File opened for modification	C:\Windows\jgaoikfzohsedcftewfc.exe	jsyyes.exe
File opened for modification	C:\Windows\pokawaxtkfsghindqkvuqg.exe	jsyyes.exe
File opened for modification	C:\Windows\pokawaxtkfsghindqkvuqg.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\lgykccvnarakhefraq.exe	hkaqkpraruk.exe
File opened for modification	C:\Windows\cwnypogxjzhqmiitb.exe	jsyyes.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
488	4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe
488	4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe
488	4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe
488	4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe
488	4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe
488	4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe
488	4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe
488	4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe
488	4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe
488	4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe
488	4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe
488	4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe
488	4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe
488	4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe
488	4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe
488	4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe
488	4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe
488	4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe
488	4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe
488	4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe
4592	jsyyes.exe
4592	jsyyes.exe
488	4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe
488	4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe
488	4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe
488	4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe
488	4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe
488	4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe
488	4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe
488	4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe
488	4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe
488	4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe
488	4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe
488	4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe
488	4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe
488	4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe
488	4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe
488	4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe
488	4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe
488	4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe
488	4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe
488	4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe
488	4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe
488	4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe
488	4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe
488	4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe
4592	jsyyes.exe
4592	jsyyes.exe
488	4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe
488	4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe
488	4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe
488	4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe
488	4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe
488	4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe
488	4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe
488	4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe
488	4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe
488	4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe
488	4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe
488	4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe
488	4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe
488	4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe
488	4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe
488	4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4592	jsyyes.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 488 wrote to memory of 4348	488	4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe	79
PID 488 wrote to memory of 4348	488	4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe	79
PID 488 wrote to memory of 4348	488	4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe	79
PID 4348 wrote to memory of 4592	4348	hkaqkpraruk.exe	80
PID 4348 wrote to memory of 4592	4348	hkaqkpraruk.exe	80
PID 4348 wrote to memory of 4592	4348	hkaqkpraruk.exe	80
PID 4348 wrote to memory of 4324	4348	hkaqkpraruk.exe	81
PID 4348 wrote to memory of 4324	4348	hkaqkpraruk.exe	81
PID 4348 wrote to memory of 4324	4348	hkaqkpraruk.exe	81
PID 488 wrote to memory of 740	488	4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe	91
PID 488 wrote to memory of 740	488	4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe	91
PID 488 wrote to memory of 740	488	4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe	91

System policy modification 1 TTPs 41 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	jsyyes.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	jsyyes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	jsyyes.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	jsyyes.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	jsyyes.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	jsyyes.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	jsyyes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	hkaqkpraruk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	jsyyes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	jsyyes.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	jsyyes.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	jsyyes.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	jsyyes.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	jsyyes.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	jsyyes.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	jsyyes.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	jsyyes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	jsyyes.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	jsyyes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	hkaqkpraruk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	jsyyes.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	jsyyes.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	jsyyes.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	jsyyes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	jsyyes.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	jsyyes.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	jsyyes.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	jsyyes.exe

C:\Users\Admin\AppData\Local\Temp\4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe
"C:\Users\Admin\AppData\Local\Temp\4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:488
- C:\Users\Admin\AppData\Local\Temp\hkaqkpraruk.exe
  "C:\Users\Admin\AppData\Local\Temp\hkaqkpraruk.exe" "c:\users\admin\appdata\local\temp\4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe*"
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Adds policy Run key to start application
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Checks computer location settings
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4348
- - C:\Users\Admin\AppData\Local\Temp\jsyyes.exe
    "C:\Users\Admin\AppData\Local\Temp\jsyyes.exe" "-C:\Users\Admin\AppData\Local\Temp\voeoectjujqytonx.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops autorun.inf file
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - System policy modification
    PID:4592
- - C:\Users\Admin\AppData\Local\Temp\jsyyes.exe
    "C:\Users\Admin\AppData\Local\Temp\jsyyes.exe" "-C:\Users\Admin\AppData\Local\Temp\voeoectjujqytonx.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System policy modification
    PID:4324
- C:\Users\Admin\AppData\Local\Temp\hkaqkpraruk.exe
  "C:\Users\Admin\AppData\Local\Temp\hkaqkpraruk.exe" "c:\users\admin\appdata\local\temp\4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a.exe"
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Adds policy Run key to start application
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System policy modification
  PID:740

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cwnypogxjzhqmiitb.exe

Filesize
528KB

MD5
0ba43ad94518674116e6a3695d127870

SHA1
11af98de9dc3371bbfd8b0b23cf3d2d947921341

SHA256
4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a

SHA512
f4b8f3a81c747f34af9cd21b3b23771ad4a42ff5ccc41828f871a4b2ae1e501ddaebb8c7876245d21d2bed1d7c04176e06c6ea62f98409295845ecfe4759c0a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\hkaqkpraruk.exe

Filesize
320KB

MD5
ca390710b8b88c912ae10c28e42add25

SHA1
59c6b2913576cf7148442c755dd713ceb82a6914

SHA256
7a3ebb42991b3d32d8457993e6daca758ca30c8818e8ede8ed01591fa22a8709

SHA512
66e203d3de7f24024cf7c136cfd10715294534666ed2f408cb976a41d8f2933fd61dee41c42dc8cc8e176f22740e690a3a9f99cb9918f89817610033abd73e00

Download Submit
C:\Users\Admin\AppData\Local\Temp\hkaqkpraruk.exe

Filesize
320KB

MD5
ca390710b8b88c912ae10c28e42add25

SHA1
59c6b2913576cf7148442c755dd713ceb82a6914

SHA256
7a3ebb42991b3d32d8457993e6daca758ca30c8818e8ede8ed01591fa22a8709

SHA512
66e203d3de7f24024cf7c136cfd10715294534666ed2f408cb976a41d8f2933fd61dee41c42dc8cc8e176f22740e690a3a9f99cb9918f89817610033abd73e00

Download Submit
C:\Users\Admin\AppData\Local\Temp\hkaqkpraruk.exe

Filesize
320KB

MD5
ca390710b8b88c912ae10c28e42add25

SHA1
59c6b2913576cf7148442c755dd713ceb82a6914

SHA256
7a3ebb42991b3d32d8457993e6daca758ca30c8818e8ede8ed01591fa22a8709

SHA512
66e203d3de7f24024cf7c136cfd10715294534666ed2f408cb976a41d8f2933fd61dee41c42dc8cc8e176f22740e690a3a9f99cb9918f89817610033abd73e00

Download Submit
C:\Users\Admin\AppData\Local\Temp\jgaoikfzohsedcftewfc.exe

Filesize
528KB

MD5
0ba43ad94518674116e6a3695d127870

SHA1
11af98de9dc3371bbfd8b0b23cf3d2d947921341

SHA256
4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a

SHA512
f4b8f3a81c747f34af9cd21b3b23771ad4a42ff5ccc41828f871a4b2ae1e501ddaebb8c7876245d21d2bed1d7c04176e06c6ea62f98409295845ecfe4759c0a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\jsyyes.exe

Filesize
720KB

MD5
9becd72e2ccef955e5897132ac96c62b

SHA1
b444a28e76028111f1c73ffedf72cb1b65b92887

SHA256
a11ac77f2626583bfeb0c9f6d100574aab047c4b1247cdb63c92bc8aeca25454

SHA512
949bbd9ced649b8581bcc6e59ca8b1f3103e3f9add7503765eb610f250d00c66f9ff3d7e08765523b89ccbe608f9fa70767e7a2a068fe0fe3dabcfa88e217c62

Download Submit
C:\Users\Admin\AppData\Local\Temp\jsyyes.exe

Filesize
720KB

MD5
9becd72e2ccef955e5897132ac96c62b

SHA1
b444a28e76028111f1c73ffedf72cb1b65b92887

SHA256
a11ac77f2626583bfeb0c9f6d100574aab047c4b1247cdb63c92bc8aeca25454

SHA512
949bbd9ced649b8581bcc6e59ca8b1f3103e3f9add7503765eb610f250d00c66f9ff3d7e08765523b89ccbe608f9fa70767e7a2a068fe0fe3dabcfa88e217c62

Download Submit
C:\Users\Admin\AppData\Local\Temp\jsyyes.exe

Filesize
720KB

MD5
9becd72e2ccef955e5897132ac96c62b

SHA1
b444a28e76028111f1c73ffedf72cb1b65b92887

SHA256
a11ac77f2626583bfeb0c9f6d100574aab047c4b1247cdb63c92bc8aeca25454

SHA512
949bbd9ced649b8581bcc6e59ca8b1f3103e3f9add7503765eb610f250d00c66f9ff3d7e08765523b89ccbe608f9fa70767e7a2a068fe0fe3dabcfa88e217c62

Download Submit
C:\Users\Admin\AppData\Local\Temp\lgykccvnarakhefraq.exe

Filesize
528KB

MD5
0ba43ad94518674116e6a3695d127870

SHA1
11af98de9dc3371bbfd8b0b23cf3d2d947921341

SHA256
4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a

SHA512
f4b8f3a81c747f34af9cd21b3b23771ad4a42ff5ccc41828f871a4b2ae1e501ddaebb8c7876245d21d2bed1d7c04176e06c6ea62f98409295845ecfe4759c0a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\pokawaxtkfsghindqkvuqg.exe

Filesize
528KB

MD5
0ba43ad94518674116e6a3695d127870

SHA1
11af98de9dc3371bbfd8b0b23cf3d2d947921341

SHA256
4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a

SHA512
f4b8f3a81c747f34af9cd21b3b23771ad4a42ff5ccc41828f871a4b2ae1e501ddaebb8c7876245d21d2bed1d7c04176e06c6ea62f98409295845ecfe4759c0a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\voeoectjujqytonx.exe

Filesize
528KB

MD5
0ba43ad94518674116e6a3695d127870

SHA1
11af98de9dc3371bbfd8b0b23cf3d2d947921341

SHA256
4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a

SHA512
f4b8f3a81c747f34af9cd21b3b23771ad4a42ff5ccc41828f871a4b2ae1e501ddaebb8c7876245d21d2bed1d7c04176e06c6ea62f98409295845ecfe4759c0a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\wslyrsmftlvgecerbsa.exe

Filesize
528KB

MD5
0ba43ad94518674116e6a3695d127870

SHA1
11af98de9dc3371bbfd8b0b23cf3d2d947921341

SHA256
4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a

SHA512
f4b8f3a81c747f34af9cd21b3b23771ad4a42ff5ccc41828f871a4b2ae1e501ddaebb8c7876245d21d2bed1d7c04176e06c6ea62f98409295845ecfe4759c0a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\ywrgbeavlfreeeixjcmkf.exe

Filesize
528KB

MD5
0ba43ad94518674116e6a3695d127870

SHA1
11af98de9dc3371bbfd8b0b23cf3d2d947921341

SHA256
4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a

SHA512
f4b8f3a81c747f34af9cd21b3b23771ad4a42ff5ccc41828f871a4b2ae1e501ddaebb8c7876245d21d2bed1d7c04176e06c6ea62f98409295845ecfe4759c0a5

Download Submit
C:\Windows\SysWOW64\cwnypogxjzhqmiitb.exe

Filesize
528KB

MD5
0ba43ad94518674116e6a3695d127870

SHA1
11af98de9dc3371bbfd8b0b23cf3d2d947921341

SHA256
4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a

SHA512
f4b8f3a81c747f34af9cd21b3b23771ad4a42ff5ccc41828f871a4b2ae1e501ddaebb8c7876245d21d2bed1d7c04176e06c6ea62f98409295845ecfe4759c0a5

Download Submit
C:\Windows\SysWOW64\jgaoikfzohsedcftewfc.exe

Filesize
528KB

MD5
0ba43ad94518674116e6a3695d127870

SHA1
11af98de9dc3371bbfd8b0b23cf3d2d947921341

SHA256
4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a

SHA512
f4b8f3a81c747f34af9cd21b3b23771ad4a42ff5ccc41828f871a4b2ae1e501ddaebb8c7876245d21d2bed1d7c04176e06c6ea62f98409295845ecfe4759c0a5

Download Submit
C:\Windows\SysWOW64\lgykccvnarakhefraq.exe

Filesize
528KB

MD5
0ba43ad94518674116e6a3695d127870

SHA1
11af98de9dc3371bbfd8b0b23cf3d2d947921341

SHA256
4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a

SHA512
f4b8f3a81c747f34af9cd21b3b23771ad4a42ff5ccc41828f871a4b2ae1e501ddaebb8c7876245d21d2bed1d7c04176e06c6ea62f98409295845ecfe4759c0a5

Download Submit
C:\Windows\SysWOW64\pokawaxtkfsghindqkvuqg.exe

Filesize
528KB

MD5
0ba43ad94518674116e6a3695d127870

SHA1
11af98de9dc3371bbfd8b0b23cf3d2d947921341

SHA256
4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a

SHA512
f4b8f3a81c747f34af9cd21b3b23771ad4a42ff5ccc41828f871a4b2ae1e501ddaebb8c7876245d21d2bed1d7c04176e06c6ea62f98409295845ecfe4759c0a5

Download Submit
C:\Windows\SysWOW64\voeoectjujqytonx.exe

Filesize
528KB

MD5
0ba43ad94518674116e6a3695d127870

SHA1
11af98de9dc3371bbfd8b0b23cf3d2d947921341

SHA256
4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a

SHA512
f4b8f3a81c747f34af9cd21b3b23771ad4a42ff5ccc41828f871a4b2ae1e501ddaebb8c7876245d21d2bed1d7c04176e06c6ea62f98409295845ecfe4759c0a5

Download Submit
C:\Windows\SysWOW64\wslyrsmftlvgecerbsa.exe

Filesize
528KB

MD5
0ba43ad94518674116e6a3695d127870

SHA1
11af98de9dc3371bbfd8b0b23cf3d2d947921341

SHA256
4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a

SHA512
f4b8f3a81c747f34af9cd21b3b23771ad4a42ff5ccc41828f871a4b2ae1e501ddaebb8c7876245d21d2bed1d7c04176e06c6ea62f98409295845ecfe4759c0a5

Download Submit
C:\Windows\SysWOW64\ywrgbeavlfreeeixjcmkf.exe

Filesize
528KB

MD5
0ba43ad94518674116e6a3695d127870

SHA1
11af98de9dc3371bbfd8b0b23cf3d2d947921341

SHA256
4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a

SHA512
f4b8f3a81c747f34af9cd21b3b23771ad4a42ff5ccc41828f871a4b2ae1e501ddaebb8c7876245d21d2bed1d7c04176e06c6ea62f98409295845ecfe4759c0a5

Download Submit
C:\Windows\cwnypogxjzhqmiitb.exe

Filesize
528KB

MD5
0ba43ad94518674116e6a3695d127870

SHA1
11af98de9dc3371bbfd8b0b23cf3d2d947921341

SHA256
4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a

SHA512
f4b8f3a81c747f34af9cd21b3b23771ad4a42ff5ccc41828f871a4b2ae1e501ddaebb8c7876245d21d2bed1d7c04176e06c6ea62f98409295845ecfe4759c0a5

Download Submit
C:\Windows\cwnypogxjzhqmiitb.exe

Filesize
528KB

MD5
0ba43ad94518674116e6a3695d127870

SHA1
11af98de9dc3371bbfd8b0b23cf3d2d947921341

SHA256
4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a

SHA512
f4b8f3a81c747f34af9cd21b3b23771ad4a42ff5ccc41828f871a4b2ae1e501ddaebb8c7876245d21d2bed1d7c04176e06c6ea62f98409295845ecfe4759c0a5

Download Submit
C:\Windows\cwnypogxjzhqmiitb.exe

Filesize
528KB

MD5
0ba43ad94518674116e6a3695d127870

SHA1
11af98de9dc3371bbfd8b0b23cf3d2d947921341

SHA256
4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a

SHA512
f4b8f3a81c747f34af9cd21b3b23771ad4a42ff5ccc41828f871a4b2ae1e501ddaebb8c7876245d21d2bed1d7c04176e06c6ea62f98409295845ecfe4759c0a5

Download Submit
C:\Windows\jgaoikfzohsedcftewfc.exe

Filesize
528KB

MD5
0ba43ad94518674116e6a3695d127870

SHA1
11af98de9dc3371bbfd8b0b23cf3d2d947921341

SHA256
4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a

SHA512
f4b8f3a81c747f34af9cd21b3b23771ad4a42ff5ccc41828f871a4b2ae1e501ddaebb8c7876245d21d2bed1d7c04176e06c6ea62f98409295845ecfe4759c0a5

Download Submit
C:\Windows\jgaoikfzohsedcftewfc.exe

Filesize
528KB

MD5
0ba43ad94518674116e6a3695d127870

SHA1
11af98de9dc3371bbfd8b0b23cf3d2d947921341

SHA256
4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a

SHA512
f4b8f3a81c747f34af9cd21b3b23771ad4a42ff5ccc41828f871a4b2ae1e501ddaebb8c7876245d21d2bed1d7c04176e06c6ea62f98409295845ecfe4759c0a5

Download Submit
C:\Windows\jgaoikfzohsedcftewfc.exe

Filesize
528KB

MD5
0ba43ad94518674116e6a3695d127870

SHA1
11af98de9dc3371bbfd8b0b23cf3d2d947921341

SHA256
4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a

SHA512
f4b8f3a81c747f34af9cd21b3b23771ad4a42ff5ccc41828f871a4b2ae1e501ddaebb8c7876245d21d2bed1d7c04176e06c6ea62f98409295845ecfe4759c0a5

Download Submit
C:\Windows\lgykccvnarakhefraq.exe

Filesize
528KB

MD5
0ba43ad94518674116e6a3695d127870

SHA1
11af98de9dc3371bbfd8b0b23cf3d2d947921341

SHA256
4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a

SHA512
f4b8f3a81c747f34af9cd21b3b23771ad4a42ff5ccc41828f871a4b2ae1e501ddaebb8c7876245d21d2bed1d7c04176e06c6ea62f98409295845ecfe4759c0a5

Download Submit
C:\Windows\lgykccvnarakhefraq.exe

Filesize
528KB

MD5
0ba43ad94518674116e6a3695d127870

SHA1
11af98de9dc3371bbfd8b0b23cf3d2d947921341

SHA256
4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a

SHA512
f4b8f3a81c747f34af9cd21b3b23771ad4a42ff5ccc41828f871a4b2ae1e501ddaebb8c7876245d21d2bed1d7c04176e06c6ea62f98409295845ecfe4759c0a5

Download Submit
C:\Windows\lgykccvnarakhefraq.exe

Filesize
528KB

MD5
0ba43ad94518674116e6a3695d127870

SHA1
11af98de9dc3371bbfd8b0b23cf3d2d947921341

SHA256
4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a

SHA512
f4b8f3a81c747f34af9cd21b3b23771ad4a42ff5ccc41828f871a4b2ae1e501ddaebb8c7876245d21d2bed1d7c04176e06c6ea62f98409295845ecfe4759c0a5

Download Submit
C:\Windows\pokawaxtkfsghindqkvuqg.exe

Filesize
528KB

MD5
0ba43ad94518674116e6a3695d127870

SHA1
11af98de9dc3371bbfd8b0b23cf3d2d947921341

SHA256
4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a

SHA512
f4b8f3a81c747f34af9cd21b3b23771ad4a42ff5ccc41828f871a4b2ae1e501ddaebb8c7876245d21d2bed1d7c04176e06c6ea62f98409295845ecfe4759c0a5

Download Submit
C:\Windows\pokawaxtkfsghindqkvuqg.exe

Filesize
528KB

MD5
0ba43ad94518674116e6a3695d127870

SHA1
11af98de9dc3371bbfd8b0b23cf3d2d947921341

SHA256
4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a

SHA512
f4b8f3a81c747f34af9cd21b3b23771ad4a42ff5ccc41828f871a4b2ae1e501ddaebb8c7876245d21d2bed1d7c04176e06c6ea62f98409295845ecfe4759c0a5

Download Submit
C:\Windows\pokawaxtkfsghindqkvuqg.exe

Filesize
528KB

MD5
0ba43ad94518674116e6a3695d127870

SHA1
11af98de9dc3371bbfd8b0b23cf3d2d947921341

SHA256
4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a

SHA512
f4b8f3a81c747f34af9cd21b3b23771ad4a42ff5ccc41828f871a4b2ae1e501ddaebb8c7876245d21d2bed1d7c04176e06c6ea62f98409295845ecfe4759c0a5

Download Submit
C:\Windows\voeoectjujqytonx.exe

Filesize
528KB

MD5
0ba43ad94518674116e6a3695d127870

SHA1
11af98de9dc3371bbfd8b0b23cf3d2d947921341

SHA256
4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a

SHA512
f4b8f3a81c747f34af9cd21b3b23771ad4a42ff5ccc41828f871a4b2ae1e501ddaebb8c7876245d21d2bed1d7c04176e06c6ea62f98409295845ecfe4759c0a5

Download Submit
C:\Windows\voeoectjujqytonx.exe

Filesize
528KB

MD5
0ba43ad94518674116e6a3695d127870

SHA1
11af98de9dc3371bbfd8b0b23cf3d2d947921341

SHA256
4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a

SHA512
f4b8f3a81c747f34af9cd21b3b23771ad4a42ff5ccc41828f871a4b2ae1e501ddaebb8c7876245d21d2bed1d7c04176e06c6ea62f98409295845ecfe4759c0a5

Download Submit
C:\Windows\voeoectjujqytonx.exe

Filesize
528KB

MD5
0ba43ad94518674116e6a3695d127870

SHA1
11af98de9dc3371bbfd8b0b23cf3d2d947921341

SHA256
4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a

SHA512
f4b8f3a81c747f34af9cd21b3b23771ad4a42ff5ccc41828f871a4b2ae1e501ddaebb8c7876245d21d2bed1d7c04176e06c6ea62f98409295845ecfe4759c0a5

Download Submit
C:\Windows\wslyrsmftlvgecerbsa.exe

Filesize
528KB

MD5
0ba43ad94518674116e6a3695d127870

SHA1
11af98de9dc3371bbfd8b0b23cf3d2d947921341

SHA256
4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a

SHA512
f4b8f3a81c747f34af9cd21b3b23771ad4a42ff5ccc41828f871a4b2ae1e501ddaebb8c7876245d21d2bed1d7c04176e06c6ea62f98409295845ecfe4759c0a5

Download Submit
C:\Windows\wslyrsmftlvgecerbsa.exe

Filesize
528KB

MD5
0ba43ad94518674116e6a3695d127870

SHA1
11af98de9dc3371bbfd8b0b23cf3d2d947921341

SHA256
4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a

SHA512
f4b8f3a81c747f34af9cd21b3b23771ad4a42ff5ccc41828f871a4b2ae1e501ddaebb8c7876245d21d2bed1d7c04176e06c6ea62f98409295845ecfe4759c0a5

Download Submit
C:\Windows\wslyrsmftlvgecerbsa.exe

Filesize
528KB

MD5
0ba43ad94518674116e6a3695d127870

SHA1
11af98de9dc3371bbfd8b0b23cf3d2d947921341

SHA256
4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a

SHA512
f4b8f3a81c747f34af9cd21b3b23771ad4a42ff5ccc41828f871a4b2ae1e501ddaebb8c7876245d21d2bed1d7c04176e06c6ea62f98409295845ecfe4759c0a5

Download Submit
C:\Windows\ywrgbeavlfreeeixjcmkf.exe

Filesize
528KB

MD5
0ba43ad94518674116e6a3695d127870

SHA1
11af98de9dc3371bbfd8b0b23cf3d2d947921341

SHA256
4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a

SHA512
f4b8f3a81c747f34af9cd21b3b23771ad4a42ff5ccc41828f871a4b2ae1e501ddaebb8c7876245d21d2bed1d7c04176e06c6ea62f98409295845ecfe4759c0a5

Download Submit
C:\Windows\ywrgbeavlfreeeixjcmkf.exe

Filesize
528KB

MD5
0ba43ad94518674116e6a3695d127870

SHA1
11af98de9dc3371bbfd8b0b23cf3d2d947921341

SHA256
4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a

SHA512
f4b8f3a81c747f34af9cd21b3b23771ad4a42ff5ccc41828f871a4b2ae1e501ddaebb8c7876245d21d2bed1d7c04176e06c6ea62f98409295845ecfe4759c0a5

Download Submit
C:\Windows\ywrgbeavlfreeeixjcmkf.exe

Filesize
528KB

MD5
0ba43ad94518674116e6a3695d127870

SHA1
11af98de9dc3371bbfd8b0b23cf3d2d947921341

SHA256
4c854b21e9e238f1206907477325565b75d3c25bc1752a05dabd00f792067a6a

SHA512
f4b8f3a81c747f34af9cd21b3b23771ad4a42ff5ccc41828f871a4b2ae1e501ddaebb8c7876245d21d2bed1d7c04176e06c6ea62f98409295845ecfe4759c0a5

Download Submit