Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01/12/2022, 22:18
Static task
static1
Behavioral task
behavioral1
Sample
b37300bd4673374262ba3896838467c649976d657e4a047f40037d9a124a9e46.exe
Resource
win7-20220812-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
b37300bd4673374262ba3896838467c649976d657e4a047f40037d9a124a9e46.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
19 signatures
150 seconds
General
-
Target
b37300bd4673374262ba3896838467c649976d657e4a047f40037d9a124a9e46.exe
-
Size
320KB
-
MD5
6d51303da26daa83864b98ec0dd5edc1
-
SHA1
b4045caba0ec3295830652210fd0b80c06033b3b
-
SHA256
b37300bd4673374262ba3896838467c649976d657e4a047f40037d9a124a9e46
-
SHA512
40e2f920b9fb31b041b7a7c8513440626c028645ebd1dd7c21c286941932071b0d420a491a9936a46445fe2dc07644f297ff0b75027110610b6a96e92d3c48e8
-
SSDEEP
6144:XTwEo1IV3puaibGKFHi0mofhaH05kipz016580bHFMdkhq86JQPDHDdx/QtqR:DCgvmzFHi0mo5aH0qMzd5807F7qPJQPx
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" b37300bd4673374262ba3896838467c649976d657e4a047f40037d9a124a9e46.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" wdflx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" wdflx.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" wdflx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" wdflx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" wdflx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" b37300bd4673374262ba3896838467c649976d657e4a047f40037d9a124a9e46.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" b37300bd4673374262ba3896838467c649976d657e4a047f40037d9a124a9e46.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" b37300bd4673374262ba3896838467c649976d657e4a047f40037d9a124a9e46.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" wdflx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" wdflx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" wdflx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" b37300bd4673374262ba3896838467c649976d657e4a047f40037d9a124a9e46.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wdflx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wdflx.exe -
Adds policy Run key to start application 2 TTPs 15 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lzivosnqhpvl = "jdslkuvebpbxpmegsz.exe" wdflx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lzivosnqhpvl = "upfzzkmwujwtmkdgtby.exe" wdflx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lzivosnqhpvl = "athzxggokxiduqhit.exe" wdflx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\alrbrskky = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hdupqcfqpftrlkeiwfdz.exe" wdflx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lzivosnqhpvl = "upfzzkmwujwtmkdgtby.exe" b37300bd4673374262ba3896838467c649976d657e4a047f40037d9a124a9e46.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run wdflx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\alrbrskky = "C:\\Users\\Admin\\AppData\\Local\\Temp\\upfzzkmwujwtmkdgtby.exe" wdflx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\alrbrskky = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jdslkuvebpbxpmegsz.exe" wdflx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\alrbrskky = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wtlhjwammdsrmmhmblkhz.exe" b37300bd4673374262ba3896838467c649976d657e4a047f40037d9a124a9e46.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lzivosnqhpvl = "hdupqcfqpftrlkeiwfdz.exe" wdflx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\alrbrskky = "C:\\Users\\Admin\\AppData\\Local\\Temp\\upfzzkmwujwtmkdgtby.exe" wdflx.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run b37300bd4673374262ba3896838467c649976d657e4a047f40037d9a124a9e46.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run wdflx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lzivosnqhpvl = "hdupqcfqpftrlkeiwfdz.exe" wdflx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\alrbrskky = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tlypmutavhrlbwmm.exe" wdflx.exe -
Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" b37300bd4673374262ba3896838467c649976d657e4a047f40037d9a124a9e46.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" wdflx.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" wdflx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" wdflx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" wdflx.exe Set value (int) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" b37300bd4673374262ba3896838467c649976d657e4a047f40037d9a124a9e46.exe -
Executes dropped EXE 2 IoCs
pid Process 1340 wdflx.exe 936 wdflx.exe -
Loads dropped DLL 4 IoCs
pid Process 1088 b37300bd4673374262ba3896838467c649976d657e4a047f40037d9a124a9e46.exe 1088 b37300bd4673374262ba3896838467c649976d657e4a047f40037d9a124a9e46.exe 1088 b37300bd4673374262ba3896838467c649976d657e4a047f40037d9a124a9e46.exe 1088 b37300bd4673374262ba3896838467c649976d657e4a047f40037d9a124a9e46.exe -
Adds Run key to start application 2 TTPs 61 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tfmxoqjkzf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tlypmutavhrlbwmm.exe" wdflx.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tfmxoqjkzf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wtlhjwammdsrmmhmblkhz.exe" wdflx.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce b37300bd4673374262ba3896838467c649976d657e4a047f40037d9a124a9e46.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ofrhdkioitcvket = "C:\\Users\\Admin\\AppData\\Local\\Temp\\upfzzkmwujwtmkdgtby.exe ." b37300bd4673374262ba3896838467c649976d657e4a047f40037d9a124a9e46.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run wdflx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ofrhdkioitcvket = "C:\\Users\\Admin\\AppData\\Local\\Temp\\upfzzkmwujwtmkdgtby.exe ." wdflx.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\objvnqkmcjo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jdslkuvebpbxpmegsz.exe ." wdflx.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tfmxoqjkzf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wtlhjwammdsrmmhmblkhz.exe" wdflx.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\lbmbwczexhphvo = "tlypmutavhrlbwmm.exe ." b37300bd4673374262ba3896838467c649976d657e4a047f40037d9a124a9e46.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run wdflx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\tfmxoqjkzf = "hdupqcfqpftrlkeiwfdz.exe" wdflx.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run wdflx.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\kzjxrwswoxevi = "hdupqcfqpftrlkeiwfdz.exe" wdflx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\tfmxoqjkzf = "jdslkuvebpbxpmegsz.exe" wdflx.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\lbmbwczexhphvo = "athzxggokxiduqhit.exe ." wdflx.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce wdflx.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\lbmbwczexhphvo = "tlypmutavhrlbwmm.exe ." wdflx.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\objvnqkmcjo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jdslkuvebpbxpmegsz.exe ." wdflx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\objvnqkmcjo = "wtlhjwammdsrmmhmblkhz.exe ." wdflx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\objvnqkmcjo = "athzxggokxiduqhit.exe ." wdflx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\tlypmutavhrlbwmm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tlypmutavhrlbwmm.exe" wdflx.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\objvnqkmcjo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wtlhjwammdsrmmhmblkhz.exe ." wdflx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\objvnqkmcjo = "tlypmutavhrlbwmm.exe ." wdflx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\tlypmutavhrlbwmm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\upfzzkmwujwtmkdgtby.exe" wdflx.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tfmxoqjkzf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\upfzzkmwujwtmkdgtby.exe" wdflx.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce b37300bd4673374262ba3896838467c649976d657e4a047f40037d9a124a9e46.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\kzjxrwswoxevi = "athzxggokxiduqhit.exe" b37300bd4673374262ba3896838467c649976d657e4a047f40037d9a124a9e46.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ofrhdkioitcvket = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wtlhjwammdsrmmhmblkhz.exe ." wdflx.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce wdflx.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\kzjxrwswoxevi = "tlypmutavhrlbwmm.exe" wdflx.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\kzjxrwswoxevi = "wtlhjwammdsrmmhmblkhz.exe" wdflx.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\objvnqkmcjo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\athzxggokxiduqhit.exe ." wdflx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\tfmxoqjkzf = "tlypmutavhrlbwmm.exe" b37300bd4673374262ba3896838467c649976d657e4a047f40037d9a124a9e46.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\objvnqkmcjo = "jdslkuvebpbxpmegsz.exe ." b37300bd4673374262ba3896838467c649976d657e4a047f40037d9a124a9e46.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce wdflx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\objvnqkmcjo = "upfzzkmwujwtmkdgtby.exe ." wdflx.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run wdflx.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\lbmbwczexhphvo = "wtlhjwammdsrmmhmblkhz.exe ." wdflx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\tlypmutavhrlbwmm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wtlhjwammdsrmmhmblkhz.exe" wdflx.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tfmxoqjkzf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tlypmutavhrlbwmm.exe" b37300bd4673374262ba3896838467c649976d657e4a047f40037d9a124a9e46.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\lbmbwczexhphvo = "wtlhjwammdsrmmhmblkhz.exe ." wdflx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ofrhdkioitcvket = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jdslkuvebpbxpmegsz.exe ." wdflx.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run b37300bd4673374262ba3896838467c649976d657e4a047f40037d9a124a9e46.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\tlypmutavhrlbwmm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\athzxggokxiduqhit.exe" b37300bd4673374262ba3896838467c649976d657e4a047f40037d9a124a9e46.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\objvnqkmcjo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wtlhjwammdsrmmhmblkhz.exe ." wdflx.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\lbmbwczexhphvo = "tlypmutavhrlbwmm.exe ." wdflx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\tfmxoqjkzf = "athzxggokxiduqhit.exe" wdflx.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\objvnqkmcjo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\athzxggokxiduqhit.exe ." b37300bd4673374262ba3896838467c649976d657e4a047f40037d9a124a9e46.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ofrhdkioitcvket = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hdupqcfqpftrlkeiwfdz.exe ." wdflx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\tfmxoqjkzf = "upfzzkmwujwtmkdgtby.exe" wdflx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\tlypmutavhrlbwmm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hdupqcfqpftrlkeiwfdz.exe" wdflx.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\objvnqkmcjo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\athzxggokxiduqhit.exe ." wdflx.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\kzjxrwswoxevi = "tlypmutavhrlbwmm.exe" wdflx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\tlypmutavhrlbwmm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\athzxggokxiduqhit.exe" wdflx.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\tfmxoqjkzf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\athzxggokxiduqhit.exe" wdflx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\tfmxoqjkzf = "upfzzkmwujwtmkdgtby.exe" wdflx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\objvnqkmcjo = "jdslkuvebpbxpmegsz.exe ." wdflx.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce wdflx.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run b37300bd4673374262ba3896838467c649976d657e4a047f40037d9a124a9e46.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\tfmxoqjkzf = "wtlhjwammdsrmmhmblkhz.exe" wdflx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\objvnqkmcjo = "tlypmutavhrlbwmm.exe ." wdflx.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wdflx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" b37300bd4673374262ba3896838467c649976d657e4a047f40037d9a124a9e46.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA b37300bd4673374262ba3896838467c649976d657e4a047f40037d9a124a9e46.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wdflx.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wdflx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wdflx.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 whatismyipaddress.com 5 whatismyip.everdot.org 6 www.showmyipaddress.com -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\tlypmutavhrlbwmmwbvnarowvcxjtndyooydxp.tqy wdflx.exe File opened for modification C:\Windows\SysWOW64\wdflxuieopoxcmrgfziprxjguqa.ajo wdflx.exe File created C:\Windows\SysWOW64\wdflxuieopoxcmrgfziprxjguqa.ajo wdflx.exe File opened for modification C:\Windows\SysWOW64\tlypmutavhrlbwmmwbvnarowvcxjtndyooydxp.tqy wdflx.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\wdflxuieopoxcmrgfziprxjguqa.ajo wdflx.exe File created C:\Program Files (x86)\wdflxuieopoxcmrgfziprxjguqa.ajo wdflx.exe File opened for modification C:\Program Files (x86)\tlypmutavhrlbwmmwbvnarowvcxjtndyooydxp.tqy wdflx.exe File created C:\Program Files (x86)\tlypmutavhrlbwmmwbvnarowvcxjtndyooydxp.tqy wdflx.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\wdflxuieopoxcmrgfziprxjguqa.ajo wdflx.exe File created C:\Windows\wdflxuieopoxcmrgfziprxjguqa.ajo wdflx.exe File opened for modification C:\Windows\tlypmutavhrlbwmmwbvnarowvcxjtndyooydxp.tqy wdflx.exe File created C:\Windows\tlypmutavhrlbwmmwbvnarowvcxjtndyooydxp.tqy wdflx.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1340 wdflx.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1340 wdflx.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1088 wrote to memory of 1340 1088 b37300bd4673374262ba3896838467c649976d657e4a047f40037d9a124a9e46.exe 28 PID 1088 wrote to memory of 1340 1088 b37300bd4673374262ba3896838467c649976d657e4a047f40037d9a124a9e46.exe 28 PID 1088 wrote to memory of 1340 1088 b37300bd4673374262ba3896838467c649976d657e4a047f40037d9a124a9e46.exe 28 PID 1088 wrote to memory of 1340 1088 b37300bd4673374262ba3896838467c649976d657e4a047f40037d9a124a9e46.exe 28 PID 1088 wrote to memory of 936 1088 b37300bd4673374262ba3896838467c649976d657e4a047f40037d9a124a9e46.exe 27 PID 1088 wrote to memory of 936 1088 b37300bd4673374262ba3896838467c649976d657e4a047f40037d9a124a9e46.exe 27 PID 1088 wrote to memory of 936 1088 b37300bd4673374262ba3896838467c649976d657e4a047f40037d9a124a9e46.exe 27 PID 1088 wrote to memory of 936 1088 b37300bd4673374262ba3896838467c649976d657e4a047f40037d9a124a9e46.exe 27 -
System policy modification 1 TTPs 37 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System wdflx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" wdflx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" wdflx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" wdflx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" wdflx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" wdflx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" b37300bd4673374262ba3896838467c649976d657e4a047f40037d9a124a9e46.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" b37300bd4673374262ba3896838467c649976d657e4a047f40037d9a124a9e46.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" b37300bd4673374262ba3896838467c649976d657e4a047f40037d9a124a9e46.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" wdflx.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System b37300bd4673374262ba3896838467c649976d657e4a047f40037d9a124a9e46.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" b37300bd4673374262ba3896838467c649976d657e4a047f40037d9a124a9e46.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" b37300bd4673374262ba3896838467c649976d657e4a047f40037d9a124a9e46.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" wdflx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" wdflx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" wdflx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" wdflx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" b37300bd4673374262ba3896838467c649976d657e4a047f40037d9a124a9e46.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System wdflx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" wdflx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" wdflx.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer wdflx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" b37300bd4673374262ba3896838467c649976d657e4a047f40037d9a124a9e46.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" b37300bd4673374262ba3896838467c649976d657e4a047f40037d9a124a9e46.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" wdflx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" wdflx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" b37300bd4673374262ba3896838467c649976d657e4a047f40037d9a124a9e46.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" wdflx.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer wdflx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" wdflx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wdflx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" wdflx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" b37300bd4673374262ba3896838467c649976d657e4a047f40037d9a124a9e46.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" wdflx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" wdflx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wdflx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" wdflx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b37300bd4673374262ba3896838467c649976d657e4a047f40037d9a124a9e46.exe"C:\Users\Admin\AppData\Local\Temp\b37300bd4673374262ba3896838467c649976d657e4a047f40037d9a124a9e46.exe"1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\wdflx.exe"C:\Users\Admin\AppData\Local\Temp\wdflx.exe" "-"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- System policy modification
PID:936
-
-
C:\Users\Admin\AppData\Local\Temp\wdflx.exe"C:\Users\Admin\AppData\Local\Temp\wdflx.exe" "-"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:1340
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
712KB
MD5698d86a5e43e2193657b50548a3efcfb
SHA1e727b9b0747292bd4eee299893e68a2ac2f2cc09
SHA25624a0263b62f5f955a50fd378b14810149015a1512b6232be2fa395f486252ef9
SHA5124f7dc0cc8c5422299fd491080d0d963e7ea90cbfde8c6a9c88ff654ecc143b05b8f92fc35c2a0c9d57a3efd8157c2886e7a081a9d68686c5a4cd3b66a4e1b040
-
Filesize
712KB
MD5698d86a5e43e2193657b50548a3efcfb
SHA1e727b9b0747292bd4eee299893e68a2ac2f2cc09
SHA25624a0263b62f5f955a50fd378b14810149015a1512b6232be2fa395f486252ef9
SHA5124f7dc0cc8c5422299fd491080d0d963e7ea90cbfde8c6a9c88ff654ecc143b05b8f92fc35c2a0c9d57a3efd8157c2886e7a081a9d68686c5a4cd3b66a4e1b040
-
Filesize
712KB
MD5698d86a5e43e2193657b50548a3efcfb
SHA1e727b9b0747292bd4eee299893e68a2ac2f2cc09
SHA25624a0263b62f5f955a50fd378b14810149015a1512b6232be2fa395f486252ef9
SHA5124f7dc0cc8c5422299fd491080d0d963e7ea90cbfde8c6a9c88ff654ecc143b05b8f92fc35c2a0c9d57a3efd8157c2886e7a081a9d68686c5a4cd3b66a4e1b040
-
Filesize
712KB
MD5698d86a5e43e2193657b50548a3efcfb
SHA1e727b9b0747292bd4eee299893e68a2ac2f2cc09
SHA25624a0263b62f5f955a50fd378b14810149015a1512b6232be2fa395f486252ef9
SHA5124f7dc0cc8c5422299fd491080d0d963e7ea90cbfde8c6a9c88ff654ecc143b05b8f92fc35c2a0c9d57a3efd8157c2886e7a081a9d68686c5a4cd3b66a4e1b040
-
Filesize
712KB
MD5698d86a5e43e2193657b50548a3efcfb
SHA1e727b9b0747292bd4eee299893e68a2ac2f2cc09
SHA25624a0263b62f5f955a50fd378b14810149015a1512b6232be2fa395f486252ef9
SHA5124f7dc0cc8c5422299fd491080d0d963e7ea90cbfde8c6a9c88ff654ecc143b05b8f92fc35c2a0c9d57a3efd8157c2886e7a081a9d68686c5a4cd3b66a4e1b040
-
Filesize
712KB
MD5698d86a5e43e2193657b50548a3efcfb
SHA1e727b9b0747292bd4eee299893e68a2ac2f2cc09
SHA25624a0263b62f5f955a50fd378b14810149015a1512b6232be2fa395f486252ef9
SHA5124f7dc0cc8c5422299fd491080d0d963e7ea90cbfde8c6a9c88ff654ecc143b05b8f92fc35c2a0c9d57a3efd8157c2886e7a081a9d68686c5a4cd3b66a4e1b040