9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3

Analysis

max time kernel
151s
max time network
184s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
01/12/2022, 09:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe
Size

456KB
MD5

3d5c3f2297871eb8462e9db0c1d3d03d
SHA1

28f9c17733deb70a1dabdefef88ab43e99de6b04
SHA256

9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3
SHA512

963a223dbaa73ebdc01dc424e3d92578af189d6f09cf59f91e0913ff1d75f0d3c18ffb6bd2c8e37a9fb7b63f45622bfcf97b5472adab62e09f0da5bdcaa43c87
SSDEEP

12288:IpUJ3r6YkVwJgNnSykgb9cqWnw4q6ZmFhqse:IpUNr6YkVRFkgbeqeo68Fhq/

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	uvlgepmyefv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	bhnmv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	bhnmv.exe

UAC bypass 3 TTPs 12 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	uvlgepmyefv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	uvlgepmyefv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	bhnmv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	bhnmv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	bhnmv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	bhnmv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	bhnmv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	bhnmv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	uvlgepmyefv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	uvlgepmyefv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	bhnmv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	bhnmv.exe

Adds policy Run key to start application 2 TTPs 18 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bhnmv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ohamizpkbpnvsuzrvo.exe"	uvlgepmyefv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\oxgiubhs = "fxpavlaukxubxyctw.exe"	bhnmv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\oxgiubhs = "ztnaxpgcujirpsyrwqd.exe"	bhnmv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bhnmv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ohamizpkbpnvsuzrvo.exe"	bhnmv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bhnmv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mhcqohzwpffposztzuid.exe"	bhnmv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bhnmv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ztnaxpgcujirpsyrwqd.exe"	bhnmv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	bhnmv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	bhnmv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bhnmv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bxtihbusmdeppucxeaplh.exe"	bhnmv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bhnmv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fxpavlaukxubxyctw.exe"	bhnmv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bhnmv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ypgqkzngvhdjeehx.exe"	bhnmv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\oxgiubhs = "ztnaxpgcujirpsyrwqd.exe"	bhnmv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	uvlgepmyefv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\oxgiubhs = "mhcqohzwpffposztzuid.exe"	uvlgepmyefv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\oxgiubhs = "mhcqohzwpffposztzuid.exe"	bhnmv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bhnmv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ypgqkzngvhdjeehx.exe"	bhnmv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\oxgiubhs = "ypgqkzngvhdjeehx.exe"	bhnmv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\oxgiubhs = "ypgqkzngvhdjeehx.exe"	bhnmv.exe

Disables RegEdit via registry modification 6 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	bhnmv.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	bhnmv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	bhnmv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	bhnmv.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	uvlgepmyefv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	uvlgepmyefv.exe

Executes dropped EXE 3 IoCs

pid	Process
1980	uvlgepmyefv.exe
1204	bhnmv.exe
884	bhnmv.exe

Loads dropped DLL 6 IoCs

pid	Process
2032	9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe
2032	9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe
1980	uvlgepmyefv.exe
1980	uvlgepmyefv.exe
1980	uvlgepmyefv.exe
1980	uvlgepmyefv.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mtaakp = "fxpavlaukxubxyctw.exe"	bhnmv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\fpzcpxeqy = "fxpavlaukxubxyctw.exe"	bhnmv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	uvlgepmyefv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qdqwmxhwhphj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ypgqkzngvhdjeehx.exe"	uvlgepmyefv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\mtaakp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fxpavlaukxubxyctw.exe"	bhnmv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mtaakp = "fxpavlaukxubxyctw.exe"	bhnmv.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	bhnmv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\zhpqbhm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ohamizpkbpnvsuzrvo.exe ."	bhnmv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\yjuymvdqzf = "ypgqkzngvhdjeehx.exe ."	bhnmv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mtaakp = "bxtihbusmdeppucxeaplh.exe"	bhnmv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qdqwmxhwhphj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ohamizpkbpnvsuzrvo.exe"	bhnmv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\mtaakp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mhcqohzwpffposztzuid.exe"	bhnmv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tfrwlvescja = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ohamizpkbpnvsuzrvo.exe ."	uvlgepmyefv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\yjuymvdqzf = "ztnaxpgcujirpsyrwqd.exe ."	bhnmv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qdqwmxhwhphj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ypgqkzngvhdjeehx.exe"	bhnmv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\zhpqbhm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mhcqohzwpffposztzuid.exe ."	uvlgepmyefv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tfrwlvescja = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ypgqkzngvhdjeehx.exe ."	bhnmv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\fpzcpxeqy = "ypgqkzngvhdjeehx.exe"	bhnmv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\mtaakp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ohamizpkbpnvsuzrvo.exe"	bhnmv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zhpqbhm = "bxtihbusmdeppucxeaplh.exe ."	bhnmv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mtaakp = "mhcqohzwpffposztzuid.exe"	uvlgepmyefv.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	bhnmv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\mtaakp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ztnaxpgcujirpsyrwqd.exe"	bhnmv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qdqwmxhwhphj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mhcqohzwpffposztzuid.exe"	bhnmv.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	bhnmv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mtaakp = "ypgqkzngvhdjeehx.exe"	bhnmv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qdqwmxhwhphj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fxpavlaukxubxyctw.exe"	bhnmv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qdqwmxhwhphj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mhcqohzwpffposztzuid.exe"	bhnmv.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	bhnmv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\zhpqbhm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bxtihbusmdeppucxeaplh.exe ."	bhnmv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zhpqbhm = "ypgqkzngvhdjeehx.exe ."	bhnmv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\yjuymvdqzf = "fxpavlaukxubxyctw.exe ."	bhnmv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\fpzcpxeqy = "mhcqohzwpffposztzuid.exe"	uvlgepmyefv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mtaakp = "bxtihbusmdeppucxeaplh.exe"	bhnmv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\fpzcpxeqy = "ypgqkzngvhdjeehx.exe"	bhnmv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\yjuymvdqzf = "mhcqohzwpffposztzuid.exe ."	bhnmv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mtaakp = "ohamizpkbpnvsuzrvo.exe"	bhnmv.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	uvlgepmyefv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\zhpqbhm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ypgqkzngvhdjeehx.exe ."	bhnmv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\zhpqbhm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fxpavlaukxubxyctw.exe ."	bhnmv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	uvlgepmyefv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zhpqbhm = "ypgqkzngvhdjeehx.exe ."	bhnmv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tfrwlvescja = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ztnaxpgcujirpsyrwqd.exe ."	bhnmv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\mtaakp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bxtihbusmdeppucxeaplh.exe"	bhnmv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zhpqbhm = "ohamizpkbpnvsuzrvo.exe ."	bhnmv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tfrwlvescja = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ztnaxpgcujirpsyrwqd.exe ."	bhnmv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zhpqbhm = "mhcqohzwpffposztzuid.exe ."	bhnmv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	bhnmv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zhpqbhm = "fxpavlaukxubxyctw.exe ."	bhnmv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\fpzcpxeqy = "ohamizpkbpnvsuzrvo.exe"	bhnmv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tfrwlvescja = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ohamizpkbpnvsuzrvo.exe ."	bhnmv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\fpzcpxeqy = "bxtihbusmdeppucxeaplh.exe"	bhnmv.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	uvlgepmyefv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\mtaakp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fxpavlaukxubxyctw.exe"	uvlgepmyefv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	bhnmv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tfrwlvescja = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fxpavlaukxubxyctw.exe ."	bhnmv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\mtaakp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ypgqkzngvhdjeehx.exe"	bhnmv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mtaakp = "ztnaxpgcujirpsyrwqd.exe"	bhnmv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\mtaakp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mhcqohzwpffposztzuid.exe"	bhnmv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\yjuymvdqzf = "ohamizpkbpnvsuzrvo.exe ."	bhnmv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	bhnmv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zhpqbhm = "mhcqohzwpffposztzuid.exe ."	bhnmv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\yjuymvdqzf = "mhcqohzwpffposztzuid.exe ."	bhnmv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qdqwmxhwhphj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ohamizpkbpnvsuzrvo.exe"	bhnmv.exe

Checks whether UAC is enabled 1 TTPs 6 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	uvlgepmyefv.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	uvlgepmyefv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	bhnmv.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	bhnmv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	bhnmv.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	bhnmv.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	whatismyip.everdot.org
8	whatismyipaddress.com
2	www.showmyipaddress.com

Drops file in System32 directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\fxpavlaukxubxyctw.exe	bhnmv.exe
File opened for modification	C:\Windows\SysWOW64\mhcqohzwpffposztzuid.exe	bhnmv.exe
File opened for modification	C:\Windows\SysWOW64\ypgqkzngvhdjeehx.exe	bhnmv.exe
File opened for modification	C:\Windows\SysWOW64\ztnaxpgcujirpsyrwqd.exe	bhnmv.exe
File opened for modification	C:\Windows\SysWOW64\mhcqohzwpffposztzuid.exe	bhnmv.exe
File opened for modification	C:\Windows\SysWOW64\lptqxzagihqjreuxmqnrvszbc.kjs	bhnmv.exe
File created	C:\Windows\SysWOW64\lptqxzagihqjreuxmqnrvszbc.kjs	bhnmv.exe
File opened for modification	C:\Windows\SysWOW64\ypgqkzngvhdjeehx.exe	uvlgepmyefv.exe
File opened for modification	C:\Windows\SysWOW64\mhcqohzwpffposztzuid.exe	uvlgepmyefv.exe
File opened for modification	C:\Windows\SysWOW64\spmccxrqldfrsyhdliyvsi.exe	uvlgepmyefv.exe
File opened for modification	C:\Windows\SysWOW64\bxtihbusmdeppucxeaplh.exe	bhnmv.exe
File opened for modification	C:\Windows\SysWOW64\qfucuhtkxhbfywxllaixmumzlcpztxqopdds.pem	bhnmv.exe
File opened for modification	C:\Windows\SysWOW64\fxpavlaukxubxyctw.exe	uvlgepmyefv.exe
File opened for modification	C:\Windows\SysWOW64\bxtihbusmdeppucxeaplh.exe	uvlgepmyefv.exe
File opened for modification	C:\Windows\SysWOW64\fxpavlaukxubxyctw.exe	bhnmv.exe
File opened for modification	C:\Windows\SysWOW64\bxtihbusmdeppucxeaplh.exe	bhnmv.exe
File created	C:\Windows\SysWOW64\qfucuhtkxhbfywxllaixmumzlcpztxqopdds.pem	bhnmv.exe
File opened for modification	C:\Windows\SysWOW64\ztnaxpgcujirpsyrwqd.exe	uvlgepmyefv.exe
File opened for modification	C:\Windows\SysWOW64\ypgqkzngvhdjeehx.exe	bhnmv.exe
File opened for modification	C:\Windows\SysWOW64\ohamizpkbpnvsuzrvo.exe	bhnmv.exe
File opened for modification	C:\Windows\SysWOW64\ztnaxpgcujirpsyrwqd.exe	bhnmv.exe
File opened for modification	C:\Windows\SysWOW64\spmccxrqldfrsyhdliyvsi.exe	bhnmv.exe
File opened for modification	C:\Windows\SysWOW64\ohamizpkbpnvsuzrvo.exe	bhnmv.exe
File opened for modification	C:\Windows\SysWOW64\spmccxrqldfrsyhdliyvsi.exe	bhnmv.exe
File opened for modification	C:\Windows\SysWOW64\ohamizpkbpnvsuzrvo.exe	uvlgepmyefv.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\lptqxzagihqjreuxmqnrvszbc.kjs	bhnmv.exe
File created	C:\Program Files (x86)\lptqxzagihqjreuxmqnrvszbc.kjs	bhnmv.exe
File opened for modification	C:\Program Files (x86)\qfucuhtkxhbfywxllaixmumzlcpztxqopdds.pem	bhnmv.exe
File created	C:\Program Files (x86)\qfucuhtkxhbfywxllaixmumzlcpztxqopdds.pem	bhnmv.exe

Drops file in Windows directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\mhcqohzwpffposztzuid.exe	uvlgepmyefv.exe
File opened for modification	C:\Windows\spmccxrqldfrsyhdliyvsi.exe	uvlgepmyefv.exe
File opened for modification	C:\Windows\bxtihbusmdeppucxeaplh.exe	bhnmv.exe
File opened for modification	C:\Windows\spmccxrqldfrsyhdliyvsi.exe	bhnmv.exe
File opened for modification	C:\Windows\ypgqkzngvhdjeehx.exe	uvlgepmyefv.exe
File opened for modification	C:\Windows\ohamizpkbpnvsuzrvo.exe	bhnmv.exe
File opened for modification	C:\Windows\mhcqohzwpffposztzuid.exe	bhnmv.exe
File opened for modification	C:\Windows\ypgqkzngvhdjeehx.exe	bhnmv.exe
File opened for modification	C:\Windows\fxpavlaukxubxyctw.exe	bhnmv.exe
File opened for modification	C:\Windows\lptqxzagihqjreuxmqnrvszbc.kjs	bhnmv.exe
File opened for modification	C:\Windows\spmccxrqldfrsyhdliyvsi.exe	bhnmv.exe
File opened for modification	C:\Windows\fxpavlaukxubxyctw.exe	uvlgepmyefv.exe
File opened for modification	C:\Windows\ohamizpkbpnvsuzrvo.exe	uvlgepmyefv.exe
File opened for modification	C:\Windows\ztnaxpgcujirpsyrwqd.exe	uvlgepmyefv.exe
File opened for modification	C:\Windows\ztnaxpgcujirpsyrwqd.exe	bhnmv.exe
File opened for modification	C:\Windows\ohamizpkbpnvsuzrvo.exe	bhnmv.exe
File opened for modification	C:\Windows\mhcqohzwpffposztzuid.exe	bhnmv.exe
File opened for modification	C:\Windows\bxtihbusmdeppucxeaplh.exe	bhnmv.exe
File created	C:\Windows\lptqxzagihqjreuxmqnrvszbc.kjs	bhnmv.exe
File created	C:\Windows\qfucuhtkxhbfywxllaixmumzlcpztxqopdds.pem	bhnmv.exe
File opened for modification	C:\Windows\bxtihbusmdeppucxeaplh.exe	uvlgepmyefv.exe
File opened for modification	C:\Windows\ypgqkzngvhdjeehx.exe	bhnmv.exe
File opened for modification	C:\Windows\fxpavlaukxubxyctw.exe	bhnmv.exe
File opened for modification	C:\Windows\ztnaxpgcujirpsyrwqd.exe	bhnmv.exe
File opened for modification	C:\Windows\qfucuhtkxhbfywxllaixmumzlcpztxqopdds.pem	bhnmv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2032	9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe
2032	9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe
2032	9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe
2032	9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe
2032	9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe
2032	9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe
2032	9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe
2032	9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe
2032	9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe
2032	9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe
2032	9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe
2032	9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe
2032	9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe
2032	9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe
2032	9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe
2032	9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe
2032	9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe
2032	9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe
2032	9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe
2032	9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe
2032	9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe
2032	9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe
2032	9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe
2032	9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe
2032	9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe
2032	9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe
2032	9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe
2032	9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe
2032	9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe
2032	9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe
884	bhnmv.exe
884	bhnmv.exe
2032	9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe
2032	9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe
2032	9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe
2032	9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe
2032	9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe
2032	9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe
2032	9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe
2032	9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe
2032	9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe
2032	9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe
2032	9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe
2032	9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe
2032	9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe
2032	9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe
2032	9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe
2032	9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe
2032	9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe
2032	9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe
2032	9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe
2032	9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe
2032	9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe
2032	9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe
2032	9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe
2032	9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe
2032	9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe
2032	9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe
2032	9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe
884	bhnmv.exe
884	bhnmv.exe
2032	9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe
2032	9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe
2032	9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	884	bhnmv.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1980	2032	9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe	28
PID 2032 wrote to memory of 1980	2032	9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe	28
PID 2032 wrote to memory of 1980	2032	9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe	28
PID 2032 wrote to memory of 1980	2032	9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe	28
PID 1980 wrote to memory of 1204	1980	uvlgepmyefv.exe	29
PID 1980 wrote to memory of 1204	1980	uvlgepmyefv.exe	29
PID 1980 wrote to memory of 1204	1980	uvlgepmyefv.exe	29
PID 1980 wrote to memory of 1204	1980	uvlgepmyefv.exe	29
PID 1980 wrote to memory of 884	1980	uvlgepmyefv.exe	30
PID 1980 wrote to memory of 884	1980	uvlgepmyefv.exe	30
PID 1980 wrote to memory of 884	1980	uvlgepmyefv.exe	30
PID 1980 wrote to memory of 884	1980	uvlgepmyefv.exe	30

System policy modification 1 TTPs 39 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	bhnmv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	uvlgepmyefv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	bhnmv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	bhnmv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	bhnmv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	bhnmv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	uvlgepmyefv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	uvlgepmyefv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	bhnmv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	bhnmv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	bhnmv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	bhnmv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	bhnmv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	bhnmv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	uvlgepmyefv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	uvlgepmyefv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	uvlgepmyefv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	uvlgepmyefv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	uvlgepmyefv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	bhnmv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	bhnmv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	bhnmv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	uvlgepmyefv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	uvlgepmyefv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	bhnmv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	bhnmv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	bhnmv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	bhnmv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	bhnmv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	bhnmv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	uvlgepmyefv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	bhnmv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	bhnmv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	bhnmv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	bhnmv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	bhnmv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	bhnmv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	uvlgepmyefv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	uvlgepmyefv.exe

C:\Users\Admin\AppData\Local\Temp\9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe
"C:\Users\Admin\AppData\Local\Temp\9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Users\Admin\AppData\Local\Temp\uvlgepmyefv.exe
  "C:\Users\Admin\AppData\Local\Temp\uvlgepmyefv.exe" "c:\users\admin\appdata\local\temp\9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3.exe*"
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Adds policy Run key to start application
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1980
- - C:\Users\Admin\AppData\Local\Temp\bhnmv.exe
    "C:\Users\Admin\AppData\Local\Temp\bhnmv.exe" "-C:\Users\Admin\AppData\Local\Temp\ypgqkzngvhdjeehx.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System policy modification
    PID:1204
- - C:\Users\Admin\AppData\Local\Temp\bhnmv.exe
    "C:\Users\Admin\AppData\Local\Temp\bhnmv.exe" "-C:\Users\Admin\AppData\Local\Temp\ypgqkzngvhdjeehx.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - System policy modification
    PID:884

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bhnmv.exe

Filesize
696KB

MD5
db47b4f91922e5342890a5f628fccaf3

SHA1
6e0b690f0c40bc0182f136a7c95aa32c227dc8e5

SHA256
c4b574b9cca289a002df57273edef6a93de1462b62d2c0db6bdb8c134ec4beae

SHA512
168fab60e6b46a45d0bf5fd83886c13491b7700aed6bdcd914c99fda1fc7851e2ee48065469fd84d759c7ac996adb451462fb5ed502d86cb08db8116a9613436

Download Submit
C:\Users\Admin\AppData\Local\Temp\bhnmv.exe

Filesize
696KB

MD5
db47b4f91922e5342890a5f628fccaf3

SHA1
6e0b690f0c40bc0182f136a7c95aa32c227dc8e5

SHA256
c4b574b9cca289a002df57273edef6a93de1462b62d2c0db6bdb8c134ec4beae

SHA512
168fab60e6b46a45d0bf5fd83886c13491b7700aed6bdcd914c99fda1fc7851e2ee48065469fd84d759c7ac996adb451462fb5ed502d86cb08db8116a9613436

Download Submit
C:\Users\Admin\AppData\Local\Temp\bxtihbusmdeppucxeaplh.exe

Filesize
456KB

MD5
3d5c3f2297871eb8462e9db0c1d3d03d

SHA1
28f9c17733deb70a1dabdefef88ab43e99de6b04

SHA256
9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3

SHA512
963a223dbaa73ebdc01dc424e3d92578af189d6f09cf59f91e0913ff1d75f0d3c18ffb6bd2c8e37a9fb7b63f45622bfcf97b5472adab62e09f0da5bdcaa43c87

Download Submit
C:\Users\Admin\AppData\Local\Temp\fxpavlaukxubxyctw.exe

Filesize
456KB

MD5
3d5c3f2297871eb8462e9db0c1d3d03d

SHA1
28f9c17733deb70a1dabdefef88ab43e99de6b04

SHA256
9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3

SHA512
963a223dbaa73ebdc01dc424e3d92578af189d6f09cf59f91e0913ff1d75f0d3c18ffb6bd2c8e37a9fb7b63f45622bfcf97b5472adab62e09f0da5bdcaa43c87

Download Submit
C:\Users\Admin\AppData\Local\Temp\mhcqohzwpffposztzuid.exe

Filesize
456KB

MD5
3d5c3f2297871eb8462e9db0c1d3d03d

SHA1
28f9c17733deb70a1dabdefef88ab43e99de6b04

SHA256
9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3

SHA512
963a223dbaa73ebdc01dc424e3d92578af189d6f09cf59f91e0913ff1d75f0d3c18ffb6bd2c8e37a9fb7b63f45622bfcf97b5472adab62e09f0da5bdcaa43c87

Download Submit
C:\Users\Admin\AppData\Local\Temp\ohamizpkbpnvsuzrvo.exe

Filesize
456KB

MD5
3d5c3f2297871eb8462e9db0c1d3d03d

SHA1
28f9c17733deb70a1dabdefef88ab43e99de6b04

SHA256
9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3

SHA512
963a223dbaa73ebdc01dc424e3d92578af189d6f09cf59f91e0913ff1d75f0d3c18ffb6bd2c8e37a9fb7b63f45622bfcf97b5472adab62e09f0da5bdcaa43c87

Download Submit
C:\Users\Admin\AppData\Local\Temp\spmccxrqldfrsyhdliyvsi.exe

Filesize
456KB

MD5
3d5c3f2297871eb8462e9db0c1d3d03d

SHA1
28f9c17733deb70a1dabdefef88ab43e99de6b04

SHA256
9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3

SHA512
963a223dbaa73ebdc01dc424e3d92578af189d6f09cf59f91e0913ff1d75f0d3c18ffb6bd2c8e37a9fb7b63f45622bfcf97b5472adab62e09f0da5bdcaa43c87

Download Submit
C:\Users\Admin\AppData\Local\Temp\uvlgepmyefv.exe

Filesize
320KB

MD5
597f4f22f059825a0611c6721385ba48

SHA1
b2f9603890431fa837bb7b36a5c4bf1779b8de91

SHA256
2341e0947336555467b952ee9d8164c4064ac64408f69083094492b805c343c7

SHA512
eabb78e188262276cd106992c2bc2861cb0e94918078559981e5af0763e351e2fca31b408811ccc14ad92ceed381c1393b7c95b56d58d7a529270da6c3a680d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\uvlgepmyefv.exe

Filesize
320KB

MD5
597f4f22f059825a0611c6721385ba48

SHA1
b2f9603890431fa837bb7b36a5c4bf1779b8de91

SHA256
2341e0947336555467b952ee9d8164c4064ac64408f69083094492b805c343c7

SHA512
eabb78e188262276cd106992c2bc2861cb0e94918078559981e5af0763e351e2fca31b408811ccc14ad92ceed381c1393b7c95b56d58d7a529270da6c3a680d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\ypgqkzngvhdjeehx.exe

Filesize
456KB

MD5
3d5c3f2297871eb8462e9db0c1d3d03d

SHA1
28f9c17733deb70a1dabdefef88ab43e99de6b04

SHA256
9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3

SHA512
963a223dbaa73ebdc01dc424e3d92578af189d6f09cf59f91e0913ff1d75f0d3c18ffb6bd2c8e37a9fb7b63f45622bfcf97b5472adab62e09f0da5bdcaa43c87

Download Submit
C:\Users\Admin\AppData\Local\Temp\ztnaxpgcujirpsyrwqd.exe

Filesize
456KB

MD5
3d5c3f2297871eb8462e9db0c1d3d03d

SHA1
28f9c17733deb70a1dabdefef88ab43e99de6b04

SHA256
9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3

SHA512
963a223dbaa73ebdc01dc424e3d92578af189d6f09cf59f91e0913ff1d75f0d3c18ffb6bd2c8e37a9fb7b63f45622bfcf97b5472adab62e09f0da5bdcaa43c87

Download Submit
C:\Windows\SysWOW64\bxtihbusmdeppucxeaplh.exe

Filesize
456KB

MD5
3d5c3f2297871eb8462e9db0c1d3d03d

SHA1
28f9c17733deb70a1dabdefef88ab43e99de6b04

SHA256
9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3

SHA512
963a223dbaa73ebdc01dc424e3d92578af189d6f09cf59f91e0913ff1d75f0d3c18ffb6bd2c8e37a9fb7b63f45622bfcf97b5472adab62e09f0da5bdcaa43c87

Download Submit
C:\Windows\SysWOW64\fxpavlaukxubxyctw.exe

Filesize
456KB

MD5
3d5c3f2297871eb8462e9db0c1d3d03d

SHA1
28f9c17733deb70a1dabdefef88ab43e99de6b04

SHA256
9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3

SHA512
963a223dbaa73ebdc01dc424e3d92578af189d6f09cf59f91e0913ff1d75f0d3c18ffb6bd2c8e37a9fb7b63f45622bfcf97b5472adab62e09f0da5bdcaa43c87

Download Submit
C:\Windows\SysWOW64\mhcqohzwpffposztzuid.exe

Filesize
456KB

MD5
3d5c3f2297871eb8462e9db0c1d3d03d

SHA1
28f9c17733deb70a1dabdefef88ab43e99de6b04

SHA256
9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3

SHA512
963a223dbaa73ebdc01dc424e3d92578af189d6f09cf59f91e0913ff1d75f0d3c18ffb6bd2c8e37a9fb7b63f45622bfcf97b5472adab62e09f0da5bdcaa43c87

Download Submit
C:\Windows\SysWOW64\ohamizpkbpnvsuzrvo.exe

Filesize
456KB

MD5
3d5c3f2297871eb8462e9db0c1d3d03d

SHA1
28f9c17733deb70a1dabdefef88ab43e99de6b04

SHA256
9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3

SHA512
963a223dbaa73ebdc01dc424e3d92578af189d6f09cf59f91e0913ff1d75f0d3c18ffb6bd2c8e37a9fb7b63f45622bfcf97b5472adab62e09f0da5bdcaa43c87

Download Submit
C:\Windows\SysWOW64\spmccxrqldfrsyhdliyvsi.exe

Filesize
456KB

MD5
3d5c3f2297871eb8462e9db0c1d3d03d

SHA1
28f9c17733deb70a1dabdefef88ab43e99de6b04

SHA256
9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3

SHA512
963a223dbaa73ebdc01dc424e3d92578af189d6f09cf59f91e0913ff1d75f0d3c18ffb6bd2c8e37a9fb7b63f45622bfcf97b5472adab62e09f0da5bdcaa43c87

Download Submit
C:\Windows\SysWOW64\ypgqkzngvhdjeehx.exe

Filesize
456KB

MD5
3d5c3f2297871eb8462e9db0c1d3d03d

SHA1
28f9c17733deb70a1dabdefef88ab43e99de6b04

SHA256
9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3

SHA512
963a223dbaa73ebdc01dc424e3d92578af189d6f09cf59f91e0913ff1d75f0d3c18ffb6bd2c8e37a9fb7b63f45622bfcf97b5472adab62e09f0da5bdcaa43c87

Download Submit
C:\Windows\SysWOW64\ztnaxpgcujirpsyrwqd.exe

Filesize
456KB

MD5
3d5c3f2297871eb8462e9db0c1d3d03d

SHA1
28f9c17733deb70a1dabdefef88ab43e99de6b04

SHA256
9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3

SHA512
963a223dbaa73ebdc01dc424e3d92578af189d6f09cf59f91e0913ff1d75f0d3c18ffb6bd2c8e37a9fb7b63f45622bfcf97b5472adab62e09f0da5bdcaa43c87

Download Submit
C:\Windows\bxtihbusmdeppucxeaplh.exe

Filesize
456KB

MD5
3d5c3f2297871eb8462e9db0c1d3d03d

SHA1
28f9c17733deb70a1dabdefef88ab43e99de6b04

SHA256
9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3

SHA512
963a223dbaa73ebdc01dc424e3d92578af189d6f09cf59f91e0913ff1d75f0d3c18ffb6bd2c8e37a9fb7b63f45622bfcf97b5472adab62e09f0da5bdcaa43c87

Download Submit
C:\Windows\bxtihbusmdeppucxeaplh.exe

Filesize
456KB

MD5
3d5c3f2297871eb8462e9db0c1d3d03d

SHA1
28f9c17733deb70a1dabdefef88ab43e99de6b04

SHA256
9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3

SHA512
963a223dbaa73ebdc01dc424e3d92578af189d6f09cf59f91e0913ff1d75f0d3c18ffb6bd2c8e37a9fb7b63f45622bfcf97b5472adab62e09f0da5bdcaa43c87

Download Submit
C:\Windows\fxpavlaukxubxyctw.exe

Filesize
456KB

MD5
3d5c3f2297871eb8462e9db0c1d3d03d

SHA1
28f9c17733deb70a1dabdefef88ab43e99de6b04

SHA256
9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3

SHA512
963a223dbaa73ebdc01dc424e3d92578af189d6f09cf59f91e0913ff1d75f0d3c18ffb6bd2c8e37a9fb7b63f45622bfcf97b5472adab62e09f0da5bdcaa43c87

Download Submit
C:\Windows\fxpavlaukxubxyctw.exe

Filesize
456KB

MD5
3d5c3f2297871eb8462e9db0c1d3d03d

SHA1
28f9c17733deb70a1dabdefef88ab43e99de6b04

SHA256
9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3

SHA512
963a223dbaa73ebdc01dc424e3d92578af189d6f09cf59f91e0913ff1d75f0d3c18ffb6bd2c8e37a9fb7b63f45622bfcf97b5472adab62e09f0da5bdcaa43c87

Download Submit
C:\Windows\mhcqohzwpffposztzuid.exe

Filesize
456KB

MD5
3d5c3f2297871eb8462e9db0c1d3d03d

SHA1
28f9c17733deb70a1dabdefef88ab43e99de6b04

SHA256
9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3

SHA512
963a223dbaa73ebdc01dc424e3d92578af189d6f09cf59f91e0913ff1d75f0d3c18ffb6bd2c8e37a9fb7b63f45622bfcf97b5472adab62e09f0da5bdcaa43c87

Download Submit
C:\Windows\mhcqohzwpffposztzuid.exe

Filesize
456KB

MD5
3d5c3f2297871eb8462e9db0c1d3d03d

SHA1
28f9c17733deb70a1dabdefef88ab43e99de6b04

SHA256
9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3

SHA512
963a223dbaa73ebdc01dc424e3d92578af189d6f09cf59f91e0913ff1d75f0d3c18ffb6bd2c8e37a9fb7b63f45622bfcf97b5472adab62e09f0da5bdcaa43c87

Download Submit
C:\Windows\ohamizpkbpnvsuzrvo.exe

Filesize
456KB

MD5
3d5c3f2297871eb8462e9db0c1d3d03d

SHA1
28f9c17733deb70a1dabdefef88ab43e99de6b04

SHA256
9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3

SHA512
963a223dbaa73ebdc01dc424e3d92578af189d6f09cf59f91e0913ff1d75f0d3c18ffb6bd2c8e37a9fb7b63f45622bfcf97b5472adab62e09f0da5bdcaa43c87

Download Submit
C:\Windows\ohamizpkbpnvsuzrvo.exe

Filesize
456KB

MD5
3d5c3f2297871eb8462e9db0c1d3d03d

SHA1
28f9c17733deb70a1dabdefef88ab43e99de6b04

SHA256
9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3

SHA512
963a223dbaa73ebdc01dc424e3d92578af189d6f09cf59f91e0913ff1d75f0d3c18ffb6bd2c8e37a9fb7b63f45622bfcf97b5472adab62e09f0da5bdcaa43c87

Download Submit
C:\Windows\spmccxrqldfrsyhdliyvsi.exe

Filesize
456KB

MD5
3d5c3f2297871eb8462e9db0c1d3d03d

SHA1
28f9c17733deb70a1dabdefef88ab43e99de6b04

SHA256
9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3

SHA512
963a223dbaa73ebdc01dc424e3d92578af189d6f09cf59f91e0913ff1d75f0d3c18ffb6bd2c8e37a9fb7b63f45622bfcf97b5472adab62e09f0da5bdcaa43c87

Download Submit
C:\Windows\spmccxrqldfrsyhdliyvsi.exe

Filesize
456KB

MD5
3d5c3f2297871eb8462e9db0c1d3d03d

SHA1
28f9c17733deb70a1dabdefef88ab43e99de6b04

SHA256
9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3

SHA512
963a223dbaa73ebdc01dc424e3d92578af189d6f09cf59f91e0913ff1d75f0d3c18ffb6bd2c8e37a9fb7b63f45622bfcf97b5472adab62e09f0da5bdcaa43c87

Download Submit
C:\Windows\ypgqkzngvhdjeehx.exe

Filesize
456KB

MD5
3d5c3f2297871eb8462e9db0c1d3d03d

SHA1
28f9c17733deb70a1dabdefef88ab43e99de6b04

SHA256
9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3

SHA512
963a223dbaa73ebdc01dc424e3d92578af189d6f09cf59f91e0913ff1d75f0d3c18ffb6bd2c8e37a9fb7b63f45622bfcf97b5472adab62e09f0da5bdcaa43c87

Download Submit
C:\Windows\ypgqkzngvhdjeehx.exe

Filesize
456KB

MD5
3d5c3f2297871eb8462e9db0c1d3d03d

SHA1
28f9c17733deb70a1dabdefef88ab43e99de6b04

SHA256
9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3

SHA512
963a223dbaa73ebdc01dc424e3d92578af189d6f09cf59f91e0913ff1d75f0d3c18ffb6bd2c8e37a9fb7b63f45622bfcf97b5472adab62e09f0da5bdcaa43c87

Download Submit
C:\Windows\ztnaxpgcujirpsyrwqd.exe

Filesize
456KB

MD5
3d5c3f2297871eb8462e9db0c1d3d03d

SHA1
28f9c17733deb70a1dabdefef88ab43e99de6b04

SHA256
9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3

SHA512
963a223dbaa73ebdc01dc424e3d92578af189d6f09cf59f91e0913ff1d75f0d3c18ffb6bd2c8e37a9fb7b63f45622bfcf97b5472adab62e09f0da5bdcaa43c87

Download Submit
C:\Windows\ztnaxpgcujirpsyrwqd.exe

Filesize
456KB

MD5
3d5c3f2297871eb8462e9db0c1d3d03d

SHA1
28f9c17733deb70a1dabdefef88ab43e99de6b04

SHA256
9630e0b51a07e18c42537c8402d15319cc6ab8e7825037447b4c7a9e6ae5aaa3

SHA512
963a223dbaa73ebdc01dc424e3d92578af189d6f09cf59f91e0913ff1d75f0d3c18ffb6bd2c8e37a9fb7b63f45622bfcf97b5472adab62e09f0da5bdcaa43c87

Download Submit
\Users\Admin\AppData\Local\Temp\bhnmv.exe

Filesize
696KB

MD5
db47b4f91922e5342890a5f628fccaf3

SHA1
6e0b690f0c40bc0182f136a7c95aa32c227dc8e5

SHA256
c4b574b9cca289a002df57273edef6a93de1462b62d2c0db6bdb8c134ec4beae

SHA512
168fab60e6b46a45d0bf5fd83886c13491b7700aed6bdcd914c99fda1fc7851e2ee48065469fd84d759c7ac996adb451462fb5ed502d86cb08db8116a9613436

Download Submit
\Users\Admin\AppData\Local\Temp\bhnmv.exe

Filesize
696KB

MD5
db47b4f91922e5342890a5f628fccaf3

SHA1
6e0b690f0c40bc0182f136a7c95aa32c227dc8e5

SHA256
c4b574b9cca289a002df57273edef6a93de1462b62d2c0db6bdb8c134ec4beae

SHA512
168fab60e6b46a45d0bf5fd83886c13491b7700aed6bdcd914c99fda1fc7851e2ee48065469fd84d759c7ac996adb451462fb5ed502d86cb08db8116a9613436

Download Submit
\Users\Admin\AppData\Local\Temp\bhnmv.exe

Filesize
696KB

MD5
db47b4f91922e5342890a5f628fccaf3

SHA1
6e0b690f0c40bc0182f136a7c95aa32c227dc8e5

SHA256
c4b574b9cca289a002df57273edef6a93de1462b62d2c0db6bdb8c134ec4beae

SHA512
168fab60e6b46a45d0bf5fd83886c13491b7700aed6bdcd914c99fda1fc7851e2ee48065469fd84d759c7ac996adb451462fb5ed502d86cb08db8116a9613436

Download Submit
\Users\Admin\AppData\Local\Temp\bhnmv.exe

Filesize
696KB

MD5
db47b4f91922e5342890a5f628fccaf3

SHA1
6e0b690f0c40bc0182f136a7c95aa32c227dc8e5

SHA256
c4b574b9cca289a002df57273edef6a93de1462b62d2c0db6bdb8c134ec4beae

SHA512
168fab60e6b46a45d0bf5fd83886c13491b7700aed6bdcd914c99fda1fc7851e2ee48065469fd84d759c7ac996adb451462fb5ed502d86cb08db8116a9613436

Download Submit
\Users\Admin\AppData\Local\Temp\uvlgepmyefv.exe

Filesize
320KB

MD5
597f4f22f059825a0611c6721385ba48

SHA1
b2f9603890431fa837bb7b36a5c4bf1779b8de91

SHA256
2341e0947336555467b952ee9d8164c4064ac64408f69083094492b805c343c7

SHA512
eabb78e188262276cd106992c2bc2861cb0e94918078559981e5af0763e351e2fca31b408811ccc14ad92ceed381c1393b7c95b56d58d7a529270da6c3a680d1

Download Submit
\Users\Admin\AppData\Local\Temp\uvlgepmyefv.exe

Filesize
320KB

MD5
597f4f22f059825a0611c6721385ba48

SHA1
b2f9603890431fa837bb7b36a5c4bf1779b8de91

SHA256
2341e0947336555467b952ee9d8164c4064ac64408f69083094492b805c343c7

SHA512
eabb78e188262276cd106992c2bc2861cb0e94918078559981e5af0763e351e2fca31b408811ccc14ad92ceed381c1393b7c95b56d58d7a529270da6c3a680d1

Download Submit
memory/2032-54-0x00000000767B1000-0x00000000767B3000-memory.dmp

Filesize
8KB

Download