2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48

Analysis

max time kernel
201s
max time network
210s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
03/12/2022, 22:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
Size

524KB
MD5

01349cb43ae1ba04685908f988111c78
SHA1

8ca7b68eefc6fda2353a24a2db0cc39d5fd17abd
SHA256

2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48
SHA512

12baad6cfde36a0f74d51bad5711148472083b19d18436c404c387fe5ec094ebfd70c7f56da652bcb4625de4ac302db6b1835332f20a6284056f902dbbdaa795
SSDEEP

6144:lIXsL0tvrSVz1DnemeYbpsnEf78AoXh6KkiD0OofzA+/VygHUSCnDU:lIXsgtvm1De5YlOx6lzBH46Ut4

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	cchfzisvmmr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	ygfmr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	ygfmr.exe

UAC bypass 3 TTPs 12 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	cchfzisvmmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ygfmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	ygfmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	ygfmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	ygfmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	ygfmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	ygfmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	ygfmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cchfzisvmmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	cchfzisvmmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	cchfzisvmmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ygfmr.exe

Adds policy Run key to start application 2 TTPs 18 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	ygfmr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mcjyldoesyyah = "voyqgbpizilqadcq.exe"	ygfmr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vimyixfsdg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jguqkjbytgnwkrumfrfc.exe"	ygfmr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mcjyldoesyyah = "voyqgbpizilqadcq.exe"	ygfmr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vimyixfsdg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wsfatrieykqylrtkcna.exe"	ygfmr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mcjyldoesyyah = "ywliddwuqemwltxqkxmkz.exe"	cchfzisvmmr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	ygfmr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	cchfzisvmmr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mcjyldoesyyah = "jguqkjbytgnwkrumfrfc.exe"	ygfmr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mcjyldoesyyah = "jguqkjbytgnwkrumfrfc.exe"	ygfmr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vimyixfsdg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lgsmebrmfqvcotukbl.exe"	ygfmr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vimyixfsdg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jguqkjbytgnwkrumfrfc.exe"	ygfmr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vimyixfsdg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\voyqgbpizilqadcq.exe"	ygfmr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vimyixfsdg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wsfatrieykqylrtkcna.exe"	cchfzisvmmr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vimyixfsdg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ywliddwuqemwltxqkxmkz.exe"	ygfmr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mcjyldoesyyah = "cwharncwoycitxxmc.exe"	ygfmr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vimyixfsdg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ywliddwuqemwltxqkxmkz.exe"	ygfmr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mcjyldoesyyah = "cwharncwoycitxxmc.exe"	ygfmr.exe

Disables RegEdit via registry modification 6 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	cchfzisvmmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	cchfzisvmmr.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	ygfmr.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	ygfmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	ygfmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	ygfmr.exe

Executes dropped EXE 3 IoCs

pid	Process
892	cchfzisvmmr.exe
468	ygfmr.exe
1920	ygfmr.exe

Loads dropped DLL 6 IoCs

pid	Process
972	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
972	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
892	cchfzisvmmr.exe
892	cchfzisvmmr.exe
892	cchfzisvmmr.exe
892	cchfzisvmmr.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	cchfzisvmmr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nciwizjylqpq = "lgsmebrmfqvcotukbl.exe ."	ygfmr.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	ygfmr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	cchfzisvmmr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\qejwhxgugki = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cwharncwoycitxxmc.exe"	ygfmr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\nciwizjylqpq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lgsmebrmfqvcotukbl.exe ."	ygfmr.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	cchfzisvmmr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cwharncwoycitxxmc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lgsmebrmfqvcotukbl.exe"	cchfzisvmmr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\qejwhxgugki = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wsfatrieykqylrtkcna.exe"	cchfzisvmmr.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	ygfmr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\voyqgbpizilqadcq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wsfatrieykqylrtkcna.exe ."	ygfmr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\qejwhxgugki = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cwharncwoycitxxmc.exe"	ygfmr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\voyqgbpizilqadcq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ywliddwuqemwltxqkxmkz.exe ."	ygfmr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nciwizjylqpq = "ywliddwuqemwltxqkxmkz.exe ."	ygfmr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nciwizjylqpq = "voyqgbpizilqadcq.exe ."	cchfzisvmmr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\qejwhxgugki = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jguqkjbytgnwkrumfrfc.exe"	ygfmr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qejwhxgugki = "voyqgbpizilqadcq.exe"	cchfzisvmmr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nciwizjylqpq = "cwharncwoycitxxmc.exe ."	cchfzisvmmr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cwharncwoycitxxmc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jguqkjbytgnwkrumfrfc.exe"	ygfmr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\qirixrewmuwajlj = "voyqgbpizilqadcq.exe ."	cchfzisvmmr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	ygfmr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\nemcqjvmbijmuv = "wsfatrieykqylrtkcna.exe"	ygfmr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\nciwizjylqpq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jguqkjbytgnwkrumfrfc.exe ."	cchfzisvmmr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qejwhxgugki = "jguqkjbytgnwkrumfrfc.exe"	cchfzisvmmr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qejwhxgugki = "voyqgbpizilqadcq.exe"	ygfmr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qejwhxgugki = "wsfatrieykqylrtkcna.exe"	ygfmr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\qirixrewmuwajlj = "jguqkjbytgnwkrumfrfc.exe ."	ygfmr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\nciwizjylqpq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cwharncwoycitxxmc.exe ."	ygfmr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\voyqgbpizilqadcq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lgsmebrmfqvcotukbl.exe ."	ygfmr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\voyqgbpizilqadcq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\voyqgbpizilqadcq.exe ."	cchfzisvmmr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\qirixrewmuwajlj = "lgsmebrmfqvcotukbl.exe ."	ygfmr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\qejwhxgugki = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wsfatrieykqylrtkcna.exe"	ygfmr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cwharncwoycitxxmc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\voyqgbpizilqadcq.exe"	ygfmr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cwharncwoycitxxmc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cwharncwoycitxxmc.exe"	ygfmr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\nciwizjylqpq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cwharncwoycitxxmc.exe ."	ygfmr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\qirixrewmuwajlj = "wsfatrieykqylrtkcna.exe ."	ygfmr.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	cchfzisvmmr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	ygfmr.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	ygfmr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\nemcqjvmbijmuv = "jguqkjbytgnwkrumfrfc.exe"	ygfmr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cwharncwoycitxxmc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lgsmebrmfqvcotukbl.exe"	ygfmr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\nciwizjylqpq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\voyqgbpizilqadcq.exe ."	ygfmr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\nemcqjvmbijmuv = "lgsmebrmfqvcotukbl.exe"	ygfmr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qejwhxgugki = "lgsmebrmfqvcotukbl.exe"	ygfmr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\nemcqjvmbijmuv = "voyqgbpizilqadcq.exe"	ygfmr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cwharncwoycitxxmc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\voyqgbpizilqadcq.exe"	ygfmr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\voyqgbpizilqadcq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lgsmebrmfqvcotukbl.exe ."	ygfmr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nciwizjylqpq = "wsfatrieykqylrtkcna.exe ."	ygfmr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\qirixrewmuwajlj = "lgsmebrmfqvcotukbl.exe ."	ygfmr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	ygfmr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\qejwhxgugki = "C:\\Users\\Admin\\AppData\\Local\\Temp\\voyqgbpizilqadcq.exe"	ygfmr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\qejwhxgugki = "C:\\Users\\Admin\\AppData\\Local\\Temp\\voyqgbpizilqadcq.exe"	ygfmr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cwharncwoycitxxmc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cwharncwoycitxxmc.exe"	ygfmr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\nciwizjylqpq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lgsmebrmfqvcotukbl.exe ."	ygfmr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\qirixrewmuwajlj = "jguqkjbytgnwkrumfrfc.exe ."	ygfmr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nciwizjylqpq = "lgsmebrmfqvcotukbl.exe ."	ygfmr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\nemcqjvmbijmuv = "wsfatrieykqylrtkcna.exe"	cchfzisvmmr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	ygfmr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qejwhxgugki = "cwharncwoycitxxmc.exe"	ygfmr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nciwizjylqpq = "wsfatrieykqylrtkcna.exe ."	ygfmr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\nemcqjvmbijmuv = "ywliddwuqemwltxqkxmkz.exe"	ygfmr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\qirixrewmuwajlj = "voyqgbpizilqadcq.exe ."	ygfmr.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	ygfmr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\voyqgbpizilqadcq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wsfatrieykqylrtkcna.exe ."	ygfmr.exe

Checks whether UAC is enabled 1 TTPs 6 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ygfmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ygfmr.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ygfmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cchfzisvmmr.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	cchfzisvmmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ygfmr.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	whatismyip.everdot.org
3	www.showmyipaddress.com
7	whatismyipaddress.com

Drops file in System32 directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\cwharncwoycitxxmc.exe	cchfzisvmmr.exe
File opened for modification	C:\Windows\SysWOW64\cwharncwoycitxxmc.exe	ygfmr.exe
File opened for modification	C:\Windows\SysWOW64\ywliddwuqemwltxqkxmkz.exe	ygfmr.exe
File opened for modification	C:\Windows\SysWOW64\jguqkjbytgnwkrumfrfc.exe	ygfmr.exe
File opened for modification	C:\Windows\SysWOW64\voyqgbpizilqadcq.exe	ygfmr.exe
File opened for modification	C:\Windows\SysWOW64\wsfatrieykqylrtkcna.exe	ygfmr.exe
File created	C:\Windows\SysWOW64\qejwhxgugkiinlfoybguzmxnwkwayydbv.orw	ygfmr.exe
File opened for modification	C:\Windows\SysWOW64\lgsmebrmfqvcotukbl.exe	cchfzisvmmr.exe
File opened for modification	C:\Windows\SysWOW64\poecyztspenyoxcwrfvuki.exe	ygfmr.exe
File opened for modification	C:\Windows\SysWOW64\cwharncwoycitxxmc.exe	ygfmr.exe
File opened for modification	C:\Windows\SysWOW64\jguqkjbytgnwkrumfrfc.exe	ygfmr.exe
File opened for modification	C:\Windows\SysWOW64\ywliddwuqemwltxqkxmkz.exe	ygfmr.exe
File opened for modification	C:\Windows\SysWOW64\zcwyydbefylauhqonfzcwy.dbe	ygfmr.exe
File opened for modification	C:\Windows\SysWOW64\lgsmebrmfqvcotukbl.exe	ygfmr.exe
File opened for modification	C:\Windows\SysWOW64\wsfatrieykqylrtkcna.exe	ygfmr.exe
File opened for modification	C:\Windows\SysWOW64\voyqgbpizilqadcq.exe	cchfzisvmmr.exe
File opened for modification	C:\Windows\SysWOW64\wsfatrieykqylrtkcna.exe	cchfzisvmmr.exe
File opened for modification	C:\Windows\SysWOW64\jguqkjbytgnwkrumfrfc.exe	cchfzisvmmr.exe
File opened for modification	C:\Windows\SysWOW64\ywliddwuqemwltxqkxmkz.exe	cchfzisvmmr.exe
File opened for modification	C:\Windows\SysWOW64\poecyztspenyoxcwrfvuki.exe	cchfzisvmmr.exe
File opened for modification	C:\Windows\SysWOW64\voyqgbpizilqadcq.exe	ygfmr.exe
File opened for modification	C:\Windows\SysWOW64\lgsmebrmfqvcotukbl.exe	ygfmr.exe
File opened for modification	C:\Windows\SysWOW64\poecyztspenyoxcwrfvuki.exe	ygfmr.exe
File created	C:\Windows\SysWOW64\zcwyydbefylauhqonfzcwy.dbe	ygfmr.exe
File opened for modification	C:\Windows\SysWOW64\qejwhxgugkiinlfoybguzmxnwkwayydbv.orw	ygfmr.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\zcwyydbefylauhqonfzcwy.dbe	ygfmr.exe
File opened for modification	C:\Program Files (x86)\qejwhxgugkiinlfoybguzmxnwkwayydbv.orw	ygfmr.exe
File created	C:\Program Files (x86)\qejwhxgugkiinlfoybguzmxnwkwayydbv.orw	ygfmr.exe
File opened for modification	C:\Program Files (x86)\zcwyydbefylauhqonfzcwy.dbe	ygfmr.exe

Drops file in Windows directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\wsfatrieykqylrtkcna.exe	ygfmr.exe
File opened for modification	C:\Windows\lgsmebrmfqvcotukbl.exe	cchfzisvmmr.exe
File opened for modification	C:\Windows\wsfatrieykqylrtkcna.exe	cchfzisvmmr.exe
File opened for modification	C:\Windows\jguqkjbytgnwkrumfrfc.exe	cchfzisvmmr.exe
File opened for modification	C:\Windows\voyqgbpizilqadcq.exe	ygfmr.exe
File opened for modification	C:\Windows\poecyztspenyoxcwrfvuki.exe	ygfmr.exe
File opened for modification	C:\Windows\qejwhxgugkiinlfoybguzmxnwkwayydbv.orw	ygfmr.exe
File created	C:\Windows\qejwhxgugkiinlfoybguzmxnwkwayydbv.orw	ygfmr.exe
File opened for modification	C:\Windows\poecyztspenyoxcwrfvuki.exe	cchfzisvmmr.exe
File opened for modification	C:\Windows\lgsmebrmfqvcotukbl.exe	ygfmr.exe
File opened for modification	C:\Windows\ywliddwuqemwltxqkxmkz.exe	ygfmr.exe
File opened for modification	C:\Windows\cwharncwoycitxxmc.exe	ygfmr.exe
File opened for modification	C:\Windows\lgsmebrmfqvcotukbl.exe	ygfmr.exe
File opened for modification	C:\Windows\ywliddwuqemwltxqkxmkz.exe	ygfmr.exe
File opened for modification	C:\Windows\poecyztspenyoxcwrfvuki.exe	ygfmr.exe
File created	C:\Windows\zcwyydbefylauhqonfzcwy.dbe	ygfmr.exe
File opened for modification	C:\Windows\voyqgbpizilqadcq.exe	cchfzisvmmr.exe
File opened for modification	C:\Windows\cwharncwoycitxxmc.exe	cchfzisvmmr.exe
File opened for modification	C:\Windows\cwharncwoycitxxmc.exe	ygfmr.exe
File opened for modification	C:\Windows\wsfatrieykqylrtkcna.exe	ygfmr.exe
File opened for modification	C:\Windows\jguqkjbytgnwkrumfrfc.exe	ygfmr.exe
File opened for modification	C:\Windows\ywliddwuqemwltxqkxmkz.exe	cchfzisvmmr.exe
File opened for modification	C:\Windows\voyqgbpizilqadcq.exe	ygfmr.exe
File opened for modification	C:\Windows\jguqkjbytgnwkrumfrfc.exe	ygfmr.exe
File opened for modification	C:\Windows\zcwyydbefylauhqonfzcwy.dbe	ygfmr.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
972	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
972	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
972	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
972	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
972	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
972	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
972	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
972	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
972	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
972	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
972	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
972	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
972	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
972	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
972	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
972	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
972	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
972	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
972	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
972	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
972	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
972	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
972	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
972	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
972	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
972	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
972	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
972	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
972	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
972	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
972	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
1920	ygfmr.exe
972	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
972	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
972	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
972	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
972	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
972	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
972	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
972	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
972	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
972	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
972	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
972	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
972	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
972	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
972	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
972	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
972	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
972	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
972	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
972	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
972	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
972	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
972	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
972	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
972	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
972	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
972	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
972	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
1920	ygfmr.exe
1920	ygfmr.exe
972	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
972	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1920	ygfmr.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 972 wrote to memory of 892	972	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe	28
PID 972 wrote to memory of 892	972	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe	28
PID 972 wrote to memory of 892	972	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe	28
PID 972 wrote to memory of 892	972	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe	28
PID 892 wrote to memory of 468	892	cchfzisvmmr.exe	29
PID 892 wrote to memory of 468	892	cchfzisvmmr.exe	29
PID 892 wrote to memory of 468	892	cchfzisvmmr.exe	29
PID 892 wrote to memory of 468	892	cchfzisvmmr.exe	29
PID 892 wrote to memory of 1920	892	cchfzisvmmr.exe	30
PID 892 wrote to memory of 1920	892	cchfzisvmmr.exe	30
PID 892 wrote to memory of 1920	892	cchfzisvmmr.exe	30
PID 892 wrote to memory of 1920	892	cchfzisvmmr.exe	30

System policy modification 1 TTPs 39 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	cchfzisvmmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	ygfmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	ygfmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	cchfzisvmmr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	ygfmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	ygfmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	ygfmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	ygfmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	ygfmr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	ygfmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	cchfzisvmmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	cchfzisvmmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	cchfzisvmmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	ygfmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	ygfmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	cchfzisvmmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	cchfzisvmmr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	cchfzisvmmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	ygfmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	ygfmr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	cchfzisvmmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cchfzisvmmr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	ygfmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	ygfmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	ygfmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	cchfzisvmmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	cchfzisvmmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	ygfmr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	ygfmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ygfmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	ygfmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	ygfmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	ygfmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	ygfmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	cchfzisvmmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ygfmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	ygfmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	ygfmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	ygfmr.exe

C:\Users\Admin\AppData\Local\Temp\2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
"C:\Users\Admin\AppData\Local\Temp\2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:972
- C:\Users\Admin\AppData\Local\Temp\cchfzisvmmr.exe
  "C:\Users\Admin\AppData\Local\Temp\cchfzisvmmr.exe" "c:\users\admin\appdata\local\temp\2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe*"
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Adds policy Run key to start application
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:892
- - C:\Users\Admin\AppData\Local\Temp\ygfmr.exe
    "C:\Users\Admin\AppData\Local\Temp\ygfmr.exe" "-C:\Users\Admin\AppData\Local\Temp\voyqgbpizilqadcq.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System policy modification
    PID:468
- - C:\Users\Admin\AppData\Local\Temp\ygfmr.exe
    "C:\Users\Admin\AppData\Local\Temp\ygfmr.exe" "-C:\Users\Admin\AppData\Local\Temp\voyqgbpizilqadcq.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - System policy modification
    PID:1920

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cchfzisvmmr.exe

Filesize
320KB

MD5
00d3b7afd752a7e66bfb8a868f3e9397

SHA1
4d9815bbfc9b50abda82c2a60de640d6fef4a2cc

SHA256
3cf0444b506a0ff4176e699b62a31e8e605de7065329d20cb45d65e2fccb8c07

SHA512
3dab71216c6449353c90e57825f93cb964ff8f3acd2a74184d3b01dd3f1f717d563ead1133f3c2541ea4127cb66cffdbc7919ec0b9c7d88a50816ffe9f5135ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\cchfzisvmmr.exe

Filesize
320KB

MD5
00d3b7afd752a7e66bfb8a868f3e9397

SHA1
4d9815bbfc9b50abda82c2a60de640d6fef4a2cc

SHA256
3cf0444b506a0ff4176e699b62a31e8e605de7065329d20cb45d65e2fccb8c07

SHA512
3dab71216c6449353c90e57825f93cb964ff8f3acd2a74184d3b01dd3f1f717d563ead1133f3c2541ea4127cb66cffdbc7919ec0b9c7d88a50816ffe9f5135ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\cwharncwoycitxxmc.exe

Filesize
524KB

MD5
01349cb43ae1ba04685908f988111c78

SHA1
8ca7b68eefc6fda2353a24a2db0cc39d5fd17abd

SHA256
2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48

SHA512
12baad6cfde36a0f74d51bad5711148472083b19d18436c404c387fe5ec094ebfd70c7f56da652bcb4625de4ac302db6b1835332f20a6284056f902dbbdaa795

Download Submit
C:\Users\Admin\AppData\Local\Temp\jguqkjbytgnwkrumfrfc.exe

Filesize
524KB

MD5
01349cb43ae1ba04685908f988111c78

SHA1
8ca7b68eefc6fda2353a24a2db0cc39d5fd17abd

SHA256
2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48

SHA512
12baad6cfde36a0f74d51bad5711148472083b19d18436c404c387fe5ec094ebfd70c7f56da652bcb4625de4ac302db6b1835332f20a6284056f902dbbdaa795

Download Submit
C:\Users\Admin\AppData\Local\Temp\lgsmebrmfqvcotukbl.exe

Filesize
524KB

MD5
01349cb43ae1ba04685908f988111c78

SHA1
8ca7b68eefc6fda2353a24a2db0cc39d5fd17abd

SHA256
2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48

SHA512
12baad6cfde36a0f74d51bad5711148472083b19d18436c404c387fe5ec094ebfd70c7f56da652bcb4625de4ac302db6b1835332f20a6284056f902dbbdaa795

Download Submit
C:\Users\Admin\AppData\Local\Temp\poecyztspenyoxcwrfvuki.exe

Filesize
524KB

MD5
01349cb43ae1ba04685908f988111c78

SHA1
8ca7b68eefc6fda2353a24a2db0cc39d5fd17abd

SHA256
2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48

SHA512
12baad6cfde36a0f74d51bad5711148472083b19d18436c404c387fe5ec094ebfd70c7f56da652bcb4625de4ac302db6b1835332f20a6284056f902dbbdaa795

Download Submit
C:\Users\Admin\AppData\Local\Temp\voyqgbpizilqadcq.exe

Filesize
524KB

MD5
01349cb43ae1ba04685908f988111c78

SHA1
8ca7b68eefc6fda2353a24a2db0cc39d5fd17abd

SHA256
2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48

SHA512
12baad6cfde36a0f74d51bad5711148472083b19d18436c404c387fe5ec094ebfd70c7f56da652bcb4625de4ac302db6b1835332f20a6284056f902dbbdaa795

Download Submit
C:\Users\Admin\AppData\Local\Temp\wsfatrieykqylrtkcna.exe

Filesize
524KB

MD5
01349cb43ae1ba04685908f988111c78

SHA1
8ca7b68eefc6fda2353a24a2db0cc39d5fd17abd

SHA256
2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48

SHA512
12baad6cfde36a0f74d51bad5711148472083b19d18436c404c387fe5ec094ebfd70c7f56da652bcb4625de4ac302db6b1835332f20a6284056f902dbbdaa795

Download Submit
C:\Users\Admin\AppData\Local\Temp\ygfmr.exe

Filesize
708KB

MD5
b322caacf3e9f6e6bfb6a68f08fe2712

SHA1
4689b932765e275054ef42b2143af6b2e47f2c9c

SHA256
57f9f554ac603c944cfe2ff464118d2c6aa3f822f9b205cb3c8d44f67ec0e38d

SHA512
239019371fa3df41db7e109f370932d49695d65c4b76ca4184ea26caab787060e5b5fe52a74cbb4c6d0507407f36a0a50a3880cc3a9ed085e88e74850e85382c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ygfmr.exe

Filesize
708KB

MD5
b322caacf3e9f6e6bfb6a68f08fe2712

SHA1
4689b932765e275054ef42b2143af6b2e47f2c9c

SHA256
57f9f554ac603c944cfe2ff464118d2c6aa3f822f9b205cb3c8d44f67ec0e38d

SHA512
239019371fa3df41db7e109f370932d49695d65c4b76ca4184ea26caab787060e5b5fe52a74cbb4c6d0507407f36a0a50a3880cc3a9ed085e88e74850e85382c

Download Submit
C:\Users\Admin\AppData\Local\Temp\ywliddwuqemwltxqkxmkz.exe

Filesize
524KB

MD5
01349cb43ae1ba04685908f988111c78

SHA1
8ca7b68eefc6fda2353a24a2db0cc39d5fd17abd

SHA256
2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48

SHA512
12baad6cfde36a0f74d51bad5711148472083b19d18436c404c387fe5ec094ebfd70c7f56da652bcb4625de4ac302db6b1835332f20a6284056f902dbbdaa795

Download Submit
C:\Windows\SysWOW64\cwharncwoycitxxmc.exe

Filesize
524KB

MD5
01349cb43ae1ba04685908f988111c78

SHA1
8ca7b68eefc6fda2353a24a2db0cc39d5fd17abd

SHA256
2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48

SHA512
12baad6cfde36a0f74d51bad5711148472083b19d18436c404c387fe5ec094ebfd70c7f56da652bcb4625de4ac302db6b1835332f20a6284056f902dbbdaa795

Download Submit
C:\Windows\SysWOW64\jguqkjbytgnwkrumfrfc.exe

Filesize
524KB

MD5
01349cb43ae1ba04685908f988111c78

SHA1
8ca7b68eefc6fda2353a24a2db0cc39d5fd17abd

SHA256
2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48

SHA512
12baad6cfde36a0f74d51bad5711148472083b19d18436c404c387fe5ec094ebfd70c7f56da652bcb4625de4ac302db6b1835332f20a6284056f902dbbdaa795

Download Submit
C:\Windows\SysWOW64\lgsmebrmfqvcotukbl.exe

Filesize
524KB

MD5
01349cb43ae1ba04685908f988111c78

SHA1
8ca7b68eefc6fda2353a24a2db0cc39d5fd17abd

SHA256
2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48

SHA512
12baad6cfde36a0f74d51bad5711148472083b19d18436c404c387fe5ec094ebfd70c7f56da652bcb4625de4ac302db6b1835332f20a6284056f902dbbdaa795

Download Submit
C:\Windows\SysWOW64\poecyztspenyoxcwrfvuki.exe

Filesize
524KB

MD5
01349cb43ae1ba04685908f988111c78

SHA1
8ca7b68eefc6fda2353a24a2db0cc39d5fd17abd

SHA256
2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48

SHA512
12baad6cfde36a0f74d51bad5711148472083b19d18436c404c387fe5ec094ebfd70c7f56da652bcb4625de4ac302db6b1835332f20a6284056f902dbbdaa795

Download Submit
C:\Windows\SysWOW64\voyqgbpizilqadcq.exe

Filesize
524KB

MD5
01349cb43ae1ba04685908f988111c78

SHA1
8ca7b68eefc6fda2353a24a2db0cc39d5fd17abd

SHA256
2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48

SHA512
12baad6cfde36a0f74d51bad5711148472083b19d18436c404c387fe5ec094ebfd70c7f56da652bcb4625de4ac302db6b1835332f20a6284056f902dbbdaa795

Download Submit
C:\Windows\SysWOW64\wsfatrieykqylrtkcna.exe

Filesize
524KB

MD5
01349cb43ae1ba04685908f988111c78

SHA1
8ca7b68eefc6fda2353a24a2db0cc39d5fd17abd

SHA256
2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48

SHA512
12baad6cfde36a0f74d51bad5711148472083b19d18436c404c387fe5ec094ebfd70c7f56da652bcb4625de4ac302db6b1835332f20a6284056f902dbbdaa795

Download Submit
C:\Windows\SysWOW64\ywliddwuqemwltxqkxmkz.exe

Filesize
524KB

MD5
01349cb43ae1ba04685908f988111c78

SHA1
8ca7b68eefc6fda2353a24a2db0cc39d5fd17abd

SHA256
2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48

SHA512
12baad6cfde36a0f74d51bad5711148472083b19d18436c404c387fe5ec094ebfd70c7f56da652bcb4625de4ac302db6b1835332f20a6284056f902dbbdaa795

Download Submit
C:\Windows\cwharncwoycitxxmc.exe

Filesize
524KB

MD5
01349cb43ae1ba04685908f988111c78

SHA1
8ca7b68eefc6fda2353a24a2db0cc39d5fd17abd

SHA256
2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48

SHA512
12baad6cfde36a0f74d51bad5711148472083b19d18436c404c387fe5ec094ebfd70c7f56da652bcb4625de4ac302db6b1835332f20a6284056f902dbbdaa795

Download Submit
C:\Windows\cwharncwoycitxxmc.exe

Filesize
524KB

MD5
01349cb43ae1ba04685908f988111c78

SHA1
8ca7b68eefc6fda2353a24a2db0cc39d5fd17abd

SHA256
2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48

SHA512
12baad6cfde36a0f74d51bad5711148472083b19d18436c404c387fe5ec094ebfd70c7f56da652bcb4625de4ac302db6b1835332f20a6284056f902dbbdaa795

Download Submit
C:\Windows\jguqkjbytgnwkrumfrfc.exe

Filesize
524KB

MD5
01349cb43ae1ba04685908f988111c78

SHA1
8ca7b68eefc6fda2353a24a2db0cc39d5fd17abd

SHA256
2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48

SHA512
12baad6cfde36a0f74d51bad5711148472083b19d18436c404c387fe5ec094ebfd70c7f56da652bcb4625de4ac302db6b1835332f20a6284056f902dbbdaa795

Download Submit
C:\Windows\jguqkjbytgnwkrumfrfc.exe

Filesize
524KB

MD5
01349cb43ae1ba04685908f988111c78

SHA1
8ca7b68eefc6fda2353a24a2db0cc39d5fd17abd

SHA256
2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48

SHA512
12baad6cfde36a0f74d51bad5711148472083b19d18436c404c387fe5ec094ebfd70c7f56da652bcb4625de4ac302db6b1835332f20a6284056f902dbbdaa795

Download Submit
C:\Windows\lgsmebrmfqvcotukbl.exe

Filesize
524KB

MD5
01349cb43ae1ba04685908f988111c78

SHA1
8ca7b68eefc6fda2353a24a2db0cc39d5fd17abd

SHA256
2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48

SHA512
12baad6cfde36a0f74d51bad5711148472083b19d18436c404c387fe5ec094ebfd70c7f56da652bcb4625de4ac302db6b1835332f20a6284056f902dbbdaa795

Download Submit
C:\Windows\lgsmebrmfqvcotukbl.exe

Filesize
524KB

MD5
01349cb43ae1ba04685908f988111c78

SHA1
8ca7b68eefc6fda2353a24a2db0cc39d5fd17abd

SHA256
2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48

SHA512
12baad6cfde36a0f74d51bad5711148472083b19d18436c404c387fe5ec094ebfd70c7f56da652bcb4625de4ac302db6b1835332f20a6284056f902dbbdaa795

Download Submit
C:\Windows\poecyztspenyoxcwrfvuki.exe

Filesize
524KB

MD5
01349cb43ae1ba04685908f988111c78

SHA1
8ca7b68eefc6fda2353a24a2db0cc39d5fd17abd

SHA256
2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48

SHA512
12baad6cfde36a0f74d51bad5711148472083b19d18436c404c387fe5ec094ebfd70c7f56da652bcb4625de4ac302db6b1835332f20a6284056f902dbbdaa795

Download Submit
C:\Windows\poecyztspenyoxcwrfvuki.exe

Filesize
524KB

MD5
01349cb43ae1ba04685908f988111c78

SHA1
8ca7b68eefc6fda2353a24a2db0cc39d5fd17abd

SHA256
2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48

SHA512
12baad6cfde36a0f74d51bad5711148472083b19d18436c404c387fe5ec094ebfd70c7f56da652bcb4625de4ac302db6b1835332f20a6284056f902dbbdaa795

Download Submit
C:\Windows\voyqgbpizilqadcq.exe

Filesize
524KB

MD5
01349cb43ae1ba04685908f988111c78

SHA1
8ca7b68eefc6fda2353a24a2db0cc39d5fd17abd

SHA256
2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48

SHA512
12baad6cfde36a0f74d51bad5711148472083b19d18436c404c387fe5ec094ebfd70c7f56da652bcb4625de4ac302db6b1835332f20a6284056f902dbbdaa795

Download Submit
C:\Windows\voyqgbpizilqadcq.exe

Filesize
524KB

MD5
01349cb43ae1ba04685908f988111c78

SHA1
8ca7b68eefc6fda2353a24a2db0cc39d5fd17abd

SHA256
2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48

SHA512
12baad6cfde36a0f74d51bad5711148472083b19d18436c404c387fe5ec094ebfd70c7f56da652bcb4625de4ac302db6b1835332f20a6284056f902dbbdaa795

Download Submit
C:\Windows\wsfatrieykqylrtkcna.exe

Filesize
524KB

MD5
01349cb43ae1ba04685908f988111c78

SHA1
8ca7b68eefc6fda2353a24a2db0cc39d5fd17abd

SHA256
2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48

SHA512
12baad6cfde36a0f74d51bad5711148472083b19d18436c404c387fe5ec094ebfd70c7f56da652bcb4625de4ac302db6b1835332f20a6284056f902dbbdaa795

Download Submit
C:\Windows\wsfatrieykqylrtkcna.exe

Filesize
524KB

MD5
01349cb43ae1ba04685908f988111c78

SHA1
8ca7b68eefc6fda2353a24a2db0cc39d5fd17abd

SHA256
2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48

SHA512
12baad6cfde36a0f74d51bad5711148472083b19d18436c404c387fe5ec094ebfd70c7f56da652bcb4625de4ac302db6b1835332f20a6284056f902dbbdaa795

Download Submit
C:\Windows\ywliddwuqemwltxqkxmkz.exe

Filesize
524KB

MD5
01349cb43ae1ba04685908f988111c78

SHA1
8ca7b68eefc6fda2353a24a2db0cc39d5fd17abd

SHA256
2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48

SHA512
12baad6cfde36a0f74d51bad5711148472083b19d18436c404c387fe5ec094ebfd70c7f56da652bcb4625de4ac302db6b1835332f20a6284056f902dbbdaa795

Download Submit
C:\Windows\ywliddwuqemwltxqkxmkz.exe

Filesize
524KB

MD5
01349cb43ae1ba04685908f988111c78

SHA1
8ca7b68eefc6fda2353a24a2db0cc39d5fd17abd

SHA256
2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48

SHA512
12baad6cfde36a0f74d51bad5711148472083b19d18436c404c387fe5ec094ebfd70c7f56da652bcb4625de4ac302db6b1835332f20a6284056f902dbbdaa795

Download Submit
\Users\Admin\AppData\Local\Temp\cchfzisvmmr.exe

Filesize
320KB

MD5
00d3b7afd752a7e66bfb8a868f3e9397

SHA1
4d9815bbfc9b50abda82c2a60de640d6fef4a2cc

SHA256
3cf0444b506a0ff4176e699b62a31e8e605de7065329d20cb45d65e2fccb8c07

SHA512
3dab71216c6449353c90e57825f93cb964ff8f3acd2a74184d3b01dd3f1f717d563ead1133f3c2541ea4127cb66cffdbc7919ec0b9c7d88a50816ffe9f5135ed

Download Submit
\Users\Admin\AppData\Local\Temp\cchfzisvmmr.exe

Filesize
320KB

MD5
00d3b7afd752a7e66bfb8a868f3e9397

SHA1
4d9815bbfc9b50abda82c2a60de640d6fef4a2cc

SHA256
3cf0444b506a0ff4176e699b62a31e8e605de7065329d20cb45d65e2fccb8c07

SHA512
3dab71216c6449353c90e57825f93cb964ff8f3acd2a74184d3b01dd3f1f717d563ead1133f3c2541ea4127cb66cffdbc7919ec0b9c7d88a50816ffe9f5135ed

Download Submit
\Users\Admin\AppData\Local\Temp\ygfmr.exe

Filesize
708KB

MD5
b322caacf3e9f6e6bfb6a68f08fe2712

SHA1
4689b932765e275054ef42b2143af6b2e47f2c9c

SHA256
57f9f554ac603c944cfe2ff464118d2c6aa3f822f9b205cb3c8d44f67ec0e38d

SHA512
239019371fa3df41db7e109f370932d49695d65c4b76ca4184ea26caab787060e5b5fe52a74cbb4c6d0507407f36a0a50a3880cc3a9ed085e88e74850e85382c

Download Submit
\Users\Admin\AppData\Local\Temp\ygfmr.exe

Filesize
708KB

MD5
b322caacf3e9f6e6bfb6a68f08fe2712

SHA1
4689b932765e275054ef42b2143af6b2e47f2c9c

SHA256
57f9f554ac603c944cfe2ff464118d2c6aa3f822f9b205cb3c8d44f67ec0e38d

SHA512
239019371fa3df41db7e109f370932d49695d65c4b76ca4184ea26caab787060e5b5fe52a74cbb4c6d0507407f36a0a50a3880cc3a9ed085e88e74850e85382c

Download Submit
\Users\Admin\AppData\Local\Temp\ygfmr.exe

Filesize
708KB

MD5
b322caacf3e9f6e6bfb6a68f08fe2712

SHA1
4689b932765e275054ef42b2143af6b2e47f2c9c

SHA256
57f9f554ac603c944cfe2ff464118d2c6aa3f822f9b205cb3c8d44f67ec0e38d

SHA512
239019371fa3df41db7e109f370932d49695d65c4b76ca4184ea26caab787060e5b5fe52a74cbb4c6d0507407f36a0a50a3880cc3a9ed085e88e74850e85382c

Download Submit
\Users\Admin\AppData\Local\Temp\ygfmr.exe

Filesize
708KB

MD5
b322caacf3e9f6e6bfb6a68f08fe2712

SHA1
4689b932765e275054ef42b2143af6b2e47f2c9c

SHA256
57f9f554ac603c944cfe2ff464118d2c6aa3f822f9b205cb3c8d44f67ec0e38d

SHA512
239019371fa3df41db7e109f370932d49695d65c4b76ca4184ea26caab787060e5b5fe52a74cbb4c6d0507407f36a0a50a3880cc3a9ed085e88e74850e85382c

Download Submit
memory/972-54-0x0000000074D81000-0x0000000074D83000-memory.dmp

Filesize
8KB

Download