2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2022, 22:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
Size

524KB
MD5

01349cb43ae1ba04685908f988111c78
SHA1

8ca7b68eefc6fda2353a24a2db0cc39d5fd17abd
SHA256

2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48
SHA512

12baad6cfde36a0f74d51bad5711148472083b19d18436c404c387fe5ec094ebfd70c7f56da652bcb4625de4ac302db6b1835332f20a6284056f902dbbdaa795
SSDEEP

6144:lIXsL0tvrSVz1DnemeYbpsnEf78AoXh6KkiD0OofzA+/VygHUSCnDU:lIXsgtvm1De5YlOx6lzBH46Ut4

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	msxchn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	msxchn.exe

UAC bypass 3 TTPs 13 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	msxchn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	msxchn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	msxchn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	msxchn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	msxchn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	msxchn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	msxchn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	msxchn.exe

Adds policy Run key to start application 2 TTPs 31 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\yirajtfqzh = "bwqkezwsmfivsfhzwypke.exe"	msxchn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\yirajtfqzh = "fwmcsjcukzyhajhvo.exe"	msxchn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\yirajtfqzh = "mgzslfbwphjvrdevrsic.exe"	msxchn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\yirajtfqzh = "yodshxpgvjhphpmz.exe"	msxchn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zgmsyfo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yodshxpgvjhphpmz.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\yirajtfqzh = "fwmcsjcukzyhajhvo.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zgmsyfo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zskcuniculmxsddtood.exe"	msxchn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\yirajtfqzh = "fwmcsjcukzyhajhvo.exe"	yborjrewily.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	msxchn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\yirajtfqzh = "bwqkezwsmfivsfhzwypke.exe"	msxchn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\yirajtfqzh = "zskcuniculmxsddtood.exe"	msxchn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zgmsyfo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yodshxpgvjhphpmz.exe"	msxchn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\yirajtfqzh = "ogxofxrkbrrbvfetnm.exe"	msxchn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zgmsyfo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ogxofxrkbrrbvfetnm.exe"	msxchn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zgmsyfo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mgzslfbwphjvrdevrsic.exe"	msxchn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\yirajtfqzh = "ogxofxrkbrrbvfetnm.exe"	msxchn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	msxchn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\yirajtfqzh = "yodshxpgvjhphpmz.exe"	msxchn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zgmsyfo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bwqkezwsmfivsfhzwypke.exe"	msxchn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zgmsyfo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zskcuniculmxsddtood.exe"	msxchn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\yirajtfqzh = "fwmcsjcukzyhajhvo.exe"	msxchn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\yirajtfqzh = "mgzslfbwphjvrdevrsic.exe"	msxchn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zgmsyfo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ogxofxrkbrrbvfetnm.exe"	msxchn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zgmsyfo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yodshxpgvjhphpmz.exe"	msxchn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zgmsyfo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mgzslfbwphjvrdevrsic.exe"	msxchn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zgmsyfo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zskcuniculmxsddtood.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\yirajtfqzh = "zskcuniculmxsddtood.exe"	msxchn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zgmsyfo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fwmcsjcukzyhajhvo.exe"	msxchn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\zgmsyfo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fwmcsjcukzyhajhvo.exe"	msxchn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	yborjrewily.exe

Disables RegEdit via registry modification 6 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	yborjrewily.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	msxchn.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	msxchn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	msxchn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	msxchn.exe

Executes dropped EXE 4 IoCs

pid	Process
4952	yborjrewily.exe
4836	msxchn.exe
5000	msxchn.exe
2832	yborjrewily.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	yborjrewily.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\owdkrzjs = "yodshxpgvjhphpmz.exe"	msxchn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\owdkrzjs = "bwqkezwsmfivsfhzwypke.exe"	yborjrewily.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	yborjrewily.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\fowemvgqy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ogxofxrkbrrbvfetnm.exe ."	msxchn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\owdkrzjs = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bwqkezwsmfivsfhzwypke.exe"	msxchn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fowemvgqy = "zskcuniculmxsddtood.exe ."	msxchn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\fowemvgqy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bwqkezwsmfivsfhzwypke.exe ."	msxchn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\qcnyjvjwhrlp = "mgzslfbwphjvrdevrsic.exe ."	msxchn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\teoyitgscle = "bwqkezwsmfivsfhzwypke.exe"	msxchn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pcoamzocozuzo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fwmcsjcukzyhajhvo.exe ."	yborjrewily.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\qcnyjvjwhrlp = "yodshxpgvjhphpmz.exe ."	msxchn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fowemvgqy = "bwqkezwsmfivsfhzwypke.exe ."	msxchn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\teoyitgscle = "mgzslfbwphjvrdevrsic.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\owdkrzjs = "ogxofxrkbrrbvfetnm.exe"	msxchn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pcoamzocozuzo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yodshxpgvjhphpmz.exe ."	msxchn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qererfvkxjflbh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mgzslfbwphjvrdevrsic.exe"	msxchn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\owdkrzjs = "ogxofxrkbrrbvfetnm.exe"	msxchn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\fowemvgqy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fwmcsjcukzyhajhvo.exe ."	yborjrewily.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	msxchn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qererfvkxjflbh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ogxofxrkbrrbvfetnm.exe"	msxchn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\owdkrzjs = "mgzslfbwphjvrdevrsic.exe"	msxchn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qererfvkxjflbh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bwqkezwsmfivsfhzwypke.exe"	msxchn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\fowemvgqy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bwqkezwsmfivsfhzwypke.exe ."	yborjrewily.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	msxchn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qererfvkxjflbh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mgzslfbwphjvrdevrsic.exe"	msxchn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fowemvgqy = "zskcuniculmxsddtood.exe ."	msxchn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\teoyitgscle = "mgzslfbwphjvrdevrsic.exe"	msxchn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fowemvgqy = "ogxofxrkbrrbvfetnm.exe ."	msxchn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fowemvgqy = "yodshxpgvjhphpmz.exe ."	msxchn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qererfvkxjflbh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ogxofxrkbrrbvfetnm.exe"	msxchn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\owdkrzjs = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yodshxpgvjhphpmz.exe"	msxchn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qererfvkxjflbh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bwqkezwsmfivsfhzwypke.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pcoamzocozuzo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yodshxpgvjhphpmz.exe ."	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pcoamzocozuzo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bwqkezwsmfivsfhzwypke.exe ."	msxchn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\teoyitgscle = "ogxofxrkbrrbvfetnm.exe"	msxchn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fowemvgqy = "mgzslfbwphjvrdevrsic.exe ."	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\owdkrzjs = "zskcuniculmxsddtood.exe"	msxchn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\owdkrzjs = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ogxofxrkbrrbvfetnm.exe"	msxchn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\teoyitgscle = "yodshxpgvjhphpmz.exe"	msxchn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\teoyitgscle = "mgzslfbwphjvrdevrsic.exe"	msxchn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qererfvkxjflbh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bwqkezwsmfivsfhzwypke.exe"	msxchn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\fowemvgqy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yodshxpgvjhphpmz.exe ."	msxchn.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	msxchn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pcoamzocozuzo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ogxofxrkbrrbvfetnm.exe ."	msxchn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qererfvkxjflbh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yodshxpgvjhphpmz.exe"	msxchn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	yborjrewily.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\qcnyjvjwhrlp = "mgzslfbwphjvrdevrsic.exe ."	yborjrewily.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\owdkrzjs = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fwmcsjcukzyhajhvo.exe"	msxchn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\owdkrzjs = "zskcuniculmxsddtood.exe"	msxchn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pcoamzocozuzo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fwmcsjcukzyhajhvo.exe ."	msxchn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\teoyitgscle = "bwqkezwsmfivsfhzwypke.exe"	yborjrewily.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pcoamzocozuzo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zskcuniculmxsddtood.exe ."	msxchn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\owdkrzjs = "fwmcsjcukzyhajhvo.exe"	msxchn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pcoamzocozuzo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zskcuniculmxsddtood.exe ."	msxchn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\teoyitgscle = "yodshxpgvjhphpmz.exe"	msxchn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pcoamzocozuzo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mgzslfbwphjvrdevrsic.exe ."	msxchn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\fowemvgqy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fwmcsjcukzyhajhvo.exe ."	msxchn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\qcnyjvjwhrlp = "bwqkezwsmfivsfhzwypke.exe ."	msxchn.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	yborjrewily.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\owdkrzjs = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fwmcsjcukzyhajhvo.exe"	msxchn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\fowemvgqy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zskcuniculmxsddtood.exe ."	msxchn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\owdkrzjs = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bwqkezwsmfivsfhzwypke.exe"	yborjrewily.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	msxchn.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	msxchn.exe

Checks whether UAC is enabled 1 TTPs 8 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	msxchn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	yborjrewily.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	yborjrewily.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	msxchn.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	msxchn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	msxchn.exe

Looks up external IP address via web service 8 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
12	www.showmyipaddress.com
16	whatismyip.everdot.org
19	whatismyipaddress.com
23	whatismyip.everdot.org
30	whatismyip.everdot.org
34	www.showmyipaddress.com
46	whatismyip.everdot.org
10	whatismyip.everdot.org

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	C:\autorun.inf	msxchn.exe
File opened for modification	C:\autorun.inf	msxchn.exe

Drops file in System32 directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\ogxofxrkbrrbvfetnm.exe	msxchn.exe
File opened for modification	C:\Windows\SysWOW64\mgzslfbwphjvrdevrsic.exe	msxchn.exe
File opened for modification	C:\Windows\SysWOW64\sojezvtqlfjxvjmfdgyupk.exe	msxchn.exe
File opened for modification	C:\Windows\SysWOW64\fwmcsjcukzyhajhvo.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\ogxofxrkbrrbvfetnm.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\zskcuniculmxsddtood.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\fwmcsjcukzyhajhvo.exe	msxchn.exe
File opened for modification	C:\Windows\SysWOW64\yodshxpgvjhphpmz.exe	msxchn.exe
File opened for modification	C:\Windows\SysWOW64\ogxofxrkbrrbvfetnm.exe	msxchn.exe
File opened for modification	C:\Windows\SysWOW64\zskcuniculmxsddtood.exe	msxchn.exe
File opened for modification	C:\Windows\SysWOW64\bwqkezwsmfivsfhzwypke.exe	msxchn.exe
File opened for modification	C:\Windows\SysWOW64\fwmcsjcukzyhajhvo.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\ogxofxrkbrrbvfetnm.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\mgzslfbwphjvrdevrsic.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\bwqkezwsmfivsfhzwypke.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\mgzslfbwphjvrdevrsic.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\bwqkezwsmfivsfhzwypke.exe	msxchn.exe
File opened for modification	C:\Windows\SysWOW64\sojezvtqlfjxvjmfdgyupk.exe	msxchn.exe
File opened for modification	C:\Windows\SysWOW64\mgzslfbwphjvrdevrsic.exe	msxchn.exe
File created	C:\Windows\SysWOW64\qererfvkxjflbhcndyiwjwjxncpbxdtzufvq.obo	msxchn.exe
File opened for modification	C:\Windows\SysWOW64\yodshxpgvjhphpmz.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\sojezvtqlfjxvjmfdgyupk.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\loqsuxcgijupupzzeonqsuwze.klw	msxchn.exe
File opened for modification	C:\Windows\SysWOW64\bwqkezwsmfivsfhzwypke.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\qererfvkxjflbhcndyiwjwjxncpbxdtzufvq.obo	msxchn.exe
File opened for modification	C:\Windows\SysWOW64\yodshxpgvjhphpmz.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\yodshxpgvjhphpmz.exe	msxchn.exe
File opened for modification	C:\Windows\SysWOW64\zskcuniculmxsddtood.exe	msxchn.exe
File opened for modification	C:\Windows\SysWOW64\fwmcsjcukzyhajhvo.exe	msxchn.exe
File created	C:\Windows\SysWOW64\loqsuxcgijupupzzeonqsuwze.klw	msxchn.exe
File opened for modification	C:\Windows\SysWOW64\zskcuniculmxsddtood.exe	yborjrewily.exe
File opened for modification	C:\Windows\SysWOW64\sojezvtqlfjxvjmfdgyupk.exe	yborjrewily.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\loqsuxcgijupupzzeonqsuwze.klw	msxchn.exe
File opened for modification	C:\Program Files (x86)\qererfvkxjflbhcndyiwjwjxncpbxdtzufvq.obo	msxchn.exe
File created	C:\Program Files (x86)\qererfvkxjflbhcndyiwjwjxncpbxdtzufvq.obo	msxchn.exe
File opened for modification	C:\Program Files (x86)\loqsuxcgijupupzzeonqsuwze.klw	msxchn.exe

Drops file in Windows directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Windows\fwmcsjcukzyhajhvo.exe	yborjrewily.exe
File opened for modification	C:\Windows\zskcuniculmxsddtood.exe	msxchn.exe
File opened for modification	C:\Windows\mgzslfbwphjvrdevrsic.exe	msxchn.exe
File opened for modification	C:\Windows\sojezvtqlfjxvjmfdgyupk.exe	msxchn.exe
File opened for modification	C:\Windows\bwqkezwsmfivsfhzwypke.exe	msxchn.exe
File opened for modification	C:\Windows\sojezvtqlfjxvjmfdgyupk.exe	msxchn.exe
File created	C:\Windows\qererfvkxjflbhcndyiwjwjxncpbxdtzufvq.obo	msxchn.exe
File opened for modification	C:\Windows\yodshxpgvjhphpmz.exe	yborjrewily.exe
File opened for modification	C:\Windows\zskcuniculmxsddtood.exe	yborjrewily.exe
File opened for modification	C:\Windows\ogxofxrkbrrbvfetnm.exe	msxchn.exe
File opened for modification	C:\Windows\mgzslfbwphjvrdevrsic.exe	msxchn.exe
File opened for modification	C:\Windows\yodshxpgvjhphpmz.exe	yborjrewily.exe
File opened for modification	C:\Windows\fwmcsjcukzyhajhvo.exe	yborjrewily.exe
File opened for modification	C:\Windows\zskcuniculmxsddtood.exe	yborjrewily.exe
File opened for modification	C:\Windows\ogxofxrkbrrbvfetnm.exe	yborjrewily.exe
File opened for modification	C:\Windows\bwqkezwsmfivsfhzwypke.exe	yborjrewily.exe
File opened for modification	C:\Windows\bwqkezwsmfivsfhzwypke.exe	yborjrewily.exe
File opened for modification	C:\Windows\ogxofxrkbrrbvfetnm.exe	msxchn.exe
File created	C:\Windows\loqsuxcgijupupzzeonqsuwze.klw	msxchn.exe
File opened for modification	C:\Windows\qererfvkxjflbhcndyiwjwjxncpbxdtzufvq.obo	msxchn.exe
File opened for modification	C:\Windows\mgzslfbwphjvrdevrsic.exe	yborjrewily.exe
File opened for modification	C:\Windows\yodshxpgvjhphpmz.exe	msxchn.exe
File opened for modification	C:\Windows\fwmcsjcukzyhajhvo.exe	msxchn.exe
File opened for modification	C:\Windows\bwqkezwsmfivsfhzwypke.exe	msxchn.exe
File opened for modification	C:\Windows\loqsuxcgijupupzzeonqsuwze.klw	msxchn.exe
File opened for modification	C:\Windows\zskcuniculmxsddtood.exe	msxchn.exe
File opened for modification	C:\Windows\ogxofxrkbrrbvfetnm.exe	yborjrewily.exe
File opened for modification	C:\Windows\sojezvtqlfjxvjmfdgyupk.exe	yborjrewily.exe
File opened for modification	C:\Windows\sojezvtqlfjxvjmfdgyupk.exe	yborjrewily.exe
File opened for modification	C:\Windows\yodshxpgvjhphpmz.exe	msxchn.exe
File opened for modification	C:\Windows\fwmcsjcukzyhajhvo.exe	msxchn.exe
File opened for modification	C:\Windows\mgzslfbwphjvrdevrsic.exe	yborjrewily.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
632	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
632	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
632	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
632	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
632	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
632	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
632	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
632	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
632	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
632	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
632	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
632	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
632	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
632	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
632	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
632	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
632	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
632	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
4836	msxchn.exe
4836	msxchn.exe
632	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
632	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
632	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
632	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
632	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
632	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
632	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
632	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
632	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
632	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
632	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
632	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
632	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
632	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
632	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
632	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
632	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
632	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
632	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
632	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
632	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
632	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
632	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
632	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
632	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
632	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
4836	msxchn.exe
4836	msxchn.exe
632	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
632	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
632	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
632	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
632	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
632	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
632	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
632	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
632	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
632	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
632	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
632	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
632	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
632	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
632	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
632	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4836	msxchn.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 632 wrote to memory of 4952	632	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe	80
PID 632 wrote to memory of 4952	632	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe	80
PID 632 wrote to memory of 4952	632	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe	80
PID 4952 wrote to memory of 4836	4952	yborjrewily.exe	81
PID 4952 wrote to memory of 4836	4952	yborjrewily.exe	81
PID 4952 wrote to memory of 4836	4952	yborjrewily.exe	81
PID 4952 wrote to memory of 5000	4952	yborjrewily.exe	82
PID 4952 wrote to memory of 5000	4952	yborjrewily.exe	82
PID 4952 wrote to memory of 5000	4952	yborjrewily.exe	82
PID 632 wrote to memory of 2832	632	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe	92
PID 632 wrote to memory of 2832	632	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe	92
PID 632 wrote to memory of 2832	632	2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe	92

System policy modification 1 TTPs 41 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	msxchn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	msxchn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	msxchn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	msxchn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	msxchn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	msxchn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	msxchn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	msxchn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	yborjrewily.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	msxchn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	msxchn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	yborjrewily.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	msxchn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	msxchn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	msxchn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	msxchn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	msxchn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	msxchn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	msxchn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	msxchn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	msxchn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	msxchn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	msxchn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	msxchn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	msxchn.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	yborjrewily.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	yborjrewily.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	msxchn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	msxchn.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	msxchn.exe

C:\Users\Admin\AppData\Local\Temp\2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe
"C:\Users\Admin\AppData\Local\Temp\2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:632
- C:\Users\Admin\AppData\Local\Temp\yborjrewily.exe
  "C:\Users\Admin\AppData\Local\Temp\yborjrewily.exe" "c:\users\admin\appdata\local\temp\2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe*"
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Adds policy Run key to start application
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Checks computer location settings
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4952
- - C:\Users\Admin\AppData\Local\Temp\msxchn.exe
    "C:\Users\Admin\AppData\Local\Temp\msxchn.exe" "-C:\Users\Admin\AppData\Local\Temp\yodshxpgvjhphpmz.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops autorun.inf file
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - System policy modification
    PID:4836
- - C:\Users\Admin\AppData\Local\Temp\msxchn.exe
    "C:\Users\Admin\AppData\Local\Temp\msxchn.exe" "-C:\Users\Admin\AppData\Local\Temp\yodshxpgvjhphpmz.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System policy modification
    PID:5000
- C:\Users\Admin\AppData\Local\Temp\yborjrewily.exe
  "C:\Users\Admin\AppData\Local\Temp\yborjrewily.exe" "c:\users\admin\appdata\local\temp\2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48.exe"
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Adds policy Run key to start application
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System policy modification
  PID:2832

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\bwqkezwsmfivsfhzwypke.exe

Filesize
524KB

MD5
01349cb43ae1ba04685908f988111c78

SHA1
8ca7b68eefc6fda2353a24a2db0cc39d5fd17abd

SHA256
2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48

SHA512
12baad6cfde36a0f74d51bad5711148472083b19d18436c404c387fe5ec094ebfd70c7f56da652bcb4625de4ac302db6b1835332f20a6284056f902dbbdaa795

Download Submit
C:\Users\Admin\AppData\Local\Temp\fwmcsjcukzyhajhvo.exe

Filesize
524KB

MD5
01349cb43ae1ba04685908f988111c78

SHA1
8ca7b68eefc6fda2353a24a2db0cc39d5fd17abd

SHA256
2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48

SHA512
12baad6cfde36a0f74d51bad5711148472083b19d18436c404c387fe5ec094ebfd70c7f56da652bcb4625de4ac302db6b1835332f20a6284056f902dbbdaa795

Download Submit
C:\Users\Admin\AppData\Local\Temp\mgzslfbwphjvrdevrsic.exe

Filesize
524KB

MD5
01349cb43ae1ba04685908f988111c78

SHA1
8ca7b68eefc6fda2353a24a2db0cc39d5fd17abd

SHA256
2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48

SHA512
12baad6cfde36a0f74d51bad5711148472083b19d18436c404c387fe5ec094ebfd70c7f56da652bcb4625de4ac302db6b1835332f20a6284056f902dbbdaa795

Download Submit
C:\Users\Admin\AppData\Local\Temp\msxchn.exe

Filesize
708KB

MD5
de8fa8b1f95e7d50afd5a5d773fe9b4f

SHA1
784cbe4da1ff37af01e6c507095491d7344a5e26

SHA256
a589f592efbb90375e22501884a5045a1395e3e80f90ebebce15ce1afb929dc4

SHA512
71f1aca9587c89fa35c242b1b61676cf8af2fc71f9643923ac0d22390232e37a79f420e8b92fe9a9f97ecec93b2a84940fa4f3316fe93ff8a3824b11f253afd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\msxchn.exe

Filesize
708KB

MD5
de8fa8b1f95e7d50afd5a5d773fe9b4f

SHA1
784cbe4da1ff37af01e6c507095491d7344a5e26

SHA256
a589f592efbb90375e22501884a5045a1395e3e80f90ebebce15ce1afb929dc4

SHA512
71f1aca9587c89fa35c242b1b61676cf8af2fc71f9643923ac0d22390232e37a79f420e8b92fe9a9f97ecec93b2a84940fa4f3316fe93ff8a3824b11f253afd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\msxchn.exe

Filesize
708KB

MD5
de8fa8b1f95e7d50afd5a5d773fe9b4f

SHA1
784cbe4da1ff37af01e6c507095491d7344a5e26

SHA256
a589f592efbb90375e22501884a5045a1395e3e80f90ebebce15ce1afb929dc4

SHA512
71f1aca9587c89fa35c242b1b61676cf8af2fc71f9643923ac0d22390232e37a79f420e8b92fe9a9f97ecec93b2a84940fa4f3316fe93ff8a3824b11f253afd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\ogxofxrkbrrbvfetnm.exe

Filesize
524KB

MD5
01349cb43ae1ba04685908f988111c78

SHA1
8ca7b68eefc6fda2353a24a2db0cc39d5fd17abd

SHA256
2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48

SHA512
12baad6cfde36a0f74d51bad5711148472083b19d18436c404c387fe5ec094ebfd70c7f56da652bcb4625de4ac302db6b1835332f20a6284056f902dbbdaa795

Download Submit
C:\Users\Admin\AppData\Local\Temp\sojezvtqlfjxvjmfdgyupk.exe

Filesize
524KB

MD5
01349cb43ae1ba04685908f988111c78

SHA1
8ca7b68eefc6fda2353a24a2db0cc39d5fd17abd

SHA256
2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48

SHA512
12baad6cfde36a0f74d51bad5711148472083b19d18436c404c387fe5ec094ebfd70c7f56da652bcb4625de4ac302db6b1835332f20a6284056f902dbbdaa795

Download Submit
C:\Users\Admin\AppData\Local\Temp\yborjrewily.exe

Filesize
320KB

MD5
2e2201794b14eef4a58a7c5522673634

SHA1
911330ee04a0db3177eba7c95d54e39d379c6d16

SHA256
993650a2694f4d2e7ceb5a4e030ab4bc3035304384fb18de34606d9722602f09

SHA512
b7a9c5fd753be7941256d0ef15fb84624aeeec73727d514cc225de99abe7181871dc4c87b0505403a9c3b539b431c2fe15921fb33f20db8053b4c4cad65cb98a

Download Submit
C:\Users\Admin\AppData\Local\Temp\yborjrewily.exe

Filesize
320KB

MD5
2e2201794b14eef4a58a7c5522673634

SHA1
911330ee04a0db3177eba7c95d54e39d379c6d16

SHA256
993650a2694f4d2e7ceb5a4e030ab4bc3035304384fb18de34606d9722602f09

SHA512
b7a9c5fd753be7941256d0ef15fb84624aeeec73727d514cc225de99abe7181871dc4c87b0505403a9c3b539b431c2fe15921fb33f20db8053b4c4cad65cb98a

Download Submit
C:\Users\Admin\AppData\Local\Temp\yborjrewily.exe

Filesize
320KB

MD5
2e2201794b14eef4a58a7c5522673634

SHA1
911330ee04a0db3177eba7c95d54e39d379c6d16

SHA256
993650a2694f4d2e7ceb5a4e030ab4bc3035304384fb18de34606d9722602f09

SHA512
b7a9c5fd753be7941256d0ef15fb84624aeeec73727d514cc225de99abe7181871dc4c87b0505403a9c3b539b431c2fe15921fb33f20db8053b4c4cad65cb98a

Download Submit
C:\Users\Admin\AppData\Local\Temp\yodshxpgvjhphpmz.exe

Filesize
524KB

MD5
01349cb43ae1ba04685908f988111c78

SHA1
8ca7b68eefc6fda2353a24a2db0cc39d5fd17abd

SHA256
2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48

SHA512
12baad6cfde36a0f74d51bad5711148472083b19d18436c404c387fe5ec094ebfd70c7f56da652bcb4625de4ac302db6b1835332f20a6284056f902dbbdaa795

Download Submit
C:\Users\Admin\AppData\Local\Temp\zskcuniculmxsddtood.exe

Filesize
524KB

MD5
01349cb43ae1ba04685908f988111c78

SHA1
8ca7b68eefc6fda2353a24a2db0cc39d5fd17abd

SHA256
2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48

SHA512
12baad6cfde36a0f74d51bad5711148472083b19d18436c404c387fe5ec094ebfd70c7f56da652bcb4625de4ac302db6b1835332f20a6284056f902dbbdaa795

Download Submit
C:\Windows\SysWOW64\bwqkezwsmfivsfhzwypke.exe

Filesize
524KB

MD5
01349cb43ae1ba04685908f988111c78

SHA1
8ca7b68eefc6fda2353a24a2db0cc39d5fd17abd

SHA256
2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48

SHA512
12baad6cfde36a0f74d51bad5711148472083b19d18436c404c387fe5ec094ebfd70c7f56da652bcb4625de4ac302db6b1835332f20a6284056f902dbbdaa795

Download Submit
C:\Windows\SysWOW64\fwmcsjcukzyhajhvo.exe

Filesize
524KB

MD5
01349cb43ae1ba04685908f988111c78

SHA1
8ca7b68eefc6fda2353a24a2db0cc39d5fd17abd

SHA256
2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48

SHA512
12baad6cfde36a0f74d51bad5711148472083b19d18436c404c387fe5ec094ebfd70c7f56da652bcb4625de4ac302db6b1835332f20a6284056f902dbbdaa795

Download Submit
C:\Windows\SysWOW64\mgzslfbwphjvrdevrsic.exe

Filesize
524KB

MD5
01349cb43ae1ba04685908f988111c78

SHA1
8ca7b68eefc6fda2353a24a2db0cc39d5fd17abd

SHA256
2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48

SHA512
12baad6cfde36a0f74d51bad5711148472083b19d18436c404c387fe5ec094ebfd70c7f56da652bcb4625de4ac302db6b1835332f20a6284056f902dbbdaa795

Download Submit
C:\Windows\SysWOW64\ogxofxrkbrrbvfetnm.exe

Filesize
524KB

MD5
01349cb43ae1ba04685908f988111c78

SHA1
8ca7b68eefc6fda2353a24a2db0cc39d5fd17abd

SHA256
2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48

SHA512
12baad6cfde36a0f74d51bad5711148472083b19d18436c404c387fe5ec094ebfd70c7f56da652bcb4625de4ac302db6b1835332f20a6284056f902dbbdaa795

Download Submit
C:\Windows\SysWOW64\sojezvtqlfjxvjmfdgyupk.exe

Filesize
524KB

MD5
01349cb43ae1ba04685908f988111c78

SHA1
8ca7b68eefc6fda2353a24a2db0cc39d5fd17abd

SHA256
2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48

SHA512
12baad6cfde36a0f74d51bad5711148472083b19d18436c404c387fe5ec094ebfd70c7f56da652bcb4625de4ac302db6b1835332f20a6284056f902dbbdaa795

Download Submit
C:\Windows\SysWOW64\yodshxpgvjhphpmz.exe

Filesize
524KB

MD5
01349cb43ae1ba04685908f988111c78

SHA1
8ca7b68eefc6fda2353a24a2db0cc39d5fd17abd

SHA256
2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48

SHA512
12baad6cfde36a0f74d51bad5711148472083b19d18436c404c387fe5ec094ebfd70c7f56da652bcb4625de4ac302db6b1835332f20a6284056f902dbbdaa795

Download Submit
C:\Windows\SysWOW64\zskcuniculmxsddtood.exe

Filesize
524KB

MD5
01349cb43ae1ba04685908f988111c78

SHA1
8ca7b68eefc6fda2353a24a2db0cc39d5fd17abd

SHA256
2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48

SHA512
12baad6cfde36a0f74d51bad5711148472083b19d18436c404c387fe5ec094ebfd70c7f56da652bcb4625de4ac302db6b1835332f20a6284056f902dbbdaa795

Download Submit
C:\Windows\bwqkezwsmfivsfhzwypke.exe

Filesize
524KB

MD5
01349cb43ae1ba04685908f988111c78

SHA1
8ca7b68eefc6fda2353a24a2db0cc39d5fd17abd

SHA256
2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48

SHA512
12baad6cfde36a0f74d51bad5711148472083b19d18436c404c387fe5ec094ebfd70c7f56da652bcb4625de4ac302db6b1835332f20a6284056f902dbbdaa795

Download Submit
C:\Windows\bwqkezwsmfivsfhzwypke.exe

Filesize
524KB

MD5
01349cb43ae1ba04685908f988111c78

SHA1
8ca7b68eefc6fda2353a24a2db0cc39d5fd17abd

SHA256
2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48

SHA512
12baad6cfde36a0f74d51bad5711148472083b19d18436c404c387fe5ec094ebfd70c7f56da652bcb4625de4ac302db6b1835332f20a6284056f902dbbdaa795

Download Submit
C:\Windows\bwqkezwsmfivsfhzwypke.exe

Filesize
524KB

MD5
01349cb43ae1ba04685908f988111c78

SHA1
8ca7b68eefc6fda2353a24a2db0cc39d5fd17abd

SHA256
2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48

SHA512
12baad6cfde36a0f74d51bad5711148472083b19d18436c404c387fe5ec094ebfd70c7f56da652bcb4625de4ac302db6b1835332f20a6284056f902dbbdaa795

Download Submit
C:\Windows\fwmcsjcukzyhajhvo.exe

Filesize
524KB

MD5
01349cb43ae1ba04685908f988111c78

SHA1
8ca7b68eefc6fda2353a24a2db0cc39d5fd17abd

SHA256
2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48

SHA512
12baad6cfde36a0f74d51bad5711148472083b19d18436c404c387fe5ec094ebfd70c7f56da652bcb4625de4ac302db6b1835332f20a6284056f902dbbdaa795

Download Submit
C:\Windows\fwmcsjcukzyhajhvo.exe

Filesize
524KB

MD5
01349cb43ae1ba04685908f988111c78

SHA1
8ca7b68eefc6fda2353a24a2db0cc39d5fd17abd

SHA256
2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48

SHA512
12baad6cfde36a0f74d51bad5711148472083b19d18436c404c387fe5ec094ebfd70c7f56da652bcb4625de4ac302db6b1835332f20a6284056f902dbbdaa795

Download Submit
C:\Windows\fwmcsjcukzyhajhvo.exe

Filesize
524KB

MD5
01349cb43ae1ba04685908f988111c78

SHA1
8ca7b68eefc6fda2353a24a2db0cc39d5fd17abd

SHA256
2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48

SHA512
12baad6cfde36a0f74d51bad5711148472083b19d18436c404c387fe5ec094ebfd70c7f56da652bcb4625de4ac302db6b1835332f20a6284056f902dbbdaa795

Download Submit
C:\Windows\mgzslfbwphjvrdevrsic.exe

Filesize
524KB

MD5
01349cb43ae1ba04685908f988111c78

SHA1
8ca7b68eefc6fda2353a24a2db0cc39d5fd17abd

SHA256
2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48

SHA512
12baad6cfde36a0f74d51bad5711148472083b19d18436c404c387fe5ec094ebfd70c7f56da652bcb4625de4ac302db6b1835332f20a6284056f902dbbdaa795

Download Submit
C:\Windows\mgzslfbwphjvrdevrsic.exe

Filesize
524KB

MD5
01349cb43ae1ba04685908f988111c78

SHA1
8ca7b68eefc6fda2353a24a2db0cc39d5fd17abd

SHA256
2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48

SHA512
12baad6cfde36a0f74d51bad5711148472083b19d18436c404c387fe5ec094ebfd70c7f56da652bcb4625de4ac302db6b1835332f20a6284056f902dbbdaa795

Download Submit
C:\Windows\mgzslfbwphjvrdevrsic.exe

Filesize
524KB

MD5
01349cb43ae1ba04685908f988111c78

SHA1
8ca7b68eefc6fda2353a24a2db0cc39d5fd17abd

SHA256
2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48

SHA512
12baad6cfde36a0f74d51bad5711148472083b19d18436c404c387fe5ec094ebfd70c7f56da652bcb4625de4ac302db6b1835332f20a6284056f902dbbdaa795

Download Submit
C:\Windows\ogxofxrkbrrbvfetnm.exe

Filesize
524KB

MD5
01349cb43ae1ba04685908f988111c78

SHA1
8ca7b68eefc6fda2353a24a2db0cc39d5fd17abd

SHA256
2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48

SHA512
12baad6cfde36a0f74d51bad5711148472083b19d18436c404c387fe5ec094ebfd70c7f56da652bcb4625de4ac302db6b1835332f20a6284056f902dbbdaa795

Download Submit
C:\Windows\ogxofxrkbrrbvfetnm.exe

Filesize
524KB

MD5
01349cb43ae1ba04685908f988111c78

SHA1
8ca7b68eefc6fda2353a24a2db0cc39d5fd17abd

SHA256
2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48

SHA512
12baad6cfde36a0f74d51bad5711148472083b19d18436c404c387fe5ec094ebfd70c7f56da652bcb4625de4ac302db6b1835332f20a6284056f902dbbdaa795

Download Submit
C:\Windows\ogxofxrkbrrbvfetnm.exe

Filesize
524KB

MD5
01349cb43ae1ba04685908f988111c78

SHA1
8ca7b68eefc6fda2353a24a2db0cc39d5fd17abd

SHA256
2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48

SHA512
12baad6cfde36a0f74d51bad5711148472083b19d18436c404c387fe5ec094ebfd70c7f56da652bcb4625de4ac302db6b1835332f20a6284056f902dbbdaa795

Download Submit
C:\Windows\sojezvtqlfjxvjmfdgyupk.exe

Filesize
524KB

MD5
01349cb43ae1ba04685908f988111c78

SHA1
8ca7b68eefc6fda2353a24a2db0cc39d5fd17abd

SHA256
2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48

SHA512
12baad6cfde36a0f74d51bad5711148472083b19d18436c404c387fe5ec094ebfd70c7f56da652bcb4625de4ac302db6b1835332f20a6284056f902dbbdaa795

Download Submit
C:\Windows\sojezvtqlfjxvjmfdgyupk.exe

Filesize
524KB

MD5
01349cb43ae1ba04685908f988111c78

SHA1
8ca7b68eefc6fda2353a24a2db0cc39d5fd17abd

SHA256
2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48

SHA512
12baad6cfde36a0f74d51bad5711148472083b19d18436c404c387fe5ec094ebfd70c7f56da652bcb4625de4ac302db6b1835332f20a6284056f902dbbdaa795

Download Submit
C:\Windows\sojezvtqlfjxvjmfdgyupk.exe

Filesize
524KB

MD5
01349cb43ae1ba04685908f988111c78

SHA1
8ca7b68eefc6fda2353a24a2db0cc39d5fd17abd

SHA256
2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48

SHA512
12baad6cfde36a0f74d51bad5711148472083b19d18436c404c387fe5ec094ebfd70c7f56da652bcb4625de4ac302db6b1835332f20a6284056f902dbbdaa795

Download Submit
C:\Windows\yodshxpgvjhphpmz.exe

Filesize
524KB

MD5
01349cb43ae1ba04685908f988111c78

SHA1
8ca7b68eefc6fda2353a24a2db0cc39d5fd17abd

SHA256
2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48

SHA512
12baad6cfde36a0f74d51bad5711148472083b19d18436c404c387fe5ec094ebfd70c7f56da652bcb4625de4ac302db6b1835332f20a6284056f902dbbdaa795

Download Submit
C:\Windows\yodshxpgvjhphpmz.exe

Filesize
524KB

MD5
01349cb43ae1ba04685908f988111c78

SHA1
8ca7b68eefc6fda2353a24a2db0cc39d5fd17abd

SHA256
2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48

SHA512
12baad6cfde36a0f74d51bad5711148472083b19d18436c404c387fe5ec094ebfd70c7f56da652bcb4625de4ac302db6b1835332f20a6284056f902dbbdaa795

Download Submit
C:\Windows\yodshxpgvjhphpmz.exe

Filesize
524KB

MD5
01349cb43ae1ba04685908f988111c78

SHA1
8ca7b68eefc6fda2353a24a2db0cc39d5fd17abd

SHA256
2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48

SHA512
12baad6cfde36a0f74d51bad5711148472083b19d18436c404c387fe5ec094ebfd70c7f56da652bcb4625de4ac302db6b1835332f20a6284056f902dbbdaa795

Download Submit
C:\Windows\zskcuniculmxsddtood.exe

Filesize
524KB

MD5
01349cb43ae1ba04685908f988111c78

SHA1
8ca7b68eefc6fda2353a24a2db0cc39d5fd17abd

SHA256
2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48

SHA512
12baad6cfde36a0f74d51bad5711148472083b19d18436c404c387fe5ec094ebfd70c7f56da652bcb4625de4ac302db6b1835332f20a6284056f902dbbdaa795

Download Submit
C:\Windows\zskcuniculmxsddtood.exe

Filesize
524KB

MD5
01349cb43ae1ba04685908f988111c78

SHA1
8ca7b68eefc6fda2353a24a2db0cc39d5fd17abd

SHA256
2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48

SHA512
12baad6cfde36a0f74d51bad5711148472083b19d18436c404c387fe5ec094ebfd70c7f56da652bcb4625de4ac302db6b1835332f20a6284056f902dbbdaa795

Download Submit
C:\Windows\zskcuniculmxsddtood.exe

Filesize
524KB

MD5
01349cb43ae1ba04685908f988111c78

SHA1
8ca7b68eefc6fda2353a24a2db0cc39d5fd17abd

SHA256
2d88d3512c9fdc3c6ffc0d3527ac2fe6c6c67d37f3726f5769b159f4f064ab48

SHA512
12baad6cfde36a0f74d51bad5711148472083b19d18436c404c387fe5ec094ebfd70c7f56da652bcb4625de4ac302db6b1835332f20a6284056f902dbbdaa795

Download Submit