Analysis
-
max time kernel
156s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
03-12-2022 22:12
Static task
static1
Behavioral task
behavioral1
Sample
cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
General
-
Target
cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe
-
Size
524KB
-
MD5
6d876affccf4b9be765d462ed5b5e6c9
-
SHA1
fbb771808fa9b0803ca411135fcd19ee47d0ed9e
-
SHA256
cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a
-
SHA512
612acdc38cca5c1406312cebdb909770d6a3fd0be3424af214ec28a9957af7f8ab925dd41cfc8af6e1a0987c60c9913637a0e30c7eaffb3dfefcea90dec8a8ca
-
SSDEEP
6144:7IXsL0tvrSVz1DnemeYbpsnEf78AoXh6KkiD0OofzA+/VygHUSCnDU:7IXsgtvm1De5YlOx6lzBH46Ut4
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" gtyelk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" gtyelk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" xsglwjgvhcq.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" xsglwjgvhcq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" gtyelk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" gtyelk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" gtyelk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" xsglwjgvhcq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" xsglwjgvhcq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" xsglwjgvhcq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" gtyelk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" gtyelk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" gtyelk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" gtyelk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" gtyelk.exe -
Adds policy Run key to start application 2 TTPs 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vhlqw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zxnewgdwoyxysdunq.exe" gtyelk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ixemvwku = "ghaupccytgimjxrntrcd.exe" gtyelk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vhlqw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ghaupccytgimjxrntrcd.exe" gtyelk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vhlqw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ihyqjusmfqqsnzrlpl.exe" gtyelk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ixemvwku = "ghaupccytgimjxrntrcd.exe" xsglwjgvhcq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run gtyelk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ixemvwku = "ttleykjeyklokxqlqnx.exe" gtyelk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ixemvwku = "speuluqiziggzjzr.exe" gtyelk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ixemvwku = "vxrmiwxuqehmkzuryxjlf.exe" gtyelk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vhlqw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ttleykjeyklokxqlqnx.exe" gtyelk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ixemvwku = "ttleykjeyklokxqlqnx.exe" gtyelk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vhlqw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vxrmiwxuqehmkzuryxjlf.exe" gtyelk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run gtyelk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vhlqw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\speuluqiziggzjzr.exe" gtyelk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ixemvwku = "zxnewgdwoyxysdunq.exe" gtyelk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vhlqw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zxnewgdwoyxysdunq.exe" gtyelk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ixemvwku = "ihyqjusmfqqsnzrlpl.exe" gtyelk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ixemvwku = "vxrmiwxuqehmkzuryxjlf.exe" gtyelk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vhlqw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ghaupccytgimjxrntrcd.exe" gtyelk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vhlqw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vxrmiwxuqehmkzuryxjlf.exe" gtyelk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run xsglwjgvhcq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vhlqw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ghaupccytgimjxrntrcd.exe" xsglwjgvhcq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ixemvwku = "ihyqjusmfqqsnzrlpl.exe" gtyelk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vhlqw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\speuluqiziggzjzr.exe" gtyelk.exe -
Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" gtyelk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" gtyelk.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" gtyelk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" gtyelk.exe Set value (int) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" xsglwjgvhcq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" xsglwjgvhcq.exe -
Executes dropped EXE 3 IoCs
pid Process 4312 xsglwjgvhcq.exe 3376 gtyelk.exe 3604 gtyelk.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe Key value queried \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation xsglwjgvhcq.exe -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run gtyelk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nfpamqhugkd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ghaupccytgimjxrntrcd.exe ." gtyelk.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\sjscnqgsdg = "vxrmiwxuqehmkzuryxjlf.exe ." gtyelk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\gtyelk = "speuluqiziggzjzr.exe" gtyelk.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\sjscnqgsdg = "zxnewgdwoyxysdunq.exe ." gtyelk.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce xsglwjgvhcq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zpxgqshsc = "zxnewgdwoyxysdunq.exe" gtyelk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\gtyelk = "ttleykjeyklokxqlqnx.exe" gtyelk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nfpamqhugkd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ihyqjusmfqqsnzrlpl.exe ." gtyelk.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zpxgqshsc = "ghaupccytgimjxrntrcd.exe" xsglwjgvhcq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gtyelk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\speuluqiziggzjzr.exe" gtyelk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kdoanskylqkg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zxnewgdwoyxysdunq.exe" gtyelk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\gtyelk = "ihyqjusmfqqsnzrlpl.exe" gtyelk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kdoanskylqkg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ttleykjeyklokxqlqnx.exe" gtyelk.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\thnuccp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ttleykjeyklokxqlqnx.exe ." gtyelk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nfpamqhugkd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vxrmiwxuqehmkzuryxjlf.exe ." xsglwjgvhcq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\thnuccp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vxrmiwxuqehmkzuryxjlf.exe ." xsglwjgvhcq.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nfpamqhugkd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ttleykjeyklokxqlqnx.exe ." gtyelk.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\sjscnqgsdg = "vxrmiwxuqehmkzuryxjlf.exe ." gtyelk.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gtyelk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zxnewgdwoyxysdunq.exe" gtyelk.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gtyelk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ihyqjusmfqqsnzrlpl.exe" gtyelk.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zpxgqshsc = "ttleykjeyklokxqlqnx.exe" gtyelk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\thnuccp = "speuluqiziggzjzr.exe ." gtyelk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kdoanskylqkg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ghaupccytgimjxrntrcd.exe" gtyelk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kdoanskylqkg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\speuluqiziggzjzr.exe" gtyelk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kdoanskylqkg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\speuluqiziggzjzr.exe" gtyelk.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gtyelk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ghaupccytgimjxrntrcd.exe" gtyelk.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\thnuccp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\speuluqiziggzjzr.exe ." gtyelk.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\sjscnqgsdg = "ttleykjeyklokxqlqnx.exe ." gtyelk.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gtyelk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vxrmiwxuqehmkzuryxjlf.exe" gtyelk.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run gtyelk.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gtyelk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\speuluqiziggzjzr.exe" gtyelk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nfpamqhugkd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ghaupccytgimjxrntrcd.exe ." gtyelk.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\thnuccp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\speuluqiziggzjzr.exe ." gtyelk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\gtyelk = "ghaupccytgimjxrntrcd.exe" gtyelk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nfpamqhugkd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\speuluqiziggzjzr.exe ." gtyelk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\gtyelk = "ghaupccytgimjxrntrcd.exe" gtyelk.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\thnuccp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vxrmiwxuqehmkzuryxjlf.exe ." gtyelk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\thnuccp = "ghaupccytgimjxrntrcd.exe ." gtyelk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nfpamqhugkd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zxnewgdwoyxysdunq.exe ." gtyelk.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run gtyelk.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zpxgqshsc = "ghaupccytgimjxrntrcd.exe" gtyelk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kdoanskylqkg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vxrmiwxuqehmkzuryxjlf.exe" gtyelk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\thnuccp = "speuluqiziggzjzr.exe ." gtyelk.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gtyelk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ttleykjeyklokxqlqnx.exe" gtyelk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\gtyelk = "zxnewgdwoyxysdunq.exe" gtyelk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\thnuccp = "ttleykjeyklokxqlqnx.exe ." gtyelk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nfpamqhugkd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ihyqjusmfqqsnzrlpl.exe ." gtyelk.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run xsglwjgvhcq.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce xsglwjgvhcq.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce gtyelk.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zpxgqshsc = "vxrmiwxuqehmkzuryxjlf.exe" gtyelk.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zpxgqshsc = "vxrmiwxuqehmkzuryxjlf.exe" gtyelk.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\sjscnqgsdg = "ghaupccytgimjxrntrcd.exe ." gtyelk.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gtyelk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vxrmiwxuqehmkzuryxjlf.exe" gtyelk.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\thnuccp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vxrmiwxuqehmkzuryxjlf.exe ." gtyelk.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run xsglwjgvhcq.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce gtyelk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nfpamqhugkd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vxrmiwxuqehmkzuryxjlf.exe ." gtyelk.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\sjscnqgsdg = "ihyqjusmfqqsnzrlpl.exe ." gtyelk.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\sjscnqgsdg = "ghaupccytgimjxrntrcd.exe ." gtyelk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nfpamqhugkd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zxnewgdwoyxysdunq.exe ." gtyelk.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\thnuccp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ihyqjusmfqqsnzrlpl.exe ." gtyelk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\thnuccp = "zxnewgdwoyxysdunq.exe ." gtyelk.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA gtyelk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" xsglwjgvhcq.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA xsglwjgvhcq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" gtyelk.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA gtyelk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" gtyelk.exe -
Looks up external IP address via web service 6 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 98 www.showmyipaddress.com 103 whatismyip.everdot.org 108 whatismyipaddress.com 118 whatismyip.everdot.org 45 whatismyip.everdot.org 84 whatismyipaddress.com -
Drops file in System32 directory 25 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ttleykjeyklokxqlqnx.exe gtyelk.exe File opened for modification C:\Windows\SysWOW64\speuluqiziggzjzr.exe xsglwjgvhcq.exe File opened for modification C:\Windows\SysWOW64\zxnewgdwoyxysdunq.exe xsglwjgvhcq.exe File opened for modification C:\Windows\SysWOW64\speuluqiziggzjzr.exe gtyelk.exe File opened for modification C:\Windows\SysWOW64\ghaupccytgimjxrntrcd.exe gtyelk.exe File opened for modification C:\Windows\SysWOW64\vxrmiwxuqehmkzuryxjlf.exe gtyelk.exe File opened for modification C:\Windows\SysWOW64\mxaejgqwbykyfdhndlgruydakq.ses gtyelk.exe File created C:\Windows\SysWOW64\mxaejgqwbykyfdhndlgruydakq.ses gtyelk.exe File opened for modification C:\Windows\SysWOW64\njxmckfwmurqirgxyrxthwmupgwebasbqhibh.rgw gtyelk.exe File opened for modification C:\Windows\SysWOW64\ihyqjusmfqqsnzrlpl.exe xsglwjgvhcq.exe File opened for modification C:\Windows\SysWOW64\vxrmiwxuqehmkzuryxjlf.exe xsglwjgvhcq.exe File opened for modification C:\Windows\SysWOW64\mpkgdsuspeiondzxffsvqm.exe xsglwjgvhcq.exe File created C:\Windows\SysWOW64\njxmckfwmurqirgxyrxthwmupgwebasbqhibh.rgw gtyelk.exe File opened for modification C:\Windows\SysWOW64\ihyqjusmfqqsnzrlpl.exe gtyelk.exe File opened for modification C:\Windows\SysWOW64\mpkgdsuspeiondzxffsvqm.exe gtyelk.exe File opened for modification C:\Windows\SysWOW64\speuluqiziggzjzr.exe gtyelk.exe File opened for modification C:\Windows\SysWOW64\zxnewgdwoyxysdunq.exe gtyelk.exe File opened for modification C:\Windows\SysWOW64\ihyqjusmfqqsnzrlpl.exe gtyelk.exe File opened for modification C:\Windows\SysWOW64\ttleykjeyklokxqlqnx.exe xsglwjgvhcq.exe File opened for modification C:\Windows\SysWOW64\ghaupccytgimjxrntrcd.exe xsglwjgvhcq.exe File opened for modification C:\Windows\SysWOW64\zxnewgdwoyxysdunq.exe gtyelk.exe File opened for modification C:\Windows\SysWOW64\ttleykjeyklokxqlqnx.exe gtyelk.exe File opened for modification C:\Windows\SysWOW64\mpkgdsuspeiondzxffsvqm.exe gtyelk.exe File opened for modification C:\Windows\SysWOW64\ghaupccytgimjxrntrcd.exe gtyelk.exe File opened for modification C:\Windows\SysWOW64\vxrmiwxuqehmkzuryxjlf.exe gtyelk.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\mxaejgqwbykyfdhndlgruydakq.ses gtyelk.exe File created C:\Program Files (x86)\mxaejgqwbykyfdhndlgruydakq.ses gtyelk.exe File opened for modification C:\Program Files (x86)\njxmckfwmurqirgxyrxthwmupgwebasbqhibh.rgw gtyelk.exe File created C:\Program Files (x86)\njxmckfwmurqirgxyrxthwmupgwebasbqhibh.rgw gtyelk.exe -
Drops file in Windows directory 25 IoCs
description ioc Process File opened for modification C:\Windows\mpkgdsuspeiondzxffsvqm.exe gtyelk.exe File opened for modification C:\Windows\ihyqjusmfqqsnzrlpl.exe xsglwjgvhcq.exe File opened for modification C:\Windows\ttleykjeyklokxqlqnx.exe xsglwjgvhcq.exe File opened for modification C:\Windows\ghaupccytgimjxrntrcd.exe gtyelk.exe File opened for modification C:\Windows\ghaupccytgimjxrntrcd.exe gtyelk.exe File opened for modification C:\Windows\vxrmiwxuqehmkzuryxjlf.exe gtyelk.exe File opened for modification C:\Windows\speuluqiziggzjzr.exe gtyelk.exe File opened for modification C:\Windows\ttleykjeyklokxqlqnx.exe gtyelk.exe File opened for modification C:\Windows\ihyqjusmfqqsnzrlpl.exe gtyelk.exe File opened for modification C:\Windows\vxrmiwxuqehmkzuryxjlf.exe gtyelk.exe File opened for modification C:\Windows\ttleykjeyklokxqlqnx.exe gtyelk.exe File opened for modification C:\Windows\mxaejgqwbykyfdhndlgruydakq.ses gtyelk.exe File opened for modification C:\Windows\speuluqiziggzjzr.exe xsglwjgvhcq.exe File opened for modification C:\Windows\zxnewgdwoyxysdunq.exe xsglwjgvhcq.exe File opened for modification C:\Windows\ghaupccytgimjxrntrcd.exe xsglwjgvhcq.exe File opened for modification C:\Windows\mpkgdsuspeiondzxffsvqm.exe xsglwjgvhcq.exe File opened for modification C:\Windows\zxnewgdwoyxysdunq.exe gtyelk.exe File created C:\Windows\mxaejgqwbykyfdhndlgruydakq.ses gtyelk.exe File opened for modification C:\Windows\njxmckfwmurqirgxyrxthwmupgwebasbqhibh.rgw gtyelk.exe File created C:\Windows\njxmckfwmurqirgxyrxthwmupgwebasbqhibh.rgw gtyelk.exe File opened for modification C:\Windows\vxrmiwxuqehmkzuryxjlf.exe xsglwjgvhcq.exe File opened for modification C:\Windows\ihyqjusmfqqsnzrlpl.exe gtyelk.exe File opened for modification C:\Windows\mpkgdsuspeiondzxffsvqm.exe gtyelk.exe File opened for modification C:\Windows\speuluqiziggzjzr.exe gtyelk.exe File opened for modification C:\Windows\zxnewgdwoyxysdunq.exe gtyelk.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1680 cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe 1680 cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe 1680 cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe 1680 cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe 1680 cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe 1680 cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe 1680 cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe 1680 cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe 1680 cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe 1680 cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe 1680 cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe 1680 cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe 1680 cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe 1680 cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe 1680 cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe 1680 cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe 1680 cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe 1680 cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe 1680 cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe 1680 cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe 1680 cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe 1680 cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe 1680 cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe 1680 cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe 1680 cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe 1680 cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe 1680 cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe 1680 cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe 1680 cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe 1680 cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe 1680 cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe 1680 cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe 3376 gtyelk.exe 3376 gtyelk.exe 1680 cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe 1680 cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe 1680 cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe 1680 cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe 1680 cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe 1680 cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe 1680 cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe 1680 cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe 1680 cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe 1680 cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe 1680 cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe 1680 cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe 1680 cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe 1680 cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe 1680 cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe 1680 cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe 1680 cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe 1680 cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe 1680 cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe 1680 cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe 1680 cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe 1680 cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe 1680 cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe 1680 cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe 1680 cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe 1680 cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe 1680 cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe 1680 cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe 1680 cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe 1680 cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3376 gtyelk.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1680 wrote to memory of 4312 1680 cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe 87 PID 1680 wrote to memory of 4312 1680 cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe 87 PID 1680 wrote to memory of 4312 1680 cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe 87 PID 4312 wrote to memory of 3376 4312 xsglwjgvhcq.exe 88 PID 4312 wrote to memory of 3376 4312 xsglwjgvhcq.exe 88 PID 4312 wrote to memory of 3376 4312 xsglwjgvhcq.exe 88 PID 4312 wrote to memory of 3604 4312 xsglwjgvhcq.exe 89 PID 4312 wrote to memory of 3604 4312 xsglwjgvhcq.exe 89 PID 4312 wrote to memory of 3604 4312 xsglwjgvhcq.exe 89 -
System policy modification 1 TTPs 39 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" gtyelk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" gtyelk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" gtyelk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" xsglwjgvhcq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" xsglwjgvhcq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" gtyelk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" xsglwjgvhcq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" gtyelk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System gtyelk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" gtyelk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" gtyelk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" gtyelk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System xsglwjgvhcq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System gtyelk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" gtyelk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" gtyelk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" gtyelk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" gtyelk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" gtyelk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" xsglwjgvhcq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" xsglwjgvhcq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" gtyelk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" gtyelk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer gtyelk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" xsglwjgvhcq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" xsglwjgvhcq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" gtyelk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" gtyelk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer xsglwjgvhcq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" xsglwjgvhcq.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer gtyelk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" gtyelk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" gtyelk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" gtyelk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" xsglwjgvhcq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" gtyelk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" gtyelk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" xsglwjgvhcq.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" xsglwjgvhcq.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe"C:\Users\Admin\AppData\Local\Temp\cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\xsglwjgvhcq.exe"C:\Users\Admin\AppData\Local\Temp\xsglwjgvhcq.exe" "c:\users\admin\appdata\local\temp\cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a.exe*"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\gtyelk.exe"C:\Users\Admin\AppData\Local\Temp\gtyelk.exe" "-C:\Users\Admin\AppData\Local\Temp\speuluqiziggzjzr.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:3376
-
-
C:\Users\Admin\AppData\Local\Temp\gtyelk.exe"C:\Users\Admin\AppData\Local\Temp\gtyelk.exe" "-C:\Users\Admin\AppData\Local\Temp\speuluqiziggzjzr.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- System policy modification
PID:3604
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
524KB
MD56d876affccf4b9be765d462ed5b5e6c9
SHA1fbb771808fa9b0803ca411135fcd19ee47d0ed9e
SHA256cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a
SHA512612acdc38cca5c1406312cebdb909770d6a3fd0be3424af214ec28a9957af7f8ab925dd41cfc8af6e1a0987c60c9913637a0e30c7eaffb3dfefcea90dec8a8ca
-
Filesize
724KB
MD57737e9a530730b5320deed9cdd3552bc
SHA1e426f3f47e8c91a47ada51abdbd1886af97dec79
SHA256511de226aa13070a121249d75fd5ef23226868e5929155783730f489ce9335ef
SHA512ed7dc56dc3b1afbee9f9be59c45a55955253d3aa4fcf0246883b84bb3da72a0d706eee271c9d177fedb49db4946cfddcbe43d696629dcf9232c4b9e019aa18c8
-
Filesize
724KB
MD57737e9a530730b5320deed9cdd3552bc
SHA1e426f3f47e8c91a47ada51abdbd1886af97dec79
SHA256511de226aa13070a121249d75fd5ef23226868e5929155783730f489ce9335ef
SHA512ed7dc56dc3b1afbee9f9be59c45a55955253d3aa4fcf0246883b84bb3da72a0d706eee271c9d177fedb49db4946cfddcbe43d696629dcf9232c4b9e019aa18c8
-
Filesize
724KB
MD57737e9a530730b5320deed9cdd3552bc
SHA1e426f3f47e8c91a47ada51abdbd1886af97dec79
SHA256511de226aa13070a121249d75fd5ef23226868e5929155783730f489ce9335ef
SHA512ed7dc56dc3b1afbee9f9be59c45a55955253d3aa4fcf0246883b84bb3da72a0d706eee271c9d177fedb49db4946cfddcbe43d696629dcf9232c4b9e019aa18c8
-
Filesize
524KB
MD56d876affccf4b9be765d462ed5b5e6c9
SHA1fbb771808fa9b0803ca411135fcd19ee47d0ed9e
SHA256cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a
SHA512612acdc38cca5c1406312cebdb909770d6a3fd0be3424af214ec28a9957af7f8ab925dd41cfc8af6e1a0987c60c9913637a0e30c7eaffb3dfefcea90dec8a8ca
-
Filesize
524KB
MD56d876affccf4b9be765d462ed5b5e6c9
SHA1fbb771808fa9b0803ca411135fcd19ee47d0ed9e
SHA256cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a
SHA512612acdc38cca5c1406312cebdb909770d6a3fd0be3424af214ec28a9957af7f8ab925dd41cfc8af6e1a0987c60c9913637a0e30c7eaffb3dfefcea90dec8a8ca
-
Filesize
524KB
MD56d876affccf4b9be765d462ed5b5e6c9
SHA1fbb771808fa9b0803ca411135fcd19ee47d0ed9e
SHA256cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a
SHA512612acdc38cca5c1406312cebdb909770d6a3fd0be3424af214ec28a9957af7f8ab925dd41cfc8af6e1a0987c60c9913637a0e30c7eaffb3dfefcea90dec8a8ca
-
Filesize
524KB
MD56d876affccf4b9be765d462ed5b5e6c9
SHA1fbb771808fa9b0803ca411135fcd19ee47d0ed9e
SHA256cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a
SHA512612acdc38cca5c1406312cebdb909770d6a3fd0be3424af214ec28a9957af7f8ab925dd41cfc8af6e1a0987c60c9913637a0e30c7eaffb3dfefcea90dec8a8ca
-
Filesize
524KB
MD56d876affccf4b9be765d462ed5b5e6c9
SHA1fbb771808fa9b0803ca411135fcd19ee47d0ed9e
SHA256cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a
SHA512612acdc38cca5c1406312cebdb909770d6a3fd0be3424af214ec28a9957af7f8ab925dd41cfc8af6e1a0987c60c9913637a0e30c7eaffb3dfefcea90dec8a8ca
-
Filesize
320KB
MD58520562835b2d08fe703af454237c887
SHA1b486f4b83603a47b572d9ad398c4f15263482e7f
SHA2560816dd593349b804a1c21e8c8aada16e5cd5f3ff110d8b25284623616e7dd4f4
SHA512258fbb50c43e54c31af23ac0e99611190d47e7e8e554f144b24629a5a87e26d39ba516fcc2ae404fe4f90f3a053db3487d43dd6cf9f143e4a0ece25d46ab5621
-
Filesize
320KB
MD58520562835b2d08fe703af454237c887
SHA1b486f4b83603a47b572d9ad398c4f15263482e7f
SHA2560816dd593349b804a1c21e8c8aada16e5cd5f3ff110d8b25284623616e7dd4f4
SHA512258fbb50c43e54c31af23ac0e99611190d47e7e8e554f144b24629a5a87e26d39ba516fcc2ae404fe4f90f3a053db3487d43dd6cf9f143e4a0ece25d46ab5621
-
Filesize
524KB
MD56d876affccf4b9be765d462ed5b5e6c9
SHA1fbb771808fa9b0803ca411135fcd19ee47d0ed9e
SHA256cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a
SHA512612acdc38cca5c1406312cebdb909770d6a3fd0be3424af214ec28a9957af7f8ab925dd41cfc8af6e1a0987c60c9913637a0e30c7eaffb3dfefcea90dec8a8ca
-
Filesize
524KB
MD56d876affccf4b9be765d462ed5b5e6c9
SHA1fbb771808fa9b0803ca411135fcd19ee47d0ed9e
SHA256cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a
SHA512612acdc38cca5c1406312cebdb909770d6a3fd0be3424af214ec28a9957af7f8ab925dd41cfc8af6e1a0987c60c9913637a0e30c7eaffb3dfefcea90dec8a8ca
-
Filesize
524KB
MD56d876affccf4b9be765d462ed5b5e6c9
SHA1fbb771808fa9b0803ca411135fcd19ee47d0ed9e
SHA256cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a
SHA512612acdc38cca5c1406312cebdb909770d6a3fd0be3424af214ec28a9957af7f8ab925dd41cfc8af6e1a0987c60c9913637a0e30c7eaffb3dfefcea90dec8a8ca
-
Filesize
524KB
MD56d876affccf4b9be765d462ed5b5e6c9
SHA1fbb771808fa9b0803ca411135fcd19ee47d0ed9e
SHA256cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a
SHA512612acdc38cca5c1406312cebdb909770d6a3fd0be3424af214ec28a9957af7f8ab925dd41cfc8af6e1a0987c60c9913637a0e30c7eaffb3dfefcea90dec8a8ca
-
Filesize
524KB
MD56d876affccf4b9be765d462ed5b5e6c9
SHA1fbb771808fa9b0803ca411135fcd19ee47d0ed9e
SHA256cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a
SHA512612acdc38cca5c1406312cebdb909770d6a3fd0be3424af214ec28a9957af7f8ab925dd41cfc8af6e1a0987c60c9913637a0e30c7eaffb3dfefcea90dec8a8ca
-
Filesize
524KB
MD56d876affccf4b9be765d462ed5b5e6c9
SHA1fbb771808fa9b0803ca411135fcd19ee47d0ed9e
SHA256cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a
SHA512612acdc38cca5c1406312cebdb909770d6a3fd0be3424af214ec28a9957af7f8ab925dd41cfc8af6e1a0987c60c9913637a0e30c7eaffb3dfefcea90dec8a8ca
-
Filesize
524KB
MD56d876affccf4b9be765d462ed5b5e6c9
SHA1fbb771808fa9b0803ca411135fcd19ee47d0ed9e
SHA256cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a
SHA512612acdc38cca5c1406312cebdb909770d6a3fd0be3424af214ec28a9957af7f8ab925dd41cfc8af6e1a0987c60c9913637a0e30c7eaffb3dfefcea90dec8a8ca
-
Filesize
524KB
MD56d876affccf4b9be765d462ed5b5e6c9
SHA1fbb771808fa9b0803ca411135fcd19ee47d0ed9e
SHA256cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a
SHA512612acdc38cca5c1406312cebdb909770d6a3fd0be3424af214ec28a9957af7f8ab925dd41cfc8af6e1a0987c60c9913637a0e30c7eaffb3dfefcea90dec8a8ca
-
Filesize
524KB
MD56d876affccf4b9be765d462ed5b5e6c9
SHA1fbb771808fa9b0803ca411135fcd19ee47d0ed9e
SHA256cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a
SHA512612acdc38cca5c1406312cebdb909770d6a3fd0be3424af214ec28a9957af7f8ab925dd41cfc8af6e1a0987c60c9913637a0e30c7eaffb3dfefcea90dec8a8ca
-
Filesize
524KB
MD56d876affccf4b9be765d462ed5b5e6c9
SHA1fbb771808fa9b0803ca411135fcd19ee47d0ed9e
SHA256cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a
SHA512612acdc38cca5c1406312cebdb909770d6a3fd0be3424af214ec28a9957af7f8ab925dd41cfc8af6e1a0987c60c9913637a0e30c7eaffb3dfefcea90dec8a8ca
-
Filesize
524KB
MD56d876affccf4b9be765d462ed5b5e6c9
SHA1fbb771808fa9b0803ca411135fcd19ee47d0ed9e
SHA256cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a
SHA512612acdc38cca5c1406312cebdb909770d6a3fd0be3424af214ec28a9957af7f8ab925dd41cfc8af6e1a0987c60c9913637a0e30c7eaffb3dfefcea90dec8a8ca
-
Filesize
524KB
MD56d876affccf4b9be765d462ed5b5e6c9
SHA1fbb771808fa9b0803ca411135fcd19ee47d0ed9e
SHA256cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a
SHA512612acdc38cca5c1406312cebdb909770d6a3fd0be3424af214ec28a9957af7f8ab925dd41cfc8af6e1a0987c60c9913637a0e30c7eaffb3dfefcea90dec8a8ca
-
Filesize
524KB
MD56d876affccf4b9be765d462ed5b5e6c9
SHA1fbb771808fa9b0803ca411135fcd19ee47d0ed9e
SHA256cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a
SHA512612acdc38cca5c1406312cebdb909770d6a3fd0be3424af214ec28a9957af7f8ab925dd41cfc8af6e1a0987c60c9913637a0e30c7eaffb3dfefcea90dec8a8ca
-
Filesize
524KB
MD56d876affccf4b9be765d462ed5b5e6c9
SHA1fbb771808fa9b0803ca411135fcd19ee47d0ed9e
SHA256cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a
SHA512612acdc38cca5c1406312cebdb909770d6a3fd0be3424af214ec28a9957af7f8ab925dd41cfc8af6e1a0987c60c9913637a0e30c7eaffb3dfefcea90dec8a8ca
-
Filesize
524KB
MD56d876affccf4b9be765d462ed5b5e6c9
SHA1fbb771808fa9b0803ca411135fcd19ee47d0ed9e
SHA256cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a
SHA512612acdc38cca5c1406312cebdb909770d6a3fd0be3424af214ec28a9957af7f8ab925dd41cfc8af6e1a0987c60c9913637a0e30c7eaffb3dfefcea90dec8a8ca
-
Filesize
524KB
MD56d876affccf4b9be765d462ed5b5e6c9
SHA1fbb771808fa9b0803ca411135fcd19ee47d0ed9e
SHA256cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a
SHA512612acdc38cca5c1406312cebdb909770d6a3fd0be3424af214ec28a9957af7f8ab925dd41cfc8af6e1a0987c60c9913637a0e30c7eaffb3dfefcea90dec8a8ca
-
Filesize
524KB
MD56d876affccf4b9be765d462ed5b5e6c9
SHA1fbb771808fa9b0803ca411135fcd19ee47d0ed9e
SHA256cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a
SHA512612acdc38cca5c1406312cebdb909770d6a3fd0be3424af214ec28a9957af7f8ab925dd41cfc8af6e1a0987c60c9913637a0e30c7eaffb3dfefcea90dec8a8ca
-
Filesize
524KB
MD56d876affccf4b9be765d462ed5b5e6c9
SHA1fbb771808fa9b0803ca411135fcd19ee47d0ed9e
SHA256cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a
SHA512612acdc38cca5c1406312cebdb909770d6a3fd0be3424af214ec28a9957af7f8ab925dd41cfc8af6e1a0987c60c9913637a0e30c7eaffb3dfefcea90dec8a8ca
-
Filesize
524KB
MD56d876affccf4b9be765d462ed5b5e6c9
SHA1fbb771808fa9b0803ca411135fcd19ee47d0ed9e
SHA256cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a
SHA512612acdc38cca5c1406312cebdb909770d6a3fd0be3424af214ec28a9957af7f8ab925dd41cfc8af6e1a0987c60c9913637a0e30c7eaffb3dfefcea90dec8a8ca
-
Filesize
524KB
MD56d876affccf4b9be765d462ed5b5e6c9
SHA1fbb771808fa9b0803ca411135fcd19ee47d0ed9e
SHA256cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a
SHA512612acdc38cca5c1406312cebdb909770d6a3fd0be3424af214ec28a9957af7f8ab925dd41cfc8af6e1a0987c60c9913637a0e30c7eaffb3dfefcea90dec8a8ca
-
Filesize
524KB
MD56d876affccf4b9be765d462ed5b5e6c9
SHA1fbb771808fa9b0803ca411135fcd19ee47d0ed9e
SHA256cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a
SHA512612acdc38cca5c1406312cebdb909770d6a3fd0be3424af214ec28a9957af7f8ab925dd41cfc8af6e1a0987c60c9913637a0e30c7eaffb3dfefcea90dec8a8ca
-
Filesize
524KB
MD56d876affccf4b9be765d462ed5b5e6c9
SHA1fbb771808fa9b0803ca411135fcd19ee47d0ed9e
SHA256cc5302e5c02a5faff7a95df266bb2bae22881ba04465ebbf5d6cfbb18a69fa5a
SHA512612acdc38cca5c1406312cebdb909770d6a3fd0be3424af214ec28a9957af7f8ab925dd41cfc8af6e1a0987c60c9913637a0e30c7eaffb3dfefcea90dec8a8ca