b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7

Analysis

max time kernel
181s
max time network
193s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 08:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe
Size

500KB
MD5

fbe2c90216392d893ebdf910ed6cd899
SHA1

d8caa015ed50248504332c87307c74cd386871df
SHA256

b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7
SHA512

39d8397281c0631ca0ae8787fd86b39b7bd933aaec435c234f3b31e8549844f2d7870752205b0daa4335c90971f650f8b72152c70a842c2f85cfabd50c754619
SSDEEP

12288:Vg5pBHxXptbN5ZRgOiBjw/C0AWzFjdTkkXBD:cH7tbrbIBjwuWR1kkxD

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	cchfzisvmmr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	ygjqcfq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	ygjqcfq.exe

UAC bypass 3 TTPs 12 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	cchfzisvmmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	ygjqcfq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	ygjqcfq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	ygjqcfq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	ygjqcfq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	ygjqcfq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cchfzisvmmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	cchfzisvmmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ygjqcfq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	ygjqcfq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	cchfzisvmmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ygjqcfq.exe

Adds policy Run key to start application 2 TTPs 19 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xioynthrxf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\awniizytkdmwltxqkxokb.exe"	cchfzisvmmr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	ygjqcfq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	ygjqcfq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xioynthrxf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yshaynkdsjqylrtkcnc.exe"	ygjqcfq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\oclyqzqdmxyah = "yshaynkdsjqylrtkcnc.exe"	ygjqcfq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\oclyqzqdmxyah = "ewjawjevixcitxxmc.exe"	ygjqcfq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\oclyqzqdmxyah = "ewjawjevixcitxxmc.exe"	ygjqcfq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\oclyqzqdmxyah = "lgwqpfdxnfnwkrumfrhc.exe"	ygjqcfq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	cchfzisvmmr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\oclyqzqdmxyah = "xoaqlxrhthlqadcq.exe"	cchfzisvmmr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\oclyqzqdmxyah = "ngumjxtlzpvcotukbl.exe"	ygjqcfq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xioynthrxf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xoaqlxrhthlqadcq.exe"	ygjqcfq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xioynthrxf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\awniizytkdmwltxqkxokb.exe"	ygjqcfq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xioynthrxf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ngumjxtlzpvcotukbl.exe"	ygjqcfq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xioynthrxf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lgwqpfdxnfnwkrumfrhc.exe"	ygjqcfq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xioynthrxf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ewjawjevixcitxxmc.exe"	ygjqcfq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\oclyqzqdmxyah = "awniizytkdmwltxqkxokb.exe"	ygjqcfq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xioynthrxf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xoaqlxrhthlqadcq.exe"	ygjqcfq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\oclyqzqdmxyah = "yshaynkdsjqylrtkcnc.exe"	ygjqcfq.exe

Disables RegEdit via registry modification 6 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	cchfzisvmmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	cchfzisvmmr.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	ygjqcfq.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	ygjqcfq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	ygjqcfq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	ygjqcfq.exe

Executes dropped EXE 3 IoCs

pid	Process
972	cchfzisvmmr.exe
524	ygjqcfq.exe
692	ygjqcfq.exe

Loads dropped DLL 6 IoCs

pid	Process
2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe
2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe
972	cchfzisvmmr.exe
972	cchfzisvmmr.exe
972	cchfzisvmmr.exe
972	cchfzisvmmr.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\selwmtitaji = "C:\\Users\\Admin\\AppData\\Local\\Temp\\awniizytkdmwltxqkxokb.exe"	ygjqcfq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\pckwnvlxfppq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xoaqlxrhthlqadcq.exe ."	ygjqcfq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pckwnvlxfppq = "xoaqlxrhthlqadcq.exe ."	ygjqcfq.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	ygjqcfq.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	ygjqcfq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\siticngvgtwajlj = "ewjawjevixcitxxmc.exe ."	ygjqcfq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\selwmtitaji = "xoaqlxrhthlqadcq.exe"	ygjqcfq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\selwmtitaji = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lgwqpfdxnfnwkrumfrhc.exe"	ygjqcfq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\pckwnvlxfppq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lgwqpfdxnfnwkrumfrhc.exe ."	ygjqcfq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xoaqlxrhthlqadcq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xoaqlxrhthlqadcq.exe ."	ygjqcfq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\selwmtitaji = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ewjawjevixcitxxmc.exe"	ygjqcfq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	cchfzisvmmr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\siticngvgtwajlj = "ngumjxtlzpvcotukbl.exe ."	cchfzisvmmr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	ygjqcfq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xoaqlxrhthlqadcq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lgwqpfdxnfnwkrumfrhc.exe ."	ygjqcfq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\selwmtitaji = "yshaynkdsjqylrtkcnc.exe"	ygjqcfq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ewjawjevixcitxxmc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ngumjxtlzpvcotukbl.exe"	ygjqcfq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xoaqlxrhthlqadcq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ngumjxtlzpvcotukbl.exe ."	ygjqcfq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pckwnvlxfppq = "lgwqpfdxnfnwkrumfrhc.exe ."	ygjqcfq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\peocvfxlvhjmuv = "ngumjxtlzpvcotukbl.exe"	ygjqcfq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\selwmtitaji = "C:\\Users\\Admin\\AppData\\Local\\Temp\\awniizytkdmwltxqkxokb.exe"	ygjqcfq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pckwnvlxfppq = "ewjawjevixcitxxmc.exe ."	ygjqcfq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\pckwnvlxfppq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lgwqpfdxnfnwkrumfrhc.exe ."	cchfzisvmmr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\selwmtitaji = "ngumjxtlzpvcotukbl.exe"	ygjqcfq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\siticngvgtwajlj = "yshaynkdsjqylrtkcnc.exe ."	ygjqcfq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ewjawjevixcitxxmc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yshaynkdsjqylrtkcnc.exe"	ygjqcfq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ewjawjevixcitxxmc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xoaqlxrhthlqadcq.exe"	ygjqcfq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\selwmtitaji = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ngumjxtlzpvcotukbl.exe"	ygjqcfq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\pckwnvlxfppq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lgwqpfdxnfnwkrumfrhc.exe ."	ygjqcfq.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	cchfzisvmmr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ewjawjevixcitxxmc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yshaynkdsjqylrtkcnc.exe"	cchfzisvmmr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	ygjqcfq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pckwnvlxfppq = "ngumjxtlzpvcotukbl.exe ."	ygjqcfq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\siticngvgtwajlj = "lgwqpfdxnfnwkrumfrhc.exe ."	ygjqcfq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\selwmtitaji = "awniizytkdmwltxqkxokb.exe"	cchfzisvmmr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xoaqlxrhthlqadcq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\awniizytkdmwltxqkxokb.exe ."	cchfzisvmmr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xoaqlxrhthlqadcq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lgwqpfdxnfnwkrumfrhc.exe ."	ygjqcfq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pckwnvlxfppq = "awniizytkdmwltxqkxokb.exe ."	ygjqcfq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\peocvfxlvhjmuv = "xoaqlxrhthlqadcq.exe"	ygjqcfq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	cchfzisvmmr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	ygjqcfq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	ygjqcfq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xoaqlxrhthlqadcq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yshaynkdsjqylrtkcnc.exe ."	ygjqcfq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\selwmtitaji = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xoaqlxrhthlqadcq.exe"	ygjqcfq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\pckwnvlxfppq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\awniizytkdmwltxqkxokb.exe ."	ygjqcfq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\selwmtitaji = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xoaqlxrhthlqadcq.exe"	cchfzisvmmr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ewjawjevixcitxxmc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ngumjxtlzpvcotukbl.exe"	ygjqcfq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ewjawjevixcitxxmc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xoaqlxrhthlqadcq.exe"	ygjqcfq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\selwmtitaji = "xoaqlxrhthlqadcq.exe"	ygjqcfq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ewjawjevixcitxxmc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\awniizytkdmwltxqkxokb.exe"	ygjqcfq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\pckwnvlxfppq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ngumjxtlzpvcotukbl.exe ."	ygjqcfq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\siticngvgtwajlj = "awniizytkdmwltxqkxokb.exe ."	ygjqcfq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\selwmtitaji = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yshaynkdsjqylrtkcnc.exe"	ygjqcfq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\pckwnvlxfppq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yshaynkdsjqylrtkcnc.exe ."	ygjqcfq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pckwnvlxfppq = "ewjawjevixcitxxmc.exe ."	ygjqcfq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\selwmtitaji = "yshaynkdsjqylrtkcnc.exe"	ygjqcfq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\selwmtitaji = "lgwqpfdxnfnwkrumfrhc.exe"	ygjqcfq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\peocvfxlvhjmuv = "yshaynkdsjqylrtkcnc.exe"	ygjqcfq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\siticngvgtwajlj = "awniizytkdmwltxqkxokb.exe ."	ygjqcfq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xoaqlxrhthlqadcq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ewjawjevixcitxxmc.exe ."	ygjqcfq.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	cchfzisvmmr.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	ygjqcfq.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	ygjqcfq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ewjawjevixcitxxmc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ewjawjevixcitxxmc.exe"	ygjqcfq.exe

Checks whether UAC is enabled 1 TTPs 6 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ygjqcfq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ygjqcfq.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ygjqcfq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cchfzisvmmr.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	cchfzisvmmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ygjqcfq.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
2	www.showmyipaddress.com
6	whatismyip.everdot.org
9	whatismyipaddress.com

Drops file in System32 directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\awniizytkdmwltxqkxokb.exe	ygjqcfq.exe
File created	C:\Windows\SysWOW64\figipntvttjawlwwxrpsqszx.fdd	ygjqcfq.exe
File opened for modification	C:\Windows\SysWOW64\xoaqlxrhthlqadcq.exe	cchfzisvmmr.exe
File opened for modification	C:\Windows\SysWOW64\ewjawjevixcitxxmc.exe	cchfzisvmmr.exe
File opened for modification	C:\Windows\SysWOW64\yshaynkdsjqylrtkcnc.exe	cchfzisvmmr.exe
File opened for modification	C:\Windows\SysWOW64\xoaqlxrhthlqadcq.exe	ygjqcfq.exe
File opened for modification	C:\Windows\SysWOW64\ngumjxtlzpvcotukbl.exe	ygjqcfq.exe
File opened for modification	C:\Windows\SysWOW64\figipntvttjawlwwxrpsqszx.fdd	ygjqcfq.exe
File opened for modification	C:\Windows\SysWOW64\oclyqzqdmxyahhdoafoclyqzqdmxyahhdoa.ocl	ygjqcfq.exe
File opened for modification	C:\Windows\SysWOW64\rogcdvvrjdnyoxcwrfxumi.exe	cchfzisvmmr.exe
File opened for modification	C:\Windows\SysWOW64\ewjawjevixcitxxmc.exe	ygjqcfq.exe
File opened for modification	C:\Windows\SysWOW64\rogcdvvrjdnyoxcwrfxumi.exe	ygjqcfq.exe
File opened for modification	C:\Windows\SysWOW64\yshaynkdsjqylrtkcnc.exe	ygjqcfq.exe
File opened for modification	C:\Windows\SysWOW64\lgwqpfdxnfnwkrumfrhc.exe	ygjqcfq.exe
File opened for modification	C:\Windows\SysWOW64\awniizytkdmwltxqkxokb.exe	ygjqcfq.exe
File created	C:\Windows\SysWOW64\oclyqzqdmxyahhdoafoclyqzqdmxyahhdoa.ocl	ygjqcfq.exe
File opened for modification	C:\Windows\SysWOW64\ngumjxtlzpvcotukbl.exe	cchfzisvmmr.exe
File opened for modification	C:\Windows\SysWOW64\ngumjxtlzpvcotukbl.exe	ygjqcfq.exe
File opened for modification	C:\Windows\SysWOW64\lgwqpfdxnfnwkrumfrhc.exe	ygjqcfq.exe
File opened for modification	C:\Windows\SysWOW64\yshaynkdsjqylrtkcnc.exe	ygjqcfq.exe
File opened for modification	C:\Windows\SysWOW64\ewjawjevixcitxxmc.exe	ygjqcfq.exe
File opened for modification	C:\Windows\SysWOW64\rogcdvvrjdnyoxcwrfxumi.exe	ygjqcfq.exe
File opened for modification	C:\Windows\SysWOW64\lgwqpfdxnfnwkrumfrhc.exe	cchfzisvmmr.exe
File opened for modification	C:\Windows\SysWOW64\awniizytkdmwltxqkxokb.exe	cchfzisvmmr.exe
File opened for modification	C:\Windows\SysWOW64\xoaqlxrhthlqadcq.exe	ygjqcfq.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\oclyqzqdmxyahhdoafoclyqzqdmxyahhdoa.ocl	ygjqcfq.exe
File opened for modification	C:\Program Files (x86)\figipntvttjawlwwxrpsqszx.fdd	ygjqcfq.exe
File created	C:\Program Files (x86)\figipntvttjawlwwxrpsqszx.fdd	ygjqcfq.exe
File opened for modification	C:\Program Files (x86)\oclyqzqdmxyahhdoafoclyqzqdmxyahhdoa.ocl	ygjqcfq.exe

Drops file in Windows directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ewjawjevixcitxxmc.exe	ygjqcfq.exe
File opened for modification	C:\Windows\lgwqpfdxnfnwkrumfrhc.exe	ygjqcfq.exe
File opened for modification	C:\Windows\ngumjxtlzpvcotukbl.exe	ygjqcfq.exe
File opened for modification	C:\Windows\oclyqzqdmxyahhdoafoclyqzqdmxyahhdoa.ocl	ygjqcfq.exe
File created	C:\Windows\oclyqzqdmxyahhdoafoclyqzqdmxyahhdoa.ocl	ygjqcfq.exe
File opened for modification	C:\Windows\yshaynkdsjqylrtkcnc.exe	cchfzisvmmr.exe
File opened for modification	C:\Windows\rogcdvvrjdnyoxcwrfxumi.exe	cchfzisvmmr.exe
File opened for modification	C:\Windows\lgwqpfdxnfnwkrumfrhc.exe	cchfzisvmmr.exe
File opened for modification	C:\Windows\awniizytkdmwltxqkxokb.exe	cchfzisvmmr.exe
File opened for modification	C:\Windows\ngumjxtlzpvcotukbl.exe	ygjqcfq.exe
File opened for modification	C:\Windows\ewjawjevixcitxxmc.exe	ygjqcfq.exe
File opened for modification	C:\Windows\awniizytkdmwltxqkxokb.exe	ygjqcfq.exe
File opened for modification	C:\Windows\xoaqlxrhthlqadcq.exe	cchfzisvmmr.exe
File opened for modification	C:\Windows\ngumjxtlzpvcotukbl.exe	cchfzisvmmr.exe
File opened for modification	C:\Windows\rogcdvvrjdnyoxcwrfxumi.exe	ygjqcfq.exe
File opened for modification	C:\Windows\rogcdvvrjdnyoxcwrfxumi.exe	ygjqcfq.exe
File opened for modification	C:\Windows\figipntvttjawlwwxrpsqszx.fdd	ygjqcfq.exe
File opened for modification	C:\Windows\xoaqlxrhthlqadcq.exe	ygjqcfq.exe
File opened for modification	C:\Windows\lgwqpfdxnfnwkrumfrhc.exe	ygjqcfq.exe
File opened for modification	C:\Windows\yshaynkdsjqylrtkcnc.exe	ygjqcfq.exe
File opened for modification	C:\Windows\yshaynkdsjqylrtkcnc.exe	ygjqcfq.exe
File opened for modification	C:\Windows\awniizytkdmwltxqkxokb.exe	ygjqcfq.exe
File created	C:\Windows\figipntvttjawlwwxrpsqszx.fdd	ygjqcfq.exe
File opened for modification	C:\Windows\ewjawjevixcitxxmc.exe	cchfzisvmmr.exe
File opened for modification	C:\Windows\xoaqlxrhthlqadcq.exe	ygjqcfq.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe
2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe
2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe
2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe
2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe
2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe
2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe
2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe
2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe
2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe
2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe
2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe
2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe
2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe
2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe
2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe
2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe
2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe
2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe
2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe
2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe
2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe
2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe
2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe
2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe
2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe
2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe
2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe
2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe
2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe
2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe
2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe
2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe
2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe
2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe
2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe
2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe
2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe
2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe
2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe
2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe
524	ygjqcfq.exe
2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe
2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe
2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe
2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe
2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe
2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe
2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe
2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe
2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe
2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe
2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe
2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe
2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe
2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe
2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe
2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe
2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe
2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe
2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe
2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe
2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe
2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	524	ygjqcfq.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 972	2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe	28
PID 2028 wrote to memory of 972	2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe	28
PID 2028 wrote to memory of 972	2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe	28
PID 2028 wrote to memory of 972	2028	b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe	28
PID 972 wrote to memory of 524	972	cchfzisvmmr.exe	29
PID 972 wrote to memory of 524	972	cchfzisvmmr.exe	29
PID 972 wrote to memory of 524	972	cchfzisvmmr.exe	29
PID 972 wrote to memory of 524	972	cchfzisvmmr.exe	29
PID 972 wrote to memory of 692	972	cchfzisvmmr.exe	30
PID 972 wrote to memory of 692	972	cchfzisvmmr.exe	30
PID 972 wrote to memory of 692	972	cchfzisvmmr.exe	30
PID 972 wrote to memory of 692	972	cchfzisvmmr.exe	30

System policy modification 1 TTPs 39 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	cchfzisvmmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	ygjqcfq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	cchfzisvmmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	ygjqcfq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	ygjqcfq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	ygjqcfq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cchfzisvmmr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	ygjqcfq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ygjqcfq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	ygjqcfq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	ygjqcfq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	ygjqcfq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	ygjqcfq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	cchfzisvmmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	cchfzisvmmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	cchfzisvmmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	ygjqcfq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	ygjqcfq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	ygjqcfq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	ygjqcfq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	ygjqcfq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	ygjqcfq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	ygjqcfq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ygjqcfq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	ygjqcfq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	ygjqcfq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	ygjqcfq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	cchfzisvmmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	cchfzisvmmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	cchfzisvmmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	ygjqcfq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	ygjqcfq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	ygjqcfq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	ygjqcfq.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	ygjqcfq.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	cchfzisvmmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	cchfzisvmmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	cchfzisvmmr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	cchfzisvmmr.exe

C:\Users\Admin\AppData\Local\Temp\b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe
"C:\Users\Admin\AppData\Local\Temp\b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Users\Admin\AppData\Local\Temp\cchfzisvmmr.exe
  "C:\Users\Admin\AppData\Local\Temp\cchfzisvmmr.exe" "c:\users\admin\appdata\local\temp\b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7.exe*"
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Adds policy Run key to start application
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:972
- - C:\Users\Admin\AppData\Local\Temp\ygjqcfq.exe
    "C:\Users\Admin\AppData\Local\Temp\ygjqcfq.exe" "-C:\Users\Admin\AppData\Local\Temp\xoaqlxrhthlqadcq.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - System policy modification
    PID:524
- - C:\Users\Admin\AppData\Local\Temp\ygjqcfq.exe
    "C:\Users\Admin\AppData\Local\Temp\ygjqcfq.exe" "-C:\Users\Admin\AppData\Local\Temp\xoaqlxrhthlqadcq.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System policy modification
    PID:692

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\awniizytkdmwltxqkxokb.exe

Filesize
500KB

MD5
fbe2c90216392d893ebdf910ed6cd899

SHA1
d8caa015ed50248504332c87307c74cd386871df

SHA256
b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7

SHA512
39d8397281c0631ca0ae8787fd86b39b7bd933aaec435c234f3b31e8549844f2d7870752205b0daa4335c90971f650f8b72152c70a842c2f85cfabd50c754619

Download Submit
C:\Users\Admin\AppData\Local\Temp\awniizytkdmwltxqkxokb.exe

Filesize
500KB

MD5
fbe2c90216392d893ebdf910ed6cd899

SHA1
d8caa015ed50248504332c87307c74cd386871df

SHA256
b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7

SHA512
39d8397281c0631ca0ae8787fd86b39b7bd933aaec435c234f3b31e8549844f2d7870752205b0daa4335c90971f650f8b72152c70a842c2f85cfabd50c754619

Download Submit
C:\Users\Admin\AppData\Local\Temp\awniizytkdmwltxqkxokb.exe

Filesize
500KB

MD5
fbe2c90216392d893ebdf910ed6cd899

SHA1
d8caa015ed50248504332c87307c74cd386871df

SHA256
b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7

SHA512
39d8397281c0631ca0ae8787fd86b39b7bd933aaec435c234f3b31e8549844f2d7870752205b0daa4335c90971f650f8b72152c70a842c2f85cfabd50c754619

Download Submit
C:\Users\Admin\AppData\Local\Temp\cchfzisvmmr.exe

Filesize
320KB

MD5
eb09c682903ecbd87f30b0366e008d8f

SHA1
59b0dc27c06ce536327490439a37751a3dbd5e38

SHA256
c4b122f7bab30363b472a3dffb8a7c61604c0ec4719ebd233ccbac8be0951be1

SHA512
83236c0955b81375666c10445d2cf5e4723b24e42e4ee5fb951f53945483be2fff5c8ef167f08cfad3accc162c61e750bb1039edbf09e26afe18cba2f994eb5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\cchfzisvmmr.exe

Filesize
320KB

MD5
eb09c682903ecbd87f30b0366e008d8f

SHA1
59b0dc27c06ce536327490439a37751a3dbd5e38

SHA256
c4b122f7bab30363b472a3dffb8a7c61604c0ec4719ebd233ccbac8be0951be1

SHA512
83236c0955b81375666c10445d2cf5e4723b24e42e4ee5fb951f53945483be2fff5c8ef167f08cfad3accc162c61e750bb1039edbf09e26afe18cba2f994eb5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\ewjawjevixcitxxmc.exe

Filesize
500KB

MD5
fbe2c90216392d893ebdf910ed6cd899

SHA1
d8caa015ed50248504332c87307c74cd386871df

SHA256
b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7

SHA512
39d8397281c0631ca0ae8787fd86b39b7bd933aaec435c234f3b31e8549844f2d7870752205b0daa4335c90971f650f8b72152c70a842c2f85cfabd50c754619

Download Submit
C:\Users\Admin\AppData\Local\Temp\ewjawjevixcitxxmc.exe

Filesize
500KB

MD5
fbe2c90216392d893ebdf910ed6cd899

SHA1
d8caa015ed50248504332c87307c74cd386871df

SHA256
b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7

SHA512
39d8397281c0631ca0ae8787fd86b39b7bd933aaec435c234f3b31e8549844f2d7870752205b0daa4335c90971f650f8b72152c70a842c2f85cfabd50c754619

Download Submit
C:\Users\Admin\AppData\Local\Temp\ewjawjevixcitxxmc.exe

Filesize
500KB

MD5
fbe2c90216392d893ebdf910ed6cd899

SHA1
d8caa015ed50248504332c87307c74cd386871df

SHA256
b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7

SHA512
39d8397281c0631ca0ae8787fd86b39b7bd933aaec435c234f3b31e8549844f2d7870752205b0daa4335c90971f650f8b72152c70a842c2f85cfabd50c754619

Download Submit
C:\Users\Admin\AppData\Local\Temp\lgwqpfdxnfnwkrumfrhc.exe

Filesize
500KB

MD5
fbe2c90216392d893ebdf910ed6cd899

SHA1
d8caa015ed50248504332c87307c74cd386871df

SHA256
b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7

SHA512
39d8397281c0631ca0ae8787fd86b39b7bd933aaec435c234f3b31e8549844f2d7870752205b0daa4335c90971f650f8b72152c70a842c2f85cfabd50c754619

Download Submit
C:\Users\Admin\AppData\Local\Temp\lgwqpfdxnfnwkrumfrhc.exe

Filesize
500KB

MD5
fbe2c90216392d893ebdf910ed6cd899

SHA1
d8caa015ed50248504332c87307c74cd386871df

SHA256
b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7

SHA512
39d8397281c0631ca0ae8787fd86b39b7bd933aaec435c234f3b31e8549844f2d7870752205b0daa4335c90971f650f8b72152c70a842c2f85cfabd50c754619

Download Submit
C:\Users\Admin\AppData\Local\Temp\ngumjxtlzpvcotukbl.exe

Filesize
500KB

MD5
fbe2c90216392d893ebdf910ed6cd899

SHA1
d8caa015ed50248504332c87307c74cd386871df

SHA256
b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7

SHA512
39d8397281c0631ca0ae8787fd86b39b7bd933aaec435c234f3b31e8549844f2d7870752205b0daa4335c90971f650f8b72152c70a842c2f85cfabd50c754619

Download Submit
C:\Users\Admin\AppData\Local\Temp\ngumjxtlzpvcotukbl.exe

Filesize
500KB

MD5
fbe2c90216392d893ebdf910ed6cd899

SHA1
d8caa015ed50248504332c87307c74cd386871df

SHA256
b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7

SHA512
39d8397281c0631ca0ae8787fd86b39b7bd933aaec435c234f3b31e8549844f2d7870752205b0daa4335c90971f650f8b72152c70a842c2f85cfabd50c754619

Download Submit
C:\Users\Admin\AppData\Local\Temp\rogcdvvrjdnyoxcwrfxumi.exe

Filesize
500KB

MD5
fbe2c90216392d893ebdf910ed6cd899

SHA1
d8caa015ed50248504332c87307c74cd386871df

SHA256
b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7

SHA512
39d8397281c0631ca0ae8787fd86b39b7bd933aaec435c234f3b31e8549844f2d7870752205b0daa4335c90971f650f8b72152c70a842c2f85cfabd50c754619

Download Submit
C:\Users\Admin\AppData\Local\Temp\rogcdvvrjdnyoxcwrfxumi.exe

Filesize
500KB

MD5
fbe2c90216392d893ebdf910ed6cd899

SHA1
d8caa015ed50248504332c87307c74cd386871df

SHA256
b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7

SHA512
39d8397281c0631ca0ae8787fd86b39b7bd933aaec435c234f3b31e8549844f2d7870752205b0daa4335c90971f650f8b72152c70a842c2f85cfabd50c754619

Download Submit
C:\Users\Admin\AppData\Local\Temp\rogcdvvrjdnyoxcwrfxumi.exe

Filesize
500KB

MD5
fbe2c90216392d893ebdf910ed6cd899

SHA1
d8caa015ed50248504332c87307c74cd386871df

SHA256
b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7

SHA512
39d8397281c0631ca0ae8787fd86b39b7bd933aaec435c234f3b31e8549844f2d7870752205b0daa4335c90971f650f8b72152c70a842c2f85cfabd50c754619

Download Submit
C:\Users\Admin\AppData\Local\Temp\xoaqlxrhthlqadcq.exe

Filesize
500KB

MD5
fbe2c90216392d893ebdf910ed6cd899

SHA1
d8caa015ed50248504332c87307c74cd386871df

SHA256
b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7

SHA512
39d8397281c0631ca0ae8787fd86b39b7bd933aaec435c234f3b31e8549844f2d7870752205b0daa4335c90971f650f8b72152c70a842c2f85cfabd50c754619

Download Submit
C:\Users\Admin\AppData\Local\Temp\ygjqcfq.exe

Filesize
712KB

MD5
01ae60c2582949032868e13ac7b84890

SHA1
c214d611db40dc291bdd67162f8b7f64ec5fb79a

SHA256
a7ea0fcac65c96e64b353bdc3744e857c1383c19b79cd3b24d6a3ed4f4e886bf

SHA512
5e86d6244e53e6658cf2ccd076958e46d7909185931b4c029d2dbf04ecfcf33bd403300476b6acfe9bafcbf1b9918ca903717fed4c9aad3f024e078ae4312005

Download Submit
C:\Users\Admin\AppData\Local\Temp\ygjqcfq.exe

Filesize
712KB

MD5
01ae60c2582949032868e13ac7b84890

SHA1
c214d611db40dc291bdd67162f8b7f64ec5fb79a

SHA256
a7ea0fcac65c96e64b353bdc3744e857c1383c19b79cd3b24d6a3ed4f4e886bf

SHA512
5e86d6244e53e6658cf2ccd076958e46d7909185931b4c029d2dbf04ecfcf33bd403300476b6acfe9bafcbf1b9918ca903717fed4c9aad3f024e078ae4312005

Download Submit
C:\Users\Admin\AppData\Local\Temp\yshaynkdsjqylrtkcnc.exe

Filesize
500KB

MD5
fbe2c90216392d893ebdf910ed6cd899

SHA1
d8caa015ed50248504332c87307c74cd386871df

SHA256
b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7

SHA512
39d8397281c0631ca0ae8787fd86b39b7bd933aaec435c234f3b31e8549844f2d7870752205b0daa4335c90971f650f8b72152c70a842c2f85cfabd50c754619

Download Submit
C:\Users\Admin\AppData\Local\Temp\yshaynkdsjqylrtkcnc.exe

Filesize
500KB

MD5
fbe2c90216392d893ebdf910ed6cd899

SHA1
d8caa015ed50248504332c87307c74cd386871df

SHA256
b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7

SHA512
39d8397281c0631ca0ae8787fd86b39b7bd933aaec435c234f3b31e8549844f2d7870752205b0daa4335c90971f650f8b72152c70a842c2f85cfabd50c754619

Download Submit
C:\Windows\SysWOW64\awniizytkdmwltxqkxokb.exe

Filesize
500KB

MD5
fbe2c90216392d893ebdf910ed6cd899

SHA1
d8caa015ed50248504332c87307c74cd386871df

SHA256
b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7

SHA512
39d8397281c0631ca0ae8787fd86b39b7bd933aaec435c234f3b31e8549844f2d7870752205b0daa4335c90971f650f8b72152c70a842c2f85cfabd50c754619

Download Submit
C:\Windows\SysWOW64\ewjawjevixcitxxmc.exe

Filesize
500KB

MD5
fbe2c90216392d893ebdf910ed6cd899

SHA1
d8caa015ed50248504332c87307c74cd386871df

SHA256
b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7

SHA512
39d8397281c0631ca0ae8787fd86b39b7bd933aaec435c234f3b31e8549844f2d7870752205b0daa4335c90971f650f8b72152c70a842c2f85cfabd50c754619

Download Submit
C:\Windows\SysWOW64\lgwqpfdxnfnwkrumfrhc.exe

Filesize
500KB

MD5
fbe2c90216392d893ebdf910ed6cd899

SHA1
d8caa015ed50248504332c87307c74cd386871df

SHA256
b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7

SHA512
39d8397281c0631ca0ae8787fd86b39b7bd933aaec435c234f3b31e8549844f2d7870752205b0daa4335c90971f650f8b72152c70a842c2f85cfabd50c754619

Download Submit
C:\Windows\SysWOW64\ngumjxtlzpvcotukbl.exe

Filesize
500KB

MD5
fbe2c90216392d893ebdf910ed6cd899

SHA1
d8caa015ed50248504332c87307c74cd386871df

SHA256
b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7

SHA512
39d8397281c0631ca0ae8787fd86b39b7bd933aaec435c234f3b31e8549844f2d7870752205b0daa4335c90971f650f8b72152c70a842c2f85cfabd50c754619

Download Submit
C:\Windows\SysWOW64\rogcdvvrjdnyoxcwrfxumi.exe

Filesize
500KB

MD5
fbe2c90216392d893ebdf910ed6cd899

SHA1
d8caa015ed50248504332c87307c74cd386871df

SHA256
b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7

SHA512
39d8397281c0631ca0ae8787fd86b39b7bd933aaec435c234f3b31e8549844f2d7870752205b0daa4335c90971f650f8b72152c70a842c2f85cfabd50c754619

Download Submit
C:\Windows\SysWOW64\xoaqlxrhthlqadcq.exe

Filesize
500KB

MD5
fbe2c90216392d893ebdf910ed6cd899

SHA1
d8caa015ed50248504332c87307c74cd386871df

SHA256
b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7

SHA512
39d8397281c0631ca0ae8787fd86b39b7bd933aaec435c234f3b31e8549844f2d7870752205b0daa4335c90971f650f8b72152c70a842c2f85cfabd50c754619

Download Submit
C:\Windows\SysWOW64\yshaynkdsjqylrtkcnc.exe

Filesize
500KB

MD5
fbe2c90216392d893ebdf910ed6cd899

SHA1
d8caa015ed50248504332c87307c74cd386871df

SHA256
b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7

SHA512
39d8397281c0631ca0ae8787fd86b39b7bd933aaec435c234f3b31e8549844f2d7870752205b0daa4335c90971f650f8b72152c70a842c2f85cfabd50c754619

Download Submit
C:\Windows\awniizytkdmwltxqkxokb.exe

Filesize
500KB

MD5
fbe2c90216392d893ebdf910ed6cd899

SHA1
d8caa015ed50248504332c87307c74cd386871df

SHA256
b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7

SHA512
39d8397281c0631ca0ae8787fd86b39b7bd933aaec435c234f3b31e8549844f2d7870752205b0daa4335c90971f650f8b72152c70a842c2f85cfabd50c754619

Download Submit
C:\Windows\awniizytkdmwltxqkxokb.exe

Filesize
500KB

MD5
fbe2c90216392d893ebdf910ed6cd899

SHA1
d8caa015ed50248504332c87307c74cd386871df

SHA256
b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7

SHA512
39d8397281c0631ca0ae8787fd86b39b7bd933aaec435c234f3b31e8549844f2d7870752205b0daa4335c90971f650f8b72152c70a842c2f85cfabd50c754619

Download Submit
C:\Windows\ewjawjevixcitxxmc.exe

Filesize
500KB

MD5
fbe2c90216392d893ebdf910ed6cd899

SHA1
d8caa015ed50248504332c87307c74cd386871df

SHA256
b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7

SHA512
39d8397281c0631ca0ae8787fd86b39b7bd933aaec435c234f3b31e8549844f2d7870752205b0daa4335c90971f650f8b72152c70a842c2f85cfabd50c754619

Download Submit
C:\Windows\ewjawjevixcitxxmc.exe

Filesize
500KB

MD5
fbe2c90216392d893ebdf910ed6cd899

SHA1
d8caa015ed50248504332c87307c74cd386871df

SHA256
b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7

SHA512
39d8397281c0631ca0ae8787fd86b39b7bd933aaec435c234f3b31e8549844f2d7870752205b0daa4335c90971f650f8b72152c70a842c2f85cfabd50c754619

Download Submit
C:\Windows\lgwqpfdxnfnwkrumfrhc.exe

Filesize
500KB

MD5
fbe2c90216392d893ebdf910ed6cd899

SHA1
d8caa015ed50248504332c87307c74cd386871df

SHA256
b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7

SHA512
39d8397281c0631ca0ae8787fd86b39b7bd933aaec435c234f3b31e8549844f2d7870752205b0daa4335c90971f650f8b72152c70a842c2f85cfabd50c754619

Download Submit
C:\Windows\lgwqpfdxnfnwkrumfrhc.exe

Filesize
500KB

MD5
fbe2c90216392d893ebdf910ed6cd899

SHA1
d8caa015ed50248504332c87307c74cd386871df

SHA256
b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7

SHA512
39d8397281c0631ca0ae8787fd86b39b7bd933aaec435c234f3b31e8549844f2d7870752205b0daa4335c90971f650f8b72152c70a842c2f85cfabd50c754619

Download Submit
C:\Windows\ngumjxtlzpvcotukbl.exe

Filesize
500KB

MD5
fbe2c90216392d893ebdf910ed6cd899

SHA1
d8caa015ed50248504332c87307c74cd386871df

SHA256
b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7

SHA512
39d8397281c0631ca0ae8787fd86b39b7bd933aaec435c234f3b31e8549844f2d7870752205b0daa4335c90971f650f8b72152c70a842c2f85cfabd50c754619

Download Submit
C:\Windows\ngumjxtlzpvcotukbl.exe

Filesize
500KB

MD5
fbe2c90216392d893ebdf910ed6cd899

SHA1
d8caa015ed50248504332c87307c74cd386871df

SHA256
b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7

SHA512
39d8397281c0631ca0ae8787fd86b39b7bd933aaec435c234f3b31e8549844f2d7870752205b0daa4335c90971f650f8b72152c70a842c2f85cfabd50c754619

Download Submit
C:\Windows\rogcdvvrjdnyoxcwrfxumi.exe

Filesize
500KB

MD5
fbe2c90216392d893ebdf910ed6cd899

SHA1
d8caa015ed50248504332c87307c74cd386871df

SHA256
b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7

SHA512
39d8397281c0631ca0ae8787fd86b39b7bd933aaec435c234f3b31e8549844f2d7870752205b0daa4335c90971f650f8b72152c70a842c2f85cfabd50c754619

Download Submit
C:\Windows\rogcdvvrjdnyoxcwrfxumi.exe

Filesize
500KB

MD5
fbe2c90216392d893ebdf910ed6cd899

SHA1
d8caa015ed50248504332c87307c74cd386871df

SHA256
b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7

SHA512
39d8397281c0631ca0ae8787fd86b39b7bd933aaec435c234f3b31e8549844f2d7870752205b0daa4335c90971f650f8b72152c70a842c2f85cfabd50c754619

Download Submit
C:\Windows\xoaqlxrhthlqadcq.exe

Filesize
500KB

MD5
fbe2c90216392d893ebdf910ed6cd899

SHA1
d8caa015ed50248504332c87307c74cd386871df

SHA256
b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7

SHA512
39d8397281c0631ca0ae8787fd86b39b7bd933aaec435c234f3b31e8549844f2d7870752205b0daa4335c90971f650f8b72152c70a842c2f85cfabd50c754619

Download Submit
C:\Windows\xoaqlxrhthlqadcq.exe

Filesize
500KB

MD5
fbe2c90216392d893ebdf910ed6cd899

SHA1
d8caa015ed50248504332c87307c74cd386871df

SHA256
b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7

SHA512
39d8397281c0631ca0ae8787fd86b39b7bd933aaec435c234f3b31e8549844f2d7870752205b0daa4335c90971f650f8b72152c70a842c2f85cfabd50c754619

Download Submit
C:\Windows\yshaynkdsjqylrtkcnc.exe

Filesize
500KB

MD5
fbe2c90216392d893ebdf910ed6cd899

SHA1
d8caa015ed50248504332c87307c74cd386871df

SHA256
b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7

SHA512
39d8397281c0631ca0ae8787fd86b39b7bd933aaec435c234f3b31e8549844f2d7870752205b0daa4335c90971f650f8b72152c70a842c2f85cfabd50c754619

Download Submit
C:\Windows\yshaynkdsjqylrtkcnc.exe

Filesize
500KB

MD5
fbe2c90216392d893ebdf910ed6cd899

SHA1
d8caa015ed50248504332c87307c74cd386871df

SHA256
b98a7651fd923ec967c4c71e0c50b38d3d587fc97e0c282ee2bafaa745dcb8f7

SHA512
39d8397281c0631ca0ae8787fd86b39b7bd933aaec435c234f3b31e8549844f2d7870752205b0daa4335c90971f650f8b72152c70a842c2f85cfabd50c754619

Download Submit
\Users\Admin\AppData\Local\Temp\cchfzisvmmr.exe

Filesize
320KB

MD5
eb09c682903ecbd87f30b0366e008d8f

SHA1
59b0dc27c06ce536327490439a37751a3dbd5e38

SHA256
c4b122f7bab30363b472a3dffb8a7c61604c0ec4719ebd233ccbac8be0951be1

SHA512
83236c0955b81375666c10445d2cf5e4723b24e42e4ee5fb951f53945483be2fff5c8ef167f08cfad3accc162c61e750bb1039edbf09e26afe18cba2f994eb5d

Download Submit
\Users\Admin\AppData\Local\Temp\cchfzisvmmr.exe

Filesize
320KB

MD5
eb09c682903ecbd87f30b0366e008d8f

SHA1
59b0dc27c06ce536327490439a37751a3dbd5e38

SHA256
c4b122f7bab30363b472a3dffb8a7c61604c0ec4719ebd233ccbac8be0951be1

SHA512
83236c0955b81375666c10445d2cf5e4723b24e42e4ee5fb951f53945483be2fff5c8ef167f08cfad3accc162c61e750bb1039edbf09e26afe18cba2f994eb5d

Download Submit
\Users\Admin\AppData\Local\Temp\ygjqcfq.exe

Filesize
712KB

MD5
01ae60c2582949032868e13ac7b84890

SHA1
c214d611db40dc291bdd67162f8b7f64ec5fb79a

SHA256
a7ea0fcac65c96e64b353bdc3744e857c1383c19b79cd3b24d6a3ed4f4e886bf

SHA512
5e86d6244e53e6658cf2ccd076958e46d7909185931b4c029d2dbf04ecfcf33bd403300476b6acfe9bafcbf1b9918ca903717fed4c9aad3f024e078ae4312005

Download Submit
\Users\Admin\AppData\Local\Temp\ygjqcfq.exe

Filesize
712KB

MD5
01ae60c2582949032868e13ac7b84890

SHA1
c214d611db40dc291bdd67162f8b7f64ec5fb79a

SHA256
a7ea0fcac65c96e64b353bdc3744e857c1383c19b79cd3b24d6a3ed4f4e886bf

SHA512
5e86d6244e53e6658cf2ccd076958e46d7909185931b4c029d2dbf04ecfcf33bd403300476b6acfe9bafcbf1b9918ca903717fed4c9aad3f024e078ae4312005

Download Submit
\Users\Admin\AppData\Local\Temp\ygjqcfq.exe

Filesize
712KB

MD5
01ae60c2582949032868e13ac7b84890

SHA1
c214d611db40dc291bdd67162f8b7f64ec5fb79a

SHA256
a7ea0fcac65c96e64b353bdc3744e857c1383c19b79cd3b24d6a3ed4f4e886bf

SHA512
5e86d6244e53e6658cf2ccd076958e46d7909185931b4c029d2dbf04ecfcf33bd403300476b6acfe9bafcbf1b9918ca903717fed4c9aad3f024e078ae4312005

Download Submit
\Users\Admin\AppData\Local\Temp\ygjqcfq.exe

Filesize
712KB

MD5
01ae60c2582949032868e13ac7b84890

SHA1
c214d611db40dc291bdd67162f8b7f64ec5fb79a

SHA256
a7ea0fcac65c96e64b353bdc3744e857c1383c19b79cd3b24d6a3ed4f4e886bf

SHA512
5e86d6244e53e6658cf2ccd076958e46d7909185931b4c029d2dbf04ecfcf33bd403300476b6acfe9bafcbf1b9918ca903717fed4c9aad3f024e078ae4312005

Download Submit
memory/2028-54-0x00000000767F1000-0x00000000767F3000-memory.dmp

Filesize
8KB

Download