efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

Analysis

max time kernel
152s
max time network
195s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
04/12/2022, 13:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
Size

524KB
MD5

f2bee96df56e120e5496568a17919a38
SHA1

48177f9e7e03b5c719032eca70164009629906d6
SHA256

efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA512

23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
SSDEEP

6144:GEIXsL0tvrSVz1DnemeYbpsnEf78AoXh6KkiD0OofzA+/VygHUSCnDU:GEIXsgtvm1De5YlOx6lzBH46Ut4

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	uvlgepmyefv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	lsxbfk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	lsxbfk.exe

UAC bypass 3 TTPs 12 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	uvlgepmyefv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	uvlgepmyefv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	uvlgepmyefv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	lsxbfk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	uvlgepmyefv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsxbfk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsxbfk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsxbfk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsxbfk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsxbfk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	lsxbfk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsxbfk.exe

Adds policy Run key to start application 2 TTPs 18 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rwzb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ewmbqgguodkghlcfx.exe"	lsxbfk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ygmrwcs = "yskbskmcypywzfydxjd.exe"	lsxbfk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rwzb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xodrfutgzntoorhj.exe"	lsxbfk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ygmrwcs = "lgzrjcfwtlvuyfzfanib.exe"	uvlgepmyefv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ygmrwcs = "xodrfutgzntoorhj.exe"	uvlgepmyefv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ygmrwcs = "ngxnduvkfvdachzdwh.exe"	lsxbfk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ygmrwcs = "ngxnduvkfvdachzdwh.exe"	lsxbfk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rwzb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ngxnduvkfvdachzdwh.exe"	uvlgepmyefv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ygmrwcs = "ewmbqgguodkghlcfx.exe"	lsxbfk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rwzb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\awqjcwasqjuuzhcjftpjc.exe"	lsxbfk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rwzb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ewmbqgguodkghlcfx.exe"	lsxbfk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rwzb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lgzrjcfwtlvuyfzfanib.exe"	lsxbfk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	uvlgepmyefv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	lsxbfk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rwzb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yskbskmcypywzfydxjd.exe"	lsxbfk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	lsxbfk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rwzb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yskbskmcypywzfydxjd.exe"	lsxbfk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ygmrwcs = "ewmbqgguodkghlcfx.exe"	lsxbfk.exe

Disables RegEdit via registry modification 6 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	lsxbfk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	lsxbfk.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	uvlgepmyefv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	uvlgepmyefv.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	lsxbfk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	lsxbfk.exe

Executes dropped EXE 3 IoCs

pid	Process
292	uvlgepmyefv.exe
468	lsxbfk.exe
1712	lsxbfk.exe

Loads dropped DLL 6 IoCs

pid	Process
1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
292	uvlgepmyefv.exe
292	uvlgepmyefv.exe
292	uvlgepmyefv.exe
292	uvlgepmyefv.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\agknq = "xodrfutgzntoorhj.exe"	lsxbfk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\seoxgqksgpq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ewmbqgguodkghlcfx.exe"	lsxbfk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\lsxbfk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lgzrjcfwtlvuyfzfanib.exe ."	lsxbfk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\eowdkskqc = "yskbskmcypywzfydxjd.exe ."	uvlgepmyefv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lsxbfk = "yskbskmcypywzfydxjd.exe ."	uvlgepmyefv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	lsxbfk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\agknq = "lgzrjcfwtlvuyfzfanib.exe"	lsxbfk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\eowdkskqc = "yskbskmcypywzfydxjd.exe ."	lsxbfk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\lsxbfk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ewmbqgguodkghlcfx.exe ."	uvlgepmyefv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\agknq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lgzrjcfwtlvuyfzfanib.exe"	lsxbfk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\eowdkskqc = "lgzrjcfwtlvuyfzfanib.exe ."	lsxbfk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\seoxgqksgpq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ewmbqgguodkghlcfx.exe"	lsxbfk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xirzhqjqdl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ngxnduvkfvdachzdwh.exe ."	lsxbfk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\agknq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\awqjcwasqjuuzhcjftpjc.exe"	lsxbfk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\agknq = "awqjcwasqjuuzhcjftpjc.exe"	lsxbfk.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	lsxbfk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xirzhqjqdl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\awqjcwasqjuuzhcjftpjc.exe ."	lsxbfk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\eowdkskqc = "ngxnduvkfvdachzdwh.exe ."	lsxbfk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lsxbfk = "ngxnduvkfvdachzdwh.exe ."	lsxbfk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xirzhqjqdl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xodrfutgzntoorhj.exe ."	lsxbfk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\eowdkskqc = "yskbskmcypywzfydxjd.exe ."	lsxbfk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\agknq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yskbskmcypywzfydxjd.exe"	lsxbfk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\agknq = "awqjcwasqjuuzhcjftpjc.exe"	uvlgepmyefv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lsxbfk = "ngxnduvkfvdachzdwh.exe ."	uvlgepmyefv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\seoxgqksgpq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xodrfutgzntoorhj.exe"	uvlgepmyefv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	lsxbfk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lsxbfk = "xodrfutgzntoorhj.exe ."	lsxbfk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\nwdjpwns = "xodrfutgzntoorhj.exe"	uvlgepmyefv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lsxbfk = "ngxnduvkfvdachzdwh.exe ."	lsxbfk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\eowdkskqc = "lgzrjcfwtlvuyfzfanib.exe ."	lsxbfk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\seoxgqksgpq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ngxnduvkfvdachzdwh.exe"	lsxbfk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\agknq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lgzrjcfwtlvuyfzfanib.exe"	uvlgepmyefv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\seoxgqksgpq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yskbskmcypywzfydxjd.exe"	lsxbfk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	uvlgepmyefv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\nwdjpwns = "ngxnduvkfvdachzdwh.exe"	lsxbfk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xirzhqjqdl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yskbskmcypywzfydxjd.exe ."	lsxbfk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\lsxbfk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ngxnduvkfvdachzdwh.exe ."	lsxbfk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\lsxbfk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yskbskmcypywzfydxjd.exe ."	lsxbfk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\agknq = "xodrfutgzntoorhj.exe"	lsxbfk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xirzhqjqdl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ewmbqgguodkghlcfx.exe ."	lsxbfk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\nwdjpwns = "lgzrjcfwtlvuyfzfanib.exe"	uvlgepmyefv.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	lsxbfk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\nwdjpwns = "yskbskmcypywzfydxjd.exe"	lsxbfk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\eowdkskqc = "xodrfutgzntoorhj.exe ."	lsxbfk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\agknq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ewmbqgguodkghlcfx.exe"	lsxbfk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\seoxgqksgpq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xodrfutgzntoorhj.exe"	lsxbfk.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	uvlgepmyefv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	lsxbfk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\seoxgqksgpq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\awqjcwasqjuuzhcjftpjc.exe"	lsxbfk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\nwdjpwns = "yskbskmcypywzfydxjd.exe"	lsxbfk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	uvlgepmyefv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xirzhqjqdl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ngxnduvkfvdachzdwh.exe ."	uvlgepmyefv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\seoxgqksgpq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ewmbqgguodkghlcfx.exe"	uvlgepmyefv.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	lsxbfk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\agknq = "lgzrjcfwtlvuyfzfanib.exe"	lsxbfk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\seoxgqksgpq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yskbskmcypywzfydxjd.exe"	lsxbfk.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	uvlgepmyefv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\eowdkskqc = "awqjcwasqjuuzhcjftpjc.exe ."	uvlgepmyefv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xirzhqjqdl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\awqjcwasqjuuzhcjftpjc.exe ."	uvlgepmyefv.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lsxbfk = "awqjcwasqjuuzhcjftpjc.exe ."	lsxbfk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\agknq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ngxnduvkfvdachzdwh.exe"	lsxbfk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	lsxbfk.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	lsxbfk.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\nwdjpwns = "awqjcwasqjuuzhcjftpjc.exe"	lsxbfk.exe

Checks whether UAC is enabled 1 TTPs 6 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsxbfk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsxbfk.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lsxbfk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	uvlgepmyefv.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	uvlgepmyefv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsxbfk.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	www.showmyipaddress.com
5	whatismyipaddress.com
2	whatismyip.everdot.org

Drops file in System32 directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\rojdxsxqpjvwclhpmbytnh.exe	uvlgepmyefv.exe
File opened for modification	C:\Windows\SysWOW64\siwjwkiumzeyxzopfndrerfdphuztsujkaiym.may	lsxbfk.exe
File opened for modification	C:\Windows\SysWOW64\ngxnduvkfvdachzdwh.exe	uvlgepmyefv.exe
File opened for modification	C:\Windows\SysWOW64\ewmbqgguodkghlcfx.exe	uvlgepmyefv.exe
File opened for modification	C:\Windows\SysWOW64\lgzrjcfwtlvuyfzfanib.exe	uvlgepmyefv.exe
File opened for modification	C:\Windows\SysWOW64\ewmbqgguodkghlcfx.exe	lsxbfk.exe
File opened for modification	C:\Windows\SysWOW64\yskbskmcypywzfydxjd.exe	lsxbfk.exe
File opened for modification	C:\Windows\SysWOW64\awqjcwasqjuuzhcjftpjc.exe	lsxbfk.exe
File opened for modification	C:\Windows\SysWOW64\xodrfutgzntoorhj.exe	lsxbfk.exe
File opened for modification	C:\Windows\SysWOW64\rojdxsxqpjvwclhpmbytnh.exe	lsxbfk.exe
File opened for modification	C:\Windows\SysWOW64\xodrfutgzntoorhj.exe	uvlgepmyefv.exe
File created	C:\Windows\SysWOW64\siwjwkiumzeyxzopfndrerfdphuztsujkaiym.may	lsxbfk.exe
File opened for modification	C:\Windows\SysWOW64\rojdxsxqpjvwclhpmbytnh.exe	lsxbfk.exe
File opened for modification	C:\Windows\SysWOW64\ngxnduvkfvdachzdwh.exe	lsxbfk.exe
File opened for modification	C:\Windows\SysWOW64\yskbskmcypywzfydxjd.exe	lsxbfk.exe
File created	C:\Windows\SysWOW64\rwzbdgtubdxgulpfkhmprtwjkr.nwk	lsxbfk.exe
File opened for modification	C:\Windows\SysWOW64\ngxnduvkfvdachzdwh.exe	lsxbfk.exe
File opened for modification	C:\Windows\SysWOW64\awqjcwasqjuuzhcjftpjc.exe	uvlgepmyefv.exe
File opened for modification	C:\Windows\SysWOW64\xodrfutgzntoorhj.exe	lsxbfk.exe
File opened for modification	C:\Windows\SysWOW64\lgzrjcfwtlvuyfzfanib.exe	lsxbfk.exe
File opened for modification	C:\Windows\SysWOW64\ewmbqgguodkghlcfx.exe	lsxbfk.exe
File opened for modification	C:\Windows\SysWOW64\lgzrjcfwtlvuyfzfanib.exe	lsxbfk.exe
File opened for modification	C:\Windows\SysWOW64\awqjcwasqjuuzhcjftpjc.exe	lsxbfk.exe
File opened for modification	C:\Windows\SysWOW64\rwzbdgtubdxgulpfkhmprtwjkr.nwk	lsxbfk.exe
File opened for modification	C:\Windows\SysWOW64\yskbskmcypywzfydxjd.exe	uvlgepmyefv.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\rwzbdgtubdxgulpfkhmprtwjkr.nwk	lsxbfk.exe
File created	C:\Program Files (x86)\rwzbdgtubdxgulpfkhmprtwjkr.nwk	lsxbfk.exe
File opened for modification	C:\Program Files (x86)\siwjwkiumzeyxzopfndrerfdphuztsujkaiym.may	lsxbfk.exe
File created	C:\Program Files (x86)\siwjwkiumzeyxzopfndrerfdphuztsujkaiym.may	lsxbfk.exe

Drops file in Windows directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\xodrfutgzntoorhj.exe	lsxbfk.exe
File opened for modification	C:\Windows\ngxnduvkfvdachzdwh.exe	lsxbfk.exe
File opened for modification	C:\Windows\yskbskmcypywzfydxjd.exe	lsxbfk.exe
File opened for modification	C:\Windows\rojdxsxqpjvwclhpmbytnh.exe	lsxbfk.exe
File opened for modification	C:\Windows\rwzbdgtubdxgulpfkhmprtwjkr.nwk	lsxbfk.exe
File opened for modification	C:\Windows\ngxnduvkfvdachzdwh.exe	uvlgepmyefv.exe
File opened for modification	C:\Windows\awqjcwasqjuuzhcjftpjc.exe	uvlgepmyefv.exe
File opened for modification	C:\Windows\ewmbqgguodkghlcfx.exe	lsxbfk.exe
File opened for modification	C:\Windows\yskbskmcypywzfydxjd.exe	lsxbfk.exe
File opened for modification	C:\Windows\lgzrjcfwtlvuyfzfanib.exe	lsxbfk.exe
File opened for modification	C:\Windows\siwjwkiumzeyxzopfndrerfdphuztsujkaiym.may	lsxbfk.exe
File opened for modification	C:\Windows\lgzrjcfwtlvuyfzfanib.exe	uvlgepmyefv.exe
File opened for modification	C:\Windows\rojdxsxqpjvwclhpmbytnh.exe	uvlgepmyefv.exe
File opened for modification	C:\Windows\xodrfutgzntoorhj.exe	lsxbfk.exe
File opened for modification	C:\Windows\ngxnduvkfvdachzdwh.exe	lsxbfk.exe
File opened for modification	C:\Windows\ewmbqgguodkghlcfx.exe	lsxbfk.exe
File opened for modification	C:\Windows\awqjcwasqjuuzhcjftpjc.exe	lsxbfk.exe
File opened for modification	C:\Windows\awqjcwasqjuuzhcjftpjc.exe	lsxbfk.exe
File created	C:\Windows\siwjwkiumzeyxzopfndrerfdphuztsujkaiym.may	lsxbfk.exe
File opened for modification	C:\Windows\xodrfutgzntoorhj.exe	uvlgepmyefv.exe
File opened for modification	C:\Windows\ewmbqgguodkghlcfx.exe	uvlgepmyefv.exe
File opened for modification	C:\Windows\yskbskmcypywzfydxjd.exe	uvlgepmyefv.exe
File opened for modification	C:\Windows\lgzrjcfwtlvuyfzfanib.exe	lsxbfk.exe
File opened for modification	C:\Windows\rojdxsxqpjvwclhpmbytnh.exe	lsxbfk.exe
File created	C:\Windows\rwzbdgtubdxgulpfkhmprtwjkr.nwk	lsxbfk.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
1712	lsxbfk.exe
1712	lsxbfk.exe
1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1712	lsxbfk.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1060 wrote to memory of 292	1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe	28
PID 1060 wrote to memory of 292	1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe	28
PID 1060 wrote to memory of 292	1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe	28
PID 1060 wrote to memory of 292	1060	efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe	28
PID 292 wrote to memory of 468	292	uvlgepmyefv.exe	29
PID 292 wrote to memory of 468	292	uvlgepmyefv.exe	29
PID 292 wrote to memory of 468	292	uvlgepmyefv.exe	29
PID 292 wrote to memory of 468	292	uvlgepmyefv.exe	29
PID 292 wrote to memory of 1712	292	uvlgepmyefv.exe	30
PID 292 wrote to memory of 1712	292	uvlgepmyefv.exe	30
PID 292 wrote to memory of 1712	292	uvlgepmyefv.exe	30
PID 292 wrote to memory of 1712	292	uvlgepmyefv.exe	30

System policy modification 1 TTPs 39 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	lsxbfk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	lsxbfk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	uvlgepmyefv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	uvlgepmyefv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	lsxbfk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	lsxbfk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsxbfk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	lsxbfk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	uvlgepmyefv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	lsxbfk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	lsxbfk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	lsxbfk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	uvlgepmyefv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	lsxbfk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	uvlgepmyefv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	uvlgepmyefv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	uvlgepmyefv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	lsxbfk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsxbfk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	lsxbfk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	uvlgepmyefv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	uvlgepmyefv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	uvlgepmyefv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsxbfk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	lsxbfk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	lsxbfk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	lsxbfk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	uvlgepmyefv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	lsxbfk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	lsxbfk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	lsxbfk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	lsxbfk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	lsxbfk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	uvlgepmyefv.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	uvlgepmyefv.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	lsxbfk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	lsxbfk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	lsxbfk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	lsxbfk.exe

C:\Users\Admin\AppData\Local\Temp\efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
"C:\Users\Admin\AppData\Local\Temp\efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1060
- C:\Users\Admin\AppData\Local\Temp\uvlgepmyefv.exe
  "C:\Users\Admin\AppData\Local\Temp\uvlgepmyefv.exe" "c:\users\admin\appdata\local\temp\efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe*"
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Adds policy Run key to start application
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:292
- - C:\Users\Admin\AppData\Local\Temp\lsxbfk.exe
    "C:\Users\Admin\AppData\Local\Temp\lsxbfk.exe" "-C:\Users\Admin\AppData\Local\Temp\xodrfutgzntoorhj.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System policy modification
    PID:468
- - C:\Users\Admin\AppData\Local\Temp\lsxbfk.exe
    "C:\Users\Admin\AppData\Local\Temp\lsxbfk.exe" "-C:\Users\Admin\AppData\Local\Temp\xodrfutgzntoorhj.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - System policy modification
    PID:1712

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\awqjcwasqjuuzhcjftpjc.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\awqjcwasqjuuzhcjftpjc.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\awqjcwasqjuuzhcjftpjc.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\ewmbqgguodkghlcfx.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\ewmbqgguodkghlcfx.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\ewmbqgguodkghlcfx.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\lgzrjcfwtlvuyfzfanib.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\lgzrjcfwtlvuyfzfanib.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\lgzrjcfwtlvuyfzfanib.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\lsxbfk.exe

Filesize
700KB

MD5
fb2658e072747d7abf701daaad8b8817

SHA1
0471c81afbfc737c1946c0ea20050311a4b9d3ff

SHA256
b82e2e021b181568160718eccb57f2c7a1062a0a633cd369e7cc5fbc4fa1641a

SHA512
8a4d7bc26c17198fe17f2e2395ef5b3cc71fdabcd729134b7ee84ceebc3f986ce0d7e1ffefe85aa94ba5743a866065ced24d077004a364c9b6d13037fbe46cc6

Download Submit
C:\Users\Admin\AppData\Local\Temp\lsxbfk.exe

Filesize
700KB

MD5
fb2658e072747d7abf701daaad8b8817

SHA1
0471c81afbfc737c1946c0ea20050311a4b9d3ff

SHA256
b82e2e021b181568160718eccb57f2c7a1062a0a633cd369e7cc5fbc4fa1641a

SHA512
8a4d7bc26c17198fe17f2e2395ef5b3cc71fdabcd729134b7ee84ceebc3f986ce0d7e1ffefe85aa94ba5743a866065ced24d077004a364c9b6d13037fbe46cc6

Download Submit
C:\Users\Admin\AppData\Local\Temp\ngxnduvkfvdachzdwh.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\ngxnduvkfvdachzdwh.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\ngxnduvkfvdachzdwh.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\rojdxsxqpjvwclhpmbytnh.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\rojdxsxqpjvwclhpmbytnh.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\rojdxsxqpjvwclhpmbytnh.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\uvlgepmyefv.exe

Filesize
320KB

MD5
7898a21395faefe6a4673158dbaa9339

SHA1
9877ceaff6e0da570bc143816023cf5307ee9d41

SHA256
ad44375641cf470da36c57c8e7637ea856620826c4460ad5346055cfd202d2d3

SHA512
77c6f82004b809d79603aaec766706254b42c56acc343ca96427e6bb7c46473b92f6f32af6d9b3199da3ea4d8da9c789af6737235560dccf02cb6c8e48d94f92

Download Submit
C:\Users\Admin\AppData\Local\Temp\uvlgepmyefv.exe

Filesize
320KB

MD5
7898a21395faefe6a4673158dbaa9339

SHA1
9877ceaff6e0da570bc143816023cf5307ee9d41

SHA256
ad44375641cf470da36c57c8e7637ea856620826c4460ad5346055cfd202d2d3

SHA512
77c6f82004b809d79603aaec766706254b42c56acc343ca96427e6bb7c46473b92f6f32af6d9b3199da3ea4d8da9c789af6737235560dccf02cb6c8e48d94f92

Download Submit
C:\Users\Admin\AppData\Local\Temp\xodrfutgzntoorhj.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\yskbskmcypywzfydxjd.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\yskbskmcypywzfydxjd.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit
C:\Users\Admin\AppData\Local\Temp\yskbskmcypywzfydxjd.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit
C:\Windows\SysWOW64\awqjcwasqjuuzhcjftpjc.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit
C:\Windows\SysWOW64\ewmbqgguodkghlcfx.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit
C:\Windows\SysWOW64\lgzrjcfwtlvuyfzfanib.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit
C:\Windows\SysWOW64\ngxnduvkfvdachzdwh.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit
C:\Windows\SysWOW64\rojdxsxqpjvwclhpmbytnh.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit
C:\Windows\SysWOW64\xodrfutgzntoorhj.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit
C:\Windows\SysWOW64\yskbskmcypywzfydxjd.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit
C:\Windows\awqjcwasqjuuzhcjftpjc.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit
C:\Windows\awqjcwasqjuuzhcjftpjc.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit
C:\Windows\ewmbqgguodkghlcfx.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit
C:\Windows\ewmbqgguodkghlcfx.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit
C:\Windows\lgzrjcfwtlvuyfzfanib.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit
C:\Windows\lgzrjcfwtlvuyfzfanib.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit
C:\Windows\ngxnduvkfvdachzdwh.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit
C:\Windows\ngxnduvkfvdachzdwh.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit
C:\Windows\rojdxsxqpjvwclhpmbytnh.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit
C:\Windows\rojdxsxqpjvwclhpmbytnh.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit
C:\Windows\xodrfutgzntoorhj.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit
C:\Windows\xodrfutgzntoorhj.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit
C:\Windows\yskbskmcypywzfydxjd.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit
C:\Windows\yskbskmcypywzfydxjd.exe

Filesize
524KB

MD5
f2bee96df56e120e5496568a17919a38

SHA1
48177f9e7e03b5c719032eca70164009629906d6

SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070

SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f

Download Submit
\Users\Admin\AppData\Local\Temp\lsxbfk.exe

Filesize
700KB

MD5
fb2658e072747d7abf701daaad8b8817

SHA1
0471c81afbfc737c1946c0ea20050311a4b9d3ff

SHA256
b82e2e021b181568160718eccb57f2c7a1062a0a633cd369e7cc5fbc4fa1641a

SHA512
8a4d7bc26c17198fe17f2e2395ef5b3cc71fdabcd729134b7ee84ceebc3f986ce0d7e1ffefe85aa94ba5743a866065ced24d077004a364c9b6d13037fbe46cc6

Download Submit
\Users\Admin\AppData\Local\Temp\lsxbfk.exe

Filesize
700KB

MD5
fb2658e072747d7abf701daaad8b8817

SHA1
0471c81afbfc737c1946c0ea20050311a4b9d3ff

SHA256
b82e2e021b181568160718eccb57f2c7a1062a0a633cd369e7cc5fbc4fa1641a

SHA512
8a4d7bc26c17198fe17f2e2395ef5b3cc71fdabcd729134b7ee84ceebc3f986ce0d7e1ffefe85aa94ba5743a866065ced24d077004a364c9b6d13037fbe46cc6

Download Submit
\Users\Admin\AppData\Local\Temp\lsxbfk.exe

Filesize
700KB

MD5
fb2658e072747d7abf701daaad8b8817

SHA1
0471c81afbfc737c1946c0ea20050311a4b9d3ff

SHA256
b82e2e021b181568160718eccb57f2c7a1062a0a633cd369e7cc5fbc4fa1641a

SHA512
8a4d7bc26c17198fe17f2e2395ef5b3cc71fdabcd729134b7ee84ceebc3f986ce0d7e1ffefe85aa94ba5743a866065ced24d077004a364c9b6d13037fbe46cc6

Download Submit
\Users\Admin\AppData\Local\Temp\lsxbfk.exe

Filesize
700KB

MD5
fb2658e072747d7abf701daaad8b8817

SHA1
0471c81afbfc737c1946c0ea20050311a4b9d3ff

SHA256
b82e2e021b181568160718eccb57f2c7a1062a0a633cd369e7cc5fbc4fa1641a

SHA512
8a4d7bc26c17198fe17f2e2395ef5b3cc71fdabcd729134b7ee84ceebc3f986ce0d7e1ffefe85aa94ba5743a866065ced24d077004a364c9b6d13037fbe46cc6

Download Submit
\Users\Admin\AppData\Local\Temp\uvlgepmyefv.exe

Filesize
320KB

MD5
7898a21395faefe6a4673158dbaa9339

SHA1
9877ceaff6e0da570bc143816023cf5307ee9d41

SHA256
ad44375641cf470da36c57c8e7637ea856620826c4460ad5346055cfd202d2d3

SHA512
77c6f82004b809d79603aaec766706254b42c56acc343ca96427e6bb7c46473b92f6f32af6d9b3199da3ea4d8da9c789af6737235560dccf02cb6c8e48d94f92

Download Submit
\Users\Admin\AppData\Local\Temp\uvlgepmyefv.exe

Filesize
320KB

MD5
7898a21395faefe6a4673158dbaa9339

SHA1
9877ceaff6e0da570bc143816023cf5307ee9d41

SHA256
ad44375641cf470da36c57c8e7637ea856620826c4460ad5346055cfd202d2d3

SHA512
77c6f82004b809d79603aaec766706254b42c56acc343ca96427e6bb7c46473b92f6f32af6d9b3199da3ea4d8da9c789af6737235560dccf02cb6c8e48d94f92

Download Submit
memory/1060-54-0x0000000076941000-0x0000000076943000-memory.dmp

Filesize
8KB

Download