Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
190s -
max time network
229s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
04/12/2022, 13:39
Static task
static1
Behavioral task
behavioral1
Sample
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
Resource
win10v2004-20221111-en
General
-
Target
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe
-
Size
524KB
-
MD5
f2bee96df56e120e5496568a17919a38
-
SHA1
48177f9e7e03b5c719032eca70164009629906d6
-
SHA256
efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
-
SHA512
23cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
SSDEEP
6144:GEIXsL0tvrSVz1DnemeYbpsnEf78AoXh6KkiD0OofzA+/VygHUSCnDU:GEIXsgtvm1De5YlOx6lzBH46Ut4
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" xzsqxqazhjc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" wfpuagm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" wfpuagm.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" xzsqxqazhjc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" xzsqxqazhjc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wfpuagm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wfpuagm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" wfpuagm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" wfpuagm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" wfpuagm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" wfpuagm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" xzsqxqazhjc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" xzsqxqazhjc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" wfpuagm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" wfpuagm.exe -
Adds policy Run key to start application 2 TTPs 21 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cnzgoweqb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yvtmgauspdhtwevysbmjh.exe" wfpuagm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nbqalwhwkpkn = "jfcungzwsfitvcsunvfb.exe" wfpuagm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cnzgoweqb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wrnewogcxjlvwcrskra.exe" wfpuagm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cnzgoweqb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vngujyngyhgnloay.exe" wfpuagm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nbqalwhwkpkn = "wrnewogcxjlvwcrskra.exe" wfpuagm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cnzgoweqb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wrnewogcxjlvwcrskra.exe" wfpuagm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nbqalwhwkpkn = "jfcungzwsfitvcsunvfb.exe" xzsqxqazhjc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cnzgoweqb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yvtmgauspdhtwevysbmjh.exe" wfpuagm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cnzgoweqb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lfaqhypkepqzzessjp.exe" xzsqxqazhjc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nbqalwhwkpkn = "vngujyngyhgnloay.exe" wfpuagm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nbqalwhwkpkn = "wrnewogcxjlvwcrskra.exe" wfpuagm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run xzsqxqazhjc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cnzgoweqb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jfcungzwsfitvcsunvfb.exe" xzsqxqazhjc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nbqalwhwkpkn = "cvpeukaunxxfeivuk.exe" xzsqxqazhjc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run wfpuagm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nbqalwhwkpkn = "cvpeukaunxxfeivuk.exe" wfpuagm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nbqalwhwkpkn = "cvpeukaunxxfeivuk.exe" wfpuagm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cnzgoweqb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wrnewogcxjlvwcrskra.exe" xzsqxqazhjc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nbqalwhwkpkn = "wrnewogcxjlvwcrskra.exe" xzsqxqazhjc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run wfpuagm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\cnzgoweqb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vngujyngyhgnloay.exe" wfpuagm.exe -
Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" wfpuagm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" wfpuagm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" wfpuagm.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" xzsqxqazhjc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" xzsqxqazhjc.exe Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" wfpuagm.exe -
Executes dropped EXE 3 IoCs
pid Process 1936 xzsqxqazhjc.exe 1904 wfpuagm.exe 2240 wfpuagm.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation xzsqxqazhjc.exe -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vngujyngyhgnloay = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wrnewogcxjlvwcrskra.exe" xzsqxqazhjc.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run wfpuagm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qdrakuesfjd = "jfcungzwsfitvcsunvfb.exe ." wfpuagm.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ndugtgtkahejfg = "cvpeukaunxxfeivuk.exe ." wfpuagm.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vhucludqcf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vngujyngyhgnloay.exe" wfpuagm.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\qdrakuesfjd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lfaqhypkepqzzessjp.exe ." wfpuagm.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vhucludqcf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vngujyngyhgnloay.exe" xzsqxqazhjc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vhucludqcf = "yvtmgauspdhtwevysbmjh.exe" xzsqxqazhjc.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mbrcoamcrxtxs = "yvtmgauspdhtwevysbmjh.exe" wfpuagm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qhzmaocultrxuwh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jfcungzwsfitvcsunvfb.exe ." wfpuagm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qdrakuesfjd = "yvtmgauspdhtwevysbmjh.exe ." wfpuagm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vngujyngyhgnloay = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lfaqhypkepqzzessjp.exe" wfpuagm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vhucludqcf = "lfaqhypkepqzzessjp.exe" wfpuagm.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce wfpuagm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vhucludqcf = "wrnewogcxjlvwcrskra.exe" wfpuagm.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mbrcoamcrxtxs = "lfaqhypkepqzzessjp.exe" wfpuagm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qhzmaocultrxuwh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yvtmgauspdhtwevysbmjh.exe ." wfpuagm.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run xzsqxqazhjc.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce xzsqxqazhjc.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ndugtgtkahejfg = "yvtmgauspdhtwevysbmjh.exe ." xzsqxqazhjc.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\qdrakuesfjd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lfaqhypkepqzzessjp.exe ." xzsqxqazhjc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vngujyngyhgnloay = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vngujyngyhgnloay.exe" wfpuagm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qhzmaocultrxuwh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lfaqhypkepqzzessjp.exe ." wfpuagm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qhzmaocultrxuwh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vngujyngyhgnloay.exe ." wfpuagm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qdrakuesfjd = "lfaqhypkepqzzessjp.exe ." wfpuagm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qhzmaocultrxuwh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lfaqhypkepqzzessjp.exe ." wfpuagm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qdrakuesfjd = "lfaqhypkepqzzessjp.exe ." xzsqxqazhjc.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ndugtgtkahejfg = "cvpeukaunxxfeivuk.exe ." xzsqxqazhjc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vhucludqcf = "jfcungzwsfitvcsunvfb.exe" wfpuagm.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ndugtgtkahejfg = "lfaqhypkepqzzessjp.exe ." wfpuagm.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mbrcoamcrxtxs = "cvpeukaunxxfeivuk.exe" wfpuagm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qdrakuesfjd = "lfaqhypkepqzzessjp.exe ." wfpuagm.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mbrcoamcrxtxs = "wrnewogcxjlvwcrskra.exe" wfpuagm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vngujyngyhgnloay = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cvpeukaunxxfeivuk.exe" wfpuagm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vhucludqcf = "yvtmgauspdhtwevysbmjh.exe" wfpuagm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vngujyngyhgnloay = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yvtmgauspdhtwevysbmjh.exe" wfpuagm.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\qdrakuesfjd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wrnewogcxjlvwcrskra.exe ." wfpuagm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vhucludqcf = "yvtmgauspdhtwevysbmjh.exe" wfpuagm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vngujyngyhgnloay = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vngujyngyhgnloay.exe" wfpuagm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vngujyngyhgnloay = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lfaqhypkepqzzessjp.exe" wfpuagm.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vhucludqcf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cvpeukaunxxfeivuk.exe" wfpuagm.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mbrcoamcrxtxs = "vngujyngyhgnloay.exe" wfpuagm.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run xzsqxqazhjc.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mbrcoamcrxtxs = "cvpeukaunxxfeivuk.exe" xzsqxqazhjc.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mbrcoamcrxtxs = "wrnewogcxjlvwcrskra.exe" xzsqxqazhjc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qdrakuesfjd = "vngujyngyhgnloay.exe ." wfpuagm.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\qdrakuesfjd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jfcungzwsfitvcsunvfb.exe ." xzsqxqazhjc.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run wfpuagm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vhucludqcf = "lfaqhypkepqzzessjp.exe" wfpuagm.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ndugtgtkahejfg = "yvtmgauspdhtwevysbmjh.exe ." wfpuagm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vhucludqcf = "lfaqhypkepqzzessjp.exe" xzsqxqazhjc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qhzmaocultrxuwh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wrnewogcxjlvwcrskra.exe ." wfpuagm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vngujyngyhgnloay = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jfcungzwsfitvcsunvfb.exe" wfpuagm.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\qdrakuesfjd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jfcungzwsfitvcsunvfb.exe ." wfpuagm.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce xzsqxqazhjc.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qdrakuesfjd = "cvpeukaunxxfeivuk.exe ." xzsqxqazhjc.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mbrcoamcrxtxs = "lfaqhypkepqzzessjp.exe" xzsqxqazhjc.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ndugtgtkahejfg = "jfcungzwsfitvcsunvfb.exe ." xzsqxqazhjc.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vhucludqcf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lfaqhypkepqzzessjp.exe" wfpuagm.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vhucludqcf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vngujyngyhgnloay.exe" wfpuagm.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\qdrakuesfjd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vngujyngyhgnloay.exe ." wfpuagm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\qhzmaocultrxuwh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cvpeukaunxxfeivuk.exe ." xzsqxqazhjc.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vhucludqcf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wrnewogcxjlvwcrskra.exe" xzsqxqazhjc.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\qdrakuesfjd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vngujyngyhgnloay.exe ." xzsqxqazhjc.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA xzsqxqazhjc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wfpuagm.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wfpuagm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wfpuagm.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wfpuagm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" xzsqxqazhjc.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 82 whatismyipaddress.com -
Drops file in System32 directory 25 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\cvpeukaunxxfeivuk.exe xzsqxqazhjc.exe File opened for modification C:\Windows\SysWOW64\pnmgbwrqodivziaezjvtsm.exe wfpuagm.exe File opened for modification C:\Windows\SysWOW64\cvpeukaunxxfeivuk.exe wfpuagm.exe File created C:\Windows\SysWOW64\mbrcoamcrxtxssbwijmbrcoamcrxtxssbwi.mbr wfpuagm.exe File opened for modification C:\Windows\SysWOW64\vngujyngyhgnloay.exe xzsqxqazhjc.exe File opened for modification C:\Windows\SysWOW64\pnmgbwrqodivziaezjvtsm.exe xzsqxqazhjc.exe File opened for modification C:\Windows\SysWOW64\lfaqhypkepqzzessjp.exe wfpuagm.exe File opened for modification C:\Windows\SysWOW64\wrnewogcxjlvwcrskra.exe wfpuagm.exe File opened for modification C:\Windows\SysWOW64\yvtmgauspdhtwevysbmjh.exe wfpuagm.exe File opened for modification C:\Windows\SysWOW64\lfaqhypkepqzzessjp.exe xzsqxqazhjc.exe File opened for modification C:\Windows\SysWOW64\jfcungzwsfitvcsunvfb.exe xzsqxqazhjc.exe File opened for modification C:\Windows\SysWOW64\yvtmgauspdhtwevysbmjh.exe xzsqxqazhjc.exe File opened for modification C:\Windows\SysWOW64\lfaqhypkepqzzessjp.exe wfpuagm.exe File opened for modification C:\Windows\SysWOW64\wrnewogcxjlvwcrskra.exe wfpuagm.exe File opened for modification C:\Windows\SysWOW64\jfcungzwsfitvcsunvfb.exe wfpuagm.exe File opened for modification C:\Windows\SysWOW64\yvtmgauspdhtwevysbmjh.exe wfpuagm.exe File opened for modification C:\Windows\SysWOW64\vngujyngyhgnloay.exe wfpuagm.exe File opened for modification C:\Windows\SysWOW64\wrnewogcxjlvwcrskra.exe xzsqxqazhjc.exe File opened for modification C:\Windows\SysWOW64\pnmgbwrqodivziaezjvtsm.exe wfpuagm.exe File created C:\Windows\SysWOW64\dhmmnopuytexhwuefvnrwwxy.eid wfpuagm.exe File opened for modification C:\Windows\SysWOW64\mbrcoamcrxtxssbwijmbrcoamcrxtxssbwi.mbr wfpuagm.exe File opened for modification C:\Windows\SysWOW64\jfcungzwsfitvcsunvfb.exe wfpuagm.exe File opened for modification C:\Windows\SysWOW64\cvpeukaunxxfeivuk.exe wfpuagm.exe File opened for modification C:\Windows\SysWOW64\dhmmnopuytexhwuefvnrwwxy.eid wfpuagm.exe File opened for modification C:\Windows\SysWOW64\vngujyngyhgnloay.exe wfpuagm.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\dhmmnopuytexhwuefvnrwwxy.eid wfpuagm.exe File created C:\Program Files (x86)\dhmmnopuytexhwuefvnrwwxy.eid wfpuagm.exe File opened for modification C:\Program Files (x86)\mbrcoamcrxtxssbwijmbrcoamcrxtxssbwi.mbr wfpuagm.exe File created C:\Program Files (x86)\mbrcoamcrxtxssbwijmbrcoamcrxtxssbwi.mbr wfpuagm.exe -
Drops file in Windows directory 25 IoCs
description ioc Process File opened for modification C:\Windows\wrnewogcxjlvwcrskra.exe wfpuagm.exe File opened for modification C:\Windows\pnmgbwrqodivziaezjvtsm.exe wfpuagm.exe File opened for modification C:\Windows\cvpeukaunxxfeivuk.exe wfpuagm.exe File opened for modification C:\Windows\pnmgbwrqodivziaezjvtsm.exe wfpuagm.exe File opened for modification C:\Windows\jfcungzwsfitvcsunvfb.exe xzsqxqazhjc.exe File opened for modification C:\Windows\vngujyngyhgnloay.exe wfpuagm.exe File opened for modification C:\Windows\lfaqhypkepqzzessjp.exe xzsqxqazhjc.exe File opened for modification C:\Windows\pnmgbwrqodivziaezjvtsm.exe xzsqxqazhjc.exe File opened for modification C:\Windows\cvpeukaunxxfeivuk.exe wfpuagm.exe File opened for modification C:\Windows\vngujyngyhgnloay.exe wfpuagm.exe File opened for modification C:\Windows\lfaqhypkepqzzessjp.exe wfpuagm.exe File opened for modification C:\Windows\jfcungzwsfitvcsunvfb.exe wfpuagm.exe File opened for modification C:\Windows\vngujyngyhgnloay.exe xzsqxqazhjc.exe File opened for modification C:\Windows\cvpeukaunxxfeivuk.exe xzsqxqazhjc.exe File created C:\Windows\dhmmnopuytexhwuefvnrwwxy.eid wfpuagm.exe File opened for modification C:\Windows\yvtmgauspdhtwevysbmjh.exe wfpuagm.exe File opened for modification C:\Windows\dhmmnopuytexhwuefvnrwwxy.eid wfpuagm.exe File opened for modification C:\Windows\jfcungzwsfitvcsunvfb.exe wfpuagm.exe File opened for modification C:\Windows\yvtmgauspdhtwevysbmjh.exe wfpuagm.exe File created C:\Windows\mbrcoamcrxtxssbwijmbrcoamcrxtxssbwi.mbr wfpuagm.exe File opened for modification C:\Windows\wrnewogcxjlvwcrskra.exe xzsqxqazhjc.exe File opened for modification C:\Windows\yvtmgauspdhtwevysbmjh.exe xzsqxqazhjc.exe File opened for modification C:\Windows\mbrcoamcrxtxssbwijmbrcoamcrxtxssbwi.mbr wfpuagm.exe File opened for modification C:\Windows\lfaqhypkepqzzessjp.exe wfpuagm.exe File opened for modification C:\Windows\wrnewogcxjlvwcrskra.exe wfpuagm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4568 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 4568 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 4568 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 4568 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 4568 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 4568 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 4568 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 4568 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 4568 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 4568 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 4568 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 4568 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 4568 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 4568 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 4568 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 4568 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 4568 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 4568 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 4568 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 4568 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 4568 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 4568 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 4568 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 4568 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 4568 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 4568 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 4568 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 4568 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 4568 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 4568 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 4568 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 4568 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 4568 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 4568 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 4568 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 4568 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 4568 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 4568 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 4568 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 4568 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 4568 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 4568 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 4568 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 4568 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 4568 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 4568 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 4568 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 4568 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 4568 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 4568 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 4568 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 4568 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 4568 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 4568 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 4568 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 4568 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 4568 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 4568 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 4568 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 4568 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 4568 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 4568 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 4568 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 4568 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2240 wfpuagm.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4568 wrote to memory of 1936 4568 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 87 PID 4568 wrote to memory of 1936 4568 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 87 PID 4568 wrote to memory of 1936 4568 efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe 87 PID 1936 wrote to memory of 1904 1936 xzsqxqazhjc.exe 92 PID 1936 wrote to memory of 1904 1936 xzsqxqazhjc.exe 92 PID 1936 wrote to memory of 1904 1936 xzsqxqazhjc.exe 92 PID 1936 wrote to memory of 2240 1936 xzsqxqazhjc.exe 93 PID 1936 wrote to memory of 2240 1936 xzsqxqazhjc.exe 93 PID 1936 wrote to memory of 2240 1936 xzsqxqazhjc.exe 93 -
System policy modification 1 TTPs 39 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" xzsqxqazhjc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" wfpuagm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" xzsqxqazhjc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" xzsqxqazhjc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" wfpuagm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" wfpuagm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" wfpuagm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" wfpuagm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer wfpuagm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" xzsqxqazhjc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System wfpuagm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" wfpuagm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" wfpuagm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" wfpuagm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" wfpuagm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer xzsqxqazhjc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wfpuagm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" xzsqxqazhjc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" xzsqxqazhjc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" wfpuagm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" wfpuagm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" wfpuagm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" xzsqxqazhjc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" xzsqxqazhjc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System xzsqxqazhjc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" wfpuagm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" wfpuagm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" wfpuagm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" wfpuagm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System wfpuagm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" wfpuagm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" xzsqxqazhjc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wfpuagm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" wfpuagm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" wfpuagm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" wfpuagm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer wfpuagm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" xzsqxqazhjc.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" xzsqxqazhjc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe"C:\Users\Admin\AppData\Local\Temp\efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\xzsqxqazhjc.exe"C:\Users\Admin\AppData\Local\Temp\xzsqxqazhjc.exe" "c:\users\admin\appdata\local\temp\efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070.exe*"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\wfpuagm.exe"C:\Users\Admin\AppData\Local\Temp\wfpuagm.exe" "-C:\Users\Admin\AppData\Local\Temp\vngujyngyhgnloay.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- System policy modification
PID:1904
-
-
C:\Users\Admin\AppData\Local\Temp\wfpuagm.exe"C:\Users\Admin\AppData\Local\Temp\wfpuagm.exe" "-C:\Users\Admin\AppData\Local\Temp\vngujyngyhgnloay.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2240
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
Filesize
712KB
MD55342c34f5c1d498489f065dd2033b618
SHA115d82d7ca9b522be78c183c18af951920da462ff
SHA256507a9f343ced9dcb323bdaeba5a4f4899f5ebd7c4ec48cb0884e473826d40c7d
SHA512540139472192242d4642f452af8f7f6a141d0171488e3c528fa21583d495542b87a26b26facfdc2a5e24e023184644d779214cf2b27e69a3236e30f02bb2fb0a
-
Filesize
712KB
MD55342c34f5c1d498489f065dd2033b618
SHA115d82d7ca9b522be78c183c18af951920da462ff
SHA256507a9f343ced9dcb323bdaeba5a4f4899f5ebd7c4ec48cb0884e473826d40c7d
SHA512540139472192242d4642f452af8f7f6a141d0171488e3c528fa21583d495542b87a26b26facfdc2a5e24e023184644d779214cf2b27e69a3236e30f02bb2fb0a
-
Filesize
712KB
MD55342c34f5c1d498489f065dd2033b618
SHA115d82d7ca9b522be78c183c18af951920da462ff
SHA256507a9f343ced9dcb323bdaeba5a4f4899f5ebd7c4ec48cb0884e473826d40c7d
SHA512540139472192242d4642f452af8f7f6a141d0171488e3c528fa21583d495542b87a26b26facfdc2a5e24e023184644d779214cf2b27e69a3236e30f02bb2fb0a
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
Filesize
320KB
MD57ff2bbb090c7de34a738f85de091e92b
SHA1aa17661f4a1a5711f273ff363649afdc494af2db
SHA256d948ab3b584e64e70b2610e6ee6baf6516e645eaa1b1ac8a6204b128ea44c30f
SHA512aea42492253c684c98209c5d8f2232a3dbc87766301b4ab2422f8fedef412257d620b3b31bff4e5368e2c1902a32d91ee76b443247f1ec04da19ee50f7e0f476
-
Filesize
320KB
MD57ff2bbb090c7de34a738f85de091e92b
SHA1aa17661f4a1a5711f273ff363649afdc494af2db
SHA256d948ab3b584e64e70b2610e6ee6baf6516e645eaa1b1ac8a6204b128ea44c30f
SHA512aea42492253c684c98209c5d8f2232a3dbc87766301b4ab2422f8fedef412257d620b3b31bff4e5368e2c1902a32d91ee76b443247f1ec04da19ee50f7e0f476
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f
-
Filesize
524KB
MD5f2bee96df56e120e5496568a17919a38
SHA148177f9e7e03b5c719032eca70164009629906d6
SHA256efd98ea53de0f992a33f871cbfc9c8281f0564815c637e6d862ac1eabddde070
SHA51223cd21cf04aaec30f871eb82c3b8d31514929133bccd905522b40ceec340c68d0de276cbcae91c8cd7cf6f99210c2bd00a29f3056e8933f3fece540c8fe4cd0f