Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
186s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
04/12/2022, 14:03
Static task
static1
Behavioral task
behavioral1
Sample
2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe
Resource
win10v2004-20221111-en
General
-
Target
2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe
-
Size
592KB
-
MD5
71881df6ca51aa48955b0102d57d1d08
-
SHA1
77651b24d165309cefa4a2662c2c4697641fbffe
-
SHA256
2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818
-
SHA512
47e189a29c9ee6b996d909ea8662f01b0fffc664c85ec3d49c32929eba5c2806632ae3728ff445f57602537cc2b8aa1c71a04279eda364ee682ba72945d498a1
-
SSDEEP
12288:J6onxOp8FySpE5zvIdtU+Ymefh6+X/l6+X/I:/wp8DozAdO9gg/Ug/I
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" cchfzisvmmr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" dagqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" dagqt.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" cchfzisvmmr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" cchfzisvmmr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" dagqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" dagqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" dagqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" dagqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cchfzisvmmr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" dagqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" dagqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" dagqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" dagqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" cchfzisvmmr.exe -
Adds policy Run key to start application 2 TTPs 17 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\swjakxhtgqpq = "oavumhztognwkrumfrkw.exe" cchfzisvmmr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hisgnxenx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qatqgzphaqvcotukbl.exe" cchfzisvmmr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run dagqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\swjakxhtgqpq = "oavumhztognwkrumfrkw.exe" dagqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hisgnxenx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hqietlarjycitxxmc.exe" dagqt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run cchfzisvmmr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hisgnxenx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\aizuiznduilqadcq.exe" cchfzisvmmr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run dagqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\swjakxhtgqpq = "hqietlarjycitxxmc.exe" dagqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\swjakxhtgqpq = "hqietlarjycitxxmc.exe" dagqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\swjakxhtgqpq = "qatqgzphaqvcotukbl.exe" cchfzisvmmr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hisgnxenx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qatqgzphaqvcotukbl.exe" dagqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\swjakxhtgqpq = "dqmmfbuplemwltxqkxrea.exe" dagqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hisgnxenx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\oavumhztognwkrumfrkw.exe" dagqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hisgnxenx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bmgevpgztkqylrtkcnf.exe" dagqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\swjakxhtgqpq = "qatqgzphaqvcotukbl.exe" dagqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\swjakxhtgqpq = "dqmmfbuplemwltxqkxrea.exe" dagqt.exe -
Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" cchfzisvmmr.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" dagqt.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" dagqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" dagqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" dagqt.exe Set value (int) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" cchfzisvmmr.exe -
Executes dropped EXE 3 IoCs
pid Process 952 cchfzisvmmr.exe 884 dagqt.exe 824 dagqt.exe -
Loads dropped DLL 6 IoCs
pid Process 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 952 cchfzisvmmr.exe 952 cchfzisvmmr.exe 952 cchfzisvmmr.exe 952 cchfzisvmmr.exe -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce dagqt.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run dagqt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\rwkcnbmznyyah = "qatqgzphaqvcotukbl.exe" dagqt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\syngshthwijmuv = "hqietlarjycitxxmc.exe ." dagqt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\syngshthwijmuv = "oavumhztognwkrumfrkw.exe ." dagqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vcsmzpcrhuwajlj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\oavumhztognwkrumfrkw.exe ." dagqt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\vykajvepbki = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qatqgzphaqvcotukbl.exe ." cchfzisvmmr.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\syngshthwijmuv = "aizuiznduilqadcq.exe ." cchfzisvmmr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run dagqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\acnckvdnyg = "bmgevpgztkqylrtkcnf.exe" dagqt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\rwkcnbmznyyah = "aizuiznduilqadcq.exe" dagqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\acnckvdnyg = "hqietlarjycitxxmc.exe" cchfzisvmmr.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce dagqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\aizuiznduilqadcq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qatqgzphaqvcotukbl.exe" dagqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vykajvepbki = "aizuiznduilqadcq.exe ." dagqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vcsmzpcrhuwajlj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hqietlarjycitxxmc.exe ." dagqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\acnckvdnyg = "aizuiznduilqadcq.exe" cchfzisvmmr.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\rwkcnbmznyyah = "bmgevpgztkqylrtkcnf.exe" cchfzisvmmr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce dagqt.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run dagqt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\vykajvepbki = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qatqgzphaqvcotukbl.exe ." dagqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vcsmzpcrhuwajlj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hqietlarjycitxxmc.exe ." cchfzisvmmr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vykajvepbki = "oavumhztognwkrumfrkw.exe ." dagqt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\rwkcnbmznyyah = "qatqgzphaqvcotukbl.exe" dagqt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\syngshthwijmuv = "dqmmfbuplemwltxqkxrea.exe ." dagqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vcsmzpcrhuwajlj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\oavumhztognwkrumfrkw.exe ." dagqt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\vykajvepbki = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hqietlarjycitxxmc.exe ." dagqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vykajvepbki = "bmgevpgztkqylrtkcnf.exe ." dagqt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\acnckvdnyg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qatqgzphaqvcotukbl.exe" cchfzisvmmr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vcsmzpcrhuwajlj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\oavumhztognwkrumfrkw.exe ." cchfzisvmmr.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\rwkcnbmznyyah = "aizuiznduilqadcq.exe" dagqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\aizuiznduilqadcq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\oavumhztognwkrumfrkw.exe" dagqt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run cchfzisvmmr.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\syngshthwijmuv = "dqmmfbuplemwltxqkxrea.exe ." cchfzisvmmr.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\vykajvepbki = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bmgevpgztkqylrtkcnf.exe ." cchfzisvmmr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\acnckvdnyg = "dqmmfbuplemwltxqkxrea.exe" dagqt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\vykajvepbki = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hqietlarjycitxxmc.exe ." dagqt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\vykajvepbki = "C:\\Users\\Admin\\AppData\\Local\\Temp\\oavumhztognwkrumfrkw.exe ." dagqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\aizuiznduilqadcq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qatqgzphaqvcotukbl.exe" cchfzisvmmr.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce dagqt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\vykajvepbki = "C:\\Users\\Admin\\AppData\\Local\\Temp\\aizuiznduilqadcq.exe ." dagqt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\acnckvdnyg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dqmmfbuplemwltxqkxrea.exe" dagqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\acnckvdnyg = "qatqgzphaqvcotukbl.exe" dagqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vykajvepbki = "hqietlarjycitxxmc.exe ." dagqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vykajvepbki = "qatqgzphaqvcotukbl.exe ." cchfzisvmmr.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\acnckvdnyg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\oavumhztognwkrumfrkw.exe" dagqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\acnckvdnyg = "oavumhztognwkrumfrkw.exe" dagqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vykajvepbki = "hqietlarjycitxxmc.exe ." cchfzisvmmr.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run cchfzisvmmr.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce cchfzisvmmr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\aizuiznduilqadcq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\aizuiznduilqadcq.exe" cchfzisvmmr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run dagqt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\syngshthwijmuv = "qatqgzphaqvcotukbl.exe ." dagqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vcsmzpcrhuwajlj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\aizuiznduilqadcq.exe ." dagqt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\syngshthwijmuv = "oavumhztognwkrumfrkw.exe ." dagqt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce cchfzisvmmr.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\rwkcnbmznyyah = "dqmmfbuplemwltxqkxrea.exe" cchfzisvmmr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vcsmzpcrhuwajlj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hqietlarjycitxxmc.exe ." dagqt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\acnckvdnyg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\aizuiznduilqadcq.exe" dagqt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\rwkcnbmznyyah = "oavumhztognwkrumfrkw.exe" dagqt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\syngshthwijmuv = "aizuiznduilqadcq.exe ." dagqt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\acnckvdnyg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\aizuiznduilqadcq.exe" cchfzisvmmr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vykajvepbki = "dqmmfbuplemwltxqkxrea.exe ." dagqt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vykajvepbki = "aizuiznduilqadcq.exe ." dagqt.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cchfzisvmmr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" dagqt.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA dagqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" dagqt.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA dagqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cchfzisvmmr.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 5 whatismyip.everdot.org 7 www.showmyipaddress.com 14 whatismyipaddress.com -
Drops file in System32 directory 25 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\oavumhztognwkrumfrkw.exe dagqt.exe File opened for modification C:\Windows\SysWOW64\bmgevpgztkqylrtkcnf.exe dagqt.exe File created C:\Windows\SysWOW64\ewxcabzzaylauhqonfewxc.bzz dagqt.exe File created C:\Windows\SysWOW64\vykajvepbkiinlfoybloaqzlufrayydbv.orb dagqt.exe File opened for modification C:\Windows\SysWOW64\dqmmfbuplemwltxqkxrea.exe dagqt.exe File opened for modification C:\Windows\SysWOW64\aizuiznduilqadcq.exe cchfzisvmmr.exe File opened for modification C:\Windows\SysWOW64\dqmmfbuplemwltxqkxrea.exe cchfzisvmmr.exe File opened for modification C:\Windows\SysWOW64\hqietlarjycitxxmc.exe dagqt.exe File opened for modification C:\Windows\SysWOW64\oavumhztognwkrumfrkw.exe dagqt.exe File opened for modification C:\Windows\SysWOW64\qatqgzphaqvcotukbl.exe dagqt.exe File opened for modification C:\Windows\SysWOW64\ewxcabzzaylauhqonfewxc.bzz dagqt.exe File opened for modification C:\Windows\SysWOW64\hqietlarjycitxxmc.exe cchfzisvmmr.exe File opened for modification C:\Windows\SysWOW64\qatqgzphaqvcotukbl.exe cchfzisvmmr.exe File opened for modification C:\Windows\SysWOW64\bmgevpgztkqylrtkcnf.exe dagqt.exe File opened for modification C:\Windows\SysWOW64\dqmmfbuplemwltxqkxrea.exe dagqt.exe File opened for modification C:\Windows\SysWOW64\hqietlarjycitxxmc.exe dagqt.exe File opened for modification C:\Windows\SysWOW64\qatqgzphaqvcotukbl.exe dagqt.exe File opened for modification C:\Windows\SysWOW64\uifgaxrnkenyoxcwrfaolm.exe dagqt.exe File opened for modification C:\Windows\SysWOW64\aizuiznduilqadcq.exe dagqt.exe File opened for modification C:\Windows\SysWOW64\bmgevpgztkqylrtkcnf.exe cchfzisvmmr.exe File opened for modification C:\Windows\SysWOW64\oavumhztognwkrumfrkw.exe cchfzisvmmr.exe File opened for modification C:\Windows\SysWOW64\uifgaxrnkenyoxcwrfaolm.exe cchfzisvmmr.exe File opened for modification C:\Windows\SysWOW64\aizuiznduilqadcq.exe dagqt.exe File opened for modification C:\Windows\SysWOW64\uifgaxrnkenyoxcwrfaolm.exe dagqt.exe File opened for modification C:\Windows\SysWOW64\vykajvepbkiinlfoybloaqzlufrayydbv.orb dagqt.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\ewxcabzzaylauhqonfewxc.bzz dagqt.exe File created C:\Program Files (x86)\ewxcabzzaylauhqonfewxc.bzz dagqt.exe File opened for modification C:\Program Files (x86)\vykajvepbkiinlfoybloaqzlufrayydbv.orb dagqt.exe File created C:\Program Files (x86)\vykajvepbkiinlfoybloaqzlufrayydbv.orb dagqt.exe -
Drops file in Windows directory 25 IoCs
description ioc Process File opened for modification C:\Windows\hqietlarjycitxxmc.exe dagqt.exe File opened for modification C:\Windows\qatqgzphaqvcotukbl.exe dagqt.exe File opened for modification C:\Windows\uifgaxrnkenyoxcwrfaolm.exe dagqt.exe File opened for modification C:\Windows\oavumhztognwkrumfrkw.exe dagqt.exe File opened for modification C:\Windows\uifgaxrnkenyoxcwrfaolm.exe dagqt.exe File opened for modification C:\Windows\ewxcabzzaylauhqonfewxc.bzz dagqt.exe File opened for modification C:\Windows\oavumhztognwkrumfrkw.exe cchfzisvmmr.exe File opened for modification C:\Windows\dqmmfbuplemwltxqkxrea.exe cchfzisvmmr.exe File opened for modification C:\Windows\vykajvepbkiinlfoybloaqzlufrayydbv.orb dagqt.exe File opened for modification C:\Windows\oavumhztognwkrumfrkw.exe dagqt.exe File opened for modification C:\Windows\hqietlarjycitxxmc.exe dagqt.exe File opened for modification C:\Windows\bmgevpgztkqylrtkcnf.exe dagqt.exe File opened for modification C:\Windows\qatqgzphaqvcotukbl.exe cchfzisvmmr.exe File opened for modification C:\Windows\bmgevpgztkqylrtkcnf.exe dagqt.exe File opened for modification C:\Windows\bmgevpgztkqylrtkcnf.exe cchfzisvmmr.exe File opened for modification C:\Windows\qatqgzphaqvcotukbl.exe dagqt.exe File opened for modification C:\Windows\dqmmfbuplemwltxqkxrea.exe dagqt.exe File created C:\Windows\ewxcabzzaylauhqonfewxc.bzz dagqt.exe File opened for modification C:\Windows\aizuiznduilqadcq.exe cchfzisvmmr.exe File opened for modification C:\Windows\hqietlarjycitxxmc.exe cchfzisvmmr.exe File opened for modification C:\Windows\dqmmfbuplemwltxqkxrea.exe dagqt.exe File opened for modification C:\Windows\aizuiznduilqadcq.exe dagqt.exe File created C:\Windows\vykajvepbkiinlfoybloaqzlufrayydbv.orb dagqt.exe File opened for modification C:\Windows\uifgaxrnkenyoxcwrfaolm.exe cchfzisvmmr.exe File opened for modification C:\Windows\aizuiznduilqadcq.exe dagqt.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 884 dagqt.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2044 wrote to memory of 952 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 28 PID 2044 wrote to memory of 952 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 28 PID 2044 wrote to memory of 952 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 28 PID 2044 wrote to memory of 952 2044 2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe 28 PID 952 wrote to memory of 884 952 cchfzisvmmr.exe 29 PID 952 wrote to memory of 884 952 cchfzisvmmr.exe 29 PID 952 wrote to memory of 884 952 cchfzisvmmr.exe 29 PID 952 wrote to memory of 884 952 cchfzisvmmr.exe 29 PID 952 wrote to memory of 824 952 cchfzisvmmr.exe 30 PID 952 wrote to memory of 824 952 cchfzisvmmr.exe 30 PID 952 wrote to memory of 824 952 cchfzisvmmr.exe 30 PID 952 wrote to memory of 824 952 cchfzisvmmr.exe 30 -
System policy modification 1 TTPs 39 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" dagqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" dagqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" dagqt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer dagqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" cchfzisvmmr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" cchfzisvmmr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" cchfzisvmmr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" cchfzisvmmr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" dagqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" dagqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" dagqt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System cchfzisvmmr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" cchfzisvmmr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" dagqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" dagqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" dagqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" dagqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" cchfzisvmmr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" cchfzisvmmr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" dagqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" dagqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" cchfzisvmmr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" dagqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" cchfzisvmmr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" cchfzisvmmr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" dagqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" dagqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" dagqt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer dagqt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer cchfzisvmmr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" cchfzisvmmr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System dagqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" dagqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" dagqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" dagqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" dagqt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System dagqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" dagqt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" dagqt.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe"C:\Users\Admin\AppData\Local\Temp\2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Local\Temp\cchfzisvmmr.exe"C:\Users\Admin\AppData\Local\Temp\cchfzisvmmr.exe" "c:\users\admin\appdata\local\temp\2407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818.exe*"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
- System policy modification
PID:952 -
C:\Users\Admin\AppData\Local\Temp\dagqt.exe"C:\Users\Admin\AppData\Local\Temp\dagqt.exe" "-C:\Users\Admin\AppData\Local\Temp\aizuiznduilqadcq.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:884
-
-
C:\Users\Admin\AppData\Local\Temp\dagqt.exe"C:\Users\Admin\AppData\Local\Temp\dagqt.exe" "-C:\Users\Admin\AppData\Local\Temp\aizuiznduilqadcq.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- System policy modification
PID:824
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
592KB
MD571881df6ca51aa48955b0102d57d1d08
SHA177651b24d165309cefa4a2662c2c4697641fbffe
SHA2562407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818
SHA51247e189a29c9ee6b996d909ea8662f01b0fffc664c85ec3d49c32929eba5c2806632ae3728ff445f57602537cc2b8aa1c71a04279eda364ee682ba72945d498a1
-
Filesize
592KB
MD571881df6ca51aa48955b0102d57d1d08
SHA177651b24d165309cefa4a2662c2c4697641fbffe
SHA2562407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818
SHA51247e189a29c9ee6b996d909ea8662f01b0fffc664c85ec3d49c32929eba5c2806632ae3728ff445f57602537cc2b8aa1c71a04279eda364ee682ba72945d498a1
-
Filesize
320KB
MD55203b6ea0901877fbf2d8d6f6d8d338e
SHA1c803e92561921b38abe13239c1fd85605b570936
SHA2560cc02d34d5fd4cf892fed282f98c1ad3e7dd6159a8877ae5c46d3f834ed36060
SHA512d48a41b4fc4c38a6473f789c02918fb7353a4b4199768a3624f3b685d91d38519887a1ccd3616e0d2b079a346afaec5a0f2ef2c46d72d3097ef561cedb476471
-
Filesize
320KB
MD55203b6ea0901877fbf2d8d6f6d8d338e
SHA1c803e92561921b38abe13239c1fd85605b570936
SHA2560cc02d34d5fd4cf892fed282f98c1ad3e7dd6159a8877ae5c46d3f834ed36060
SHA512d48a41b4fc4c38a6473f789c02918fb7353a4b4199768a3624f3b685d91d38519887a1ccd3616e0d2b079a346afaec5a0f2ef2c46d72d3097ef561cedb476471
-
Filesize
712KB
MD58dcfd2505f80675752e4a3dbcaf8e3cf
SHA1b7c9734f01be9278d1484f9b3d63b2bb200fa830
SHA2569f5e4a941f66372c49886896f4f63c28e88160356ce0794cfb88ce79e1e3ba3e
SHA51211589ec3e87e2dd48cd6cf5ad159b9c94788c9e294f634b31d98d9bb6d2d0568be3e61cc3b7a25d4653e443a9e32ec247fb170e17cc039de706c73191a1d02ee
-
Filesize
712KB
MD58dcfd2505f80675752e4a3dbcaf8e3cf
SHA1b7c9734f01be9278d1484f9b3d63b2bb200fa830
SHA2569f5e4a941f66372c49886896f4f63c28e88160356ce0794cfb88ce79e1e3ba3e
SHA51211589ec3e87e2dd48cd6cf5ad159b9c94788c9e294f634b31d98d9bb6d2d0568be3e61cc3b7a25d4653e443a9e32ec247fb170e17cc039de706c73191a1d02ee
-
Filesize
592KB
MD571881df6ca51aa48955b0102d57d1d08
SHA177651b24d165309cefa4a2662c2c4697641fbffe
SHA2562407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818
SHA51247e189a29c9ee6b996d909ea8662f01b0fffc664c85ec3d49c32929eba5c2806632ae3728ff445f57602537cc2b8aa1c71a04279eda364ee682ba72945d498a1
-
Filesize
592KB
MD571881df6ca51aa48955b0102d57d1d08
SHA177651b24d165309cefa4a2662c2c4697641fbffe
SHA2562407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818
SHA51247e189a29c9ee6b996d909ea8662f01b0fffc664c85ec3d49c32929eba5c2806632ae3728ff445f57602537cc2b8aa1c71a04279eda364ee682ba72945d498a1
-
Filesize
592KB
MD571881df6ca51aa48955b0102d57d1d08
SHA177651b24d165309cefa4a2662c2c4697641fbffe
SHA2562407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818
SHA51247e189a29c9ee6b996d909ea8662f01b0fffc664c85ec3d49c32929eba5c2806632ae3728ff445f57602537cc2b8aa1c71a04279eda364ee682ba72945d498a1
-
Filesize
592KB
MD571881df6ca51aa48955b0102d57d1d08
SHA177651b24d165309cefa4a2662c2c4697641fbffe
SHA2562407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818
SHA51247e189a29c9ee6b996d909ea8662f01b0fffc664c85ec3d49c32929eba5c2806632ae3728ff445f57602537cc2b8aa1c71a04279eda364ee682ba72945d498a1
-
Filesize
592KB
MD571881df6ca51aa48955b0102d57d1d08
SHA177651b24d165309cefa4a2662c2c4697641fbffe
SHA2562407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818
SHA51247e189a29c9ee6b996d909ea8662f01b0fffc664c85ec3d49c32929eba5c2806632ae3728ff445f57602537cc2b8aa1c71a04279eda364ee682ba72945d498a1
-
Filesize
592KB
MD571881df6ca51aa48955b0102d57d1d08
SHA177651b24d165309cefa4a2662c2c4697641fbffe
SHA2562407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818
SHA51247e189a29c9ee6b996d909ea8662f01b0fffc664c85ec3d49c32929eba5c2806632ae3728ff445f57602537cc2b8aa1c71a04279eda364ee682ba72945d498a1
-
Filesize
592KB
MD571881df6ca51aa48955b0102d57d1d08
SHA177651b24d165309cefa4a2662c2c4697641fbffe
SHA2562407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818
SHA51247e189a29c9ee6b996d909ea8662f01b0fffc664c85ec3d49c32929eba5c2806632ae3728ff445f57602537cc2b8aa1c71a04279eda364ee682ba72945d498a1
-
Filesize
592KB
MD571881df6ca51aa48955b0102d57d1d08
SHA177651b24d165309cefa4a2662c2c4697641fbffe
SHA2562407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818
SHA51247e189a29c9ee6b996d909ea8662f01b0fffc664c85ec3d49c32929eba5c2806632ae3728ff445f57602537cc2b8aa1c71a04279eda364ee682ba72945d498a1
-
Filesize
592KB
MD571881df6ca51aa48955b0102d57d1d08
SHA177651b24d165309cefa4a2662c2c4697641fbffe
SHA2562407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818
SHA51247e189a29c9ee6b996d909ea8662f01b0fffc664c85ec3d49c32929eba5c2806632ae3728ff445f57602537cc2b8aa1c71a04279eda364ee682ba72945d498a1
-
Filesize
592KB
MD571881df6ca51aa48955b0102d57d1d08
SHA177651b24d165309cefa4a2662c2c4697641fbffe
SHA2562407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818
SHA51247e189a29c9ee6b996d909ea8662f01b0fffc664c85ec3d49c32929eba5c2806632ae3728ff445f57602537cc2b8aa1c71a04279eda364ee682ba72945d498a1
-
Filesize
592KB
MD571881df6ca51aa48955b0102d57d1d08
SHA177651b24d165309cefa4a2662c2c4697641fbffe
SHA2562407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818
SHA51247e189a29c9ee6b996d909ea8662f01b0fffc664c85ec3d49c32929eba5c2806632ae3728ff445f57602537cc2b8aa1c71a04279eda364ee682ba72945d498a1
-
Filesize
592KB
MD571881df6ca51aa48955b0102d57d1d08
SHA177651b24d165309cefa4a2662c2c4697641fbffe
SHA2562407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818
SHA51247e189a29c9ee6b996d909ea8662f01b0fffc664c85ec3d49c32929eba5c2806632ae3728ff445f57602537cc2b8aa1c71a04279eda364ee682ba72945d498a1
-
Filesize
592KB
MD571881df6ca51aa48955b0102d57d1d08
SHA177651b24d165309cefa4a2662c2c4697641fbffe
SHA2562407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818
SHA51247e189a29c9ee6b996d909ea8662f01b0fffc664c85ec3d49c32929eba5c2806632ae3728ff445f57602537cc2b8aa1c71a04279eda364ee682ba72945d498a1
-
Filesize
592KB
MD571881df6ca51aa48955b0102d57d1d08
SHA177651b24d165309cefa4a2662c2c4697641fbffe
SHA2562407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818
SHA51247e189a29c9ee6b996d909ea8662f01b0fffc664c85ec3d49c32929eba5c2806632ae3728ff445f57602537cc2b8aa1c71a04279eda364ee682ba72945d498a1
-
Filesize
592KB
MD571881df6ca51aa48955b0102d57d1d08
SHA177651b24d165309cefa4a2662c2c4697641fbffe
SHA2562407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818
SHA51247e189a29c9ee6b996d909ea8662f01b0fffc664c85ec3d49c32929eba5c2806632ae3728ff445f57602537cc2b8aa1c71a04279eda364ee682ba72945d498a1
-
Filesize
592KB
MD571881df6ca51aa48955b0102d57d1d08
SHA177651b24d165309cefa4a2662c2c4697641fbffe
SHA2562407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818
SHA51247e189a29c9ee6b996d909ea8662f01b0fffc664c85ec3d49c32929eba5c2806632ae3728ff445f57602537cc2b8aa1c71a04279eda364ee682ba72945d498a1
-
Filesize
592KB
MD571881df6ca51aa48955b0102d57d1d08
SHA177651b24d165309cefa4a2662c2c4697641fbffe
SHA2562407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818
SHA51247e189a29c9ee6b996d909ea8662f01b0fffc664c85ec3d49c32929eba5c2806632ae3728ff445f57602537cc2b8aa1c71a04279eda364ee682ba72945d498a1
-
Filesize
592KB
MD571881df6ca51aa48955b0102d57d1d08
SHA177651b24d165309cefa4a2662c2c4697641fbffe
SHA2562407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818
SHA51247e189a29c9ee6b996d909ea8662f01b0fffc664c85ec3d49c32929eba5c2806632ae3728ff445f57602537cc2b8aa1c71a04279eda364ee682ba72945d498a1
-
Filesize
592KB
MD571881df6ca51aa48955b0102d57d1d08
SHA177651b24d165309cefa4a2662c2c4697641fbffe
SHA2562407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818
SHA51247e189a29c9ee6b996d909ea8662f01b0fffc664c85ec3d49c32929eba5c2806632ae3728ff445f57602537cc2b8aa1c71a04279eda364ee682ba72945d498a1
-
Filesize
592KB
MD571881df6ca51aa48955b0102d57d1d08
SHA177651b24d165309cefa4a2662c2c4697641fbffe
SHA2562407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818
SHA51247e189a29c9ee6b996d909ea8662f01b0fffc664c85ec3d49c32929eba5c2806632ae3728ff445f57602537cc2b8aa1c71a04279eda364ee682ba72945d498a1
-
Filesize
592KB
MD571881df6ca51aa48955b0102d57d1d08
SHA177651b24d165309cefa4a2662c2c4697641fbffe
SHA2562407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818
SHA51247e189a29c9ee6b996d909ea8662f01b0fffc664c85ec3d49c32929eba5c2806632ae3728ff445f57602537cc2b8aa1c71a04279eda364ee682ba72945d498a1
-
Filesize
592KB
MD571881df6ca51aa48955b0102d57d1d08
SHA177651b24d165309cefa4a2662c2c4697641fbffe
SHA2562407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818
SHA51247e189a29c9ee6b996d909ea8662f01b0fffc664c85ec3d49c32929eba5c2806632ae3728ff445f57602537cc2b8aa1c71a04279eda364ee682ba72945d498a1
-
Filesize
592KB
MD571881df6ca51aa48955b0102d57d1d08
SHA177651b24d165309cefa4a2662c2c4697641fbffe
SHA2562407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818
SHA51247e189a29c9ee6b996d909ea8662f01b0fffc664c85ec3d49c32929eba5c2806632ae3728ff445f57602537cc2b8aa1c71a04279eda364ee682ba72945d498a1
-
Filesize
592KB
MD571881df6ca51aa48955b0102d57d1d08
SHA177651b24d165309cefa4a2662c2c4697641fbffe
SHA2562407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818
SHA51247e189a29c9ee6b996d909ea8662f01b0fffc664c85ec3d49c32929eba5c2806632ae3728ff445f57602537cc2b8aa1c71a04279eda364ee682ba72945d498a1
-
Filesize
592KB
MD571881df6ca51aa48955b0102d57d1d08
SHA177651b24d165309cefa4a2662c2c4697641fbffe
SHA2562407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818
SHA51247e189a29c9ee6b996d909ea8662f01b0fffc664c85ec3d49c32929eba5c2806632ae3728ff445f57602537cc2b8aa1c71a04279eda364ee682ba72945d498a1
-
Filesize
592KB
MD571881df6ca51aa48955b0102d57d1d08
SHA177651b24d165309cefa4a2662c2c4697641fbffe
SHA2562407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818
SHA51247e189a29c9ee6b996d909ea8662f01b0fffc664c85ec3d49c32929eba5c2806632ae3728ff445f57602537cc2b8aa1c71a04279eda364ee682ba72945d498a1
-
Filesize
592KB
MD571881df6ca51aa48955b0102d57d1d08
SHA177651b24d165309cefa4a2662c2c4697641fbffe
SHA2562407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818
SHA51247e189a29c9ee6b996d909ea8662f01b0fffc664c85ec3d49c32929eba5c2806632ae3728ff445f57602537cc2b8aa1c71a04279eda364ee682ba72945d498a1
-
Filesize
592KB
MD571881df6ca51aa48955b0102d57d1d08
SHA177651b24d165309cefa4a2662c2c4697641fbffe
SHA2562407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818
SHA51247e189a29c9ee6b996d909ea8662f01b0fffc664c85ec3d49c32929eba5c2806632ae3728ff445f57602537cc2b8aa1c71a04279eda364ee682ba72945d498a1
-
Filesize
592KB
MD571881df6ca51aa48955b0102d57d1d08
SHA177651b24d165309cefa4a2662c2c4697641fbffe
SHA2562407eb9b97801082bed93bd202ce28cf70d35c021901c1d9083896d3e51ea818
SHA51247e189a29c9ee6b996d909ea8662f01b0fffc664c85ec3d49c32929eba5c2806632ae3728ff445f57602537cc2b8aa1c71a04279eda364ee682ba72945d498a1
-
Filesize
320KB
MD55203b6ea0901877fbf2d8d6f6d8d338e
SHA1c803e92561921b38abe13239c1fd85605b570936
SHA2560cc02d34d5fd4cf892fed282f98c1ad3e7dd6159a8877ae5c46d3f834ed36060
SHA512d48a41b4fc4c38a6473f789c02918fb7353a4b4199768a3624f3b685d91d38519887a1ccd3616e0d2b079a346afaec5a0f2ef2c46d72d3097ef561cedb476471
-
Filesize
320KB
MD55203b6ea0901877fbf2d8d6f6d8d338e
SHA1c803e92561921b38abe13239c1fd85605b570936
SHA2560cc02d34d5fd4cf892fed282f98c1ad3e7dd6159a8877ae5c46d3f834ed36060
SHA512d48a41b4fc4c38a6473f789c02918fb7353a4b4199768a3624f3b685d91d38519887a1ccd3616e0d2b079a346afaec5a0f2ef2c46d72d3097ef561cedb476471
-
Filesize
712KB
MD58dcfd2505f80675752e4a3dbcaf8e3cf
SHA1b7c9734f01be9278d1484f9b3d63b2bb200fa830
SHA2569f5e4a941f66372c49886896f4f63c28e88160356ce0794cfb88ce79e1e3ba3e
SHA51211589ec3e87e2dd48cd6cf5ad159b9c94788c9e294f634b31d98d9bb6d2d0568be3e61cc3b7a25d4653e443a9e32ec247fb170e17cc039de706c73191a1d02ee
-
Filesize
712KB
MD58dcfd2505f80675752e4a3dbcaf8e3cf
SHA1b7c9734f01be9278d1484f9b3d63b2bb200fa830
SHA2569f5e4a941f66372c49886896f4f63c28e88160356ce0794cfb88ce79e1e3ba3e
SHA51211589ec3e87e2dd48cd6cf5ad159b9c94788c9e294f634b31d98d9bb6d2d0568be3e61cc3b7a25d4653e443a9e32ec247fb170e17cc039de706c73191a1d02ee
-
Filesize
712KB
MD58dcfd2505f80675752e4a3dbcaf8e3cf
SHA1b7c9734f01be9278d1484f9b3d63b2bb200fa830
SHA2569f5e4a941f66372c49886896f4f63c28e88160356ce0794cfb88ce79e1e3ba3e
SHA51211589ec3e87e2dd48cd6cf5ad159b9c94788c9e294f634b31d98d9bb6d2d0568be3e61cc3b7a25d4653e443a9e32ec247fb170e17cc039de706c73191a1d02ee
-
Filesize
712KB
MD58dcfd2505f80675752e4a3dbcaf8e3cf
SHA1b7c9734f01be9278d1484f9b3d63b2bb200fa830
SHA2569f5e4a941f66372c49886896f4f63c28e88160356ce0794cfb88ce79e1e3ba3e
SHA51211589ec3e87e2dd48cd6cf5ad159b9c94788c9e294f634b31d98d9bb6d2d0568be3e61cc3b7a25d4653e443a9e32ec247fb170e17cc039de706c73191a1d02ee