8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e

Analysis

max time kernel
152s
max time network
182s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 05:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
Size

548KB
MD5

19463146fa399cb896cda232d0476107
SHA1

5c70d9405722197350300a9ce43161befbed3f4a
SHA256

8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e
SHA512

84e084f6e8bba42962205e84a49791bc579f6ea745ceac6be4d3204a2b67a05e78fd1d32716127a7187fe7554a21f7a672556905dedca3765f4700d2e94272a5
SSDEEP

12288:s2iwn/ND7S3xI66S/H3UyKxWn2hJ+MRmhhhlgNxbkP:s213Sed0XjhM7g

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	vdhos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	cchfzisvmmr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	vdhos.exe

UAC bypass 3 TTPs 12 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	cchfzisvmmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	vdhos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	vdhos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	vdhos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cchfzisvmmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	cchfzisvmmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	cchfzisvmmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	vdhos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	vdhos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	vdhos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	vdhos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	vdhos.exe

Adds policy Run key to start application 2 TTPs 19 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kboerlxnzijmuv = "vtnkefyvoemwltxqkxjhb.exe"	vdhos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kboerlxnzijmuv = "gdwslldzrgnwkrumfrcz.exe"	vdhos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nblyiziveki = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iduofdtndqvcotukbl.exe"	cchfzisvmmr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kboerlxnzijmuv = "slashdrjxilqadcq.exe"	vdhos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nblyiziveki = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tphcutkfwkqylrtkcnx.exe"	vdhos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kboerlxnzijmuv = "ztjcspexmycitxxmc.exe"	vdhos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nblyiziveki = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gdwslldzrgnwkrumfrcz.exe"	vdhos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	cchfzisvmmr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kboerlxnzijmuv = "tphcutkfwkqylrtkcnx.exe"	cchfzisvmmr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nblyiziveki = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gdwslldzrgnwkrumfrcz.exe"	cchfzisvmmr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nblyiziveki = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gdwslldzrgnwkrumfrcz.exe"	vdhos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kboerlxnzijmuv = "tphcutkfwkqylrtkcnx.exe"	vdhos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nblyiziveki = "C:\\Users\\Admin\\AppData\\Local\\Temp\\slashdrjxilqadcq.exe"	vdhos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nblyiziveki = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ztjcspexmycitxxmc.exe"	vdhos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kboerlxnzijmuv = "slashdrjxilqadcq.exe"	cchfzisvmmr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	vdhos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nblyiziveki = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tphcutkfwkqylrtkcnx.exe"	vdhos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	vdhos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\kboerlxnzijmuv = "slashdrjxilqadcq.exe"	vdhos.exe

Disables RegEdit via registry modification 6 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	vdhos.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	vdhos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	vdhos.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	cchfzisvmmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	cchfzisvmmr.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	vdhos.exe

Executes dropped EXE 3 IoCs

pid	Process
1988	cchfzisvmmr.exe
884	vdhos.exe
1332	vdhos.exe

Loads dropped DLL 6 IoCs

pid	Process
1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1988	cchfzisvmmr.exe
1988	cchfzisvmmr.exe
1988	cchfzisvmmr.exe
1988	cchfzisvmmr.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\slashdrjxilqadcq = "slashdrjxilqadcq.exe ."	cchfzisvmmr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\slashdrjxilqadcq = "iduofdtndqvcotukbl.exe ."	vdhos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\jzlamfqfqyyah = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tphcutkfwkqylrtkcnx.exe ."	cchfzisvmmr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\kzkyjblzjqpq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vtnkefyvoemwltxqkxjhb.exe"	vdhos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\nftkytgxkuwajlj = "iduofdtndqvcotukbl.exe"	vdhos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\nftkytgxkuwajlj = "gdwslldzrgnwkrumfrcz.exe"	cchfzisvmmr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\iduofdtndqvcotukbl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vtnkefyvoemwltxqkxjhb.exe"	cchfzisvmmr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\nftkytgxkuwajlj = "ztjcspexmycitxxmc.exe"	cchfzisvmmr.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	vdhos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\slashdrjxilqadcq = "ztjcspexmycitxxmc.exe ."	vdhos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ztjcspexmycitxxmc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ztjcspexmycitxxmc.exe ."	vdhos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	cchfzisvmmr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\jzlamfqfqyyah = "vtnkefyvoemwltxqkxjhb.exe ."	cchfzisvmmr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ztjcspexmycitxxmc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\slashdrjxilqadcq.exe ."	vdhos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\nftkytgxkuwajlj = "ztjcspexmycitxxmc.exe"	vdhos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ztjcspexmycitxxmc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ztjcspexmycitxxmc.exe ."	vdhos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ztjcspexmycitxxmc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vtnkefyvoemwltxqkxjhb.exe ."	vdhos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\kzkyjblzjqpq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tphcutkfwkqylrtkcnx.exe"	vdhos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	cchfzisvmmr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\iduofdtndqvcotukbl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iduofdtndqvcotukbl.exe"	vdhos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kzkyjblzjqpq = "ztjcspexmycitxxmc.exe"	vdhos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\kzkyjblzjqpq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tphcutkfwkqylrtkcnx.exe"	vdhos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\slashdrjxilqadcq = "gdwslldzrgnwkrumfrcz.exe ."	vdhos.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	cchfzisvmmr.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	cchfzisvmmr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\kzkyjblzjqpq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vtnkefyvoemwltxqkxjhb.exe"	cchfzisvmmr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\jzlamfqfqyyah = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gdwslldzrgnwkrumfrcz.exe ."	vdhos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\iduofdtndqvcotukbl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tphcutkfwkqylrtkcnx.exe"	vdhos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\nftkytgxkuwajlj = "iduofdtndqvcotukbl.exe"	vdhos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\jzlamfqfqyyah = "gdwslldzrgnwkrumfrcz.exe ."	vdhos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\iduofdtndqvcotukbl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iduofdtndqvcotukbl.exe"	vdhos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kzkyjblzjqpq = "slashdrjxilqadcq.exe"	vdhos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	vdhos.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	vdhos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\jzlamfqfqyyah = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iduofdtndqvcotukbl.exe ."	vdhos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\slashdrjxilqadcq = "gdwslldzrgnwkrumfrcz.exe ."	cchfzisvmmr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	vdhos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\kzkyjblzjqpq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vtnkefyvoemwltxqkxjhb.exe"	vdhos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\jzlamfqfqyyah = "ztjcspexmycitxxmc.exe ."	vdhos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\nftkytgxkuwajlj = "ztjcspexmycitxxmc.exe"	vdhos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\jzlamfqfqyyah = "slashdrjxilqadcq.exe ."	vdhos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kzkyjblzjqpq = "tphcutkfwkqylrtkcnx.exe"	cchfzisvmmr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\nftkytgxkuwajlj = "tphcutkfwkqylrtkcnx.exe"	vdhos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\iduofdtndqvcotukbl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tphcutkfwkqylrtkcnx.exe"	vdhos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\jzlamfqfqyyah = "vtnkefyvoemwltxqkxjhb.exe ."	vdhos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kzkyjblzjqpq = "tphcutkfwkqylrtkcnx.exe"	vdhos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kzkyjblzjqpq = "vtnkefyvoemwltxqkxjhb.exe"	vdhos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	vdhos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\nftkytgxkuwajlj = "vtnkefyvoemwltxqkxjhb.exe"	vdhos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ztjcspexmycitxxmc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tphcutkfwkqylrtkcnx.exe ."	vdhos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\jzlamfqfqyyah = "gdwslldzrgnwkrumfrcz.exe ."	vdhos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\slashdrjxilqadcq = "tphcutkfwkqylrtkcnx.exe ."	vdhos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\slashdrjxilqadcq = "tphcutkfwkqylrtkcnx.exe ."	vdhos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\nftkytgxkuwajlj = "tphcutkfwkqylrtkcnx.exe"	vdhos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ztjcspexmycitxxmc = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iduofdtndqvcotukbl.exe ."	cchfzisvmmr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kzkyjblzjqpq = "gdwslldzrgnwkrumfrcz.exe"	vdhos.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	vdhos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\slashdrjxilqadcq = "slashdrjxilqadcq.exe ."	vdhos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\jzlamfqfqyyah = "slashdrjxilqadcq.exe ."	vdhos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\kzkyjblzjqpq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iduofdtndqvcotukbl.exe"	vdhos.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\jzlamfqfqyyah = "gdwslldzrgnwkrumfrcz.exe ."	cchfzisvmmr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce	vdhos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\jzlamfqfqyyah = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tphcutkfwkqylrtkcnx.exe ."	vdhos.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	vdhos.exe

Checks whether UAC is enabled 1 TTPs 6 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	vdhos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cchfzisvmmr.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	cchfzisvmmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	vdhos.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	vdhos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	vdhos.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	www.showmyipaddress.com
5	whatismyipaddress.com
14	whatismyip.everdot.org

Drops file in System32 directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\tphcutkfwkqylrtkcnx.exe	vdhos.exe
File opened for modification	C:\Windows\SysWOW64\mlgezbvtnenyoxcwrfsrmk.exe	vdhos.exe
File opened for modification	C:\Windows\SysWOW64\slashdrjxilqadcq.exe	cchfzisvmmr.exe
File opened for modification	C:\Windows\SysWOW64\iduofdtndqvcotukbl.exe	cchfzisvmmr.exe
File opened for modification	C:\Windows\SysWOW64\tphcutkfwkqylrtkcnx.exe	cchfzisvmmr.exe
File opened for modification	C:\Windows\SysWOW64\vtnkefyvoemwltxqkxjhb.exe	cchfzisvmmr.exe
File opened for modification	C:\Windows\SysWOW64\tphcutkfwkqylrtkcnx.exe	vdhos.exe
File opened for modification	C:\Windows\SysWOW64\iduofdtndqvcotukbl.exe	vdhos.exe
File opened for modification	C:\Windows\SysWOW64\xzxywbyzwqcqjvdaypfhf.ejg	vdhos.exe
File opened for modification	C:\Windows\SysWOW64\sfoajzhtbgdcgdwenpqdmyhxfrzebaeb.cln	vdhos.exe
File opened for modification	C:\Windows\SysWOW64\ztjcspexmycitxxmc.exe	vdhos.exe
File opened for modification	C:\Windows\SysWOW64\gdwslldzrgnwkrumfrcz.exe	vdhos.exe
File opened for modification	C:\Windows\SysWOW64\vtnkefyvoemwltxqkxjhb.exe	vdhos.exe
File opened for modification	C:\Windows\SysWOW64\mlgezbvtnenyoxcwrfsrmk.exe	vdhos.exe
File opened for modification	C:\Windows\SysWOW64\vtnkefyvoemwltxqkxjhb.exe	vdhos.exe
File created	C:\Windows\SysWOW64\xzxywbyzwqcqjvdaypfhf.ejg	vdhos.exe
File opened for modification	C:\Windows\SysWOW64\ztjcspexmycitxxmc.exe	cchfzisvmmr.exe
File opened for modification	C:\Windows\SysWOW64\slashdrjxilqadcq.exe	vdhos.exe
File opened for modification	C:\Windows\SysWOW64\gdwslldzrgnwkrumfrcz.exe	vdhos.exe
File created	C:\Windows\SysWOW64\sfoajzhtbgdcgdwenpqdmyhxfrzebaeb.cln	vdhos.exe
File opened for modification	C:\Windows\SysWOW64\gdwslldzrgnwkrumfrcz.exe	cchfzisvmmr.exe
File opened for modification	C:\Windows\SysWOW64\mlgezbvtnenyoxcwrfsrmk.exe	cchfzisvmmr.exe
File opened for modification	C:\Windows\SysWOW64\slashdrjxilqadcq.exe	vdhos.exe
File opened for modification	C:\Windows\SysWOW64\iduofdtndqvcotukbl.exe	vdhos.exe
File opened for modification	C:\Windows\SysWOW64\ztjcspexmycitxxmc.exe	vdhos.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\xzxywbyzwqcqjvdaypfhf.ejg	vdhos.exe
File created	C:\Program Files (x86)\xzxywbyzwqcqjvdaypfhf.ejg	vdhos.exe
File opened for modification	C:\Program Files (x86)\sfoajzhtbgdcgdwenpqdmyhxfrzebaeb.cln	vdhos.exe
File created	C:\Program Files (x86)\sfoajzhtbgdcgdwenpqdmyhxfrzebaeb.cln	vdhos.exe

Drops file in Windows directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\tphcutkfwkqylrtkcnx.exe	cchfzisvmmr.exe
File opened for modification	C:\Windows\gdwslldzrgnwkrumfrcz.exe	cchfzisvmmr.exe
File opened for modification	C:\Windows\ztjcspexmycitxxmc.exe	vdhos.exe
File opened for modification	C:\Windows\iduofdtndqvcotukbl.exe	vdhos.exe
File opened for modification	C:\Windows\tphcutkfwkqylrtkcnx.exe	vdhos.exe
File opened for modification	C:\Windows\vtnkefyvoemwltxqkxjhb.exe	vdhos.exe
File created	C:\Windows\sfoajzhtbgdcgdwenpqdmyhxfrzebaeb.cln	vdhos.exe
File opened for modification	C:\Windows\mlgezbvtnenyoxcwrfsrmk.exe	cchfzisvmmr.exe
File opened for modification	C:\Windows\slashdrjxilqadcq.exe	vdhos.exe
File opened for modification	C:\Windows\iduofdtndqvcotukbl.exe	vdhos.exe
File opened for modification	C:\Windows\gdwslldzrgnwkrumfrcz.exe	vdhos.exe
File opened for modification	C:\Windows\vtnkefyvoemwltxqkxjhb.exe	vdhos.exe
File opened for modification	C:\Windows\slashdrjxilqadcq.exe	vdhos.exe
File created	C:\Windows\xzxywbyzwqcqjvdaypfhf.ejg	vdhos.exe
File opened for modification	C:\Windows\iduofdtndqvcotukbl.exe	cchfzisvmmr.exe
File opened for modification	C:\Windows\ztjcspexmycitxxmc.exe	vdhos.exe
File opened for modification	C:\Windows\tphcutkfwkqylrtkcnx.exe	vdhos.exe
File opened for modification	C:\Windows\mlgezbvtnenyoxcwrfsrmk.exe	vdhos.exe
File opened for modification	C:\Windows\gdwslldzrgnwkrumfrcz.exe	vdhos.exe
File opened for modification	C:\Windows\mlgezbvtnenyoxcwrfsrmk.exe	vdhos.exe
File opened for modification	C:\Windows\xzxywbyzwqcqjvdaypfhf.ejg	vdhos.exe
File opened for modification	C:\Windows\slashdrjxilqadcq.exe	cchfzisvmmr.exe
File opened for modification	C:\Windows\ztjcspexmycitxxmc.exe	cchfzisvmmr.exe
File opened for modification	C:\Windows\vtnkefyvoemwltxqkxjhb.exe	cchfzisvmmr.exe
File opened for modification	C:\Windows\sfoajzhtbgdcgdwenpqdmyhxfrzebaeb.cln	vdhos.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
884	vdhos.exe
884	vdhos.exe
1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	884	vdhos.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1816 wrote to memory of 1988	1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe	28
PID 1816 wrote to memory of 1988	1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe	28
PID 1816 wrote to memory of 1988	1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe	28
PID 1816 wrote to memory of 1988	1816	8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe	28
PID 1988 wrote to memory of 884	1988	cchfzisvmmr.exe	29
PID 1988 wrote to memory of 884	1988	cchfzisvmmr.exe	29
PID 1988 wrote to memory of 884	1988	cchfzisvmmr.exe	29
PID 1988 wrote to memory of 884	1988	cchfzisvmmr.exe	29
PID 1988 wrote to memory of 1332	1988	cchfzisvmmr.exe	30
PID 1988 wrote to memory of 1332	1988	cchfzisvmmr.exe	30
PID 1988 wrote to memory of 1332	1988	cchfzisvmmr.exe	30
PID 1988 wrote to memory of 1332	1988	cchfzisvmmr.exe	30

System policy modification 1 TTPs 39 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	vdhos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	vdhos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	vdhos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	cchfzisvmmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	vdhos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	vdhos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	vdhos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	vdhos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	cchfzisvmmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	vdhos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	vdhos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	vdhos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	cchfzisvmmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	vdhos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	vdhos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	vdhos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	vdhos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cchfzisvmmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	cchfzisvmmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	vdhos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	vdhos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	cchfzisvmmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	cchfzisvmmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	cchfzisvmmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	cchfzisvmmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	vdhos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	cchfzisvmmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	cchfzisvmmr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	vdhos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	vdhos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	cchfzisvmmr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	vdhos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	vdhos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	vdhos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	cchfzisvmmr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	vdhos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	vdhos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	vdhos.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	vdhos.exe

C:\Users\Admin\AppData\Local\Temp\8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe
"C:\Users\Admin\AppData\Local\Temp\8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Users\Admin\AppData\Local\Temp\cchfzisvmmr.exe
  "C:\Users\Admin\AppData\Local\Temp\cchfzisvmmr.exe" "c:\users\admin\appdata\local\temp\8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e.exe*"
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Adds policy Run key to start application
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1988
- - C:\Users\Admin\AppData\Local\Temp\vdhos.exe
    "C:\Users\Admin\AppData\Local\Temp\vdhos.exe" "-C:\Users\Admin\AppData\Local\Temp\slashdrjxilqadcq.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - System policy modification
    PID:884
- - C:\Users\Admin\AppData\Local\Temp\vdhos.exe
    "C:\Users\Admin\AppData\Local\Temp\vdhos.exe" "-C:\Users\Admin\AppData\Local\Temp\slashdrjxilqadcq.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System policy modification
    PID:1332

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\cchfzisvmmr.exe

Filesize
320KB

MD5
1cffa20c16ab8859dab6c9ef1d8efa8a

SHA1
9d8eb9f13de138608670617fb35966552a92daca

SHA256
2ce480d0b2d4f005d7e110dd47e9a15da745301d95af7b2e5fa8ada0e94e59a4

SHA512
35dbce9e82aedc29f90a14b899d0def15678f0f1c7f99628c9c752d46a543f82057ba78999e796b45c85a1453e03c439c612059deac6d683eb9feb1e983b7103

Download Submit
C:\Users\Admin\AppData\Local\Temp\cchfzisvmmr.exe

Filesize
320KB

MD5
1cffa20c16ab8859dab6c9ef1d8efa8a

SHA1
9d8eb9f13de138608670617fb35966552a92daca

SHA256
2ce480d0b2d4f005d7e110dd47e9a15da745301d95af7b2e5fa8ada0e94e59a4

SHA512
35dbce9e82aedc29f90a14b899d0def15678f0f1c7f99628c9c752d46a543f82057ba78999e796b45c85a1453e03c439c612059deac6d683eb9feb1e983b7103

Download Submit
C:\Users\Admin\AppData\Local\Temp\gdwslldzrgnwkrumfrcz.exe

Filesize
548KB

MD5
19463146fa399cb896cda232d0476107

SHA1
5c70d9405722197350300a9ce43161befbed3f4a

SHA256
8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e

SHA512
84e084f6e8bba42962205e84a49791bc579f6ea745ceac6be4d3204a2b67a05e78fd1d32716127a7187fe7554a21f7a672556905dedca3765f4700d2e94272a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\iduofdtndqvcotukbl.exe

Filesize
548KB

MD5
19463146fa399cb896cda232d0476107

SHA1
5c70d9405722197350300a9ce43161befbed3f4a

SHA256
8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e

SHA512
84e084f6e8bba42962205e84a49791bc579f6ea745ceac6be4d3204a2b67a05e78fd1d32716127a7187fe7554a21f7a672556905dedca3765f4700d2e94272a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\mlgezbvtnenyoxcwrfsrmk.exe

Filesize
548KB

MD5
19463146fa399cb896cda232d0476107

SHA1
5c70d9405722197350300a9ce43161befbed3f4a

SHA256
8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e

SHA512
84e084f6e8bba42962205e84a49791bc579f6ea745ceac6be4d3204a2b67a05e78fd1d32716127a7187fe7554a21f7a672556905dedca3765f4700d2e94272a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\mlgezbvtnenyoxcwrfsrmk.exe

Filesize
548KB

MD5
19463146fa399cb896cda232d0476107

SHA1
5c70d9405722197350300a9ce43161befbed3f4a

SHA256
8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e

SHA512
84e084f6e8bba42962205e84a49791bc579f6ea745ceac6be4d3204a2b67a05e78fd1d32716127a7187fe7554a21f7a672556905dedca3765f4700d2e94272a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\slashdrjxilqadcq.exe

Filesize
548KB

MD5
19463146fa399cb896cda232d0476107

SHA1
5c70d9405722197350300a9ce43161befbed3f4a

SHA256
8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e

SHA512
84e084f6e8bba42962205e84a49791bc579f6ea745ceac6be4d3204a2b67a05e78fd1d32716127a7187fe7554a21f7a672556905dedca3765f4700d2e94272a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\tphcutkfwkqylrtkcnx.exe

Filesize
548KB

MD5
19463146fa399cb896cda232d0476107

SHA1
5c70d9405722197350300a9ce43161befbed3f4a

SHA256
8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e

SHA512
84e084f6e8bba42962205e84a49791bc579f6ea745ceac6be4d3204a2b67a05e78fd1d32716127a7187fe7554a21f7a672556905dedca3765f4700d2e94272a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\vdhos.exe

Filesize
712KB

MD5
d739d80e7fd209876d0d06ea936cc409

SHA1
7bd6b6f4458c1f8eafd6b9f8c86e1b99832c195c

SHA256
ef3f7ed4f0a4deb2ce16317e75af164018906e326bd9093905d1925e04e6efb5

SHA512
c2524a7679d3f08f93cc2e44b861854615c4ab0f72dfade84b03efaa612d768b7ddbfb75c9a4573473a9e90dee63080ac633bc36ff0248fea84428c60d42e0c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\vdhos.exe

Filesize
712KB

MD5
d739d80e7fd209876d0d06ea936cc409

SHA1
7bd6b6f4458c1f8eafd6b9f8c86e1b99832c195c

SHA256
ef3f7ed4f0a4deb2ce16317e75af164018906e326bd9093905d1925e04e6efb5

SHA512
c2524a7679d3f08f93cc2e44b861854615c4ab0f72dfade84b03efaa612d768b7ddbfb75c9a4573473a9e90dee63080ac633bc36ff0248fea84428c60d42e0c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\vtnkefyvoemwltxqkxjhb.exe

Filesize
548KB

MD5
19463146fa399cb896cda232d0476107

SHA1
5c70d9405722197350300a9ce43161befbed3f4a

SHA256
8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e

SHA512
84e084f6e8bba42962205e84a49791bc579f6ea745ceac6be4d3204a2b67a05e78fd1d32716127a7187fe7554a21f7a672556905dedca3765f4700d2e94272a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\vtnkefyvoemwltxqkxjhb.exe

Filesize
548KB

MD5
19463146fa399cb896cda232d0476107

SHA1
5c70d9405722197350300a9ce43161befbed3f4a

SHA256
8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e

SHA512
84e084f6e8bba42962205e84a49791bc579f6ea745ceac6be4d3204a2b67a05e78fd1d32716127a7187fe7554a21f7a672556905dedca3765f4700d2e94272a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\ztjcspexmycitxxmc.exe

Filesize
548KB

MD5
19463146fa399cb896cda232d0476107

SHA1
5c70d9405722197350300a9ce43161befbed3f4a

SHA256
8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e

SHA512
84e084f6e8bba42962205e84a49791bc579f6ea745ceac6be4d3204a2b67a05e78fd1d32716127a7187fe7554a21f7a672556905dedca3765f4700d2e94272a5

Download Submit
C:\Windows\SysWOW64\gdwslldzrgnwkrumfrcz.exe

Filesize
548KB

MD5
19463146fa399cb896cda232d0476107

SHA1
5c70d9405722197350300a9ce43161befbed3f4a

SHA256
8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e

SHA512
84e084f6e8bba42962205e84a49791bc579f6ea745ceac6be4d3204a2b67a05e78fd1d32716127a7187fe7554a21f7a672556905dedca3765f4700d2e94272a5

Download Submit
C:\Windows\SysWOW64\iduofdtndqvcotukbl.exe

Filesize
548KB

MD5
19463146fa399cb896cda232d0476107

SHA1
5c70d9405722197350300a9ce43161befbed3f4a

SHA256
8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e

SHA512
84e084f6e8bba42962205e84a49791bc579f6ea745ceac6be4d3204a2b67a05e78fd1d32716127a7187fe7554a21f7a672556905dedca3765f4700d2e94272a5

Download Submit
C:\Windows\SysWOW64\mlgezbvtnenyoxcwrfsrmk.exe

Filesize
548KB

MD5
19463146fa399cb896cda232d0476107

SHA1
5c70d9405722197350300a9ce43161befbed3f4a

SHA256
8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e

SHA512
84e084f6e8bba42962205e84a49791bc579f6ea745ceac6be4d3204a2b67a05e78fd1d32716127a7187fe7554a21f7a672556905dedca3765f4700d2e94272a5

Download Submit
C:\Windows\SysWOW64\slashdrjxilqadcq.exe

Filesize
548KB

MD5
19463146fa399cb896cda232d0476107

SHA1
5c70d9405722197350300a9ce43161befbed3f4a

SHA256
8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e

SHA512
84e084f6e8bba42962205e84a49791bc579f6ea745ceac6be4d3204a2b67a05e78fd1d32716127a7187fe7554a21f7a672556905dedca3765f4700d2e94272a5

Download Submit
C:\Windows\SysWOW64\tphcutkfwkqylrtkcnx.exe

Filesize
548KB

MD5
19463146fa399cb896cda232d0476107

SHA1
5c70d9405722197350300a9ce43161befbed3f4a

SHA256
8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e

SHA512
84e084f6e8bba42962205e84a49791bc579f6ea745ceac6be4d3204a2b67a05e78fd1d32716127a7187fe7554a21f7a672556905dedca3765f4700d2e94272a5

Download Submit
C:\Windows\SysWOW64\vtnkefyvoemwltxqkxjhb.exe

Filesize
548KB

MD5
19463146fa399cb896cda232d0476107

SHA1
5c70d9405722197350300a9ce43161befbed3f4a

SHA256
8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e

SHA512
84e084f6e8bba42962205e84a49791bc579f6ea745ceac6be4d3204a2b67a05e78fd1d32716127a7187fe7554a21f7a672556905dedca3765f4700d2e94272a5

Download Submit
C:\Windows\SysWOW64\ztjcspexmycitxxmc.exe

Filesize
548KB

MD5
19463146fa399cb896cda232d0476107

SHA1
5c70d9405722197350300a9ce43161befbed3f4a

SHA256
8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e

SHA512
84e084f6e8bba42962205e84a49791bc579f6ea745ceac6be4d3204a2b67a05e78fd1d32716127a7187fe7554a21f7a672556905dedca3765f4700d2e94272a5

Download Submit
C:\Windows\gdwslldzrgnwkrumfrcz.exe

Filesize
548KB

MD5
19463146fa399cb896cda232d0476107

SHA1
5c70d9405722197350300a9ce43161befbed3f4a

SHA256
8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e

SHA512
84e084f6e8bba42962205e84a49791bc579f6ea745ceac6be4d3204a2b67a05e78fd1d32716127a7187fe7554a21f7a672556905dedca3765f4700d2e94272a5

Download Submit
C:\Windows\gdwslldzrgnwkrumfrcz.exe

Filesize
548KB

MD5
19463146fa399cb896cda232d0476107

SHA1
5c70d9405722197350300a9ce43161befbed3f4a

SHA256
8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e

SHA512
84e084f6e8bba42962205e84a49791bc579f6ea745ceac6be4d3204a2b67a05e78fd1d32716127a7187fe7554a21f7a672556905dedca3765f4700d2e94272a5

Download Submit
C:\Windows\iduofdtndqvcotukbl.exe

Filesize
548KB

MD5
19463146fa399cb896cda232d0476107

SHA1
5c70d9405722197350300a9ce43161befbed3f4a

SHA256
8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e

SHA512
84e084f6e8bba42962205e84a49791bc579f6ea745ceac6be4d3204a2b67a05e78fd1d32716127a7187fe7554a21f7a672556905dedca3765f4700d2e94272a5

Download Submit
C:\Windows\iduofdtndqvcotukbl.exe

Filesize
548KB

MD5
19463146fa399cb896cda232d0476107

SHA1
5c70d9405722197350300a9ce43161befbed3f4a

SHA256
8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e

SHA512
84e084f6e8bba42962205e84a49791bc579f6ea745ceac6be4d3204a2b67a05e78fd1d32716127a7187fe7554a21f7a672556905dedca3765f4700d2e94272a5

Download Submit
C:\Windows\mlgezbvtnenyoxcwrfsrmk.exe

Filesize
548KB

MD5
19463146fa399cb896cda232d0476107

SHA1
5c70d9405722197350300a9ce43161befbed3f4a

SHA256
8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e

SHA512
84e084f6e8bba42962205e84a49791bc579f6ea745ceac6be4d3204a2b67a05e78fd1d32716127a7187fe7554a21f7a672556905dedca3765f4700d2e94272a5

Download Submit
C:\Windows\mlgezbvtnenyoxcwrfsrmk.exe

Filesize
548KB

MD5
19463146fa399cb896cda232d0476107

SHA1
5c70d9405722197350300a9ce43161befbed3f4a

SHA256
8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e

SHA512
84e084f6e8bba42962205e84a49791bc579f6ea745ceac6be4d3204a2b67a05e78fd1d32716127a7187fe7554a21f7a672556905dedca3765f4700d2e94272a5

Download Submit
C:\Windows\slashdrjxilqadcq.exe

Filesize
548KB

MD5
19463146fa399cb896cda232d0476107

SHA1
5c70d9405722197350300a9ce43161befbed3f4a

SHA256
8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e

SHA512
84e084f6e8bba42962205e84a49791bc579f6ea745ceac6be4d3204a2b67a05e78fd1d32716127a7187fe7554a21f7a672556905dedca3765f4700d2e94272a5

Download Submit
C:\Windows\slashdrjxilqadcq.exe

Filesize
548KB

MD5
19463146fa399cb896cda232d0476107

SHA1
5c70d9405722197350300a9ce43161befbed3f4a

SHA256
8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e

SHA512
84e084f6e8bba42962205e84a49791bc579f6ea745ceac6be4d3204a2b67a05e78fd1d32716127a7187fe7554a21f7a672556905dedca3765f4700d2e94272a5

Download Submit
C:\Windows\tphcutkfwkqylrtkcnx.exe

Filesize
548KB

MD5
19463146fa399cb896cda232d0476107

SHA1
5c70d9405722197350300a9ce43161befbed3f4a

SHA256
8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e

SHA512
84e084f6e8bba42962205e84a49791bc579f6ea745ceac6be4d3204a2b67a05e78fd1d32716127a7187fe7554a21f7a672556905dedca3765f4700d2e94272a5

Download Submit
C:\Windows\tphcutkfwkqylrtkcnx.exe

Filesize
548KB

MD5
19463146fa399cb896cda232d0476107

SHA1
5c70d9405722197350300a9ce43161befbed3f4a

SHA256
8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e

SHA512
84e084f6e8bba42962205e84a49791bc579f6ea745ceac6be4d3204a2b67a05e78fd1d32716127a7187fe7554a21f7a672556905dedca3765f4700d2e94272a5

Download Submit
C:\Windows\vtnkefyvoemwltxqkxjhb.exe

Filesize
548KB

MD5
19463146fa399cb896cda232d0476107

SHA1
5c70d9405722197350300a9ce43161befbed3f4a

SHA256
8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e

SHA512
84e084f6e8bba42962205e84a49791bc579f6ea745ceac6be4d3204a2b67a05e78fd1d32716127a7187fe7554a21f7a672556905dedca3765f4700d2e94272a5

Download Submit
C:\Windows\vtnkefyvoemwltxqkxjhb.exe

Filesize
548KB

MD5
19463146fa399cb896cda232d0476107

SHA1
5c70d9405722197350300a9ce43161befbed3f4a

SHA256
8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e

SHA512
84e084f6e8bba42962205e84a49791bc579f6ea745ceac6be4d3204a2b67a05e78fd1d32716127a7187fe7554a21f7a672556905dedca3765f4700d2e94272a5

Download Submit
C:\Windows\ztjcspexmycitxxmc.exe

Filesize
548KB

MD5
19463146fa399cb896cda232d0476107

SHA1
5c70d9405722197350300a9ce43161befbed3f4a

SHA256
8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e

SHA512
84e084f6e8bba42962205e84a49791bc579f6ea745ceac6be4d3204a2b67a05e78fd1d32716127a7187fe7554a21f7a672556905dedca3765f4700d2e94272a5

Download Submit
C:\Windows\ztjcspexmycitxxmc.exe

Filesize
548KB

MD5
19463146fa399cb896cda232d0476107

SHA1
5c70d9405722197350300a9ce43161befbed3f4a

SHA256
8ff06485f483a64944aceaabbf826191fc566b864a90e8de5b27750b80f37f0e

SHA512
84e084f6e8bba42962205e84a49791bc579f6ea745ceac6be4d3204a2b67a05e78fd1d32716127a7187fe7554a21f7a672556905dedca3765f4700d2e94272a5

Download Submit
\Users\Admin\AppData\Local\Temp\cchfzisvmmr.exe

Filesize
320KB

MD5
1cffa20c16ab8859dab6c9ef1d8efa8a

SHA1
9d8eb9f13de138608670617fb35966552a92daca

SHA256
2ce480d0b2d4f005d7e110dd47e9a15da745301d95af7b2e5fa8ada0e94e59a4

SHA512
35dbce9e82aedc29f90a14b899d0def15678f0f1c7f99628c9c752d46a543f82057ba78999e796b45c85a1453e03c439c612059deac6d683eb9feb1e983b7103

Download Submit
\Users\Admin\AppData\Local\Temp\cchfzisvmmr.exe

Filesize
320KB

MD5
1cffa20c16ab8859dab6c9ef1d8efa8a

SHA1
9d8eb9f13de138608670617fb35966552a92daca

SHA256
2ce480d0b2d4f005d7e110dd47e9a15da745301d95af7b2e5fa8ada0e94e59a4

SHA512
35dbce9e82aedc29f90a14b899d0def15678f0f1c7f99628c9c752d46a543f82057ba78999e796b45c85a1453e03c439c612059deac6d683eb9feb1e983b7103

Download Submit
\Users\Admin\AppData\Local\Temp\vdhos.exe

Filesize
712KB

MD5
d739d80e7fd209876d0d06ea936cc409

SHA1
7bd6b6f4458c1f8eafd6b9f8c86e1b99832c195c

SHA256
ef3f7ed4f0a4deb2ce16317e75af164018906e326bd9093905d1925e04e6efb5

SHA512
c2524a7679d3f08f93cc2e44b861854615c4ab0f72dfade84b03efaa612d768b7ddbfb75c9a4573473a9e90dee63080ac633bc36ff0248fea84428c60d42e0c2

Download Submit
\Users\Admin\AppData\Local\Temp\vdhos.exe

Filesize
712KB

MD5
d739d80e7fd209876d0d06ea936cc409

SHA1
7bd6b6f4458c1f8eafd6b9f8c86e1b99832c195c

SHA256
ef3f7ed4f0a4deb2ce16317e75af164018906e326bd9093905d1925e04e6efb5

SHA512
c2524a7679d3f08f93cc2e44b861854615c4ab0f72dfade84b03efaa612d768b7ddbfb75c9a4573473a9e90dee63080ac633bc36ff0248fea84428c60d42e0c2

Download Submit
\Users\Admin\AppData\Local\Temp\vdhos.exe

Filesize
712KB

MD5
d739d80e7fd209876d0d06ea936cc409

SHA1
7bd6b6f4458c1f8eafd6b9f8c86e1b99832c195c

SHA256
ef3f7ed4f0a4deb2ce16317e75af164018906e326bd9093905d1925e04e6efb5

SHA512
c2524a7679d3f08f93cc2e44b861854615c4ab0f72dfade84b03efaa612d768b7ddbfb75c9a4573473a9e90dee63080ac633bc36ff0248fea84428c60d42e0c2

Download Submit
\Users\Admin\AppData\Local\Temp\vdhos.exe

Filesize
712KB

MD5
d739d80e7fd209876d0d06ea936cc409

SHA1
7bd6b6f4458c1f8eafd6b9f8c86e1b99832c195c

SHA256
ef3f7ed4f0a4deb2ce16317e75af164018906e326bd9093905d1925e04e6efb5

SHA512
c2524a7679d3f08f93cc2e44b861854615c4ab0f72dfade84b03efaa612d768b7ddbfb75c9a4573473a9e90dee63080ac633bc36ff0248fea84428c60d42e0c2

Download Submit
memory/1816-54-0x0000000075511000-0x0000000075513000-memory.dmp

Filesize
8KB

Download