0de805cfde7a628a940caf8def63836afd6d75860614592f619797ff2265eb73

Analysis

max time kernel
172s
max time network
187s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
14/11/2023, 18:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0de805cfde7a628a940caf8def63836afd6d75860614592f619797ff2265eb73.exe
Size

26.5MB
MD5

970f1757ccc0b60859d23302688359ee
SHA1

bbe7be423ba59b0e9872d4f8556b8a9f89d46204
SHA256

0de805cfde7a628a940caf8def63836afd6d75860614592f619797ff2265eb73
SHA512

ca1e1b4a018c730391b90b7b235932bc87b1aa331c1c8327d1aa510cb0c6eb49e7ed110703ae8b2c41e54c1f066d51fa691aff3e09c5cc7a22c3195bce23ff47
SSDEEP

6144:O3Te8ySm8hQAAIfFrRXuEE+0l97mKwKArOHV3j86JQPDHDdx/Qtqa:B/zkFF+EExZmKbciVTPJQPDHvd

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	0de805cfde7a628a940caf8def63836afd6d75860614592f619797ff2265eb73.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	zbhveeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	zbhveeo.exe

UAC bypass 3 TTPs 12 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	0de805cfde7a628a940caf8def63836afd6d75860614592f619797ff2265eb73.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	0de805cfde7a628a940caf8def63836afd6d75860614592f619797ff2265eb73.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	zbhveeo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	zbhveeo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	zbhveeo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	zbhveeo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	0de805cfde7a628a940caf8def63836afd6d75860614592f619797ff2265eb73.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	0de805cfde7a628a940caf8def63836afd6d75860614592f619797ff2265eb73.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	zbhveeo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	zbhveeo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	zbhveeo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	zbhveeo.exe

Adds policy Run key to start application 2 TTPs 28 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\orynxyjp = "obsrlwrhbuxsppfysi.exe"	zbhveeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\orynxyjp = "mbuvrebtpkpmlnfawodw.exe"	zbhveeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bbfry = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yjyvnwpdvmngbzne.exe"	zbhveeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bbfry = "C:\\Users\\Admin\\AppData\\Local\\Temp\\obsrlwrhbuxsppfysi.exe"	0de805cfde7a628a940caf8def63836afd6d75860614592f619797ff2265eb73.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\orynxyjp = "brlnkywpmiommpiebukeg.exe"	0de805cfde7a628a940caf8def63836afd6d75860614592f619797ff2265eb73.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bbfry = "C:\\Users\\Admin\\AppData\\Local\\Temp\\obsrlwrhbuxsppfysi.exe"	zbhveeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bbfry = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yjyvnwpdvmngbzne.exe"	zbhveeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\orynxyjp = "brlnkywpmiommpiebukeg.exe"	zbhveeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bbfry = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mbuvrebtpkpmlnfawodw.exe"	0de805cfde7a628a940caf8def63836afd6d75860614592f619797ff2265eb73.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bbfry = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mbuvrebtpkpmlnfawodw.exe"	zbhveeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bbfry = "C:\\Users\\Admin\\AppData\\Local\\Temp\\frhfyicrkceyutiat.exe"	zbhveeo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	zbhveeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\orynxyjp = "znffamizuosomneytky.exe"	zbhveeo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	zbhveeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\orynxyjp = "znffamizuosomneytky.exe"	zbhveeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\orynxyjp = "brlnkywpmiommpiebukeg.exe"	zbhveeo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	0de805cfde7a628a940caf8def63836afd6d75860614592f619797ff2265eb73.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\orynxyjp = "obsrlwrhbuxsppfysi.exe"	0de805cfde7a628a940caf8def63836afd6d75860614592f619797ff2265eb73.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bbfry = "C:\\Users\\Admin\\AppData\\Local\\Temp\\znffamizuosomneytky.exe"	zbhveeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\orynxyjp = "yjyvnwpdvmngbzne.exe"	zbhveeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bbfry = "C:\\Users\\Admin\\AppData\\Local\\Temp\\frhfyicrkceyutiat.exe"	zbhveeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bbfry = "C:\\Users\\Admin\\AppData\\Local\\Temp\\znffamizuosomneytky.exe"	zbhveeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\orynxyjp = "frhfyicrkceyutiat.exe"	zbhveeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\orynxyjp = "mbuvrebtpkpmlnfawodw.exe"	zbhveeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bbfry = "C:\\Users\\Admin\\AppData\\Local\\Temp\\brlnkywpmiommpiebukeg.exe"	zbhveeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\orynxyjp = "yjyvnwpdvmngbzne.exe"	zbhveeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bbfry = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mbuvrebtpkpmlnfawodw.exe"	zbhveeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bbfry = "C:\\Users\\Admin\\AppData\\Local\\Temp\\obsrlwrhbuxsppfysi.exe"	zbhveeo.exe

Disables RegEdit via registry modification 6 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	zbhveeo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	zbhveeo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	zbhveeo.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	0de805cfde7a628a940caf8def63836afd6d75860614592f619797ff2265eb73.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	0de805cfde7a628a940caf8def63836afd6d75860614592f619797ff2265eb73.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	zbhveeo.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\Control Panel\International\Geo\Nation	0de805cfde7a628a940caf8def63836afd6d75860614592f619797ff2265eb73.exe

Executes dropped EXE 2 IoCs

pid	Process
2232	zbhveeo.exe
4288	zbhveeo.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zbhveeo = "znffamizuosomneytky.exe ."	zbhveeo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\zbhveeo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\obsrlwrhbuxsppfysi.exe ."	zbhveeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qxibpujthurg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\brlnkywpmiommpiebukeg.exe"	zbhveeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zbhveeo = "yjyvnwpdvmngbzne.exe ."	0de805cfde7a628a940caf8def63836afd6d75860614592f619797ff2265eb73.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tzjbosgpcok = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mbuvrebtpkpmlnfawodw.exe ."	zbhveeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zbhveeo = "mbuvrebtpkpmlnfawodw.exe ."	zbhveeo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fjrhsugny = "brlnkywpmiommpiebukeg.exe"	zbhveeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mnsfnm = "znffamizuosomneytky.exe"	zbhveeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mnsfnm = "mbuvrebtpkpmlnfawodw.exe"	zbhveeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mnsfnm = "mbuvrebtpkpmlnfawodw.exe"	zbhveeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tzjbosgpcok = "C:\\Users\\Admin\\AppData\\Local\\Temp\\znffamizuosomneytky.exe ."	zbhveeo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mnsfnm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yjyvnwpdvmngbzne.exe"	zbhveeo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ydmdpsfnzk = "mbuvrebtpkpmlnfawodw.exe ."	zbhveeo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\zbhveeo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\obsrlwrhbuxsppfysi.exe ."	zbhveeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qxibpujthurg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mbuvrebtpkpmlnfawodw.exe"	zbhveeo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ydmdpsfnzk = "frhfyicrkceyutiat.exe ."	zbhveeo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ydmdpsfnzk = "brlnkywpmiommpiebukeg.exe ."	zbhveeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tzjbosgpcok = "C:\\Users\\Admin\\AppData\\Local\\Temp\\brlnkywpmiommpiebukeg.exe ."	zbhveeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zbhveeo = "yjyvnwpdvmngbzne.exe ."	zbhveeo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mnsfnm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\obsrlwrhbuxsppfysi.exe"	zbhveeo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\zbhveeo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\znffamizuosomneytky.exe ."	zbhveeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zbhveeo = "brlnkywpmiommpiebukeg.exe ."	zbhveeo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mnsfnm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\brlnkywpmiommpiebukeg.exe"	zbhveeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tzjbosgpcok = "C:\\Users\\Admin\\AppData\\Local\\Temp\\znffamizuosomneytky.exe ."	0de805cfde7a628a940caf8def63836afd6d75860614592f619797ff2265eb73.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mnsfnm = "znffamizuosomneytky.exe"	zbhveeo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mnsfnm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\znffamizuosomneytky.exe"	zbhveeo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\zbhveeo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\znffamizuosomneytky.exe ."	zbhveeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zbhveeo = "yjyvnwpdvmngbzne.exe ."	zbhveeo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\zbhveeo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mbuvrebtpkpmlnfawodw.exe ."	zbhveeo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fjrhsugny = "frhfyicrkceyutiat.exe"	0de805cfde7a628a940caf8def63836afd6d75860614592f619797ff2265eb73.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mnsfnm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\obsrlwrhbuxsppfysi.exe"	0de805cfde7a628a940caf8def63836afd6d75860614592f619797ff2265eb73.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zbhveeo = "frhfyicrkceyutiat.exe ."	zbhveeo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mnsfnm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\znffamizuosomneytky.exe"	zbhveeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qxibpujthurg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\brlnkywpmiommpiebukeg.exe"	zbhveeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tzjbosgpcok = "C:\\Users\\Admin\\AppData\\Local\\Temp\\obsrlwrhbuxsppfysi.exe ."	0de805cfde7a628a940caf8def63836afd6d75860614592f619797ff2265eb73.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tzjbosgpcok = "C:\\Users\\Admin\\AppData\\Local\\Temp\\brlnkywpmiommpiebukeg.exe ."	zbhveeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zbhveeo = "obsrlwrhbuxsppfysi.exe ."	zbhveeo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mnsfnm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mbuvrebtpkpmlnfawodw.exe"	0de805cfde7a628a940caf8def63836afd6d75860614592f619797ff2265eb73.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ydmdpsfnzk = "yjyvnwpdvmngbzne.exe ."	zbhveeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qxibpujthurg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\obsrlwrhbuxsppfysi.exe"	zbhveeo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ydmdpsfnzk = "yjyvnwpdvmngbzne.exe ."	0de805cfde7a628a940caf8def63836afd6d75860614592f619797ff2265eb73.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fjrhsugny = "mbuvrebtpkpmlnfawodw.exe"	zbhveeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qxibpujthurg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\frhfyicrkceyutiat.exe"	zbhveeo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ydmdpsfnzk = "obsrlwrhbuxsppfysi.exe ."	zbhveeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mnsfnm = "yjyvnwpdvmngbzne.exe"	zbhveeo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ydmdpsfnzk = "frhfyicrkceyutiat.exe ."	zbhveeo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ydmdpsfnzk = "brlnkywpmiommpiebukeg.exe ."	0de805cfde7a628a940caf8def63836afd6d75860614592f619797ff2265eb73.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fjrhsugny = "frhfyicrkceyutiat.exe"	zbhveeo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ydmdpsfnzk = "obsrlwrhbuxsppfysi.exe ."	zbhveeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qxibpujthurg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yjyvnwpdvmngbzne.exe"	zbhveeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mnsfnm = "yjyvnwpdvmngbzne.exe"	0de805cfde7a628a940caf8def63836afd6d75860614592f619797ff2265eb73.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\zbhveeo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\znffamizuosomneytky.exe ."	0de805cfde7a628a940caf8def63836afd6d75860614592f619797ff2265eb73.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qxibpujthurg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\frhfyicrkceyutiat.exe"	zbhveeo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\zbhveeo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\frhfyicrkceyutiat.exe ."	zbhveeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mnsfnm = "obsrlwrhbuxsppfysi.exe"	zbhveeo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ydmdpsfnzk = "znffamizuosomneytky.exe ."	zbhveeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zbhveeo = "znffamizuosomneytky.exe ."	zbhveeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tzjbosgpcok = "C:\\Users\\Admin\\AppData\\Local\\Temp\\znffamizuosomneytky.exe ."	zbhveeo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mnsfnm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yjyvnwpdvmngbzne.exe"	zbhveeo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\zbhveeo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yjyvnwpdvmngbzne.exe ."	zbhveeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mnsfnm = "yjyvnwpdvmngbzne.exe"	zbhveeo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\zbhveeo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\brlnkywpmiommpiebukeg.exe ."	zbhveeo.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fjrhsugny = "yjyvnwpdvmngbzne.exe"	zbhveeo.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qxibpujthurg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yjyvnwpdvmngbzne.exe"	zbhveeo.exe

Checks whether UAC is enabled 1 TTPs 6 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	0de805cfde7a628a940caf8def63836afd6d75860614592f619797ff2265eb73.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	zbhveeo.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	zbhveeo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	zbhveeo.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	zbhveeo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	0de805cfde7a628a940caf8def63836afd6d75860614592f619797ff2265eb73.exe

Looks up external IP address via web service 6 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
61	www.showmyipaddress.com
75	whatismyip.everdot.org
87	whatismyip.everdot.org
97	whatismyip.everdot.org
54	whatismyipaddress.com
60	whatismyip.everdot.org

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\srufliprxcryhtvagihkvbyfhn.hox	zbhveeo.exe
File opened for modification	C:\Windows\SysWOW64\tdrnemeriyyqkhukboymizhzmdttlfcpfwjth.ucu	zbhveeo.exe
File created	C:\Windows\SysWOW64\tdrnemeriyyqkhukboymizhzmdttlfcpfwjth.ucu	zbhveeo.exe
File opened for modification	C:\Windows\SysWOW64\srufliprxcryhtvagihkvbyfhn.hox	zbhveeo.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\tdrnemeriyyqkhukboymizhzmdttlfcpfwjth.ucu	zbhveeo.exe
File opened for modification	C:\Program Files (x86)\srufliprxcryhtvagihkvbyfhn.hox	zbhveeo.exe
File created	C:\Program Files (x86)\srufliprxcryhtvagihkvbyfhn.hox	zbhveeo.exe
File opened for modification	C:\Program Files (x86)\tdrnemeriyyqkhukboymizhzmdttlfcpfwjth.ucu	zbhveeo.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\srufliprxcryhtvagihkvbyfhn.hox	zbhveeo.exe
File created	C:\Windows\srufliprxcryhtvagihkvbyfhn.hox	zbhveeo.exe
File opened for modification	C:\Windows\tdrnemeriyyqkhukboymizhzmdttlfcpfwjth.ucu	zbhveeo.exe
File created	C:\Windows\tdrnemeriyyqkhukboymizhzmdttlfcpfwjth.ucu	zbhveeo.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings	0de805cfde7a628a940caf8def63836afd6d75860614592f619797ff2265eb73.exe
Key created	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings	zbhveeo.exe
Key created	\REGISTRY\USER\S-1-5-21-1114462139-3090196418-29517368-1000_Classes\Local Settings	zbhveeo.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
2232	zbhveeo.exe
2232	zbhveeo.exe
2232	zbhveeo.exe
2232	zbhveeo.exe
2232	zbhveeo.exe
2232	zbhveeo.exe
2232	zbhveeo.exe
2232	zbhveeo.exe
2232	zbhveeo.exe
2232	zbhveeo.exe
2232	zbhveeo.exe
2232	zbhveeo.exe
2232	zbhveeo.exe
2232	zbhveeo.exe
2232	zbhveeo.exe
2232	zbhveeo.exe
2232	zbhveeo.exe
2232	zbhveeo.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4288	zbhveeo.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2232	zbhveeo.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 744 wrote to memory of 2232	744	0de805cfde7a628a940caf8def63836afd6d75860614592f619797ff2265eb73.exe	97
PID 744 wrote to memory of 2232	744	0de805cfde7a628a940caf8def63836afd6d75860614592f619797ff2265eb73.exe	97
PID 744 wrote to memory of 2232	744	0de805cfde7a628a940caf8def63836afd6d75860614592f619797ff2265eb73.exe	97
PID 744 wrote to memory of 4288	744	0de805cfde7a628a940caf8def63836afd6d75860614592f619797ff2265eb73.exe	98
PID 744 wrote to memory of 4288	744	0de805cfde7a628a940caf8def63836afd6d75860614592f619797ff2265eb73.exe	98
PID 744 wrote to memory of 4288	744	0de805cfde7a628a940caf8def63836afd6d75860614592f619797ff2265eb73.exe	98

System policy modification 1 TTPs 39 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	0de805cfde7a628a940caf8def63836afd6d75860614592f619797ff2265eb73.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	0de805cfde7a628a940caf8def63836afd6d75860614592f619797ff2265eb73.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	0de805cfde7a628a940caf8def63836afd6d75860614592f619797ff2265eb73.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	zbhveeo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	zbhveeo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	0de805cfde7a628a940caf8def63836afd6d75860614592f619797ff2265eb73.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	zbhveeo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	zbhveeo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	zbhveeo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	zbhveeo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	0de805cfde7a628a940caf8def63836afd6d75860614592f619797ff2265eb73.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	0de805cfde7a628a940caf8def63836afd6d75860614592f619797ff2265eb73.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	zbhveeo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	zbhveeo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	zbhveeo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	zbhveeo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	zbhveeo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	0de805cfde7a628a940caf8def63836afd6d75860614592f619797ff2265eb73.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	0de805cfde7a628a940caf8def63836afd6d75860614592f619797ff2265eb73.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	zbhveeo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	zbhveeo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	zbhveeo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	zbhveeo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	zbhveeo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	zbhveeo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	zbhveeo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	zbhveeo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	zbhveeo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	zbhveeo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	0de805cfde7a628a940caf8def63836afd6d75860614592f619797ff2265eb73.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	zbhveeo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	0de805cfde7a628a940caf8def63836afd6d75860614592f619797ff2265eb73.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	0de805cfde7a628a940caf8def63836afd6d75860614592f619797ff2265eb73.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	zbhveeo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	0de805cfde7a628a940caf8def63836afd6d75860614592f619797ff2265eb73.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	0de805cfde7a628a940caf8def63836afd6d75860614592f619797ff2265eb73.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	zbhveeo.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	zbhveeo.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	zbhveeo.exe

C:\Users\Admin\AppData\Local\Temp\0de805cfde7a628a940caf8def63836afd6d75860614592f619797ff2265eb73.exe
"C:\Users\Admin\AppData\Local\Temp\0de805cfde7a628a940caf8def63836afd6d75860614592f619797ff2265eb73.exe"
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of WriteProcessMemory
- System policy modification
PID:744
- C:\Users\Admin\AppData\Local\Temp\zbhveeo.exe
  "C:\Users\Admin\AppData\Local\Temp\zbhveeo.exe" "-"
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Adds policy Run key to start application
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - System policy modification
  PID:2232
- C:\Users\Admin\AppData\Local\Temp\zbhveeo.exe
  "C:\Users\Admin\AppData\Local\Temp\zbhveeo.exe" "-"
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Adds policy Run key to start application
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - System policy modification
  PID:4288

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\srufliprxcryhtvagihkvbyfhn.hox

Filesize
272B

MD5
b7a223628039591df400d9d073074247

SHA1
14180f95d7dcb03027f9e1f210b3d25de0988b15

SHA256
bf73dd0ee59cf6e4fdf7f5d07180937f9a01e8cb9cfbc5c3b4b13f62041559ff

SHA512
ea510d20a9ff2fb79ec0be3806385663b3ec4ba5b3c19cdeb5bf84e4207791dd1237e2cb54d34d059810075fe8fb36ab979e5266d27156ef603934db86de713d

Download Submit
C:\Program Files (x86)\srufliprxcryhtvagihkvbyfhn.hox

Filesize
272B

MD5
0f9056c50e2315b04557c36ab01c3495

SHA1
8de638860abe1a44107f43f1e18cf0647e9fcc83

SHA256
c3cb50cd40a7e1bddadbd364efc4e39aed377a58048f00e6db9fd01d79e1de3a

SHA512
6bb036a8c74a071d73191d61ac99908e86605be8e8368a30183615c6ac72ee8854894686bbc725b73f4cd1bc1e28916e1da3549f1c7fcee29d0a8d195589239d

Download Submit
C:\Program Files (x86)\srufliprxcryhtvagihkvbyfhn.hox

Filesize
272B

MD5
6037e4cfda89ba67c51a0bd2a18b27a5

SHA1
787c6748b1d953883397bc08159031c8be71be4b

SHA256
97335a57aafddb3a48d1c681c2b7b7f948aba809adbc28c081b39570c5e292df

SHA512
119c2a163991006fecac1f12a1146ad686781a2c498b5beee03e36f72cbd95fff17f8a37f6ca400f9a06a1c3deed2369f6e64bcdbc24fa0960921a8516e8ea2b

Download Submit
C:\Program Files (x86)\srufliprxcryhtvagihkvbyfhn.hox

Filesize
272B

MD5
d8994d09373ea83c00a5baf7207df7ce

SHA1
2e7641254fdefda154d60c28b8634e96c524def5

SHA256
f6253f89aaa23c798b8706331d0e974451f6037ff13b66dc7f0810a3c81cd67e

SHA512
b4e49c8d1bb3b9ecb82a01eaec0dc170ea2e49562b29bd4c3ea4648936d835773316db8b6065be860b3802643bb1a49dfaed282fa38a495681dc60a535abb7f5

Download Submit
C:\Program Files (x86)\srufliprxcryhtvagihkvbyfhn.hox

Filesize
272B

MD5
a07bc0247012e2687d1ccffb9eb589b8

SHA1
0b9ca3f79333b4a1a96a24b6c877c8a9caeda2ed

SHA256
6b247f9241347be56ff8ff0c7274a15be4553165a9eba4be694b19372213ab45

SHA512
c9250a0862b40a573e94a36264235d00a9763af532f49e55b89da88b40ad7b56b4f1c7bc64f74731d0794abf4f9e7451b1f27dc76ca66e9373060a038ac747b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\zbhveeo.exe

Filesize
30.5MB

MD5
62e318bdd360e8124fa8f1434a2f587c

SHA1
45dd33b2a04deff02245c75f2dd93375ba683640

SHA256
7a67d3bd8a729be3230d4800dbbd84480e508ca17f9c51c15241e77ead2d858e

SHA512
9af3475d2baf0981cde3bca4cc92d5ef7115baca26f243be242274b67fb8e3ff5228d72c92b797e1a2361b0ac35abb6c66b7485a4c722387aaf390193f40d2d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\zbhveeo.exe

Filesize
30.5MB

MD5
62e318bdd360e8124fa8f1434a2f587c

SHA1
45dd33b2a04deff02245c75f2dd93375ba683640

SHA256
7a67d3bd8a729be3230d4800dbbd84480e508ca17f9c51c15241e77ead2d858e

SHA512
9af3475d2baf0981cde3bca4cc92d5ef7115baca26f243be242274b67fb8e3ff5228d72c92b797e1a2361b0ac35abb6c66b7485a4c722387aaf390193f40d2d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\zbhveeo.exe

Filesize
30.5MB

MD5
62e318bdd360e8124fa8f1434a2f587c

SHA1
45dd33b2a04deff02245c75f2dd93375ba683640

SHA256
7a67d3bd8a729be3230d4800dbbd84480e508ca17f9c51c15241e77ead2d858e

SHA512
9af3475d2baf0981cde3bca4cc92d5ef7115baca26f243be242274b67fb8e3ff5228d72c92b797e1a2361b0ac35abb6c66b7485a4c722387aaf390193f40d2d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\zbhveeo.exe

Filesize
30.5MB

MD5
62e318bdd360e8124fa8f1434a2f587c

SHA1
45dd33b2a04deff02245c75f2dd93375ba683640

SHA256
7a67d3bd8a729be3230d4800dbbd84480e508ca17f9c51c15241e77ead2d858e

SHA512
9af3475d2baf0981cde3bca4cc92d5ef7115baca26f243be242274b67fb8e3ff5228d72c92b797e1a2361b0ac35abb6c66b7485a4c722387aaf390193f40d2d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\zbhveeo.exe

Filesize
30.5MB

MD5
62e318bdd360e8124fa8f1434a2f587c

SHA1
45dd33b2a04deff02245c75f2dd93375ba683640

SHA256
7a67d3bd8a729be3230d4800dbbd84480e508ca17f9c51c15241e77ead2d858e

SHA512
9af3475d2baf0981cde3bca4cc92d5ef7115baca26f243be242274b67fb8e3ff5228d72c92b797e1a2361b0ac35abb6c66b7485a4c722387aaf390193f40d2d5

Download Submit
C:\Users\Admin\AppData\Local\srufliprxcryhtvagihkvbyfhn.hox

Filesize
272B

MD5
83468ae00280b2dd428d29bff9dc1d0d

SHA1
d8c7176b0f423b3fece7ec3fdf5d112ab4f0b13b

SHA256
bfae2eefafacb4305508cef3110a8bbf105f6417554b184f3434d9deb74f4fc5

SHA512
373ec792774694103e344a1b46b51c598822fa7acd0a842714edfedbab3d8fdac69f38f3a6c8547ef2b0791b3d65e3cead425b56bb7e0a09e64c34c0c92a6833

Download Submit
C:\Users\Admin\AppData\Local\tdrnemeriyyqkhukboymizhzmdttlfcpfwjth.ucu

Filesize
3KB

MD5
fd25ee0deeb3caf44a87c5cd4849a24f

SHA1
25eb78e0acc1d5a30ec9036987c3f86b124186b2

SHA256
c83f404aa990490869e427d37ea5b16c2d3327e8421199105f51cfd564c1ddac

SHA512
10e0249cc40774fd7263f52cadcf111859a78f263cd0b55cad8077a5695398a72464326ea86f9e8482635c08c6d7ea075ad85a2de50da68ab34b1c5c358c9a89

Download Submit