Analysis
-
max time kernel
159s -
max time network
171s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
14/11/2023, 18:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
44dc942677e75933760dd468f991484daa89de0d4ba93b7564a19c9fe3bd5993.exe
Resource
win7-20231023-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
44dc942677e75933760dd468f991484daa89de0d4ba93b7564a19c9fe3bd5993.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
19 signatures
150 seconds
General
-
Target
44dc942677e75933760dd468f991484daa89de0d4ba93b7564a19c9fe3bd5993.exe
-
Size
320KB
-
MD5
9b861f6866eff9136f10a9c87509ed5b
-
SHA1
151af021a3e1e1425c25df510144d908b07c416b
-
SHA256
44dc942677e75933760dd468f991484daa89de0d4ba93b7564a19c9fe3bd5993
-
SHA512
ee5f0914745b29a76b81f9ffebafe0194f7309982d5dc8b0d60971a4e4dfca35f582b6204171979ce6354900f7169750358858c9d629a2a5a9f510f7690f8920
-
SSDEEP
6144:gTwZo1IV3puaibGKFHi0mofhaH05kipz016580bHFbl86JQPDHDdx/QtqR:uXgvmzFHi0mo5aH0qMzd5807FRPJQPDV
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" vfnuxks.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" vfnuxks.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" 44dc942677e75933760dd468f991484daa89de0d4ba93b7564a19c9fe3bd5993.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 44dc942677e75933760dd468f991484daa89de0d4ba93b7564a19c9fe3bd5993.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" vfnuxks.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" vfnuxks.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" vfnuxks.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" vfnuxks.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" vfnuxks.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 44dc942677e75933760dd468f991484daa89de0d4ba93b7564a19c9fe3bd5993.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" 44dc942677e75933760dd468f991484daa89de0d4ba93b7564a19c9fe3bd5993.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 44dc942677e75933760dd468f991484daa89de0d4ba93b7564a19c9fe3bd5993.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" vfnuxks.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" vfnuxks.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" vfnuxks.exe -
Adds policy Run key to start application 2 TTPs 30 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vfnuxks = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kfyqecvncpptesymxt.exe" vfnuxks.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vfnuxks = "C:\\Users\\Admin\\AppData\\Local\\Temp\\uneugctjwhfhqcgs.exe" vfnuxks.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\uhsciyjtaf = "kfyqecvncpptesymxt.exe" vfnuxks.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vfnuxks = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bvnerogxlxwzjwboy.exe" vfnuxks.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 44dc942677e75933760dd468f991484daa89de0d4ba93b7564a19c9fe3bd5993.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vfnuxks = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ifaukkfzqfhnaqyobzeb.exe" vfnuxks.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vfnuxks = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xvrmdeavndgnbsbsgfljf.exe" vfnuxks.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\uhsciyjtaf = "ifaukkfzqfhnaqyobzeb.exe" vfnuxks.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\uhsciyjtaf = "uneugctjwhfhqcgs.exe" vfnuxks.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\uhsciyjtaf = "bvnerogxlxwzjwboy.exe" 44dc942677e75933760dd468f991484daa89de0d4ba93b7564a19c9fe3bd5993.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run vfnuxks.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\uhsciyjtaf = "kfyqecvncpptesymxt.exe" 44dc942677e75933760dd468f991484daa89de0d4ba93b7564a19c9fe3bd5993.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run vfnuxks.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vfnuxks = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kfyqecvncpptesymxt.exe" vfnuxks.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\uhsciyjtaf = "ifaukkfzqfhnaqyobzeb.exe" vfnuxks.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\uhsciyjtaf = "bvnerogxlxwzjwboy.exe" vfnuxks.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vfnuxks = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bvnerogxlxwzjwboy.exe" vfnuxks.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vfnuxks = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vrletsmfvjkpbqxmyvz.exe" vfnuxks.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\uhsciyjtaf = "xvrmdeavndgnbsbsgfljf.exe" vfnuxks.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\uhsciyjtaf = "vrletsmfvjkpbqxmyvz.exe" vfnuxks.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vfnuxks = "C:\\Users\\Admin\\AppData\\Local\\Temp\\uneugctjwhfhqcgs.exe" vfnuxks.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\uhsciyjtaf = "kfyqecvncpptesymxt.exe" vfnuxks.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\uhsciyjtaf = "bvnerogxlxwzjwboy.exe" vfnuxks.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vfnuxks = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vrletsmfvjkpbqxmyvz.exe" vfnuxks.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\uhsciyjtaf = "vrletsmfvjkpbqxmyvz.exe" vfnuxks.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vfnuxks = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xvrmdeavndgnbsbsgfljf.exe" vfnuxks.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vfnuxks = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ifaukkfzqfhnaqyobzeb.exe" 44dc942677e75933760dd468f991484daa89de0d4ba93b7564a19c9fe3bd5993.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\uhsciyjtaf = "uneugctjwhfhqcgs.exe" vfnuxks.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\uhsciyjtaf = "xvrmdeavndgnbsbsgfljf.exe" vfnuxks.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\vfnuxks = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ifaukkfzqfhnaqyobzeb.exe" vfnuxks.exe -
Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 44dc942677e75933760dd468f991484daa89de0d4ba93b7564a19c9fe3bd5993.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 44dc942677e75933760dd468f991484daa89de0d4ba93b7564a19c9fe3bd5993.exe Set value (int) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" vfnuxks.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" vfnuxks.exe Set value (int) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" vfnuxks.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" vfnuxks.exe -
Executes dropped EXE 2 IoCs
pid Process 2600 vfnuxks.exe 2720 vfnuxks.exe -
Loads dropped DLL 4 IoCs
pid Process 2540 44dc942677e75933760dd468f991484daa89de0d4ba93b7564a19c9fe3bd5993.exe 2540 44dc942677e75933760dd468f991484daa89de0d4ba93b7564a19c9fe3bd5993.exe 2540 44dc942677e75933760dd468f991484daa89de0d4ba93b7564a19c9fe3bd5993.exe 2540 44dc942677e75933760dd468f991484daa89de0d4ba93b7564a19c9fe3bd5993.exe -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lbpclesfpxsrx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\uneugctjwhfhqcgs.exe ." vfnuxks.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bnxglaktz = "xvrmdeavndgnbsbsgfljf.exe ." vfnuxks.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mdsgqkznyhddku = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xvrmdeavndgnbsbsgfljf.exe" 44dc942677e75933760dd468f991484daa89de0d4ba93b7564a19c9fe3bd5993.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Run\kvemqenv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xvrmdeavndgnbsbsgfljf.exe" vfnuxks.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kvemqenv = "uneugctjwhfhqcgs.exe" 44dc942677e75933760dd468f991484daa89de0d4ba93b7564a19c9fe3bd5993.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\mboaianzipjh = "vrletsmfvjkpbqxmyvz.exe ." vfnuxks.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kvemqenv = "vrletsmfvjkpbqxmyvz.exe" vfnuxks.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bnxglaktz = "uneugctjwhfhqcgs.exe ." vfnuxks.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mdsgqkznyhddku = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vrletsmfvjkpbqxmyvz.exe" vfnuxks.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lbpclesfpxsrx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bvnerogxlxwzjwboy.exe ." vfnuxks.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\mboaianzipjh = "ifaukkfzqfhnaqyobzeb.exe ." vfnuxks.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bnxglaktz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bvnerogxlxwzjwboy.exe ." vfnuxks.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lbpclesfpxsrx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vrletsmfvjkpbqxmyvz.exe ." vfnuxks.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bnxglaktz = "bvnerogxlxwzjwboy.exe ." vfnuxks.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Run\pdpahykvdjc = "ifaukkfzqfhnaqyobzeb.exe" vfnuxks.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lbpclesfpxsrx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xvrmdeavndgnbsbsgfljf.exe ." 44dc942677e75933760dd468f991484daa89de0d4ba93b7564a19c9fe3bd5993.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mdsgqkznyhddku = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xvrmdeavndgnbsbsgfljf.exe" vfnuxks.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mdsgqkznyhddku = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xvrmdeavndgnbsbsgfljf.exe" vfnuxks.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bnxglaktz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vrletsmfvjkpbqxmyvz.exe ." vfnuxks.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kvemqenv = "uneugctjwhfhqcgs.exe" vfnuxks.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bnxglaktz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ifaukkfzqfhnaqyobzeb.exe ." 44dc942677e75933760dd468f991484daa89de0d4ba93b7564a19c9fe3bd5993.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Run\kvemqenv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\uneugctjwhfhqcgs.exe" vfnuxks.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Run\kvemqenv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\uneugctjwhfhqcgs.exe" vfnuxks.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Run\kvemqenv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vrletsmfvjkpbqxmyvz.exe" vfnuxks.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Run\pdpahykvdjc = "xvrmdeavndgnbsbsgfljf.exe" vfnuxks.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kvemqenv = "vrletsmfvjkpbqxmyvz.exe" 44dc942677e75933760dd468f991484daa89de0d4ba93b7564a19c9fe3bd5993.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kvemqenv = "ifaukkfzqfhnaqyobzeb.exe" vfnuxks.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Run\kvemqenv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bvnerogxlxwzjwboy.exe" vfnuxks.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Run\pdpahykvdjc = "bvnerogxlxwzjwboy.exe" vfnuxks.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Run\pdpahykvdjc = "uneugctjwhfhqcgs.exe" vfnuxks.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mdsgqkznyhddku = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ifaukkfzqfhnaqyobzeb.exe" vfnuxks.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mdsgqkznyhddku = "C:\\Users\\Admin\\AppData\\Local\\Temp\\uneugctjwhfhqcgs.exe" vfnuxks.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\mboaianzipjh = "bvnerogxlxwzjwboy.exe ." vfnuxks.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mdsgqkznyhddku = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vrletsmfvjkpbqxmyvz.exe" vfnuxks.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bnxglaktz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ifaukkfzqfhnaqyobzeb.exe ." vfnuxks.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\mboaianzipjh = "kfyqecvncpptesymxt.exe ." vfnuxks.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Run\pdpahykvdjc = "kfyqecvncpptesymxt.exe" vfnuxks.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Run\kvemqenv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ifaukkfzqfhnaqyobzeb.exe" 44dc942677e75933760dd468f991484daa89de0d4ba93b7564a19c9fe3bd5993.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Run\pdpahykvdjc = "bvnerogxlxwzjwboy.exe" 44dc942677e75933760dd468f991484daa89de0d4ba93b7564a19c9fe3bd5993.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kvemqenv = "bvnerogxlxwzjwboy.exe" vfnuxks.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lbpclesfpxsrx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xvrmdeavndgnbsbsgfljf.exe ." vfnuxks.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Run\pdpahykvdjc = "kfyqecvncpptesymxt.exe" vfnuxks.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bnxglaktz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bvnerogxlxwzjwboy.exe ." vfnuxks.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bnxglaktz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kfyqecvncpptesymxt.exe ." vfnuxks.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Run\pdpahykvdjc = "vrletsmfvjkpbqxmyvz.exe" vfnuxks.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Run\pdpahykvdjc = "bvnerogxlxwzjwboy.exe" vfnuxks.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kvemqenv = "xvrmdeavndgnbsbsgfljf.exe" vfnuxks.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lbpclesfpxsrx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\uneugctjwhfhqcgs.exe ." 44dc942677e75933760dd468f991484daa89de0d4ba93b7564a19c9fe3bd5993.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bnxglaktz = "kfyqecvncpptesymxt.exe ." 44dc942677e75933760dd468f991484daa89de0d4ba93b7564a19c9fe3bd5993.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lbpclesfpxsrx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\uneugctjwhfhqcgs.exe ." vfnuxks.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Run\pdpahykvdjc = "vrletsmfvjkpbqxmyvz.exe" 44dc942677e75933760dd468f991484daa89de0d4ba93b7564a19c9fe3bd5993.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\mboaianzipjh = "xvrmdeavndgnbsbsgfljf.exe ." vfnuxks.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\mboaianzipjh = "xvrmdeavndgnbsbsgfljf.exe ." 44dc942677e75933760dd468f991484daa89de0d4ba93b7564a19c9fe3bd5993.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bnxglaktz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kfyqecvncpptesymxt.exe ." 44dc942677e75933760dd468f991484daa89de0d4ba93b7564a19c9fe3bd5993.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\lbpclesfpxsrx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kfyqecvncpptesymxt.exe ." vfnuxks.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bnxglaktz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\uneugctjwhfhqcgs.exe ." vfnuxks.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Run\kvemqenv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bvnerogxlxwzjwboy.exe" 44dc942677e75933760dd468f991484daa89de0d4ba93b7564a19c9fe3bd5993.exe Set value (str) \REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Run\kvemqenv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bvnerogxlxwzjwboy.exe" vfnuxks.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kvemqenv = "kfyqecvncpptesymxt.exe" vfnuxks.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kvemqenv = "bvnerogxlxwzjwboy.exe" vfnuxks.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mdsgqkznyhddku = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bvnerogxlxwzjwboy.exe" vfnuxks.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bnxglaktz = "bvnerogxlxwzjwboy.exe ." vfnuxks.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mdsgqkznyhddku = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kfyqecvncpptesymxt.exe" vfnuxks.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bnxglaktz = "uneugctjwhfhqcgs.exe ." vfnuxks.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 44dc942677e75933760dd468f991484daa89de0d4ba93b7564a19c9fe3bd5993.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 44dc942677e75933760dd468f991484daa89de0d4ba93b7564a19c9fe3bd5993.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" vfnuxks.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA vfnuxks.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" vfnuxks.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA vfnuxks.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 whatismyip.everdot.org 5 whatismyipaddress.com 11 www.showmyipaddress.com -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ybccyeffcxfrkguqjnybcc.eff vfnuxks.exe File created C:\Windows\SysWOW64\ybccyeffcxfrkguqjnybcc.eff vfnuxks.exe File opened for modification C:\Windows\SysWOW64\pdpahykvdjczdkjqujftfqxoaltzsptaz.kzv vfnuxks.exe File created C:\Windows\SysWOW64\pdpahykvdjczdkjqujftfqxoaltzsptaz.kzv vfnuxks.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\ybccyeffcxfrkguqjnybcc.eff vfnuxks.exe File created C:\Program Files (x86)\ybccyeffcxfrkguqjnybcc.eff vfnuxks.exe File opened for modification C:\Program Files (x86)\pdpahykvdjczdkjqujftfqxoaltzsptaz.kzv vfnuxks.exe File created C:\Program Files (x86)\pdpahykvdjczdkjqujftfqxoaltzsptaz.kzv vfnuxks.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\ybccyeffcxfrkguqjnybcc.eff vfnuxks.exe File created C:\Windows\ybccyeffcxfrkguqjnybcc.eff vfnuxks.exe File opened for modification C:\Windows\pdpahykvdjczdkjqujftfqxoaltzsptaz.kzv vfnuxks.exe File created C:\Windows\pdpahykvdjczdkjqujftfqxoaltzsptaz.kzv vfnuxks.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2600 vfnuxks.exe 2600 vfnuxks.exe 2600 vfnuxks.exe 2600 vfnuxks.exe 2600 vfnuxks.exe 2600 vfnuxks.exe 2600 vfnuxks.exe 2600 vfnuxks.exe 2600 vfnuxks.exe 2600 vfnuxks.exe 2600 vfnuxks.exe 2600 vfnuxks.exe 2600 vfnuxks.exe 2600 vfnuxks.exe 2600 vfnuxks.exe 2600 vfnuxks.exe 2600 vfnuxks.exe 2600 vfnuxks.exe 2600 vfnuxks.exe 2600 vfnuxks.exe 2600 vfnuxks.exe 2600 vfnuxks.exe 2600 vfnuxks.exe 2600 vfnuxks.exe 2600 vfnuxks.exe 2600 vfnuxks.exe 2600 vfnuxks.exe 2600 vfnuxks.exe 2600 vfnuxks.exe 2600 vfnuxks.exe 2600 vfnuxks.exe 2600 vfnuxks.exe 2600 vfnuxks.exe 2600 vfnuxks.exe 2600 vfnuxks.exe 2600 vfnuxks.exe 2600 vfnuxks.exe 2600 vfnuxks.exe 2600 vfnuxks.exe 2600 vfnuxks.exe 2600 vfnuxks.exe 2600 vfnuxks.exe 2600 vfnuxks.exe 2600 vfnuxks.exe 2600 vfnuxks.exe 2600 vfnuxks.exe 2600 vfnuxks.exe 2600 vfnuxks.exe 2600 vfnuxks.exe 2600 vfnuxks.exe 2600 vfnuxks.exe 2600 vfnuxks.exe 2600 vfnuxks.exe 2600 vfnuxks.exe 2600 vfnuxks.exe 2600 vfnuxks.exe 2600 vfnuxks.exe 2600 vfnuxks.exe 2600 vfnuxks.exe 2600 vfnuxks.exe 2600 vfnuxks.exe 2600 vfnuxks.exe 2600 vfnuxks.exe 2600 vfnuxks.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2600 vfnuxks.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2540 wrote to memory of 2600 2540 44dc942677e75933760dd468f991484daa89de0d4ba93b7564a19c9fe3bd5993.exe 28 PID 2540 wrote to memory of 2600 2540 44dc942677e75933760dd468f991484daa89de0d4ba93b7564a19c9fe3bd5993.exe 28 PID 2540 wrote to memory of 2600 2540 44dc942677e75933760dd468f991484daa89de0d4ba93b7564a19c9fe3bd5993.exe 28 PID 2540 wrote to memory of 2600 2540 44dc942677e75933760dd468f991484daa89de0d4ba93b7564a19c9fe3bd5993.exe 28 PID 2540 wrote to memory of 2720 2540 44dc942677e75933760dd468f991484daa89de0d4ba93b7564a19c9fe3bd5993.exe 29 PID 2540 wrote to memory of 2720 2540 44dc942677e75933760dd468f991484daa89de0d4ba93b7564a19c9fe3bd5993.exe 29 PID 2540 wrote to memory of 2720 2540 44dc942677e75933760dd468f991484daa89de0d4ba93b7564a19c9fe3bd5993.exe 29 PID 2540 wrote to memory of 2720 2540 44dc942677e75933760dd468f991484daa89de0d4ba93b7564a19c9fe3bd5993.exe 29 -
System policy modification 1 TTPs 39 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer vfnuxks.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 44dc942677e75933760dd468f991484daa89de0d4ba93b7564a19c9fe3bd5993.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 44dc942677e75933760dd468f991484daa89de0d4ba93b7564a19c9fe3bd5993.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" 44dc942677e75933760dd468f991484daa89de0d4ba93b7564a19c9fe3bd5993.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" vfnuxks.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" vfnuxks.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" 44dc942677e75933760dd468f991484daa89de0d4ba93b7564a19c9fe3bd5993.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" vfnuxks.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" vfnuxks.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" vfnuxks.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" vfnuxks.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System vfnuxks.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" vfnuxks.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" vfnuxks.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" vfnuxks.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" vfnuxks.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" vfnuxks.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer vfnuxks.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" vfnuxks.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" 44dc942677e75933760dd468f991484daa89de0d4ba93b7564a19c9fe3bd5993.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" 44dc942677e75933760dd468f991484daa89de0d4ba93b7564a19c9fe3bd5993.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System vfnuxks.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" vfnuxks.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 44dc942677e75933760dd468f991484daa89de0d4ba93b7564a19c9fe3bd5993.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" 44dc942677e75933760dd468f991484daa89de0d4ba93b7564a19c9fe3bd5993.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 44dc942677e75933760dd468f991484daa89de0d4ba93b7564a19c9fe3bd5993.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" vfnuxks.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" vfnuxks.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" vfnuxks.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" vfnuxks.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" 44dc942677e75933760dd468f991484daa89de0d4ba93b7564a19c9fe3bd5993.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" vfnuxks.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" vfnuxks.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" vfnuxks.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" vfnuxks.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 44dc942677e75933760dd468f991484daa89de0d4ba93b7564a19c9fe3bd5993.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 44dc942677e75933760dd468f991484daa89de0d4ba93b7564a19c9fe3bd5993.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" 44dc942677e75933760dd468f991484daa89de0d4ba93b7564a19c9fe3bd5993.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" vfnuxks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\44dc942677e75933760dd468f991484daa89de0d4ba93b7564a19c9fe3bd5993.exe"C:\Users\Admin\AppData\Local\Temp\44dc942677e75933760dd468f991484daa89de0d4ba93b7564a19c9fe3bd5993.exe"1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\vfnuxks.exe"C:\Users\Admin\AppData\Local\Temp\vfnuxks.exe" "-"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2600
-
-
C:\Users\Admin\AppData\Local\Temp\vfnuxks.exe"C:\Users\Admin\AppData\Local\Temp\vfnuxks.exe" "-"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- System policy modification
PID:2720
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
280B
MD5f2de69eb1ca5fa21f12be4d1e374d935
SHA19f667a31fc6a0a2bf81ba000d5258a2bc4425b8b
SHA256386d08cd56d90b4b2d3ee35d91131c6a9154a13990ab4cd46303a15164c4e585
SHA512003e277f7beee3a5b61932b4ad9ee7573949699b7f49dbeabe20eda4a510a79cebea0666b281094e1aeba512d543562c5d943aec191f436d5cfc1dff6cea12bd
-
Filesize
280B
MD5082e7eb272a297c775273863c3d90c57
SHA19bc40fb144ffa1581cf773218ed6fddb884cb9f3
SHA256407908921c67fad2bcb11c29c0ddc5db81a084439b848e9da9847414d19f7252
SHA5125e72ce25515dbc69d2ffa275b9dfac66d439861313d5d18274b8e0d4c2b9634e31811e7ae9bf11f14eb958291dd330cac2bf064ef1b4425a525b1e636d548ed5
-
Filesize
280B
MD53e1f3776dfae342e1ed6609ec55b20bd
SHA15a5fa84d76052c8ec85b028fd988af74d7b88c80
SHA256c7dd9bff3e3f69c332562c78b1b5352a4880fc35eb304a56ca8a76e01c39c536
SHA5125b76fac1b9dc2e75b6cc20fe1df4b6370814070e898f3a7db9b9df16658592a2591b021419074a3661f0251f97856c1bd9bf1c647478443d8d9c4c72a662cc30
-
Filesize
280B
MD5d2961c6b15f8164d2087943aaf31403f
SHA1c8ef2a93b1ceebf04e2343c189e59f933cd649c3
SHA25696786ce35cb02ba436bcce7baa8d84ad328127347c4b58c0a4dcb0462c79a409
SHA512b6270b5596128f72c858d2caf7774131fe9e184eb8278d5d20f6cda49ea8cab76cd1529476e789bd2911327bbf5b9ee398f4ac55de44cff0774e39d6b374229b
-
Filesize
280B
MD57ab41b96f41fe225bac7a98f45efca3f
SHA1c71ecf7214f87d001694022f224b4db70c8842ec
SHA256dc708c305c730a6f3dc5f96a520ed17c55bd903dc803d6dfbf6288428ce4dd75
SHA5128672ddc84b811084aa6a4c6cdfd99bc83967b62b2bf4f1bb9c9d4574b1f08280d7c340df189013c06ee69b91301ed48e7c81aed09f7aba69c213ad36de3cc404
-
Filesize
280B
MD5e22a8c13aaddb80f38bbfdd8e7f3311d
SHA17587079f21bcb653b19e7620e0cce2c5a3c8f28c
SHA256477596cd865715e8cbb14a2e53ebc2f66181a26bb48edd47199d9fdf98f35b73
SHA5126edd485379cf41a289dc2cbe108068a97419f52911771c7c39eaf3f3fadeb1383aa3118c49af2073c98612fc47a55ba2a31b0784aa9e23d27e31da70415bb19d
-
Filesize
700KB
MD523a5acb1fa6a686b4fb90c7ea31f8462
SHA1a5c9612b9c50b4c2141a71907d388ab547dfcc0b
SHA256f7138e4df80c0059bea65f9fde7089157d6b86185b36d902f06ff782867f77ba
SHA5122bd8665527112e3938909a4a6e1a0f553a189e13de67023cb07b89d33da96fd0006beab22c7efed57c20cfcfac5c80837aff1fa64afbffcb50a247da3921e91d
-
Filesize
700KB
MD523a5acb1fa6a686b4fb90c7ea31f8462
SHA1a5c9612b9c50b4c2141a71907d388ab547dfcc0b
SHA256f7138e4df80c0059bea65f9fde7089157d6b86185b36d902f06ff782867f77ba
SHA5122bd8665527112e3938909a4a6e1a0f553a189e13de67023cb07b89d33da96fd0006beab22c7efed57c20cfcfac5c80837aff1fa64afbffcb50a247da3921e91d
-
Filesize
700KB
MD523a5acb1fa6a686b4fb90c7ea31f8462
SHA1a5c9612b9c50b4c2141a71907d388ab547dfcc0b
SHA256f7138e4df80c0059bea65f9fde7089157d6b86185b36d902f06ff782867f77ba
SHA5122bd8665527112e3938909a4a6e1a0f553a189e13de67023cb07b89d33da96fd0006beab22c7efed57c20cfcfac5c80837aff1fa64afbffcb50a247da3921e91d
-
Filesize
4KB
MD5f2648cebb98ea39993b519800c2e3be8
SHA1463ec241254d35c309285049567824efdc2fcf09
SHA256ca0d10fee7552651b6e74d37c54d2a8754c5f6ec333c69970e42da1326a76d19
SHA512cdf9a65eededdbc02cf28b6456868cf2ca970d7d5e1937fdd8a9eb1cce9aec461d6c7e5c82650369e30669c8cb5897bc549aec1bfad57aefd5fcff04d1533ffe
-
Filesize
280B
MD5e43e2ee0e77a837d489d4648c10978a0
SHA15fa3d257c48796523796329e1139f78122be2e75
SHA25672415ea6cc04d301935acfaa894a11f0d96162d5c4799e8f8b2c391423b85d4f
SHA512e1d5690b04a3bfcc29725381c57e2f13c6115b84be21151ceebc05ad36f84389808174bd56995507d9a3d9a3f48b26dea4b1324f3b9f112c410838875c045906
-
Filesize
280B
MD5246b1da5ea4313f8ee6d08f78a099fe4
SHA1099eac75fbe13b3414fa77cbcf3c4ea4a724aaa6
SHA256f7b6572e423452e2beb0b19d95a77cdd1fedde90cefa09d4c4aba508c84fb7a1
SHA5121342dc7481ddc5ef383da3f4dd0cab090a0f4cd2215e9b3816227df1c8a3867f01b89d6e5f44d5bf8cd2ed0320e20d4098d9d517564d86acf607938a2da0a8e1
-
Filesize
700KB
MD523a5acb1fa6a686b4fb90c7ea31f8462
SHA1a5c9612b9c50b4c2141a71907d388ab547dfcc0b
SHA256f7138e4df80c0059bea65f9fde7089157d6b86185b36d902f06ff782867f77ba
SHA5122bd8665527112e3938909a4a6e1a0f553a189e13de67023cb07b89d33da96fd0006beab22c7efed57c20cfcfac5c80837aff1fa64afbffcb50a247da3921e91d
-
Filesize
700KB
MD523a5acb1fa6a686b4fb90c7ea31f8462
SHA1a5c9612b9c50b4c2141a71907d388ab547dfcc0b
SHA256f7138e4df80c0059bea65f9fde7089157d6b86185b36d902f06ff782867f77ba
SHA5122bd8665527112e3938909a4a6e1a0f553a189e13de67023cb07b89d33da96fd0006beab22c7efed57c20cfcfac5c80837aff1fa64afbffcb50a247da3921e91d
-
Filesize
700KB
MD523a5acb1fa6a686b4fb90c7ea31f8462
SHA1a5c9612b9c50b4c2141a71907d388ab547dfcc0b
SHA256f7138e4df80c0059bea65f9fde7089157d6b86185b36d902f06ff782867f77ba
SHA5122bd8665527112e3938909a4a6e1a0f553a189e13de67023cb07b89d33da96fd0006beab22c7efed57c20cfcfac5c80837aff1fa64afbffcb50a247da3921e91d
-
Filesize
700KB
MD523a5acb1fa6a686b4fb90c7ea31f8462
SHA1a5c9612b9c50b4c2141a71907d388ab547dfcc0b
SHA256f7138e4df80c0059bea65f9fde7089157d6b86185b36d902f06ff782867f77ba
SHA5122bd8665527112e3938909a4a6e1a0f553a189e13de67023cb07b89d33da96fd0006beab22c7efed57c20cfcfac5c80837aff1fa64afbffcb50a247da3921e91d