9f7a095cb1184e6f219ed41bd9671d0bb5f1fbfab60f2b662e5b3ab31283e21d

Analysis

max time kernel
150s
max time network
146s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 05:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

100a74df616b79e8edcddeea916618b6.exe
Size

492KB
MD5

100a74df616b79e8edcddeea916618b6
SHA1

422d6beff33a185c591cb7c172c68d11315e330a
SHA256

9f7a095cb1184e6f219ed41bd9671d0bb5f1fbfab60f2b662e5b3ab31283e21d
SHA512

afada613cca10fb0ed7088b8a69e98c3c33130fc3ce6f3d844adbfe8fff72c5c66582a369681a3a16338f61e24afdb8e2924c3296bda7d30d630ad49c810a9e9
SSDEEP

12288:JK2iwn/ND7S3xI66S/H3UyKxWn2hJ+MRmhhhn:JK213Sed0XjhV

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	winoy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	qnssgssfaxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	qnssgssfaxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	winoy.exe

UAC bypass 3 TTPs 13 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	qnssgssfaxc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	qnssgssfaxc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winoy.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winoy.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winoy.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winoy.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winoy.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	qnssgssfaxc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winoy.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	winoy.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	qnssgssfaxc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	qnssgssfaxc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	winoy.exe

Adds policy Run key to start application 2 TTPs 25 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\keraswpbkzyfh = "jiaolusjxrvhojcjdd.exe"	winoy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\keraswpbkzyfh = "hicsrccvlhnbkhclhjke.exe"	winoy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\tkuapqgpvh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wytkkwxrifmbljfpmprmd.exe"	qnssgssfaxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\keraswpbkzyfh = "tqgsnuqfrjlvatkp.exe"	winoy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\tkuapqgpvh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\uuncakjbqlqdlhbjeff.exe"	winoy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\keraswpbkzyfh = "jiaolusjxrvhojcjdd.exe"	winoy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	qnssgssfaxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\keraswpbkzyfh = "wytkkwxrifmbljfpmprmd.exe"	qnssgssfaxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\tkuapqgpvh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wytkkwxrifmbljfpmprmd.exe"	winoy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\keraswpbkzyfh = "wytkkwxrifmbljfpmprmd.exe"	winoy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\keraswpbkzyfh = "uuncakjbqlqdlhbjeff.exe"	qnssgssfaxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\tkuapqgpvh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\aypcygdtgzcntnfle.exe"	winoy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\tkuapqgpvh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wytkkwxrifmbljfpmprmd.exe"	qnssgssfaxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\tkuapqgpvh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hicsrccvlhnbkhclhjke.exe"	winoy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\tkuapqgpvh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\uuncakjbqlqdlhbjeff.exe"	winoy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\tkuapqgpvh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jiaolusjxrvhojcjdd.exe"	winoy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\keraswpbkzyfh = "aypcygdtgzcntnfle.exe"	winoy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winoy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\keraswpbkzyfh = "hicsrccvlhnbkhclhjke.exe"	winoy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\tkuapqgpvh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\aypcygdtgzcntnfle.exe"	winoy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\tkuapqgpvh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wytkkwxrifmbljfpmprmd.exe"	winoy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	qnssgssfaxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	winoy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\keraswpbkzyfh = "tqgsnuqfrjlvatkp.exe"	winoy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\tkuapqgpvh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jiaolusjxrvhojcjdd.exe"	winoy.exe

Disables RegEdit via registry modification 6 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winoy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winoy.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winoy.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winoy.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	qnssgssfaxc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	qnssgssfaxc.exe

Executes dropped EXE 4 IoCs

pid	Process
2516	qnssgssfaxc.exe
2592	winoy.exe
1284	winoy.exe
2800	qnssgssfaxc.exe

Loads dropped DLL 8 IoCs

pid	Process
2988	100a74df616b79e8edcddeea916618b6.exe
2988	100a74df616b79e8edcddeea916618b6.exe
2516	qnssgssfaxc.exe
2516	qnssgssfaxc.exe
2516	qnssgssfaxc.exe
2516	qnssgssfaxc.exe
2988	100a74df616b79e8edcddeea916618b6.exe
2988	100a74df616b79e8edcddeea916618b6.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\ogryoqhryli = "C:\\Users\\Admin\\AppData\\Local\\Temp\\aypcygdtgzcntnfle.exe"	winoy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\aypcygdtgzcntnfle = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tqgsnuqfrjlvatkp.exe"	winoy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\leqypskvdrpv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\aypcygdtgzcntnfle.exe ."	winoy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\leqypskvdrpv = "tqgsnuqfrjlvatkp.exe ."	winoy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\leqypskvdrpv = "aypcygdtgzcntnfle.exe ."	winoy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\okzkekftevwfjbr = "wytkkwxrifmbljfpmprmd.exe ."	winoy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ogryoqhryli = "uuncakjbqlqdlhbjeff.exe"	winoy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ogryoqhryli = "uuncakjbqlqdlhbjeff.exe"	qnssgssfaxc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\okzkekftevwfjbr = "aypcygdtgzcntnfle.exe ."	winoy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tqgsnuqfrjlvatkp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hicsrccvlhnbkhclhjke.exe ."	winoy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\aypcygdtgzcntnfle = "C:\\Users\\Admin\\AppData\\Local\\Temp\\aypcygdtgzcntnfle.exe"	winoy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\lguexcwjtjjrul = "hicsrccvlhnbkhclhjke.exe"	winoy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ogryoqhryli = "wytkkwxrifmbljfpmprmd.exe"	winoy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\leqypskvdrpv = "uuncakjbqlqdlhbjeff.exe ."	qnssgssfaxc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\ogryoqhryli = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jiaolusjxrvhojcjdd.exe"	qnssgssfaxc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\okzkekftevwfjbr = "hicsrccvlhnbkhclhjke.exe ."	winoy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tqgsnuqfrjlvatkp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jiaolusjxrvhojcjdd.exe ."	winoy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ogryoqhryli = "hicsrccvlhnbkhclhjke.exe"	winoy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\aypcygdtgzcntnfle = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tqgsnuqfrjlvatkp.exe"	qnssgssfaxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\aypcygdtgzcntnfle = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hicsrccvlhnbkhclhjke.exe"	winoy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\okzkekftevwfjbr = "hicsrccvlhnbkhclhjke.exe ."	qnssgssfaxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\aypcygdtgzcntnfle = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wytkkwxrifmbljfpmprmd.exe"	winoy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tqgsnuqfrjlvatkp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jiaolusjxrvhojcjdd.exe ."	winoy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ogryoqhryli = "jiaolusjxrvhojcjdd.exe"	winoy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ogryoqhryli = "jiaolusjxrvhojcjdd.exe"	qnssgssfaxc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\lguexcwjtjjrul = "aypcygdtgzcntnfle.exe"	winoy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\okzkekftevwfjbr = "tqgsnuqfrjlvatkp.exe ."	winoy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\lguexcwjtjjrul = "tqgsnuqfrjlvatkp.exe"	winoy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\leqypskvdrpv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jiaolusjxrvhojcjdd.exe ."	winoy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tqgsnuqfrjlvatkp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wytkkwxrifmbljfpmprmd.exe ."	winoy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\ogryoqhryli = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wytkkwxrifmbljfpmprmd.exe"	winoy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\ogryoqhryli = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tqgsnuqfrjlvatkp.exe"	winoy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\lguexcwjtjjrul = "jiaolusjxrvhojcjdd.exe"	winoy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\okzkekftevwfjbr = "tqgsnuqfrjlvatkp.exe ."	winoy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\okzkekftevwfjbr = "jiaolusjxrvhojcjdd.exe ."	winoy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ogryoqhryli = "aypcygdtgzcntnfle.exe"	winoy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tqgsnuqfrjlvatkp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\aypcygdtgzcntnfle.exe ."	winoy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\ogryoqhryli = "C:\\Users\\Admin\\AppData\\Local\\Temp\\uuncakjbqlqdlhbjeff.exe"	winoy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ogryoqhryli = "aypcygdtgzcntnfle.exe"	winoy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\leqypskvdrpv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\uuncakjbqlqdlhbjeff.exe ."	winoy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\leqypskvdrpv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\aypcygdtgzcntnfle.exe ."	winoy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\lguexcwjtjjrul = "wytkkwxrifmbljfpmprmd.exe"	winoy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\aypcygdtgzcntnfle = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jiaolusjxrvhojcjdd.exe"	qnssgssfaxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\leqypskvdrpv = "wytkkwxrifmbljfpmprmd.exe ."	winoy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tqgsnuqfrjlvatkp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tqgsnuqfrjlvatkp.exe ."	winoy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\ogryoqhryli = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jiaolusjxrvhojcjdd.exe"	winoy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\leqypskvdrpv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tqgsnuqfrjlvatkp.exe ."	winoy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\leqypskvdrpv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jiaolusjxrvhojcjdd.exe ."	qnssgssfaxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\aypcygdtgzcntnfle = "C:\\Users\\Admin\\AppData\\Local\\Temp\\uuncakjbqlqdlhbjeff.exe"	winoy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\aypcygdtgzcntnfle = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jiaolusjxrvhojcjdd.exe"	winoy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\okzkekftevwfjbr = "wytkkwxrifmbljfpmprmd.exe ."	winoy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tqgsnuqfrjlvatkp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hicsrccvlhnbkhclhjke.exe ."	winoy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\okzkekftevwfjbr = "aypcygdtgzcntnfle.exe ."	winoy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\lguexcwjtjjrul = "tqgsnuqfrjlvatkp.exe"	winoy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\okzkekftevwfjbr = "jiaolusjxrvhojcjdd.exe ."	winoy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tqgsnuqfrjlvatkp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hicsrccvlhnbkhclhjke.exe ."	qnssgssfaxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\leqypskvdrpv = "uuncakjbqlqdlhbjeff.exe ."	winoy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\ogryoqhryli = "C:\\Users\\Admin\\AppData\\Local\\Temp\\uuncakjbqlqdlhbjeff.exe"	winoy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\ogryoqhryli = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hicsrccvlhnbkhclhjke.exe"	winoy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\lguexcwjtjjrul = "aypcygdtgzcntnfle.exe"	qnssgssfaxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tqgsnuqfrjlvatkp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tqgsnuqfrjlvatkp.exe ."	winoy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\leqypskvdrpv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wytkkwxrifmbljfpmprmd.exe ."	winoy.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\lguexcwjtjjrul = "hicsrccvlhnbkhclhjke.exe"	winoy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ogryoqhryli = "uuncakjbqlqdlhbjeff.exe"	qnssgssfaxc.exe

Checks whether UAC is enabled 1 TTPs 8 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	qnssgssfaxc.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	qnssgssfaxc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	qnssgssfaxc.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	qnssgssfaxc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winoy.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winoy.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winoy.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	winoy.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
5	whatismyipaddress.com
8	www.showmyipaddress.com
1	whatismyip.everdot.org

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	F:\autorun.inf	winoy.exe
File opened for modification	C:\autorun.inf	winoy.exe
File created	C:\autorun.inf	winoy.exe
File opened for modification	F:\autorun.inf	winoy.exe

Drops file in System32 directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\hicsrccvlhnbkhclhjke.exe	winoy.exe
File opened for modification	C:\Windows\SysWOW64\aypcygdtgzcntnfle.exe	qnssgssfaxc.exe
File opened for modification	C:\Windows\SysWOW64\aypcygdtgzcntnfle.exe	qnssgssfaxc.exe
File opened for modification	C:\Windows\SysWOW64\tqgsnuqfrjlvatkp.exe	winoy.exe
File opened for modification	C:\Windows\SysWOW64\uuncakjbqlqdlhbjeff.exe	winoy.exe
File opened for modification	C:\Windows\SysWOW64\wytkkwxrifmbljfpmprmd.exe	winoy.exe
File opened for modification	C:\Windows\SysWOW64\jiaolusjxrvhojcjdd.exe	winoy.exe
File opened for modification	C:\Windows\SysWOW64\jiaolusjxrvhojcjdd.exe	qnssgssfaxc.exe
File opened for modification	C:\Windows\SysWOW64\nqmefsuphfndonkvtxawop.exe	qnssgssfaxc.exe
File opened for modification	C:\Windows\SysWOW64\jiaolusjxrvhojcjdd.exe	qnssgssfaxc.exe
File opened for modification	C:\Windows\SysWOW64\uuncakjbqlqdlhbjeff.exe	qnssgssfaxc.exe
File opened for modification	C:\Windows\SysWOW64\wytkkwxrifmbljfpmprmd.exe	qnssgssfaxc.exe
File opened for modification	C:\Windows\SysWOW64\hicsrccvlhnbkhclhjke.exe	qnssgssfaxc.exe
File opened for modification	C:\Windows\SysWOW64\tqgsnuqfrjlvatkp.exe	qnssgssfaxc.exe
File opened for modification	C:\Windows\SysWOW64\hicsrccvlhnbkhclhjke.exe	qnssgssfaxc.exe
File created	C:\Windows\SysWOW64\ogryoqhrylinnbnnatlwdtvmwdqnssgss.yqb	winoy.exe
File opened for modification	C:\Windows\SysWOW64\uuncakjbqlqdlhbjeff.exe	qnssgssfaxc.exe
File opened for modification	C:\Windows\SysWOW64\wytkkwxrifmbljfpmprmd.exe	qnssgssfaxc.exe
File opened for modification	C:\Windows\SysWOW64\aypcygdtgzcntnfle.exe	winoy.exe
File opened for modification	C:\Windows\SysWOW64\uuncakjbqlqdlhbjeff.exe	winoy.exe
File opened for modification	C:\Windows\SysWOW64\wytkkwxrifmbljfpmprmd.exe	winoy.exe
File opened for modification	C:\Windows\SysWOW64\tqgsnuqfrjlvatkp.exe	winoy.exe
File opened for modification	C:\Windows\SysWOW64\hicsrccvlhnbkhclhjke.exe	winoy.exe
File opened for modification	C:\Windows\SysWOW64\nqmefsuphfndonkvtxawop.exe	winoy.exe
File created	C:\Windows\SysWOW64\xeeafwcbxzlfuxynpxeeaf.cbx	winoy.exe
File opened for modification	C:\Windows\SysWOW64\nqmefsuphfndonkvtxawop.exe	qnssgssfaxc.exe
File opened for modification	C:\Windows\SysWOW64\aypcygdtgzcntnfle.exe	winoy.exe
File opened for modification	C:\Windows\SysWOW64\jiaolusjxrvhojcjdd.exe	winoy.exe
File opened for modification	C:\Windows\SysWOW64\ogryoqhrylinnbnnatlwdtvmwdqnssgss.yqb	winoy.exe
File opened for modification	C:\Windows\SysWOW64\tqgsnuqfrjlvatkp.exe	qnssgssfaxc.exe
File opened for modification	C:\Windows\SysWOW64\nqmefsuphfndonkvtxawop.exe	winoy.exe
File opened for modification	C:\Windows\SysWOW64\xeeafwcbxzlfuxynpxeeaf.cbx	winoy.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ogryoqhrylinnbnnatlwdtvmwdqnssgss.yqb	winoy.exe
File opened for modification	C:\Program Files (x86)\xeeafwcbxzlfuxynpxeeaf.cbx	winoy.exe
File created	C:\Program Files (x86)\xeeafwcbxzlfuxynpxeeaf.cbx	winoy.exe
File opened for modification	C:\Program Files (x86)\ogryoqhrylinnbnnatlwdtvmwdqnssgss.yqb	winoy.exe

Drops file in Windows directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Windows\jiaolusjxrvhojcjdd.exe	qnssgssfaxc.exe
File opened for modification	C:\Windows\hicsrccvlhnbkhclhjke.exe	qnssgssfaxc.exe
File opened for modification	C:\Windows\wytkkwxrifmbljfpmprmd.exe	qnssgssfaxc.exe
File opened for modification	C:\Windows\tqgsnuqfrjlvatkp.exe	qnssgssfaxc.exe
File opened for modification	C:\Windows\wytkkwxrifmbljfpmprmd.exe	qnssgssfaxc.exe
File opened for modification	C:\Windows\aypcygdtgzcntnfle.exe	qnssgssfaxc.exe
File opened for modification	C:\Windows\wytkkwxrifmbljfpmprmd.exe	winoy.exe
File opened for modification	C:\Windows\nqmefsuphfndonkvtxawop.exe	winoy.exe
File opened for modification	C:\Windows\jiaolusjxrvhojcjdd.exe	qnssgssfaxc.exe
File opened for modification	C:\Windows\aypcygdtgzcntnfle.exe	winoy.exe
File opened for modification	C:\Windows\hicsrccvlhnbkhclhjke.exe	winoy.exe
File opened for modification	C:\Windows\tqgsnuqfrjlvatkp.exe	qnssgssfaxc.exe
File opened for modification	C:\Windows\nqmefsuphfndonkvtxawop.exe	qnssgssfaxc.exe
File opened for modification	C:\Windows\jiaolusjxrvhojcjdd.exe	winoy.exe
File opened for modification	C:\Windows\nqmefsuphfndonkvtxawop.exe	winoy.exe
File created	C:\Windows\xeeafwcbxzlfuxynpxeeaf.cbx	winoy.exe
File opened for modification	C:\Windows\uuncakjbqlqdlhbjeff.exe	winoy.exe
File opened for modification	C:\Windows\wytkkwxrifmbljfpmprmd.exe	winoy.exe
File opened for modification	C:\Windows\xeeafwcbxzlfuxynpxeeaf.cbx	winoy.exe
File opened for modification	C:\Windows\jiaolusjxrvhojcjdd.exe	winoy.exe
File opened for modification	C:\Windows\uuncakjbqlqdlhbjeff.exe	winoy.exe
File opened for modification	C:\Windows\hicsrccvlhnbkhclhjke.exe	winoy.exe
File opened for modification	C:\Windows\uuncakjbqlqdlhbjeff.exe	qnssgssfaxc.exe
File opened for modification	C:\Windows\uuncakjbqlqdlhbjeff.exe	qnssgssfaxc.exe
File opened for modification	C:\Windows\tqgsnuqfrjlvatkp.exe	winoy.exe
File created	C:\Windows\ogryoqhrylinnbnnatlwdtvmwdqnssgss.yqb	winoy.exe
File opened for modification	C:\Windows\hicsrccvlhnbkhclhjke.exe	qnssgssfaxc.exe
File opened for modification	C:\Windows\tqgsnuqfrjlvatkp.exe	winoy.exe
File opened for modification	C:\Windows\aypcygdtgzcntnfle.exe	winoy.exe
File opened for modification	C:\Windows\aypcygdtgzcntnfle.exe	qnssgssfaxc.exe
File opened for modification	C:\Windows\nqmefsuphfndonkvtxawop.exe	qnssgssfaxc.exe
File opened for modification	C:\Windows\ogryoqhrylinnbnnatlwdtvmwdqnssgss.yqb	winoy.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2988	100a74df616b79e8edcddeea916618b6.exe
2988	100a74df616b79e8edcddeea916618b6.exe
2988	100a74df616b79e8edcddeea916618b6.exe
2988	100a74df616b79e8edcddeea916618b6.exe
2988	100a74df616b79e8edcddeea916618b6.exe
2988	100a74df616b79e8edcddeea916618b6.exe
2592	winoy.exe
2592	winoy.exe
2988	100a74df616b79e8edcddeea916618b6.exe
2988	100a74df616b79e8edcddeea916618b6.exe
2988	100a74df616b79e8edcddeea916618b6.exe
2592	winoy.exe
2592	winoy.exe
2988	100a74df616b79e8edcddeea916618b6.exe
2988	100a74df616b79e8edcddeea916618b6.exe
2988	100a74df616b79e8edcddeea916618b6.exe
2592	winoy.exe
2592	winoy.exe
2988	100a74df616b79e8edcddeea916618b6.exe
2988	100a74df616b79e8edcddeea916618b6.exe
2988	100a74df616b79e8edcddeea916618b6.exe
2592	winoy.exe
2592	winoy.exe
2988	100a74df616b79e8edcddeea916618b6.exe
2988	100a74df616b79e8edcddeea916618b6.exe
2988	100a74df616b79e8edcddeea916618b6.exe
2592	winoy.exe
2592	winoy.exe
2988	100a74df616b79e8edcddeea916618b6.exe
2988	100a74df616b79e8edcddeea916618b6.exe
2988	100a74df616b79e8edcddeea916618b6.exe
2592	winoy.exe
2592	winoy.exe
2988	100a74df616b79e8edcddeea916618b6.exe
2988	100a74df616b79e8edcddeea916618b6.exe
2988	100a74df616b79e8edcddeea916618b6.exe
2592	winoy.exe
2592	winoy.exe
2988	100a74df616b79e8edcddeea916618b6.exe
2988	100a74df616b79e8edcddeea916618b6.exe
2988	100a74df616b79e8edcddeea916618b6.exe
2988	100a74df616b79e8edcddeea916618b6.exe
2592	winoy.exe
2592	winoy.exe
2988	100a74df616b79e8edcddeea916618b6.exe
2988	100a74df616b79e8edcddeea916618b6.exe
2988	100a74df616b79e8edcddeea916618b6.exe
2592	winoy.exe
2592	winoy.exe
2988	100a74df616b79e8edcddeea916618b6.exe
2988	100a74df616b79e8edcddeea916618b6.exe
2988	100a74df616b79e8edcddeea916618b6.exe
2592	winoy.exe
2592	winoy.exe
2988	100a74df616b79e8edcddeea916618b6.exe
2988	100a74df616b79e8edcddeea916618b6.exe
2988	100a74df616b79e8edcddeea916618b6.exe
2592	winoy.exe
2592	winoy.exe
2988	100a74df616b79e8edcddeea916618b6.exe
2988	100a74df616b79e8edcddeea916618b6.exe
2988	100a74df616b79e8edcddeea916618b6.exe
2592	winoy.exe
2592	winoy.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2592	winoy.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 2516	2988	100a74df616b79e8edcddeea916618b6.exe	28
PID 2988 wrote to memory of 2516	2988	100a74df616b79e8edcddeea916618b6.exe	28
PID 2988 wrote to memory of 2516	2988	100a74df616b79e8edcddeea916618b6.exe	28
PID 2988 wrote to memory of 2516	2988	100a74df616b79e8edcddeea916618b6.exe	28
PID 2516 wrote to memory of 2592	2516	qnssgssfaxc.exe	30
PID 2516 wrote to memory of 2592	2516	qnssgssfaxc.exe	30
PID 2516 wrote to memory of 2592	2516	qnssgssfaxc.exe	30
PID 2516 wrote to memory of 2592	2516	qnssgssfaxc.exe	30
PID 2516 wrote to memory of 1284	2516	qnssgssfaxc.exe	29
PID 2516 wrote to memory of 1284	2516	qnssgssfaxc.exe	29
PID 2516 wrote to memory of 1284	2516	qnssgssfaxc.exe	29
PID 2516 wrote to memory of 1284	2516	qnssgssfaxc.exe	29
PID 2988 wrote to memory of 2800	2988	100a74df616b79e8edcddeea916618b6.exe	33
PID 2988 wrote to memory of 2800	2988	100a74df616b79e8edcddeea916618b6.exe	33
PID 2988 wrote to memory of 2800	2988	100a74df616b79e8edcddeea916618b6.exe	33
PID 2988 wrote to memory of 2800	2988	100a74df616b79e8edcddeea916618b6.exe	33

System policy modification 1 TTPs 41 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	qnssgssfaxc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	qnssgssfaxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	winoy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	qnssgssfaxc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	winoy.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winoy.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	qnssgssfaxc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	qnssgssfaxc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	qnssgssfaxc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	winoy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	winoy.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winoy.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	winoy.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	winoy.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	winoy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	qnssgssfaxc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	qnssgssfaxc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	winoy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	winoy.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	qnssgssfaxc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	winoy.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	winoy.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	winoy.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	winoy.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winoy.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	qnssgssfaxc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	qnssgssfaxc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winoy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	winoy.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	qnssgssfaxc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	qnssgssfaxc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	winoy.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	winoy.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	winoy.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	winoy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	qnssgssfaxc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	qnssgssfaxc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	winoy.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	winoy.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	winoy.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	winoy.exe

C:\Users\Admin\AppData\Local\Temp\100a74df616b79e8edcddeea916618b6.exe
"C:\Users\Admin\AppData\Local\Temp\100a74df616b79e8edcddeea916618b6.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Users\Admin\AppData\Local\Temp\qnssgssfaxc.exe
  "C:\Users\Admin\AppData\Local\Temp\qnssgssfaxc.exe" "c:\users\admin\appdata\local\temp\100a74df616b79e8edcddeea916618b6.exe*"
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Adds policy Run key to start application
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2516
- - C:\Users\Admin\AppData\Local\Temp\winoy.exe
    "C:\Users\Admin\AppData\Local\Temp\winoy.exe" "-C:\Users\Admin\AppData\Local\Temp\tqgsnuqfrjlvatkp.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System policy modification
    PID:1284
- - C:\Users\Admin\AppData\Local\Temp\winoy.exe
    "C:\Users\Admin\AppData\Local\Temp\winoy.exe" "-C:\Users\Admin\AppData\Local\Temp\tqgsnuqfrjlvatkp.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops autorun.inf file
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - System policy modification
    PID:2592
- C:\Users\Admin\AppData\Local\Temp\qnssgssfaxc.exe
  "C:\Users\Admin\AppData\Local\Temp\qnssgssfaxc.exe" "c:\users\admin\appdata\local\temp\100a74df616b79e8edcddeea916618b6.exe"
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Adds policy Run key to start application
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System policy modification
  PID:2800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\aypcygdtgzcntnfle.exe

Filesize
127KB

MD5
073d5c0140f39fc9c2c2e25d97ca495f

SHA1
19273892ea43c992bd72703747ccfa518a37663e

SHA256
cb4918fbf222a1381715cf6b0b3ef3cc3a84af1cadc450c3b74ce5815d071915

SHA512
25bbe35d0321070bf4f7f0b49ccfc20cdba73b2bfe7aee32980561b7b4d80230616489f0858842325a31d3312fa6299d035e380e93146d0941a1388abdea71a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\hicsrccvlhnbkhclhjke.exe

Filesize
113KB

MD5
9ea337aee85f9813252334835615573e

SHA1
430a169de577785c4bc0fd1047b8077dcce6a38e

SHA256
31333d40eab53378a703c893b10d6490f8fbe3a50c5685a1a810ab4008624d67

SHA512
b2e7bf965756091ddb4c6ce22ab1cf7d56a0e032b098cd30effe84c79d3612ba59c75f8490ab8fa6389359232f0cf945607ff007c22ab958ffc88bbf01aa8602

Download Submit
C:\Users\Admin\AppData\Local\Temp\jiaolusjxrvhojcjdd.exe

Filesize
86KB

MD5
0c5b99cc8ad82043dede80f7e6cf6551

SHA1
efe5ab234869297b19a3bb635523fd2ca1b80e63

SHA256
d1842d7f91bec01620febe5f546aa8f5fce571c93d6d9ef0a9af6b308be0ae1d

SHA512
ca7ad886c7b023bd9dcb8b06c5de77a49d29ad64dbb71ace3f7296a60cd877762db56b9f73dff1d762d6c73ec21c3436d263698c68412fc8f6beb7eb0165d48c

Download Submit
C:\Users\Admin\AppData\Local\Temp\nqmefsuphfndonkvtxawop.exe

Filesize
21KB

MD5
9e59522469228c3fa263dd926fea1556

SHA1
d3d7d9664ffcdfe73ba673eb1b6e0bc214f8435d

SHA256
6ec9084555e107d2c2700f36fb432fa349497b3baaac69038fd316768fa29f2c

SHA512
23722c8008dcb6897c271abe38fffe3ae982c817466f0b33b268182e732c4925d826fc0a681ef431d18dddabd6fd4263a504b98c1d074559259738590cd9ac7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\qnssgssfaxc.exe

Filesize
115KB

MD5
622e3a2a6a8590656cb6e7da6751eb84

SHA1
cc589cd6a3827945f48e7e920808a6f9ee7d1792

SHA256
a03c1887e5b348cf98cbc65646c45b33037a7da0f67285c79e81a8e086a6c2ad

SHA512
fe15fe66baf3c573b536ac8573bdf30fa5a1371ee42dcfebb7cff883ff37fe985d70a41f921ada98b7d8c5e7c7395914e3439697e322c8f5d1dcdfbd95d4a657

Download Submit
C:\Users\Admin\AppData\Local\Temp\qnssgssfaxc.exe

Filesize
257KB

MD5
50c5c72ec3807d6ba9edea33bbf8f83d

SHA1
fb59994e6f3ed962ec58275191b1317e11414ba5

SHA256
b8ab758b2503cd4dd35b0e35996d7755822c3dc0a78a2ec67db2a835ef114a52

SHA512
2df7ed86341297062f8f236e589d91d5ba8c41066bcd3765956bcd5d584226da25ac9b56e36d896889ee57221703cc4794d96481e6098ae59afb8e50d1f60621

Download Submit
C:\Users\Admin\AppData\Local\Temp\qnssgssfaxc.exe

Filesize
159KB

MD5
0a2b257a52daaece7621f0452d7ab570

SHA1
09ac717ce73f143764234ec586ab6491c9e53917

SHA256
0effca256b7e2a64b8d412122219a8ca140ac47bc2f6ac882e2b6ddedd177348

SHA512
84a327c39b9c4e06674f236b7ba536891e6c1903f420302daedda460d216137eef9585f6806a15f0b5f63b308caab0fa4eac3e8ea5bf8c58701f51711dbb674e

Download Submit
C:\Users\Admin\AppData\Local\Temp\tqgsnuqfrjlvatkp.exe

Filesize
69KB

MD5
a1113d6f069f79a55eab3848d62dfa6f

SHA1
b5a5d6d6c8de6681606922ddb3bc611c4d6cb603

SHA256
dd9cf763dee5661bbdf8576fb5fdbe80907452fff909b53f911a9d29c52ad6a5

SHA512
14269c70ab7647193e073adc0b6f19baefe45f68df273d55489d8a5d9b595904ad12e974cfd9def95790be96419d800008d01ca0d91e9b285df86c4df505f42f

Download Submit
C:\Users\Admin\AppData\Local\Temp\uuncakjbqlqdlhbjeff.exe

Filesize
99KB

MD5
a73ae67da85274d101943df9d0fbaa0d

SHA1
4a5f089be95aea902a8fd762cde1fe3891041230

SHA256
40c241508f0877f03c7eeae00764ba97b4652a9a7103028952099ef77bbfd1d8

SHA512
f2be7122249e0a1cd0e1b282aaa2bf6754df40c728cab49666eb246e844b1636051a2cc8aabc913f3a8e345d5b4d00d944a67195439b0d0f8a1ef1a7db399f53

Download Submit
C:\Users\Admin\AppData\Local\Temp\winoy.exe

Filesize
74KB

MD5
b73c85b9082d14097bc0707c490f5c6c

SHA1
122b620f8a0a6d4f0d147b6fa8c272817898bb18

SHA256
eb9d405945ab326a37ad981c7491219f601239c55ab7da5e5e73a890cdba7ee8

SHA512
f8ada67b614996e82c388c5a334764905ad09c0a443350059922ee9cff24fb2e046c284725bcab78f2cfdf4d292f906775ecab284520c93de140c6e84e397cb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\winoy.exe

Filesize
34KB

MD5
3d241d97d23e59acd01d3700e681e91a

SHA1
682626d2496625235149b63dd82640758ad446cd

SHA256
115ebfda6ec89cf016e489bc40f8f73a4d2b9dc155baf3a0f42c335fe16e27d4

SHA512
267d541aae12320b1c22660e5c0b9c390ca0997ebe615dbcf65a4a4c9f6b43a76227a052dc2c22e8733c102e3c8ee403895e27da6b979281bd32b376aa585fcb

Download Submit
C:\Users\Admin\AppData\Local\Temp\winoy.exe

Filesize
60KB

MD5
c3c53db6307474177d02938bd33ac17f

SHA1
aad73034261555cadfdf9177eb8148cb2eab68d5

SHA256
a92f13eb1d5675e0fc969bc600cda44ad15b9775d07ab0a746ec52afb68518de

SHA512
895d54eb05639906fe2ced747e32d5defcb3174ecf7ffc21a526227bdd43f952adb0fd330844b2787a74803e7f7f71303cb3160078960c2174905b0f2680b06d

Download Submit
C:\Users\Admin\AppData\Local\Temp\wytkkwxrifmbljfpmprmd.exe

Filesize
84KB

MD5
caaa20c97a450531296b54bfcc31cf49

SHA1
69f11b3ad2b3f87479921f53cec99662cad7ce58

SHA256
f279e57ca3cab59a01582525f399c34e0dc7b650f297587b9bf90358664f2752

SHA512
da9bfc56cc42fe4c05bd05dc02e6a6e02f990ce7b6030747c570bfd14d789efb8e6081b3ee8ef6a0c8a2a30f1d8a845bfbdd9b233604bf1cd0caff10f01f635d

Download Submit
C:\Windows\SysWOW64\aypcygdtgzcntnfle.exe

Filesize
55KB

MD5
377fd43de44ae016182735730dda1a09

SHA1
0982bf2a058c0f8cdab57f964ff73e95e5cfb819

SHA256
056e975d7d4e1615460d7faacbf3adc62d3dd61cfb4bb616a22764f4b4cd9013

SHA512
2c0f612704e1602f60545f531ba3f79cb60ad538db81ba19508a7712688c7af612c42ed19e981d5a7dbbc407ae24020e1271ce1932e23af6f748598aaf5b61fc

Download Submit
C:\Windows\SysWOW64\hicsrccvlhnbkhclhjke.exe

Filesize
92KB

MD5
6230bb6346ba5c2ea823bd8ce3eb8291

SHA1
5518a5617059acde84d2c9007767c11f5a237c69

SHA256
7813cf3fedee35fdf88f81a0ebe929fbabb89902dd2c8d4e56bfc9673c578bfe

SHA512
55586f70b4cb30c2fabda3db59a27e8f69e6f49c45074426a02c65d9fa63498fed0e9fe8e0562085327995fbc8eed681670399e4a77975488fb5ea47db2a4f6a

Download Submit
C:\Windows\SysWOW64\jiaolusjxrvhojcjdd.exe

Filesize
18KB

MD5
6cb4f0180fb6f96ee7072b98dc342676

SHA1
6eb325a0434df07021778485a861b8c5b1e0858c

SHA256
b437f6df5b626989f4955461a4e84343fb3eead9d5f1678388fa3252b9542911

SHA512
0c95ddb2103872315a9c796310c969cf24e13c53295003da772781f5c29193bcc878b5e7946fc32447364e007160f7477dc7853273513e076252e1d966f81e75

Download Submit
C:\Windows\SysWOW64\jiaolusjxrvhojcjdd.exe

Filesize
105KB

MD5
743daccd57c43168c0297dde8acd619d

SHA1
a91f74f121f6d838d28a7f93cd17206ed2e06471

SHA256
54e835f7c66fdebeeb632bffbf798d8a265166100b7a546e469ba2387e5175bb

SHA512
0f1b3c98839272b9d5ffb7e60d5f5dd9914b4eb1945caa191e03020785d077b8c0526b24b93bdcfc9da57a4b9d1685960978b61aa5404c97b0e2d6fde6104b7b

Download Submit
C:\Windows\SysWOW64\nqmefsuphfndonkvtxawop.exe

Filesize
111KB

MD5
0752bbe2eee251e7cf6265a4d0a74df2

SHA1
6ba2720f78760538c305061a14d12d5c149d3cd5

SHA256
4f417ff8a0b942f39f5bf04faf2755d0566dd0370a2c0961aedd415e7f6f2861

SHA512
ae7f313f2887f1d9a48e9c5d22b92cfb258c3ee6e8fae2452a9d6a7a550b781b1f2f0fe9f32a3298fbd5dcaf0393bbacaf5f2779ed7b8d253d0ffedb7946dd38

Download Submit
C:\Windows\SysWOW64\uuncakjbqlqdlhbjeff.exe

Filesize
39KB

MD5
8647fe035e3c989054ecbb01e11f64e8

SHA1
a7f7bee735dcd6d8205e2dc56d44dda9b5ab4b4b

SHA256
2305d87d95aaae95c86974d961c251e78c38d1330a6a06f38e1c9a8b672e12e8

SHA512
e8c44b2b126bfea371d280dfd94f34885fb9a32b039a3eaef6bc3f88dc937870d527a7c272b50ef4ab0a905d68e7753c179676e3e05c3976e4ecf911cc542797

Download Submit
C:\Windows\SysWOW64\wytkkwxrifmbljfpmprmd.exe

Filesize
81KB

MD5
04c5e84f400cbb3a69df7299809bf081

SHA1
38e7381211a15b51c12804cb26cd7cb2a6f4a09e

SHA256
cf9b0d2bc2b7bf3389d133d1a5dc03f7c6013ed3ce76a0f962bca75969e7714f

SHA512
002fd11630c543eeff051816cf1fcc6b245535e6ee42faf82ebae2d719dcc084520d0e0caa5d90e4182abd73e32c058641b666180396326a8c3d695367cd6ea3

Download Submit
C:\Windows\aypcygdtgzcntnfle.exe

Filesize
95KB

MD5
8f97fd7418a1e34b5f3da432da54c5c2

SHA1
0d9e47e20d84ced90bb74714b0f20d339fef8003

SHA256
c7bdb051da884c91444e0ecf91c2af32e621614e476f8db424077b03cf9cc14e

SHA512
f924cf866cba4f99647714b1599c1dd434f0a26ed4d1839682c900abf5ee1269579166abdef35d6e8c45f18f51d288e34fe858f033e06b5c8355443ab74c6bb3

Download Submit
C:\Windows\aypcygdtgzcntnfle.exe

Filesize
74KB

MD5
8955623eb8373ec8a486968db2ff0ffe

SHA1
899df0406e91a67fc80e9bb9c924f093d0e59f31

SHA256
4a2068f1abb5362344457dc1d72f26ee6880af656d353a177071efae4910f649

SHA512
8794882846be942ed1e3a9404bb769b67310b8d68f38268b4eddbb837cbe91a5699b92853b212cc07dc08d94c949addf2913028c23af4869671e84efa8bf7f0a

Download Submit
C:\Windows\hicsrccvlhnbkhclhjke.exe

Filesize
94KB

MD5
5ce85d880fa5ef97de6c5b8fbf6688dd

SHA1
5318a4b0d8a8f756e2075365e0614649de07df0d

SHA256
1d51fbdde1f19a09fd3f5cadac248149c484bfdc39cdffe7a75067aa8f807269

SHA512
0393b042abe488e4992518e468dede87025bf4e2082d38578f117b4244a26e0ca47cabe3df03b6570139666d16f87b9406cd0d993cd4c6a951a0e9626b262a19

Download Submit
C:\Windows\hicsrccvlhnbkhclhjke.exe

Filesize
47KB

MD5
055dbc677de28f15f4a1ca4462a618ba

SHA1
67a628cc1435f2b6a45449f4ffca399d54fc86b6

SHA256
7b98cc8b9b0f131cef6c81a5d5f498d3048fdd08457b46f827d74780e64c13de

SHA512
7f65b86fa086c770b216d3ddb5cfa2e56eba042ac97558802b7753fe1339921210388e1defec6f2537e1c64b4d9437592c5e4b4d93c29bd199217fcd26dc4e9d

Download Submit
C:\Windows\jiaolusjxrvhojcjdd.exe

Filesize
72KB

MD5
24967daabc9c54467f9d4b744587994b

SHA1
37aaa8939fae5fec2e42406eaeb8b9bc505d0934

SHA256
339df9dbe7143b6be6cf1e6fe36d373a5f05c9b0f0f04890c6bdb8db7ba851b2

SHA512
c97c72090d260cc99a1fba5873b6a97d1e27f2e86a59dcb3c3dd0e3ca80522868109e17466fb83250e132d2a31212a95fad685564cdd8753cc4c8fb504a868bf

Download Submit
C:\Windows\jiaolusjxrvhojcjdd.exe

Filesize
75KB

MD5
20cb9540aba81754816de05a1ce7d22d

SHA1
7c3261482fa6b4c5bc4b24d126bf3a6132684f1b

SHA256
72989fb3aa7d8d2a9ec56e56a63a374f9c6ed4cea7a743b14ec3358887f3f32e

SHA512
e52bc719b28c7d22cb3b9d622c3c6af3ef44628884145ff1cfaada9263753812679a1d6bdc5c406121eb6dc78923ecf9012dd5dff4884355e8a0bce02ca031c4

Download Submit
C:\Windows\nqmefsuphfndonkvtxawop.exe

Filesize
47KB

MD5
ccc8570d3a89c9110c8b447fa9fb7651

SHA1
2f5806433ff05e156f1f7771a67a3b4efaeea009

SHA256
084d3e5326c5c015bd6999e94fccaa1d45da36ee814d370ddf68546902abd077

SHA512
7e7a8421feac791b85dd994e7cd6256ee5c45f4e52b648b609edddc0a955f822639d685dfc3d677d62542a589c6683e8681288e8ec4a6b70f631e04c27d284f0

Download Submit
C:\Windows\nqmefsuphfndonkvtxawop.exe

Filesize
69KB

MD5
1a59ad00a3ac82a7aa3aab18118cb906

SHA1
fe8c5204fde6da8beb750239225b87ad97355ca3

SHA256
00837f912b131586d5365ecbe0a92b8324fc2f5f5d40c0ff3b01098d0a086b0f

SHA512
21aff57a14b8a2135f5af66cb8c366293bdfd3f835d04c526e8516b3c28957f62f2354bb97d38ff479b6d4f556488c1e5752a056972d659d7d9a123efc4511da

Download Submit
C:\Windows\tqgsnuqfrjlvatkp.exe

Filesize
64KB

MD5
a1da7d09c2f7a84fa4e34a016bed1658

SHA1
3f605e5321db81df9db7ee3d175203264c163ed5

SHA256
87810a418f194988c5642acb96b5c0604f83f207cd4a341c1910f1471be92c89

SHA512
4e8ee53b5fe775ec4398153d0992294604c0804e7728416b41295228cb50ba24914637268b241b4d7485fda793af21f1d63575824f03eb53d98491a5609f37f4

Download Submit
C:\Windows\tqgsnuqfrjlvatkp.exe

Filesize
74KB

MD5
be5f5fb5b34a8280ca5462a3612c9d32

SHA1
c39ee8de17485c860d237b93d34d91ab60d16653

SHA256
aee34147a97bcc5b458756a3b97fa31866474abe3db2b73f7874876d95c896f0

SHA512
bb25bb4bc918a00fcdb674dad82c1f9914a78deeff3d17c5bf7cf993c963496b5fec548ce6f00459c1e60f131ff95a7949d8c181da0d2a59431c78831802fa2e

Download Submit
C:\Windows\uuncakjbqlqdlhbjeff.exe

Filesize
150KB

MD5
399de99494c714ce1ad53ce1b32b81d6

SHA1
47cbc24321e97d9cc1779d9b8d59106a1fd605ad

SHA256
55411b796595b3d5160db358088dcd8ed35408b3fefd2d284381f6589bad6d01

SHA512
b421498401b35cc8cae05795b64e8f139d8c4ce4cfbbc1c64bb075048f33e1c70a9c3746fce2fc181322d4b3e7cbd8718aaaf9ba0d4de9b0a094df13815e90b6

Download Submit
C:\Windows\uuncakjbqlqdlhbjeff.exe

Filesize
68KB

MD5
945561a5d0040bc8cab8bc75ce226b4d

SHA1
e88394f0a7621c3ce35d5dc9c8d47bc2b14c93a2

SHA256
576c22b3b504f127012b9678a9e605fd848f92783e19572a968cb164074bacad

SHA512
3bcebc362e9d3c47880bc664b605c557a54daf592b9b68c3b33a3b0b99d4d5db22f215b3a5e0f0890a9c5e8b38b057219381d91301d34b65e89de81c20e3681b

Download Submit
C:\Windows\wytkkwxrifmbljfpmprmd.exe

Filesize
94KB

MD5
9e3cf3a23b4f21a3e093d59dc85ba82b

SHA1
0fa150b1f31237e1d308de27dde99368eb2a0075

SHA256
9fa2a20fb6de51d435984702fd3fecaedee3f15aaacde3224dd408dec38ae618

SHA512
18f283ff2e5d24543de05148305ae8fc8d5d0decfbb6ef10a4e654730062279b19db30d63cb7cc01604fa8700ee1de54f61062b9c95fe9a091bff45173575472

Download Submit
C:\Windows\wytkkwxrifmbljfpmprmd.exe

Filesize
16KB

MD5
5dd365092c775e2487457699c0846c3a

SHA1
490c5e04cdc5eac1990df6de76c703448b78c051

SHA256
bfddefb82fe1148af3bc1be01253392fda835fb9adbf02bb81f0c02faa257953

SHA512
7d5b1267c24154a89ab672a3d6a7a8297b33f4be370192308c9d7f61c80d05b82bf2b45149f3b2192f86806c21c72653190bc977dc3a94c74bd641c85bd2fa3d

Download Submit
\Users\Admin\AppData\Local\Temp\qnssgssfaxc.exe

Filesize
320KB

MD5
1fb168ac77aa47964d468e35cbb08aa5

SHA1
9e538b5adc478aaaa6bd1394317c8063aacc233a

SHA256
f3b443952ee0b42722d84e7adaf47bc8661003fc92d4c238a570e4fe4e469683

SHA512
5daa41f9cbd36614c5a0840e83a0a186dfd4283324228f61c9bfbfe1e805b0cca514ae443640f4e4736192ac414f5fb474902f573c7064cd8880613fc0ba9758

Download Submit
\Users\Admin\AppData\Local\Temp\qnssgssfaxc.exe

Filesize
231KB

MD5
06fc1476e3973d3b67422ee07a7e6f0b

SHA1
9ac00a4d2d935e40e73b5959b45e03833a949728

SHA256
43b158d70d2de40e17ed14d7b701a19e3b151b726407aed9806d078d9b12f74b

SHA512
01e109dd396cece624f4488bef8a26648c978d2a55b39847eada2289aa5f95862f876be3066fe0e1bd7d92afc1c731e862d517f238464668404b8cca9d8dd4d5

Download Submit
\Users\Admin\AppData\Local\Temp\winoy.exe

Filesize
32KB

MD5
272839d59aa33c763d339504d6d0f568

SHA1
79e0b062212355c54a2d4dee06d12a2c961e578d

SHA256
945e1bca90673a30e2ac51a2d7af28d8973ac5884a6db1a311ddb2d7b25633f8

SHA512
5b21df8e0a6d344849ca44a3ba76f93fa59f7b793b6aa896ceb484265c7c5755e8caf717c22d21d09be92a85ca461e54859ce9f4de0367f4f6cd78f871c7abc9

Download Submit
\Users\Admin\AppData\Local\Temp\winoy.exe

Filesize
88KB

MD5
6f7f88f2aca016456f3899ebc90c932a

SHA1
8a0004f0822344e2738a414350c130494e6ee1fa

SHA256
ce08175fb8e7987f048decc0f092cf3a6ae2e4e1ac5b0c6f367d114bc60a1d7d

SHA512
4e970636a59aa7c119cf3bb496092e00571b46afb9cb17cb96dc6b098bb3936465802263d6a99e0b0cdb4f52c6e88dc91eb0212be1c7493ceb274f7009cbcb99

Download Submit