Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
31/12/2023, 06:25
Static task
static1
Behavioral task
behavioral1
Sample
rusik na kuhne.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
rusik na kuhne.exe
Resource
win10v2004-20231215-en
General
-
Target
rusik na kuhne.exe
-
Size
564KB
-
MD5
f44445aeb63e81045e17563a55e76f13
-
SHA1
7b5b8cba606b2d28236ae6801ca0e1be4b391455
-
SHA256
938cf550c7f4f125804d8a1d7bf9ea9ad72facedae6a01e776bff846f948e6dc
-
SHA512
3bde94299b855b57faaa2d1bb9e88ce693bbdf7a00d1849e45806e28c2d85afaa67e39f3ca774ab2993d7bc488904233745cf01321af26225c68da2e25d62b50
-
SSDEEP
12288:6pUJ3r6YkVwJgNnSykgb9cqWnw4q6ZmFhqss3MMq:6pUNr6YkVRFkgbeqeo68FhqxMM
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" nnnooeelxxx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" zbhwafn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" zbhwafn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" nnnooeelxxx.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" zbhwafn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" zbhwafn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" zbhwafn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" zbhwafn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" nnnooeelxxx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" nnnooeelxxx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" nnnooeelxxx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" zbhwafn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" nnnooeelxxx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" zbhwafn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" nnnooeelxxx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" zbhwafn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" zbhwafn.exe -
Adds policy Run key to start application 2 TTPs 28 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ljl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\frhgujbphxntzgmio.exe" nnnooeelxxx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ljl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yjywjxobshwbgmrm.exe" zbhwafn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ljl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\znfgwnhxrjbjraigodd.exe" zbhwafn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ljl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mbuwnfarmfyhqajirhix.exe" nnnooeelxxx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ljl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yjywjxobshwbgmrm.exe" zbhwafn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mnsgjn = "mbuwnfarmfyhqajirhix.exe" zbhwafn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mnsgjn = "frhgujbphxntzgmio.exe" zbhwafn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run nnnooeelxxx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ljl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\frhgujbphxntzgmio.exe" zbhwafn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mnsgjn = "znfgwnhxrjbjraigodd.exe" zbhwafn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run zbhwafn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mnsgjn = "brlogzvnjdxhrcmmwnpfz.exe" zbhwafn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mnsgjn = "obsshxqfypgnucjgnb.exe" zbhwafn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mnsgjn = "yjywjxobshwbgmrm.exe" zbhwafn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mnsgjn = "brlogzvnjdxhrcmmwnpfz.exe" zbhwafn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run nnnooeelxxx.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run zbhwafn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ljl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\brlogzvnjdxhrcmmwnpfz.exe" zbhwafn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mnsgjn = "znfgwnhxrjbjraigodd.exe" zbhwafn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ljl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\obsshxqfypgnucjgnb.exe" zbhwafn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mnsgjn = "yjywjxobshwbgmrm.exe" zbhwafn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mnsgjn = "frhgujbphxntzgmio.exe" nnnooeelxxx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mnsgjn = "frhgujbphxntzgmio.exe" nnnooeelxxx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mnsgjn = "mbuwnfarmfyhqajirhix.exe" zbhwafn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mnsgjn = "znfgwnhxrjbjraigodd.exe" nnnooeelxxx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ljl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\frhgujbphxntzgmio.exe" zbhwafn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mnsgjn = "frhgujbphxntzgmio.exe" zbhwafn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ljl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mbuwnfarmfyhqajirhix.exe" zbhwafn.exe -
Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" zbhwafn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" zbhwafn.exe Set value (int) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" zbhwafn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" zbhwafn.exe Set value (int) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" nnnooeelxxx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" nnnooeelxxx.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\International\Geo\Nation rusik na kuhne.exe Key value queried \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\International\Geo\Nation nnnooeelxxx.exe -
Executes dropped EXE 4 IoCs
pid Process 2232 nnnooeelxxx.exe 1092 zbhwafn.exe 1996 zbhwafn.exe 1064 nnnooeelxxx.exe -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fjriovflv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mbuwnfarmfyhqajirhix.exe ." zbhwafn.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\srug = "C:\\Users\\Admin\\AppData\\Local\\Temp\\brlogzvnjdxhrcmmwnpfz.exe" zbhwafn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bbfsu = "yjywjxobshwbgmrm.exe ." zbhwafn.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\oryotzin = "znfgwnhxrjbjraigodd.exe ." zbhwafn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\srug = "znfgwnhxrjbjraigodd.exe" zbhwafn.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\oryotzin = "yjywjxobshwbgmrm.exe ." zbhwafn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\srug = "yjywjxobshwbgmrm.exe" zbhwafn.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\oryotzin = "yjywjxobshwbgmrm.exe ." nnnooeelxxx.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\srug = "C:\\Users\\Admin\\AppData\\Local\\Temp\\frhgujbphxntzgmio.exe" zbhwafn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\srug = "obsshxqfypgnucjgnb.exe" nnnooeelxxx.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zbhwafn = "frhgujbphxntzgmio.exe" nnnooeelxxx.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bbfsu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yjywjxobshwbgmrm.exe ." zbhwafn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ydmeltelwf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\znfgwnhxrjbjraigodd.exe" zbhwafn.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bbfsu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\obsshxqfypgnucjgnb.exe ." nnnooeelxxx.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\srug = "C:\\Users\\Admin\\AppData\\Local\\Temp\\brlogzvnjdxhrcmmwnpfz.exe" nnnooeelxxx.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\oryotzin = "obsshxqfypgnucjgnb.exe ." zbhwafn.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bbfsu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\frhgujbphxntzgmio.exe ." zbhwafn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bbfsu = "yjywjxobshwbgmrm.exe ." zbhwafn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fjriovflv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mbuwnfarmfyhqajirhix.exe ." zbhwafn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\srug = "brlogzvnjdxhrcmmwnpfz.exe" zbhwafn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ydmeltelwf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\frhgujbphxntzgmio.exe" zbhwafn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fjriovflv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\znfgwnhxrjbjraigodd.exe ." zbhwafn.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bbfsu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\znfgwnhxrjbjraigodd.exe ." zbhwafn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ydmeltelwf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\brlogzvnjdxhrcmmwnpfz.exe" zbhwafn.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bbfsu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\brlogzvnjdxhrcmmwnpfz.exe ." nnnooeelxxx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fjriovflv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\brlogzvnjdxhrcmmwnpfz.exe ." zbhwafn.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\srug = "C:\\Users\\Admin\\AppData\\Local\\Temp\\obsshxqfypgnucjgnb.exe" zbhwafn.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zbhwafn = "frhgujbphxntzgmio.exe" zbhwafn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fjriovflv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\obsshxqfypgnucjgnb.exe ." zbhwafn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ydmeltelwf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\frhgujbphxntzgmio.exe" nnnooeelxxx.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zbhwafn = "yjywjxobshwbgmrm.exe" zbhwafn.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zbhwafn = "znfgwnhxrjbjraigodd.exe" zbhwafn.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\srug = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yjywjxobshwbgmrm.exe" nnnooeelxxx.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zbhwafn = "znfgwnhxrjbjraigodd.exe" zbhwafn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bbfsu = "znfgwnhxrjbjraigodd.exe ." zbhwafn.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bbfsu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mbuwnfarmfyhqajirhix.exe ." zbhwafn.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\srug = "C:\\Users\\Admin\\AppData\\Local\\Temp\\obsshxqfypgnucjgnb.exe" zbhwafn.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\oryotzin = "brlogzvnjdxhrcmmwnpfz.exe ." zbhwafn.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bbfsu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yjywjxobshwbgmrm.exe ." zbhwafn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bbfsu = "frhgujbphxntzgmio.exe ." nnnooeelxxx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ydmeltelwf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yjywjxobshwbgmrm.exe" zbhwafn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bbfsu = "frhgujbphxntzgmio.exe ." zbhwafn.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\srug = "C:\\Users\\Admin\\AppData\\Local\\Temp\\brlogzvnjdxhrcmmwnpfz.exe" zbhwafn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bbfsu = "mbuwnfarmfyhqajirhix.exe ." zbhwafn.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bbfsu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\brlogzvnjdxhrcmmwnpfz.exe ." zbhwafn.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\srug = "C:\\Users\\Admin\\AppData\\Local\\Temp\\frhgujbphxntzgmio.exe" zbhwafn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\srug = "yjywjxobshwbgmrm.exe" zbhwafn.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\oryotzin = "brlogzvnjdxhrcmmwnpfz.exe ." zbhwafn.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\srug = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mbuwnfarmfyhqajirhix.exe" zbhwafn.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bbfsu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\znfgwnhxrjbjraigodd.exe ." zbhwafn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fjriovflv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\frhgujbphxntzgmio.exe ." zbhwafn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ydmeltelwf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mbuwnfarmfyhqajirhix.exe" zbhwafn.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\oryotzin = "yjywjxobshwbgmrm.exe ." nnnooeelxxx.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zbhwafn = "obsshxqfypgnucjgnb.exe" nnnooeelxxx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fjriovflv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\frhgujbphxntzgmio.exe ." zbhwafn.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zbhwafn = "mbuwnfarmfyhqajirhix.exe" zbhwafn.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bbfsu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\frhgujbphxntzgmio.exe ." zbhwafn.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zbhwafn = "obsshxqfypgnucjgnb.exe" zbhwafn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fjriovflv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\znfgwnhxrjbjraigodd.exe ." zbhwafn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fjriovflv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yjywjxobshwbgmrm.exe ." zbhwafn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\srug = "brlogzvnjdxhrcmmwnpfz.exe" zbhwafn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fjriovflv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\frhgujbphxntzgmio.exe ." nnnooeelxxx.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ydmeltelwf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\frhgujbphxntzgmio.exe" nnnooeelxxx.exe Set value (str) \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bbfsu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\obsshxqfypgnucjgnb.exe ." zbhwafn.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" zbhwafn.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA zbhwafn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" zbhwafn.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA zbhwafn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" nnnooeelxxx.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA nnnooeelxxx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" nnnooeelxxx.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA nnnooeelxxx.exe -
Looks up external IP address via web service 6 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 103 whatismyip.everdot.org 44 whatismyip.everdot.org 45 whatismyip.everdot.org 46 www.showmyipaddress.com 58 whatismyip.everdot.org 83 whatismyipaddress.com -
Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification F:\autorun.inf zbhwafn.exe File created F:\autorun.inf zbhwafn.exe File opened for modification C:\autorun.inf zbhwafn.exe File created C:\autorun.inf zbhwafn.exe -
Drops file in System32 directory 32 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\znfgwnhxrjbjraigodd.exe nnnooeelxxx.exe File opened for modification C:\Windows\SysWOW64\sjeibvslidyjugrsdvypko.exe zbhwafn.exe File opened for modification C:\Windows\SysWOW64\frhgujbphxntzgmio.exe zbhwafn.exe File opened for modification C:\Windows\SysWOW64\brlogzvnjdxhrcmmwnpfz.exe zbhwafn.exe File opened for modification C:\Windows\SysWOW64\brlogzvnjdxhrcmmwnpfz.exe nnnooeelxxx.exe File opened for modification C:\Windows\SysWOW64\yjywjxobshwbgmrm.exe nnnooeelxxx.exe File opened for modification C:\Windows\SysWOW64\frhgujbphxntzgmio.exe zbhwafn.exe File opened for modification C:\Windows\SysWOW64\yjywjxobshwbgmrm.exe zbhwafn.exe File opened for modification C:\Windows\SysWOW64\obsshxqfypgnucjgnb.exe nnnooeelxxx.exe File opened for modification C:\Windows\SysWOW64\brlogzvnjdxhrcmmwnpfz.exe nnnooeelxxx.exe File opened for modification C:\Windows\SysWOW64\znfgwnhxrjbjraigodd.exe zbhwafn.exe File opened for modification C:\Windows\SysWOW64\brlogzvnjdxhrcmmwnpfz.exe zbhwafn.exe File created C:\Windows\SysWOW64\bbfsuxdflptnhcwgabnnregjprx.fzt zbhwafn.exe File created C:\Windows\SysWOW64\yjywjxobshwbgmrmrdalaylzqdujydiototfcn.anb zbhwafn.exe File opened for modification C:\Windows\SysWOW64\znfgwnhxrjbjraigodd.exe nnnooeelxxx.exe File opened for modification C:\Windows\SysWOW64\frhgujbphxntzgmio.exe nnnooeelxxx.exe File opened for modification C:\Windows\SysWOW64\znfgwnhxrjbjraigodd.exe zbhwafn.exe File opened for modification C:\Windows\SysWOW64\mbuwnfarmfyhqajirhix.exe nnnooeelxxx.exe File opened for modification C:\Windows\SysWOW64\obsshxqfypgnucjgnb.exe nnnooeelxxx.exe File opened for modification C:\Windows\SysWOW64\obsshxqfypgnucjgnb.exe zbhwafn.exe File opened for modification C:\Windows\SysWOW64\obsshxqfypgnucjgnb.exe zbhwafn.exe File opened for modification C:\Windows\SysWOW64\sjeibvslidyjugrsdvypko.exe zbhwafn.exe File opened for modification C:\Windows\SysWOW64\bbfsuxdflptnhcwgabnnregjprx.fzt zbhwafn.exe File opened for modification C:\Windows\SysWOW64\sjeibvslidyjugrsdvypko.exe nnnooeelxxx.exe File opened for modification C:\Windows\SysWOW64\mbuwnfarmfyhqajirhix.exe nnnooeelxxx.exe File opened for modification C:\Windows\SysWOW64\sjeibvslidyjugrsdvypko.exe nnnooeelxxx.exe File opened for modification C:\Windows\SysWOW64\yjywjxobshwbgmrm.exe zbhwafn.exe File opened for modification C:\Windows\SysWOW64\mbuwnfarmfyhqajirhix.exe zbhwafn.exe File opened for modification C:\Windows\SysWOW64\yjywjxobshwbgmrmrdalaylzqdujydiototfcn.anb zbhwafn.exe File opened for modification C:\Windows\SysWOW64\yjywjxobshwbgmrm.exe nnnooeelxxx.exe File opened for modification C:\Windows\SysWOW64\mbuwnfarmfyhqajirhix.exe zbhwafn.exe File opened for modification C:\Windows\SysWOW64\frhgujbphxntzgmio.exe nnnooeelxxx.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\bbfsuxdflptnhcwgabnnregjprx.fzt zbhwafn.exe File created C:\Program Files (x86)\bbfsuxdflptnhcwgabnnregjprx.fzt zbhwafn.exe File opened for modification C:\Program Files (x86)\yjywjxobshwbgmrmrdalaylzqdujydiototfcn.anb zbhwafn.exe File created C:\Program Files (x86)\yjywjxobshwbgmrmrdalaylzqdujydiototfcn.anb zbhwafn.exe -
Drops file in Windows directory 32 IoCs
description ioc Process File opened for modification C:\Windows\frhgujbphxntzgmio.exe nnnooeelxxx.exe File opened for modification C:\Windows\yjywjxobshwbgmrm.exe zbhwafn.exe File opened for modification C:\Windows\frhgujbphxntzgmio.exe zbhwafn.exe File opened for modification C:\Windows\obsshxqfypgnucjgnb.exe nnnooeelxxx.exe File opened for modification C:\Windows\brlogzvnjdxhrcmmwnpfz.exe nnnooeelxxx.exe File opened for modification C:\Windows\znfgwnhxrjbjraigodd.exe nnnooeelxxx.exe File opened for modification C:\Windows\yjywjxobshwbgmrm.exe nnnooeelxxx.exe File opened for modification C:\Windows\mbuwnfarmfyhqajirhix.exe zbhwafn.exe File opened for modification C:\Windows\brlogzvnjdxhrcmmwnpfz.exe nnnooeelxxx.exe File opened for modification C:\Windows\obsshxqfypgnucjgnb.exe zbhwafn.exe File opened for modification C:\Windows\obsshxqfypgnucjgnb.exe zbhwafn.exe File created C:\Windows\bbfsuxdflptnhcwgabnnregjprx.fzt zbhwafn.exe File opened for modification C:\Windows\mbuwnfarmfyhqajirhix.exe nnnooeelxxx.exe File opened for modification C:\Windows\sjeibvslidyjugrsdvypko.exe zbhwafn.exe File opened for modification C:\Windows\znfgwnhxrjbjraigodd.exe nnnooeelxxx.exe File opened for modification C:\Windows\sjeibvslidyjugrsdvypko.exe nnnooeelxxx.exe File opened for modification C:\Windows\mbuwnfarmfyhqajirhix.exe zbhwafn.exe File opened for modification C:\Windows\sjeibvslidyjugrsdvypko.exe nnnooeelxxx.exe File opened for modification C:\Windows\bbfsuxdflptnhcwgabnnregjprx.fzt zbhwafn.exe File created C:\Windows\yjywjxobshwbgmrmrdalaylzqdujydiototfcn.anb zbhwafn.exe File opened for modification C:\Windows\mbuwnfarmfyhqajirhix.exe nnnooeelxxx.exe File opened for modification C:\Windows\frhgujbphxntzgmio.exe zbhwafn.exe File opened for modification C:\Windows\znfgwnhxrjbjraigodd.exe zbhwafn.exe File opened for modification C:\Windows\znfgwnhxrjbjraigodd.exe zbhwafn.exe File opened for modification C:\Windows\sjeibvslidyjugrsdvypko.exe zbhwafn.exe File opened for modification C:\Windows\frhgujbphxntzgmio.exe nnnooeelxxx.exe File opened for modification C:\Windows\obsshxqfypgnucjgnb.exe nnnooeelxxx.exe File opened for modification C:\Windows\brlogzvnjdxhrcmmwnpfz.exe zbhwafn.exe File opened for modification C:\Windows\yjywjxobshwbgmrm.exe zbhwafn.exe File opened for modification C:\Windows\brlogzvnjdxhrcmmwnpfz.exe zbhwafn.exe File opened for modification C:\Windows\yjywjxobshwbgmrmrdalaylzqdujydiototfcn.anb zbhwafn.exe File opened for modification C:\Windows\yjywjxobshwbgmrm.exe nnnooeelxxx.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3156 rusik na kuhne.exe 3156 rusik na kuhne.exe 3156 rusik na kuhne.exe 3156 rusik na kuhne.exe 3156 rusik na kuhne.exe 3156 rusik na kuhne.exe 3156 rusik na kuhne.exe 3156 rusik na kuhne.exe 3156 rusik na kuhne.exe 3156 rusik na kuhne.exe 3156 rusik na kuhne.exe 3156 rusik na kuhne.exe 3156 rusik na kuhne.exe 3156 rusik na kuhne.exe 3156 rusik na kuhne.exe 3156 rusik na kuhne.exe 1092 zbhwafn.exe 1092 zbhwafn.exe 3156 rusik na kuhne.exe 3156 rusik na kuhne.exe 3156 rusik na kuhne.exe 3156 rusik na kuhne.exe 3156 rusik na kuhne.exe 3156 rusik na kuhne.exe 3156 rusik na kuhne.exe 3156 rusik na kuhne.exe 3156 rusik na kuhne.exe 3156 rusik na kuhne.exe 3156 rusik na kuhne.exe 3156 rusik na kuhne.exe 3156 rusik na kuhne.exe 3156 rusik na kuhne.exe 3156 rusik na kuhne.exe 3156 rusik na kuhne.exe 3156 rusik na kuhne.exe 3156 rusik na kuhne.exe 3156 rusik na kuhne.exe 3156 rusik na kuhne.exe 3156 rusik na kuhne.exe 3156 rusik na kuhne.exe 3156 rusik na kuhne.exe 3156 rusik na kuhne.exe 3156 rusik na kuhne.exe 3156 rusik na kuhne.exe 3156 rusik na kuhne.exe 3156 rusik na kuhne.exe 3156 rusik na kuhne.exe 3156 rusik na kuhne.exe 3156 rusik na kuhne.exe 3156 rusik na kuhne.exe 1092 zbhwafn.exe 1092 zbhwafn.exe 3156 rusik na kuhne.exe 3156 rusik na kuhne.exe 3156 rusik na kuhne.exe 3156 rusik na kuhne.exe 3156 rusik na kuhne.exe 3156 rusik na kuhne.exe 3156 rusik na kuhne.exe 3156 rusik na kuhne.exe 3156 rusik na kuhne.exe 3156 rusik na kuhne.exe 3156 rusik na kuhne.exe 3156 rusik na kuhne.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1092 zbhwafn.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3156 wrote to memory of 2232 3156 rusik na kuhne.exe 91 PID 3156 wrote to memory of 2232 3156 rusik na kuhne.exe 91 PID 3156 wrote to memory of 2232 3156 rusik na kuhne.exe 91 PID 2232 wrote to memory of 1092 2232 nnnooeelxxx.exe 96 PID 2232 wrote to memory of 1092 2232 nnnooeelxxx.exe 96 PID 2232 wrote to memory of 1092 2232 nnnooeelxxx.exe 96 PID 2232 wrote to memory of 1996 2232 nnnooeelxxx.exe 97 PID 2232 wrote to memory of 1996 2232 nnnooeelxxx.exe 97 PID 2232 wrote to memory of 1996 2232 nnnooeelxxx.exe 97 PID 3156 wrote to memory of 1064 3156 rusik na kuhne.exe 114 PID 3156 wrote to memory of 1064 3156 rusik na kuhne.exe 114 PID 3156 wrote to memory of 1064 3156 rusik na kuhne.exe 114 -
System policy modification 1 TTPs 41 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" zbhwafn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" zbhwafn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" zbhwafn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer zbhwafn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" zbhwafn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" zbhwafn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" zbhwafn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System nnnooeelxxx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" nnnooeelxxx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" nnnooeelxxx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" nnnooeelxxx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" zbhwafn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" zbhwafn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer zbhwafn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" nnnooeelxxx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" nnnooeelxxx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" zbhwafn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" zbhwafn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" zbhwafn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" zbhwafn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" zbhwafn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" zbhwafn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" nnnooeelxxx.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System zbhwafn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" zbhwafn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" zbhwafn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System nnnooeelxxx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" zbhwafn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" zbhwafn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" nnnooeelxxx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" nnnooeelxxx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" nnnooeelxxx.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System zbhwafn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" nnnooeelxxx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" zbhwafn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" zbhwafn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" nnnooeelxxx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" nnnooeelxxx.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer nnnooeelxxx.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" zbhwafn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" zbhwafn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\rusik na kuhne.exe"C:\Users\Admin\AppData\Local\Temp\rusik na kuhne.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\nnnooeelxxx.exe"C:\Users\Admin\AppData\Local\Temp\nnnooeelxxx.exe" "c:\users\admin\appdata\local\temp\rusik na kuhne.exe*"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\zbhwafn.exe"C:\Users\Admin\AppData\Local\Temp\zbhwafn.exe" "-C:\Users\Admin\AppData\Local\Temp\yjywjxobshwbgmrm.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:1092
-
-
C:\Users\Admin\AppData\Local\Temp\zbhwafn.exe"C:\Users\Admin\AppData\Local\Temp\zbhwafn.exe" "-C:\Users\Admin\AppData\Local\Temp\yjywjxobshwbgmrm.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- System policy modification
PID:1996
-
-
-
C:\Users\Admin\AppData\Local\Temp\nnnooeelxxx.exe"C:\Users\Admin\AppData\Local\Temp\nnnooeelxxx.exe" "c:\users\admin\appdata\local\temp\rusik na kuhne.exe"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- System policy modification
PID:1064
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
280B
MD5e20e3adb2afd4d5ebda06911fbd01786
SHA12bb455f0a145ace61fa7c014625afef7090ffc67
SHA2565956bc6e3a013f0c446734a3d774652c12c0ff495a5c300804e3bc6f0648cc12
SHA51276bc8c75a1d0b2b187684a30b42f194140ac393a8fc14141fe3a6baab1f364a7adf18d637ded4aff4b35561b0c52cc073b06ce1b866ca457320c0a86dfec9953
-
Filesize
280B
MD54ca1ad3e3b2a3f9e7f73d6154f2748c2
SHA1babb6875b2a2377feda4958b13f963803b3e0f4d
SHA256449920e93e877d9dcec288ddb4cb6548f6985a21f5832ae5d890190b6799f8d7
SHA512b7b892e0eebc9bec72591643acee22d69a66aaf3d7b23416cd37f7a9f9eaa76d6bb4242ed29313029aab148a2da9c36ff1646facd870fee69bd4d89be07b5b1a
-
Filesize
280B
MD50b0ab3093b2e061de7beb83feac15e96
SHA118096684c4baaddc1d74fdd9b8bb974c899761ca
SHA256b48fda82e83947b097cd5f677bd7e96e00b077b87b1f6d9c36eafe6c167735ea
SHA512749717568c55185dcddc6efb10571a5e7db88480b5aca362f6c675485daf7341a7f75a69fd7228a5357df5bf18865d4faaab045e580f20c1d3b28360b0a3e5c0
-
Filesize
320KB
MD5d52783842a8dd58c3f73dbec2fe9f9d6
SHA1e825ef51aecbe7be28d31999c8e90c2363022916
SHA256ff236df6261a4edccd62b9426cb1389ad26ae1f78d20ac37cd061f3236e8a359
SHA51290495243bf88a8469b3fe67eb5ae86204eef0bdaf30c3e15db03ac66fb7ba8d225e83d867d8cc354d270bf1a4d12cf60a005d6947d1be3b2b17470947f857f7b
-
Filesize
192KB
MD5eecc74cd3cab6148ec5e19a18e4970da
SHA123b50b919435db3dafbb7cda1ded26617bc25aee
SHA25693c6e4b5c9f2b55852539bf0f4b5b5776f20f229d333a10daa252e8042c0c73e
SHA51226c9bbcb083f7145734766c9599cab217128ef2831d4b4b989ac20edccd6adaae4088daf77a24ab3eab2e3e5e660fbbfe9eebe5feb2d7607dd00cd25e10e7cc3
-
Filesize
700KB
MD5a856afb7d867179e770f29e02be4ada7
SHA1419a50d4f3ef6a35f3c9cd08fc803a97d9ad9346
SHA256a1fe4dfd57d495c62e1f9306723553e76408c0d1cd2a5d2dd5aa2e86697f346c
SHA5120465f9081246e3542a6fa67b2566cdbd69485706099eae021c558aeddd8629e35b9bb11ff6c7f3a4e1612d1ece3881039a516360a398d8efc59308abb0f9e8b3
-
Filesize
193KB
MD52bf85be8c1e64426bedcd3e53e84ab54
SHA19c98dbb39d30046bdf852d846d248ccc52b4c6fe
SHA256726ad0010cc6f2629fd8b453aee05b4db785617c507605f3194aebc9780255e6
SHA5129caebfc8d136f362e5cd266e0b8cddbb0152151ca8bef7403d787654362d8694c367f59f23c001a045030a57c054a9c98ea8a3ecec751a7f029ab3554e50fe01
-
Filesize
66KB
MD5c1593a24524860d55d0c8f0cd0cfe89e
SHA1a2abe5521ed65fc7064d3e0de0ce03675c351d49
SHA256a9fbe4177dc10b83e3fa378ae1312bb3a72f9248c298e936964833b4ed029fe5
SHA51263fb1f7b03599771be6f63b1e9eae4ff2bc1a30afb581d31e37e447f82c6482477c48ee3102f758ea352ea5cc16c2c1ae9f13a5ff4dd1288d8ae0e38fae4f2d4
-
Filesize
564KB
MD5f44445aeb63e81045e17563a55e76f13
SHA17b5b8cba606b2d28236ae6801ca0e1be4b391455
SHA256938cf550c7f4f125804d8a1d7bf9ea9ad72facedae6a01e776bff846f948e6dc
SHA5123bde94299b855b57faaa2d1bb9e88ce693bbdf7a00d1849e45806e28c2d85afaa67e39f3ca774ab2993d7bc488904233745cf01321af26225c68da2e25d62b50
-
Filesize
128KB
MD5780ad0f3273c722f82c1930c40afda00
SHA130632c0b9c40425eca8555051c0e5ee2e79581b9
SHA2564588d598902f22bd4edb5e77a029ece19ecbc5a8550ed9ef616151dbeaf401ed
SHA512854a26392f4e58eca6bbef7cb248533199ec161355336dd2dca381f22e022ee6f2121896faf279b5621ac9a23eb80e305b0b15a773d78a4c258ca82653b29b88
-
Filesize
93KB
MD5c996d2eab6eb7ed76bfca74bed1bfbce
SHA10c8368047e321aacfeb90e4cc55d528a90181b20
SHA2565ca8f1e8c505bc54ea7fb60cd57006b09864ab4622e4f56d3cd8d49e45778f90
SHA512c5b4733b80f1cf2ec2c0840891f37dd64a5eb2e12f7da047343ea453760aa45bab326296e904f21ccd8321f61b04fa73ef93b9b82f2a2cbcde6923fd0a20572d
-
Filesize
193KB
MD55d467ef0ee59a579ceafdadbb36916d5
SHA1cd6954108483ac7d18987c00ce9bb24aee459e7b
SHA256868f6179b043f3f49ec7ab6f6c2d96898654a6f59126fbc101219d693b66e797
SHA5125983664bd6c9768d792d3df9557e844c0fbbdb7971c949aa8eda6096255581359d4a58984f5099f5a4c8cb194c5d1e0c1adb698e5428707a84250c00f48d553c
-
Filesize
92KB
MD53566599d12a144b307d867d1bba99ee1
SHA10b4c09415c68c2db68f4e0073278d41ce927315d
SHA2563d53e5a1e786b22cb789141504a7997a178bdfa1625e30ca5288a4e934e22c74
SHA51287a30f0d17c211480dee69a295b677a857e4214d18cf745a43f6f30693a7a6b658af4603b0863d1095e84f156c1033193c5c0b368b2eaf896ef5404a64f862ec
-
Filesize
484KB
MD58687abc6eb625cb413f6b2b2dee9807b
SHA1c674ac45e1e6067924630281777eb912fc154adb
SHA256c87e0c8327d31b3d98c5f4f623e3acc5634071322e6c4dcca514519ec5f14ab8
SHA5122954c6c8f9651d010afaaad5f859a66927d5e08e165866080b076d1b7ab8e037e434f43297aca419c9be8fbe001131531dc062848c3656a35fcb4825044451ed