58bc31f79036d7a759d9abb5d260a169ef8682771b456a90108bf671d8de981d

Analysis

max time kernel
99s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 13:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

38690f12cca082d90d5d63f981c4132e.exe
Size

524KB
MD5

38690f12cca082d90d5d63f981c4132e
SHA1

7ec1b60e16759122cdc38dd3e3353af59f2bb52b
SHA256

58bc31f79036d7a759d9abb5d260a169ef8682771b456a90108bf671d8de981d
SHA512

926422a57e5b325f49bf08e2612c1f8d6f2c76905aab0385d80bdfb797a8109ac7da146ed579fa43b6109656d46bc194fe01535a26370545f3fdf02d1d338fd8
SSDEEP

12288:DgkDxdkL+6JNgKVcRa+fpHyWs3OBH4pUGACR:/xsKXa+hHyWseBgQCR

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	stbzmjmhcdl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	vbgnu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	vbgnu.exe

UAC bypass 3 TTPs 12 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	stbzmjmhcdl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	stbzmjmhcdl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	vbgnu.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	vbgnu.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	vbgnu.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	vbgnu.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	stbzmjmhcdl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	stbzmjmhcdl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	vbgnu.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	vbgnu.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	vbgnu.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	vbgnu.exe

Adds policy Run key to start application 2 TTPs 27 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\fjm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vrmjgzwulfcnfnkrejjfa.exe"	stbzmjmhcdl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\fjm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ibtnhxrmarltinhlvx.exe"	vbgnu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\gntbjn = "gbvrnfbyohdnelhnzdcx.exe"	vbgnu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\gntbjn = "tngbwnietlgpflglwzx.exe"	vbgnu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\fjm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sjzrjxpiujbhuxpr.exe"	vbgnu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\fjm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gbvrnfbyohdnelhnzdcx.exe"	stbzmjmhcdl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	vbgnu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\gntbjn = "vrmjgzwulfcnfnkrejjfa.exe"	vbgnu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\fjm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zribujcwjzsznrknw.exe"	vbgnu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\fjm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ibtnhxrmarltinhlvx.exe"	vbgnu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\gntbjn = "vrmjgzwulfcnfnkrejjfa.exe"	vbgnu.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	stbzmjmhcdl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\gntbjn = "sjzrjxpiujbhuxpr.exe"	stbzmjmhcdl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\gntbjn = "tngbwnietlgpflglwzx.exe"	vbgnu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\fjm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sjzrjxpiujbhuxpr.exe"	vbgnu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\fjm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tngbwnietlgpflglwzx.exe"	vbgnu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\gntbjn = "sjzrjxpiujbhuxpr.exe"	vbgnu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\gntbjn = "ibtnhxrmarltinhlvx.exe"	vbgnu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\fjm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gbvrnfbyohdnelhnzdcx.exe"	vbgnu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\fjm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vrmjgzwulfcnfnkrejjfa.exe"	vbgnu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\gntbjn = "gbvrnfbyohdnelhnzdcx.exe"	vbgnu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\gntbjn = "tngbwnietlgpflglwzx.exe"	stbzmjmhcdl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	vbgnu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\gntbjn = "sjzrjxpiujbhuxpr.exe"	vbgnu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\fjm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gbvrnfbyohdnelhnzdcx.exe"	vbgnu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\gntbjn = "zribujcwjzsznrknw.exe"	vbgnu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\fjm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vrmjgzwulfcnfnkrejjfa.exe"	vbgnu.exe

Disables RegEdit via registry modification 6 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	stbzmjmhcdl.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	vbgnu.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	vbgnu.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	vbgnu.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	vbgnu.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	stbzmjmhcdl.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation	38690f12cca082d90d5d63f981c4132e.exe
Key value queried	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation	stbzmjmhcdl.exe

Executes dropped EXE 3 IoCs

pid	Process
4476	stbzmjmhcdl.exe
4220	vbgnu.exe
1476	vbgnu.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\irzjtzju = "tngbwnietlgpflglwzx.exe ."	vbgnu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\vbgnu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gbvrnfbyohdnelhnzdcx.exe ."	vbgnu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\irzjtzju = "sjzrjxpiujbhuxpr.exe ."	vbgnu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vbgnu = "vrmjgzwulfcnfnkrejjfa.exe ."	vbgnu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tbirafo = "gbvrnfbyohdnelhnzdcx.exe"	vbgnu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\irzjtzju = "zribujcwjzsznrknw.exe ."	stbzmjmhcdl.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\vbgnu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zribujcwjzsznrknw.exe ."	stbzmjmhcdl.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tbirafo = "gbvrnfbyohdnelhnzdcx.exe"	vbgnu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\vbgnu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tngbwnietlgpflglwzx.exe ."	vbgnu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tbirafo = "ibtnhxrmarltinhlvx.exe"	vbgnu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\irzjtzju = "gbvrnfbyohdnelhnzdcx.exe ."	vbgnu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sdnzltfsyh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ibtnhxrmarltinhlvx.exe"	vbgnu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mrvb = "vrmjgzwulfcnfnkrejjfa.exe"	vbgnu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tbirafo = "zribujcwjzsznrknw.exe"	vbgnu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\irzjtzju = "zribujcwjzsznrknw.exe ."	vbgnu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tbirafo = "zribujcwjzsznrknw.exe"	stbzmjmhcdl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vbgnu = "gbvrnfbyohdnelhnzdcx.exe ."	vbgnu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\irzjtzju = "vrmjgzwulfcnfnkrejjfa.exe ."	vbgnu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vbgnu = "sjzrjxpiujbhuxpr.exe ."	vbgnu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mrvb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tngbwnietlgpflglwzx.exe"	vbgnu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sdnzltfsyh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vrmjgzwulfcnfnkrejjfa.exe"	vbgnu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mrvb = "tngbwnietlgpflglwzx.exe"	vbgnu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mrvb = "zribujcwjzsznrknw.exe"	vbgnu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mrvb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ibtnhxrmarltinhlvx.exe"	vbgnu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mrvb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vrmjgzwulfcnfnkrejjfa.exe"	vbgnu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mrvb = "zribujcwjzsznrknw.exe"	vbgnu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zjsdovgsx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zribujcwjzsznrknw.exe ."	vbgnu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mrvb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vrmjgzwulfcnfnkrejjfa.exe"	vbgnu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tbirafo = "tngbwnietlgpflglwzx.exe"	vbgnu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zjsdovgsx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vrmjgzwulfcnfnkrejjfa.exe ."	vbgnu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\vbgnu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sjzrjxpiujbhuxpr.exe ."	vbgnu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\irzjtzju = "tngbwnietlgpflglwzx.exe ."	vbgnu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zjsdovgsx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sjzrjxpiujbhuxpr.exe ."	stbzmjmhcdl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vbgnu = "tngbwnietlgpflglwzx.exe ."	vbgnu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zjsdovgsx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ibtnhxrmarltinhlvx.exe ."	vbgnu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vbgnu = "ibtnhxrmarltinhlvx.exe ."	vbgnu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sdnzltfsyh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vrmjgzwulfcnfnkrejjfa.exe"	vbgnu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mrvb = "zribujcwjzsznrknw.exe"	stbzmjmhcdl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vbgnu = "tngbwnietlgpflglwzx.exe ."	vbgnu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tbirafo = "vrmjgzwulfcnfnkrejjfa.exe"	vbgnu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zjsdovgsx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vrmjgzwulfcnfnkrejjfa.exe ."	vbgnu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\irzjtzju = "ibtnhxrmarltinhlvx.exe ."	stbzmjmhcdl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sdnzltfsyh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tngbwnietlgpflglwzx.exe"	vbgnu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mrvb = "gbvrnfbyohdnelhnzdcx.exe"	vbgnu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\vbgnu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ibtnhxrmarltinhlvx.exe ."	vbgnu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mrvb = "sjzrjxpiujbhuxpr.exe"	vbgnu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zjsdovgsx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sjzrjxpiujbhuxpr.exe ."	vbgnu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vbgnu = "ibtnhxrmarltinhlvx.exe ."	vbgnu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vbgnu = "zribujcwjzsznrknw.exe ."	stbzmjmhcdl.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\irzjtzju = "ibtnhxrmarltinhlvx.exe ."	vbgnu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\irzjtzju = "ibtnhxrmarltinhlvx.exe ."	vbgnu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mrvb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zribujcwjzsznrknw.exe"	vbgnu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\vbgnu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sjzrjxpiujbhuxpr.exe ."	vbgnu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\vbgnu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sjzrjxpiujbhuxpr.exe ."	stbzmjmhcdl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mrvb = "vrmjgzwulfcnfnkrejjfa.exe"	vbgnu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mrvb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sjzrjxpiujbhuxpr.exe"	vbgnu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mrvb = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zribujcwjzsznrknw.exe"	vbgnu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sdnzltfsyh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gbvrnfbyohdnelhnzdcx.exe"	vbgnu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mrvb = "tngbwnietlgpflglwzx.exe"	vbgnu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sdnzltfsyh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gbvrnfbyohdnelhnzdcx.exe"	stbzmjmhcdl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zjsdovgsx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tngbwnietlgpflglwzx.exe ."	vbgnu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\vbgnu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zribujcwjzsznrknw.exe ."	vbgnu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zjsdovgsx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ibtnhxrmarltinhlvx.exe ."	vbgnu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\vbgnu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ibtnhxrmarltinhlvx.exe ."	vbgnu.exe

Checks whether UAC is enabled 1 TTPs 6 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	vbgnu.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	vbgnu.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	stbzmjmhcdl.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	stbzmjmhcdl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	vbgnu.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	vbgnu.exe

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
97	whatismyip.everdot.org
32	www.showmyipaddress.com
38	whatismyipaddress.com
83	whatismyip.everdot.org

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	C:\autorun.inf	vbgnu.exe
File opened for modification	F:\autorun.inf	vbgnu.exe
File created	F:\autorun.inf	vbgnu.exe
File opened for modification	C:\autorun.inf	vbgnu.exe

Drops file in System32 directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\zribujcwjzsznrknw.exe	stbzmjmhcdl.exe
File opened for modification	C:\Windows\SysWOW64\mjfdbvtskfdpirpxlrsplj.exe	stbzmjmhcdl.exe
File opened for modification	C:\Windows\SysWOW64\ibtnhxrmarltinhlvx.exe	vbgnu.exe
File opened for modification	C:\Windows\SysWOW64\tngbwnietlgpflglwzx.exe	vbgnu.exe
File opened for modification	C:\Windows\SysWOW64\mjfdbvtskfdpirpxlrsplj.exe	vbgnu.exe
File opened for modification	C:\Windows\SysWOW64\gbvrnfbyohdnelhnzdcx.exe	stbzmjmhcdl.exe
File opened for modification	C:\Windows\SysWOW64\vrmjgzwulfcnfnkrejjfa.exe	stbzmjmhcdl.exe
File opened for modification	C:\Windows\SysWOW64\sjzrjxpiujbhuxpr.exe	vbgnu.exe
File opened for modification	C:\Windows\SysWOW64\zribujcwjzsznrknw.exe	vbgnu.exe
File opened for modification	C:\Windows\SysWOW64\gbvrnfbyohdnelhnzdcx.exe	vbgnu.exe
File created	C:\Windows\SysWOW64\kzndtfvmwjzdopffljcrfvlxneobrvghxxdb.jxn	vbgnu.exe
File opened for modification	C:\Windows\SysWOW64\tngbwnietlgpflglwzx.exe	stbzmjmhcdl.exe
File opened for modification	C:\Windows\SysWOW64\mjfdbvtskfdpirpxlrsplj.exe	vbgnu.exe
File opened for modification	C:\Windows\SysWOW64\sjzrjxpiujbhuxpr.exe	stbzmjmhcdl.exe
File opened for modification	C:\Windows\SysWOW64\ibtnhxrmarltinhlvx.exe	stbzmjmhcdl.exe
File opened for modification	C:\Windows\SysWOW64\tngbwnietlgpflglwzx.exe	vbgnu.exe
File opened for modification	C:\Windows\SysWOW64\fjmrwxcihjohhxcrmzhlotyze.jlq	vbgnu.exe
File created	C:\Windows\SysWOW64\fjmrwxcihjohhxcrmzhlotyze.jlq	vbgnu.exe
File opened for modification	C:\Windows\SysWOW64\sjzrjxpiujbhuxpr.exe	vbgnu.exe
File opened for modification	C:\Windows\SysWOW64\zribujcwjzsznrknw.exe	vbgnu.exe
File opened for modification	C:\Windows\SysWOW64\gbvrnfbyohdnelhnzdcx.exe	vbgnu.exe
File opened for modification	C:\Windows\SysWOW64\vrmjgzwulfcnfnkrejjfa.exe	vbgnu.exe
File opened for modification	C:\Windows\SysWOW64\vrmjgzwulfcnfnkrejjfa.exe	vbgnu.exe
File opened for modification	C:\Windows\SysWOW64\kzndtfvmwjzdopffljcrfvlxneobrvghxxdb.jxn	vbgnu.exe
File opened for modification	C:\Windows\SysWOW64\ibtnhxrmarltinhlvx.exe	vbgnu.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\fjmrwxcihjohhxcrmzhlotyze.jlq	vbgnu.exe
File created	C:\Program Files (x86)\fjmrwxcihjohhxcrmzhlotyze.jlq	vbgnu.exe
File opened for modification	C:\Program Files (x86)\kzndtfvmwjzdopffljcrfvlxneobrvghxxdb.jxn	vbgnu.exe
File created	C:\Program Files (x86)\kzndtfvmwjzdopffljcrfvlxneobrvghxxdb.jxn	vbgnu.exe

Drops file in Windows directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\mjfdbvtskfdpirpxlrsplj.exe	vbgnu.exe
File created	C:\Windows\fjmrwxcihjohhxcrmzhlotyze.jlq	vbgnu.exe
File opened for modification	C:\Windows\fjmrwxcihjohhxcrmzhlotyze.jlq	vbgnu.exe
File opened for modification	C:\Windows\mjfdbvtskfdpirpxlrsplj.exe	stbzmjmhcdl.exe
File opened for modification	C:\Windows\sjzrjxpiujbhuxpr.exe	vbgnu.exe
File opened for modification	C:\Windows\ibtnhxrmarltinhlvx.exe	vbgnu.exe
File opened for modification	C:\Windows\ibtnhxrmarltinhlvx.exe	vbgnu.exe
File opened for modification	C:\Windows\tngbwnietlgpflglwzx.exe	vbgnu.exe
File opened for modification	C:\Windows\mjfdbvtskfdpirpxlrsplj.exe	vbgnu.exe
File opened for modification	C:\Windows\gbvrnfbyohdnelhnzdcx.exe	vbgnu.exe
File opened for modification	C:\Windows\gbvrnfbyohdnelhnzdcx.exe	stbzmjmhcdl.exe
File opened for modification	C:\Windows\vrmjgzwulfcnfnkrejjfa.exe	vbgnu.exe
File created	C:\Windows\kzndtfvmwjzdopffljcrfvlxneobrvghxxdb.jxn	vbgnu.exe
File opened for modification	C:\Windows\ibtnhxrmarltinhlvx.exe	stbzmjmhcdl.exe
File opened for modification	C:\Windows\zribujcwjzsznrknw.exe	stbzmjmhcdl.exe
File opened for modification	C:\Windows\sjzrjxpiujbhuxpr.exe	vbgnu.exe
File opened for modification	C:\Windows\zribujcwjzsznrknw.exe	vbgnu.exe
File opened for modification	C:\Windows\zribujcwjzsznrknw.exe	vbgnu.exe
File opened for modification	C:\Windows\gbvrnfbyohdnelhnzdcx.exe	vbgnu.exe
File opened for modification	C:\Windows\vrmjgzwulfcnfnkrejjfa.exe	vbgnu.exe
File opened for modification	C:\Windows\sjzrjxpiujbhuxpr.exe	stbzmjmhcdl.exe
File opened for modification	C:\Windows\tngbwnietlgpflglwzx.exe	vbgnu.exe
File opened for modification	C:\Windows\tngbwnietlgpflglwzx.exe	stbzmjmhcdl.exe
File opened for modification	C:\Windows\vrmjgzwulfcnfnkrejjfa.exe	stbzmjmhcdl.exe
File opened for modification	C:\Windows\kzndtfvmwjzdopffljcrfvlxneobrvghxxdb.jxn	vbgnu.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2440	38690f12cca082d90d5d63f981c4132e.exe
2440	38690f12cca082d90d5d63f981c4132e.exe
2440	38690f12cca082d90d5d63f981c4132e.exe
2440	38690f12cca082d90d5d63f981c4132e.exe
2440	38690f12cca082d90d5d63f981c4132e.exe
2440	38690f12cca082d90d5d63f981c4132e.exe
2440	38690f12cca082d90d5d63f981c4132e.exe
2440	38690f12cca082d90d5d63f981c4132e.exe
2440	38690f12cca082d90d5d63f981c4132e.exe
2440	38690f12cca082d90d5d63f981c4132e.exe
2440	38690f12cca082d90d5d63f981c4132e.exe
2440	38690f12cca082d90d5d63f981c4132e.exe
2440	38690f12cca082d90d5d63f981c4132e.exe
2440	38690f12cca082d90d5d63f981c4132e.exe
2440	38690f12cca082d90d5d63f981c4132e.exe
2440	38690f12cca082d90d5d63f981c4132e.exe
2440	38690f12cca082d90d5d63f981c4132e.exe
2440	38690f12cca082d90d5d63f981c4132e.exe
2440	38690f12cca082d90d5d63f981c4132e.exe
2440	38690f12cca082d90d5d63f981c4132e.exe
2440	38690f12cca082d90d5d63f981c4132e.exe
2440	38690f12cca082d90d5d63f981c4132e.exe
2440	38690f12cca082d90d5d63f981c4132e.exe
2440	38690f12cca082d90d5d63f981c4132e.exe
2440	38690f12cca082d90d5d63f981c4132e.exe
2440	38690f12cca082d90d5d63f981c4132e.exe
2440	38690f12cca082d90d5d63f981c4132e.exe
2440	38690f12cca082d90d5d63f981c4132e.exe
2440	38690f12cca082d90d5d63f981c4132e.exe
2440	38690f12cca082d90d5d63f981c4132e.exe
2440	38690f12cca082d90d5d63f981c4132e.exe
2440	38690f12cca082d90d5d63f981c4132e.exe
2440	38690f12cca082d90d5d63f981c4132e.exe
2440	38690f12cca082d90d5d63f981c4132e.exe
2440	38690f12cca082d90d5d63f981c4132e.exe
2440	38690f12cca082d90d5d63f981c4132e.exe
4220	vbgnu.exe
4220	vbgnu.exe
2440	38690f12cca082d90d5d63f981c4132e.exe
2440	38690f12cca082d90d5d63f981c4132e.exe
2440	38690f12cca082d90d5d63f981c4132e.exe
2440	38690f12cca082d90d5d63f981c4132e.exe
2440	38690f12cca082d90d5d63f981c4132e.exe
2440	38690f12cca082d90d5d63f981c4132e.exe
2440	38690f12cca082d90d5d63f981c4132e.exe
2440	38690f12cca082d90d5d63f981c4132e.exe
2440	38690f12cca082d90d5d63f981c4132e.exe
2440	38690f12cca082d90d5d63f981c4132e.exe
2440	38690f12cca082d90d5d63f981c4132e.exe
2440	38690f12cca082d90d5d63f981c4132e.exe
2440	38690f12cca082d90d5d63f981c4132e.exe
2440	38690f12cca082d90d5d63f981c4132e.exe
2440	38690f12cca082d90d5d63f981c4132e.exe
2440	38690f12cca082d90d5d63f981c4132e.exe
2440	38690f12cca082d90d5d63f981c4132e.exe
2440	38690f12cca082d90d5d63f981c4132e.exe
2440	38690f12cca082d90d5d63f981c4132e.exe
2440	38690f12cca082d90d5d63f981c4132e.exe
2440	38690f12cca082d90d5d63f981c4132e.exe
2440	38690f12cca082d90d5d63f981c4132e.exe
2440	38690f12cca082d90d5d63f981c4132e.exe
2440	38690f12cca082d90d5d63f981c4132e.exe
2440	38690f12cca082d90d5d63f981c4132e.exe
2440	38690f12cca082d90d5d63f981c4132e.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4220	vbgnu.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 4476	2440	38690f12cca082d90d5d63f981c4132e.exe	91
PID 2440 wrote to memory of 4476	2440	38690f12cca082d90d5d63f981c4132e.exe	91
PID 2440 wrote to memory of 4476	2440	38690f12cca082d90d5d63f981c4132e.exe	91
PID 4476 wrote to memory of 4220	4476	stbzmjmhcdl.exe	92
PID 4476 wrote to memory of 4220	4476	stbzmjmhcdl.exe	92
PID 4476 wrote to memory of 4220	4476	stbzmjmhcdl.exe	92
PID 4476 wrote to memory of 1476	4476	stbzmjmhcdl.exe	93
PID 4476 wrote to memory of 1476	4476	stbzmjmhcdl.exe	93
PID 4476 wrote to memory of 1476	4476	stbzmjmhcdl.exe	93

System policy modification 1 TTPs 39 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	stbzmjmhcdl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	vbgnu.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	vbgnu.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	vbgnu.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	stbzmjmhcdl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	stbzmjmhcdl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	stbzmjmhcdl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	vbgnu.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	vbgnu.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	vbgnu.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	stbzmjmhcdl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	stbzmjmhcdl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	vbgnu.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	vbgnu.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	stbzmjmhcdl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	vbgnu.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	vbgnu.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	vbgnu.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	vbgnu.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	vbgnu.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	stbzmjmhcdl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	stbzmjmhcdl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	vbgnu.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	vbgnu.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	stbzmjmhcdl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	vbgnu.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	vbgnu.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	vbgnu.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	stbzmjmhcdl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	stbzmjmhcdl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	vbgnu.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	vbgnu.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	vbgnu.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	stbzmjmhcdl.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	vbgnu.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	vbgnu.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	vbgnu.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	vbgnu.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	vbgnu.exe

C:\Users\Admin\AppData\Local\Temp\38690f12cca082d90d5d63f981c4132e.exe
"C:\Users\Admin\AppData\Local\Temp\38690f12cca082d90d5d63f981c4132e.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Users\Admin\AppData\Local\Temp\stbzmjmhcdl.exe
  "C:\Users\Admin\AppData\Local\Temp\stbzmjmhcdl.exe" "c:\users\admin\appdata\local\temp\38690f12cca082d90d5d63f981c4132e.exe*"
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Adds policy Run key to start application
  - Disables RegEdit via registry modification
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4476
- - C:\Users\Admin\AppData\Local\Temp\vbgnu.exe
    "C:\Users\Admin\AppData\Local\Temp\vbgnu.exe" "-C:\Users\Admin\AppData\Local\Temp\sjzrjxpiujbhuxpr.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops autorun.inf file
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - System policy modification
    PID:4220
- - C:\Users\Admin\AppData\Local\Temp\vbgnu.exe
    "C:\Users\Admin\AppData\Local\Temp\vbgnu.exe" "-C:\Users\Admin\AppData\Local\Temp\sjzrjxpiujbhuxpr.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System policy modification
    PID:1476
- C:\Users\Admin\AppData\Local\Temp\stbzmjmhcdl.exe
  "C:\Users\Admin\AppData\Local\Temp\stbzmjmhcdl.exe" "c:\users\admin\appdata\local\temp\38690f12cca082d90d5d63f981c4132e.exe"
  2⤵
  PID:4076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\fjmrwxcihjohhxcrmzhlotyze.jlq

Filesize
272B

MD5
55f5918c582d2351e5d90b534a5d1674

SHA1
46abb271001b246a9a0763fbdea62553451950bd

SHA256
b9d2d07623a1e3c6e7a551498349abb6160d30615cc1636476f8028606fc2e87

SHA512
574fba66d7df60f491baa714fee8f022c92d5ef47bfecd5a1c015ba6482caa6ddf36ddeedcf9b62b128a73d523cdf12048de17cfbbcf8ec1d3aa2688a8fe208c

Download Submit
C:\Program Files (x86)\fjmrwxcihjohhxcrmzhlotyze.jlq

Filesize
272B

MD5
ae37ebe12b131f4b482fae7efaed8caf

SHA1
6120fa8aca6be70669d114adbbba6d8e9c432061

SHA256
7218c08d78c4e893c422e72d5997e61427ec11b62b6a4fc8b49ec562633211ad

SHA512
66a3815ba83e9cead7a75fbcd25ca4ab9dfc8eedd115497c58661844746e3d5c9d3d099e323bacd7f7eb326258e1cda9eb6b9b2cc89cef6a64223e1ffadc3e48

Download Submit
C:\Program Files (x86)\fjmrwxcihjohhxcrmzhlotyze.jlq

Filesize
272B

MD5
e5b7ef2be60ab70683c597e3803bf023

SHA1
9d2ffbc3093f4a9aae211e9f84cf65018bbed87e

SHA256
239fb856346430be794856d44242b1a2e37bf2adeda2c61fbf4946a0540a8082

SHA512
f242ab433a9a0a346706e1fbfa5470ccc7f256ebf915ede35c1ebf94b5b955bf90c395d9ad4a60fe03df1aa78a92340adc2dc4459bcf63e177368a278117a2ca

Download Submit
C:\Program Files (x86)\fjmrwxcihjohhxcrmzhlotyze.jlq

Filesize
272B

MD5
6d51704cf3a6d72d23bf51cff31b91b7

SHA1
f953bed69eb38470b7e3068f3ff9a813063b0e5c

SHA256
0aa87defffea66a354aa475a1ecb1afb0a9e9d08d1b6d3925d9e7ddfc1ccd6a8

SHA512
f5878b3f736b3a332b653cdf4b0a097071a89dedec88bd2b8d1e37d9fd15a138c440cd27e5b3fa9bbd050f96bf4afb31a74962f468bb2b4db720acee12fe68e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\gbvrnfbyohdnelhnzdcx.exe

Filesize
89KB

MD5
4615b2fde507f33ac14bec21f9c8af0d

SHA1
e94500c478670ef83fdb7f019be513c5805fcfcc

SHA256
4eb217273f371792c36bf91d917594de4d78bc7d245fc98f59624a92f69578ab

SHA512
d7c96829432af4dd4d7b39e723faa30e4a116923ce3c386a307775da62a9bfad86dd2a8dc8dd87394d8b9dae0c5c9fa2ac068c57f8aa72b5ef63fd6cf55367d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\ibtnhxrmarltinhlvx.exe

Filesize
69KB

MD5
7c13ef133013c191216d30292db8f517

SHA1
df27c4c1f482eda8d0ca2859194aac1029830938

SHA256
bf19e198c119434d203c5720a19e9cdcc49848aae8ac246a552122febee04668

SHA512
e8a6e406546e9901071ae9730a1d1460a8b8b645991370ecb6f998a49f87de35cf77ec551c51965e4860a02f7b4cad4f7a63b726aeec0287cf0aeb24011d39d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\mjfdbvtskfdpirpxlrsplj.exe

Filesize
83KB

MD5
68d305a941683415d01d72d4a96b2a19

SHA1
8efc7a4b15f665b4ff84ce582f7a52c1110aba8c

SHA256
36cd5e301d38245d00a14aaa7dcff3638ca420c25174622a36b530d0053ebb26

SHA512
ef1101f347d7de5eb00e9716a7ad63009dae94fdde19392ea99ffe92bbda8222f48ea037fb88eca6613e130af3f5bd2a846ff2bde90df36294b876de74b9d0ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\sjzrjxpiujbhuxpr.exe

Filesize
227KB

MD5
487351e9d514d5c4263691fa79970bb7

SHA1
54a0c4efa817c9318888a2cab80609142e013570

SHA256
078aa3191109e546db63b4f1eb5daff20581443802388bc0e849e0867a135c07

SHA512
d72ef5360e3d6d1de124e499928a0d0e382be011cf8054c1d5a7d8123ccc86c1cc1aa514063902592338feec8997a96679b6a6c53386d7683e7de8ceaf078ffe

Download Submit
C:\Users\Admin\AppData\Local\Temp\stbzmjmhcdl.exe

Filesize
223KB

MD5
bb8da64dad33893d87cb564ebafd60e1

SHA1
8b1d0c11499fd850ee583058a0491834c97d1b5a

SHA256
ffafc501ba5dde57fcb4a5b9f3f2cb289c982cb4e669d38ebdc307bf3b935f4c

SHA512
6bec41d273b2e9a95828447a0303a8447e6b7c28438fa318497cf9cc4d7928e23e8701c8c73c8c8f8f517e8088ff52bdcd702e0376053f0202294f449b95fddb

Download Submit
C:\Users\Admin\AppData\Local\Temp\stbzmjmhcdl.exe

Filesize
320KB

MD5
1dd5dd5561723f37ccc81e15ecdbf830

SHA1
eeb9131c8d276ceb710d163e89fdc62b3e111971

SHA256
c8c542ac3f6526d1501c2b9d6262bfa029a1ac0d9dd6b3c1965977abdd8bd126

SHA512
b4881d7cd0c2ceeba067e13d23763e739389108d1269acd6c343dd308aa1fedde89da696a8482944342f44ea1094ea6b50021a15d4c6d03762ba032a9598bba5

Download Submit
C:\Users\Admin\AppData\Local\Temp\stbzmjmhcdl.exe

Filesize
173KB

MD5
8be80159327131a59c3c77e9efc66a29

SHA1
4ef5b9e41ec889bae19e64f64fc73618ff6ae0da

SHA256
a0c06cc0b20790c4658e049d15c63fdd9580a635c2d00dadd634a3edf1ca8681

SHA512
d4e1966d51c474133ccebb279a7342712647af3eef72d1dec018246098519ef795e6d8bf3afc4aa091fbacb551ac10e9648bfdd034aff2447132e7bd02317ca1

Download Submit
C:\Users\Admin\AppData\Local\Temp\stbzmjmhcdl.exe

Filesize
171KB

MD5
787196c47e9d572b5a72555257fd666c

SHA1
e4713ac7065dd14d8ef3c7e4257b2fd2fc40f544

SHA256
3f83b36d403b2f6330ac859f5a6a387a1f7658860b2013a541ea9969358ca125

SHA512
1f0f4ab759856477927089550e61e9d0791062613e950e054f6dcadbf55d1b45b2c28bbaef7f0a64a64d599c4b47ac746cdfd7b0f53abd9d27a40257a0e2a332

Download Submit
C:\Users\Admin\AppData\Local\Temp\tngbwnietlgpflglwzx.exe

Filesize
93KB

MD5
633c31b1b2e70e5fd3138eded2b46dd2

SHA1
a5686c05063b47ebd8db1ed3a88f2e53b6923544

SHA256
847b4e3f433ba1ca1568bff0e0bf4c72432523925f5b0c0c0383d6bb0b0412b3

SHA512
9b6195fa2424880f60f612d606ee475ac3f1c4c8b6ca2deb7ec1d9118471250591d36341d4f26c0a306d9a2398588b52745e23000a50ff8bfbeca8c940350539

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbgnu.exe

Filesize
708KB

MD5
4fb56f2986ef5496a8d94b53905a2ef4

SHA1
5d057a95e86bfee9e1155dca995c54c18bf491aa

SHA256
6407d1680c342a64d6078e4139649603a2d5a38d003d8491523aece359826f8d

SHA512
ffa20d5ebf165b4f1b02ce48657b7cca0e086045ed245015b646e781b4d6cb643b7e65b166f1466399ebac91f23e26c7526764ab82918a0220e1ec229dc48371

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbgnu.exe

Filesize
504KB

MD5
4147210062f7ddba4c124ef87c8a9b73

SHA1
3c8b95fe687334632a9bc137dbdd522cd31fe64d

SHA256
bd0d025421ef9905cd5752d6cfb96e2aad8d35499cf67a01f390ae78cdc9e238

SHA512
344864f342d6a13910b04207b480fb36a3f0351200a2dea5aacc1b9400b490b4acfa01ff77743d41f168bc41bd1d75d0fd7e41e085dd1f08089bd08431f28d1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbgnu.exe

Filesize
400KB

MD5
bd8469e1bbf4ace061c9afab336cce7b

SHA1
9e64d9de4ae7cf71b4158075d8a76237f87caea9

SHA256
90df4053f60a5fe602d3da34516e4bcd1aaa37bc3828d8fe9d6cd468b92aefb2

SHA512
d3f29a59246935c3b6fd5942acaf83a274570348052a69eb75629e4cdf8f6e15124f768761d31412b116af671242d8abf072c0bed7ad8ebe1170b32a3156021a

Download Submit
C:\Users\Admin\AppData\Local\Temp\vrmjgzwulfcnfnkrejjfa.exe

Filesize
142KB

MD5
6c748fc29cd6b0928fc83b105d1e87b6

SHA1
90665f1d06806decf3c7f7fd3a0dd7f220511c64

SHA256
07e59f831fdbe4b518c0fe3f495af4445d0dba8ce0889707c75c3981b3037b09

SHA512
d24efbcfef1816a028e2de3a2f85f1b69a4f325a154c46cc5a79aa49b58fbd13412055f74b48a3efa90f62c9e5d2923ad306345f3d5341aa48b437bf17d5065f

Download Submit
C:\Users\Admin\AppData\Local\Temp\zribujcwjzsznrknw.exe

Filesize
115KB

MD5
418b9c45efcfcf98a785d7ac75508533

SHA1
7807b4c84f9349dfa58979509b58ab18656f7ed8

SHA256
be8bd32f9e379d33ec7c256693dd0719e07f5c4f6dd39dde53f3a9d60202f15c

SHA512
ec137e40e5f697754e4b4309c39504f779cd60ad74ed944f3f62c12cdf8a21ddd7e3e080134c42ec19cbc14aa248d9936eee9f22ff751b461109a1498fe4c272

Download Submit
C:\Users\Admin\AppData\Local\fjmrwxcihjohhxcrmzhlotyze.jlq

Filesize
272B

MD5
08fbc84a85032996f93915e30638811c

SHA1
b49821a63d50dd8c7f3b934e97912295e83de292

SHA256
8d98a32bb9a52c4642f421bdfcd3ed1b866b0836795612709d2c2c470c4df4fd

SHA512
2da624ab1118d5e5495a829c808c7e77c1e8e9309ad0dc1765c6a935b00c1867da7bb1da100423fa9b9acff783df50ef0ab5d234f5b78836d6e01c0dcf1a36b4

Download Submit
C:\Users\Admin\AppData\Local\fjmrwxcihjohhxcrmzhlotyze.jlq

Filesize
272B

MD5
222a121e8e1309cc4b1c631345759a01

SHA1
b4a3d0d29a250b835ec4b2449e0583f731f0c496

SHA256
bce90fcade90b228b080c84ec0a9b29ebadc91a043ff9321e3138f1b54da79a3

SHA512
8fef325a196726bdf4aa63c4fd35e6a3323eb875cce0b4e51a29c5603919190eeaf175648556442682ffdfabd9aef6cfacebe13659697e215ac3159d865f9745

Download Submit
C:\Users\Admin\AppData\Local\fjmrwxcihjohhxcrmzhlotyze.jlq

Filesize
272B

MD5
c7406df61128d3f4088c064ed682f1b3

SHA1
15ce53bf635b7bc35611d2993224e8d9e939f718

SHA256
fa0e33a7584ac99443a68c035dbfe04f6b000e4c9550d263ff4d9051574e2e71

SHA512
51a153fad1dae3b164b18b84900e7857adc0462d703e51d3ab84c04f2582a252c49e5c6ce802f56eb0903822a5735a7e4a32ecd6d281d3af3009cf958bdfeda4

Download Submit
C:\Users\Admin\AppData\Local\kzndtfvmwjzdopffljcrfvlxneobrvghxxdb.jxn

Filesize
3KB

MD5
de50e2a67bd29159b9e4125a1039c63c

SHA1
f2b8528fe58606ca19e34054dc9308de403385a2

SHA256
1a13d6901292e3d1ca273d85f40ab39617f64904a8e44e82138d026587b64917

SHA512
1d3f6af6ff0775d86999865e98a5e34a6fb1dae68f62054e642b7a1def555f78f7a321c2eee2c13e16facd4025ab3ae5aeb71322cf4defd56a2293c86ef79103

Download Submit
C:\Windows\SysWOW64\gbvrnfbyohdnelhnzdcx.exe

Filesize
240KB

MD5
f4c217bf104c13aa94fc2fa123ebebe8

SHA1
7435d847b2fa97df50dc2ea87d8d9a36943c931d

SHA256
0c5c4fcbf67919742e12b3381b9404886bd45d13918fc8ab9c64d2794fa7b5c7

SHA512
b662ae9744f5bab5ea9dbcd2e8594e41cb3ca267f44fcde5ac8bfa734797b235632be6ce95062bb35bc049075a5cf08a94a22c44420f9912c22c0e2f26483540

Download Submit
C:\Windows\SysWOW64\ibtnhxrmarltinhlvx.exe

Filesize
1KB

MD5
1fcfeac7acae04927a6b88278bc11446

SHA1
6c4491208b532bfe79b736a517cbe4b3fdb1c813

SHA256
a8b80d8d1648454633fb3c8c0a28dc2226d3e2c17478354429c58b36ceaa6f6f

SHA512
cd27e2330933ef8464780de0eb99327cf9760a35e277429a5d7d1298d3ab87917a22dbaf22edca814f248c5a0a5c2084a07bd284839debb612e6c5531d6ecded

Download Submit
C:\Windows\SysWOW64\ibtnhxrmarltinhlvx.exe

Filesize
176KB

MD5
e252d8e6bb8ba9e95b8fb0b7cf6842fd

SHA1
e9a73543a8638cb13e237fe7f17effe6055dfb86

SHA256
1a21b45066a88bcb8b51901d87f6a48d196088aadfe98c4942cd550ffb0d2ca8

SHA512
5c2ae26d33739a18809dff6c5b53debac02a90fba2ddbf2b22db12a5048f1c4c50737c87b11bb85c174662c42c87b2deb99d1b5397dcebe388efbd862fb57b24

Download Submit
C:\Windows\SysWOW64\mjfdbvtskfdpirpxlrsplj.exe

Filesize
149KB

MD5
0a37367266fe1da3484104d967c1e926

SHA1
622cab02eac37ca74d3e6a521d83ade5af8f3806

SHA256
cbce1c2c875c42dd2f367c1dd29829d43107655a0fae6194365eaa713a0d40ab

SHA512
8547a47ef0981f4205b53d914b41917ad3a2cf69de1597e1631a4dba8c393a46726879b77a0c8e8e7868818cf935e2a5d0eaf1ae21500c192127d46d6fe1170d

Download Submit
C:\Windows\SysWOW64\sjzrjxpiujbhuxpr.exe

Filesize
302KB

MD5
101fb0d4764bc256ab6232302db0ec8d

SHA1
ddd5f18ff1c573cca63cb68b1b17b5c3c5c2ea35

SHA256
9d36953cf5b4da067d9f25b5c91a10ee3d405c1d95678c7b2decf5c6f11a6418

SHA512
c042c7fc68dba5c0fe10f1ea36ed6dda26e7ada8b213889a6814603500f40bd8a3b29f2b79555495fcf67bf30986a04ddb185e5af19d1bd581228b25fd391da8

Download Submit
C:\Windows\SysWOW64\tngbwnietlgpflglwzx.exe

Filesize
217KB

MD5
8c95e08c5c1e5889cdd8f62216e99f97

SHA1
17a2aa94f78b2372bf10523c3b814b0b6dcffe88

SHA256
a2c721271a0961cca7653be84810f617f6f1529b00e12a0a48d9fe1ff9bde4de

SHA512
82c31326c95c995efb1bb57fe6f1fe384cd04a6059038e89ff7e2a8160e95c5c4981349a2cac4e29e140a0576a046cc7019d941d7ee37cb36601e317d664e64c

Download Submit
C:\Windows\SysWOW64\vrmjgzwulfcnfnkrejjfa.exe

Filesize
222KB

MD5
4f356c663fd563b4ac05813c66b43abc

SHA1
1a652430068fb0b33131d51ac3ac66aab52f2447

SHA256
6eaa3890ae8c6f407b516117e189f3cb77c298ff48aa09992d59e6cfb91defcd

SHA512
126a58617defd07ce38e4772d3062c3ac4e3d37fc2a660e624636ff246e0bb4402f4b38a724d2e2b716bfc5d0c9c10de2082c9aa002c8246dd9f58a6a891238c

Download Submit
C:\Windows\SysWOW64\zribujcwjzsznrknw.exe

Filesize
208KB

MD5
beefa7d0a3bb2f54a7cd8702bb994f84

SHA1
51d2ec361c752b4096a75538343781f49f06da95

SHA256
43cef61d751f8df8ff02d2b94fc743f49d70c522fad2e7f24b791b8eea9d3801

SHA512
ebf3dc1653d0acf130932c892b46beb4abe0041165ac3b06d39b6000df0577609a1dd41d9b557cd898f585d1536eae3646d29d965322df8edbc481a9f5d4a7bb

Download Submit
C:\Windows\gbvrnfbyohdnelhnzdcx.exe

Filesize
219KB

MD5
163c9bc21b7e841558f4b1ad38d4cc47

SHA1
b54266d6ae1ab27cc19d1e3632110aa5127b5ddd

SHA256
d54bed409a3ccead613dbdd3d788bf0e435595007a5f432c36b052b1ba7ff0e6

SHA512
94486c4de586e25bfa7d241180392014c1dc48ecdbe8d4bcd27217cf1ab683f1b28a2b7a20aceff9646baea05c404ca2f8ce62b2a33f7a6d46d744fccbb90cdd

Download Submit
C:\Windows\gbvrnfbyohdnelhnzdcx.exe

Filesize
99KB

MD5
d23bf8d967f4f2efebd60b6f0eea009e

SHA1
9c57239e7fa7ec8760672f0f2ee7371470127557

SHA256
0e55a678a8e736bb505db87cddc0752e1dbce657a3cfeded4c33d1778fb8f1ff

SHA512
6805e574a34490ceb5562f087c3d343d34d6e3877144264e95e5deafa4890bf4601c76295e551ab04664384b2b4d0d096ec5a64d538bd4f1c9dea92b7c77b3d3

Download Submit
C:\Windows\gbvrnfbyohdnelhnzdcx.exe

Filesize
116KB

MD5
f7442ee9f24d4d0eeac661701bdf1700

SHA1
77b585a2e420c035faec635de1c3e859d770beec

SHA256
f02436f1363399346d9053bad1df67d564c17587ffc0a93faa26c99f7d511724

SHA512
7f03ad4486cdf8676697216b64d169e95ebafe0005039360c7fa4d54d18cbebdd247eae4b96c2df3d97e0b8bf52afc5076fc30ff86a90f826aa5a569f736bd72

Download Submit
C:\Windows\ibtnhxrmarltinhlvx.exe

Filesize
375KB

MD5
1a04720966fdda87f12d90eda474f10c

SHA1
d32c94f522309131a1ae658b8cd64409c8e0ffde

SHA256
d7d53fc624807f3125a4f1f5960eb0cbf3e7d27278bcdd847f4e59391a1fcab1

SHA512
156653afb2ae7fff74ba6b8d4573b4dc743d33295263c62adad2da02fe14b58ccbee2314365a287635451e5725b582109e7ddfeee94a97d0729f3cd91c357b62

Download Submit
C:\Windows\ibtnhxrmarltinhlvx.exe

Filesize
135KB

MD5
92a8219532f4da784858b2f318b33dac

SHA1
f0f49b547f7c75e2f62eabb93ec9801ec8aca06b

SHA256
ebb4c1d90723e4c37498b6da004c580d436b38192f38d1920fd4dca6269963dc

SHA512
2fcba79afb92888b4bff0b2d91850f3d1d7bb83a78ebe866e6db49cea648bee772acba4abceec292f5376ef24f5e656fef118e57d3ff46dc222816acfed3353c

Download Submit
C:\Windows\ibtnhxrmarltinhlvx.exe

Filesize
127KB

MD5
6d4d1eabb06c1746c5b7987e1d3f4452

SHA1
eecf62616ab03c01b098fbbd7292c484efc313d4

SHA256
1e8f1fd1c671115c2a1436597dda6819eb0eae3feb0ddcea814d1b8774335f3c

SHA512
3fffa4e97bcdbf62d7fad24328460b45bd435c6cfde679318686128f7ec560f638cd5ca73f56ea21c49aa928871dc2cce7b6d7ceb2fdaa6dfa60e142141f37e4

Download Submit
C:\Windows\mjfdbvtskfdpirpxlrsplj.exe

Filesize
90KB

MD5
230217801487b82cfc0c6312b9382b0c

SHA1
6501db02a564707a09b8415d3936b73edbc7647f

SHA256
3a220ce735307835a7a673e0e2f9c320088e6f6fd4be07bb6d78efb3a17bf732

SHA512
eca8a062277fbd457d401955fcb28e660550dd98d051d84642d1aa40c82f61cc1c8cef6fa539d945fa0742c54fc3816b407fc3166915fc2c7fe93c9ff07a5d11

Download Submit
C:\Windows\mjfdbvtskfdpirpxlrsplj.exe

Filesize
102KB

MD5
12fccf455842f8527427c6d8f3a0638e

SHA1
4b3b33c26b7fae8e442d566fcc3eae52523d1ad0

SHA256
581579ae252e4095bf45bcc00766bea4a17b3f6abd46ff0f68e5efa63dc3584e

SHA512
bc223fe1fbc11efec20c08a7d4455bb29baf68ad3270c9122ef9ba7fc7dddfa9be46bec28dbfc58f4c79150494ff951bd00d704393a1ca533bce0722b67e3ad8

Download Submit
C:\Windows\mjfdbvtskfdpirpxlrsplj.exe

Filesize
112KB

MD5
0381d738f5a288a4d5e7885d1ec54973

SHA1
c09e02a6d57bd8a971add4f8ec29e47adda54138

SHA256
e3139aff3706535171705faed8f56fea3e0b153396d4ad68a37e576c22be9f9d

SHA512
b198457bd8b687c608a9e6c5bea80c96482ad2b1a0b9e41160f933660ad07d1d6b511143bee23f797202e8cb9bb6d8e74394a2f8ad96ab1ca2fcc4331f316c1c

Download Submit
C:\Windows\sjzrjxpiujbhuxpr.exe

Filesize
408KB

MD5
822c548fc16ef9990be24f26bd5043fa

SHA1
8ac3a6f9250d662848a63d3f85cbec684de38d40

SHA256
fb459974171887969ad5c0198e8891a7e14d0c27e305eeaf4a3e8c6db6bee2c6

SHA512
439373ffc50cb9e5aa68be9ec34ffa86f3584970f215f1a35d81b33bbf0310dd6b4f69295333ed4bf2a9c200c7e1ffa1e5f282482329800f4f5de31ef4ae5ac1

Download Submit
C:\Windows\sjzrjxpiujbhuxpr.exe

Filesize
178KB

MD5
92bc0dbcb859d45a2a8c1c64b928856f

SHA1
f77c8e5f8dd685de9834b35c2825fc217186c60c

SHA256
7b7994fb45657de7497631fd2e468976c5620ff6f8c681746a816b905b1b9c24

SHA512
dd20871159d943396a5371f36e90a26df559bd0a12219e598d5c66f2af948b33ab82cf68602f5f5924ed207ba80293b8754e9c22d52e5b3bb09c55d97d83d628

Download Submit
C:\Windows\sjzrjxpiujbhuxpr.exe

Filesize
148KB

MD5
011de09fdd029984d5397e9128a2f825

SHA1
91998c9802a3ace83f29384fcd9cdcbe01d0d38b

SHA256
c9367e3109c23adeeb5fa2825fa4fb8ac2f51e84ce1f82a76dbedaf43763d240

SHA512
4f3821085e6800a4df1d7e6aaabbdcc775e7cfc62dcb4e8756b1577d47143409f0b01049b4b23eb5682c44f9ef2cf30a171862c105dba6d776bd8e502fc7df16

Download Submit
C:\Windows\tngbwnietlgpflglwzx.exe

Filesize
411KB

MD5
3b6d33d77441abfd620dcccb642fe9ef

SHA1
bbd37fccfb6b7f665fdc6471b5128c23b3e5c5a6

SHA256
2e9f08ed58a817f6beeff529b1f158633624d275750345ecb6b83a912528f436

SHA512
5b377d6bcd8bc6e5b09b7e5db3b4839af1bd5bc636932b141b92687f860cede8ab9645fd3019ea496b83db8a045692a3fcebda4bb307afe7aff6fc9cd48a9065

Download Submit
C:\Windows\tngbwnietlgpflglwzx.exe

Filesize
39KB

MD5
6cd99fd8ceaf8d347c15834ff19f873e

SHA1
7070a86d96957daa2562a2e815cffdc7cda00b7f

SHA256
998a4e43f1a2ad0ab0f2e139556e350cf7bd78e04a2d671add1358924d35a4a2

SHA512
0a360e6b5e0f8cbeefc9d4191f83f84769697dc3a193495c4497f4256ddc506a85b1d2118e38e6e19f7bc6fb6597b3a273935e0935ab5764a0779fe9e2897c21

Download Submit
C:\Windows\tngbwnietlgpflglwzx.exe

Filesize
128KB

MD5
978c754949b050aded8e8e89f2abb12f

SHA1
e42206ba10e31404be3b5f3d4a224ec6c44cec0c

SHA256
5e274a3a063e69b689c112474d612e19b4b2a2bf6522c3aea3bbabc24b11efb8

SHA512
1df01abf28ea81ef2cc8b473d428c0cb3519cc976ecfa90f4bc69f7a34d870c3ea163c8b7cc10980fe387c2599f437e16a514882e63e6749cbf30aa7bf280b5c

Download Submit
C:\Windows\vrmjgzwulfcnfnkrejjfa.exe

Filesize
143KB

MD5
995a0e47505d31e997bc6e16ee7301b0

SHA1
da3aa7159f0e9883245549fd5744b25304885815

SHA256
3a1a735555bf38fee005bf52c3d30bc9cb6ad5b23b2b299b5fb501e34a010030

SHA512
286c2fefccb304dd1f4a4538c1fbf28292a51ff4ae692d87ff2e177baf10808f4565b1daab586859de927239f5447ec7d72b80956019c526301bfc473644bc89

Download Submit
C:\Windows\vrmjgzwulfcnfnkrejjfa.exe

Filesize
91KB

MD5
e80fced64324c764c82ec282338c5ac0

SHA1
906fb4f1f8daa29f832c24513bfc9d5ac34ed079

SHA256
f5fab852c7fe88fb7bc583cdd46f00daa397c00680037e9d8fd4b19e617df295

SHA512
3664143d4298931307b6ec0ae3f5ad2fb1b96837d979257a17a44b811cb64c7f742e3fa883197ad6a5cb7f917dfa3ff098c86b4b7a93081c33e5eba9340fe876

Download Submit
C:\Windows\vrmjgzwulfcnfnkrejjfa.exe

Filesize
157KB

MD5
4ba641fc67622af4aab0da7974634ef7

SHA1
7ca4105cd6c2a8097d8ea0b53d885789fcf1ae3d

SHA256
9c6286ff759ce05c215498b2b0c3d599d631d3823a62ba48c13e6a9a8182936f

SHA512
bbeafd6579e9f3d0dc5ff9a19e88c34ec45f625ebe7ab179c7133d42a97146b3a14ca7c678f569055fd9e18ec1da1dc8f6d0241e5f62390790e3e68998d220d8

Download Submit
C:\Windows\zribujcwjzsznrknw.exe

Filesize
141KB

MD5
0630806f2f4d8a24d1cdde75278ce1ea

SHA1
440cb330430e4855e24ad3627bcf29ffdf950d68

SHA256
9f132c8a1f0b66e8c40b853ee6cf8d19bcfbf1621da8d9c193a0a7cad2102258

SHA512
988a17d2501e089fc6b3b3e52732042ce41a2cf2ae99e89e0e26be65bb9fbe6fbadaaa7bab2b0b30beb68ba7bfcb16cb68817a8cd595f50f6f6b3d767a2f5b10

Download Submit
C:\Windows\zribujcwjzsznrknw.exe

Filesize
102KB

MD5
efd5c9c2edf163e35336f16a1900b382

SHA1
2705aaae7af195cb27f82f25cf27c6be7856bcd8

SHA256
c6170953d81c8c81ad2f7f367d27dd820366197fd0e57bde85abdac835f649c4

SHA512
6838077a7e7105db16fd08e96b280e71ff6f2623ce48e20ad351b52a4d81d3cf3758ea0258b036f9b1d8a8cff5042f2ae6413c1c7ee20d267a6583466d2497b7

Download Submit