4e7ae8c1b57d2178d7014c18b11a0d9ff1444f07d513ea8fdfa5af7a11f02873

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/02/2024, 07:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

969b2dabe6080bc2da7236a0d455ced7.exe
Size

480KB
MD5

969b2dabe6080bc2da7236a0d455ced7
SHA1

f2b4c9c70bbb5e11ec823846ad88a20c235775cd
SHA256

4e7ae8c1b57d2178d7014c18b11a0d9ff1444f07d513ea8fdfa5af7a11f02873
SHA512

1218dab072f3144304196c98f1b3c0494448929b8e6be35d5db88ef3dee0d0c12191f8cf3c94d8287195cde1af9a2a910a230d2e96f987e196e34ba00ae247c0
SSDEEP

6144:Kjg5pk1GS0xX3lPtbNN/DNRgkpiZzjhDQ0oeGF91YVusYJx+9sisyYpFTOOzHTvP:Kg5pBHxXptbN5ZRgOiBjw/C0AWzFjPvP

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	sfquntntcpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	wikpwhs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	wikpwhs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	sfquntntcpa.exe

UAC bypass 3 TTPs 13 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wikpwhs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	sfquntntcpa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sfquntntcpa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wikpwhs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wikpwhs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wikpwhs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	wikpwhs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wikpwhs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sfquntntcpa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sfquntntcpa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wikpwhs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	wikpwhs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sfquntntcpa.exe

Adds policy Run key to start application 2 TTPs 29 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qgmvgvknxmy = "livldzvfwslfxiivwj.exe"	sfquntntcpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lybhpbnn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cykzqlgpfaslcmlxx.exe"	sfquntntcpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lybhpbnn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\livldzvfwslfxiivwj.exe"	wikpwhs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lybhpbnn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jixpjhfrkidztgixapfe.exe"	wikpwhs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qgmvgvknxmy = "wuizspmxpmgbughvxla.exe"	wikpwhs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lybhpbnn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yyohcbanhgczuilbfvmmc.exe"	wikpwhs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lybhpbnn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wuizspmxpmgbughvxla.exe"	wikpwhs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wikpwhs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lybhpbnn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cykzqlgpfaslcmlxx.exe"	wikpwhs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lybhpbnn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jixpjhfrkidztgixapfe.exe"	sfquntntcpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lybhpbnn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cykzqlgpfaslcmlxx.exe"	wikpwhs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qgmvgvknxmy = "jixpjhfrkidztgixapfe.exe"	wikpwhs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lybhpbnn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\livldzvfwslfxiivwj.exe"	wikpwhs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	sfquntntcpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qgmvgvknxmy = "wuizspmxpmgbughvxla.exe"	sfquntntcpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qgmvgvknxmy = "yyohcbanhgczuilbfvmmc.exe"	wikpwhs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lybhpbnn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vqbpfztbqkbtjsqb.exe"	wikpwhs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lybhpbnn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wuizspmxpmgbughvxla.exe"	wikpwhs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qgmvgvknxmy = "vqbpfztbqkbtjsqb.exe"	wikpwhs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qgmvgvknxmy = "livldzvfwslfxiivwj.exe"	wikpwhs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lybhpbnn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yyohcbanhgczuilbfvmmc.exe"	wikpwhs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lybhpbnn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vqbpfztbqkbtjsqb.exe"	wikpwhs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	sfquntntcpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qgmvgvknxmy = "jixpjhfrkidztgixapfe.exe"	sfquntntcpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lybhpbnn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vqbpfztbqkbtjsqb.exe"	sfquntntcpa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	wikpwhs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qgmvgvknxmy = "vqbpfztbqkbtjsqb.exe"	wikpwhs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qgmvgvknxmy = "cykzqlgpfaslcmlxx.exe"	wikpwhs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qgmvgvknxmy = "wuizspmxpmgbughvxla.exe"	wikpwhs.exe

Disables RegEdit via registry modification 6 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	wikpwhs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	wikpwhs.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	sfquntntcpa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	sfquntntcpa.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	wikpwhs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	wikpwhs.exe

Executes dropped EXE 4 IoCs

pid	Process
2304	sfquntntcpa.exe
2480	wikpwhs.exe
2984	wikpwhs.exe
2228	sfquntntcpa.exe

Loads dropped DLL 8 IoCs

pid	Process
1888	969b2dabe6080bc2da7236a0d455ced7.exe
1888	969b2dabe6080bc2da7236a0d455ced7.exe
2304	sfquntntcpa.exe
2304	sfquntntcpa.exe
2304	sfquntntcpa.exe
2304	sfquntntcpa.exe
1888	969b2dabe6080bc2da7236a0d455ced7.exe
1888	969b2dabe6080bc2da7236a0d455ced7.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\vkpxhvjlui = "C:\\Users\\Admin\\AppData\\Local\\Temp\\livldzvfwslfxiivwj.exe ."	wikpwhs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ngpbphzfskzpdk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yyohcbanhgczuilbfvmmc.exe ."	sfquntntcpa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\memxkbsxjaodq = "cykzqlgpfaslcmlxx.exe ."	wikpwhs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\memxkbsxjaodq = "vqbpfztbqkbtjsqb.exe ."	wikpwhs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ngpbphzfskzpdk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yyohcbanhgczuilbfvmmc.exe ."	wikpwhs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qkuhwpipdwmdsax = "C:\\Users\\Admin\\AppData\\Local\\Temp\\livldzvfwslfxiivwj.exe"	wikpwhs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qkuhwpipdwmdsax = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jixpjhfrkidztgixapfe.exe"	wikpwhs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ngpbphzfskzpdk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cykzqlgpfaslcmlxx.exe ."	wikpwhs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\vkpxhvjlui = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vqbpfztbqkbtjsqb.exe ."	wikpwhs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\memxkbsxjaodq = "yyohcbanhgczuilbfvmmc.exe ."	wikpwhs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\cqubkxklt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wuizspmxpmgbughvxla.exe"	wikpwhs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cqubkxklt = "livldzvfwslfxiivwj.exe"	wikpwhs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qkuhwpipdwmdsax = "C:\\Users\\Admin\\AppData\\Local\\Temp\\livldzvfwslfxiivwj.exe"	wikpwhs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\nelvhxnrcsft = "livldzvfwslfxiivwj.exe"	wikpwhs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\nelvhxnrcsft = "vqbpfztbqkbtjsqb.exe"	sfquntntcpa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\vkpxhvjlui = "C:\\Users\\Admin\\AppData\\Local\\Temp\\livldzvfwslfxiivwj.exe ."	wikpwhs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vkpxhvjlui = "jixpjhfrkidztgixapfe.exe ."	wikpwhs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\nelvhxnrcsft = "yyohcbanhgczuilbfvmmc.exe"	wikpwhs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\vkpxhvjlui = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wuizspmxpmgbughvxla.exe ."	wikpwhs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vkpxhvjlui = "jixpjhfrkidztgixapfe.exe ."	sfquntntcpa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\cqubkxklt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cykzqlgpfaslcmlxx.exe"	sfquntntcpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vkpxhvjlui = "livldzvfwslfxiivwj.exe ."	wikpwhs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ngpbphzfskzpdk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\livldzvfwslfxiivwj.exe ."	wikpwhs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\cqubkxklt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jixpjhfrkidztgixapfe.exe"	wikpwhs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cqubkxklt = "livldzvfwslfxiivwj.exe"	wikpwhs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vkpxhvjlui = "cykzqlgpfaslcmlxx.exe ."	wikpwhs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\vkpxhvjlui = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cykzqlgpfaslcmlxx.exe ."	wikpwhs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\nelvhxnrcsft = "wuizspmxpmgbughvxla.exe"	wikpwhs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\nelvhxnrcsft = "cykzqlgpfaslcmlxx.exe"	wikpwhs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ngpbphzfskzpdk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vqbpfztbqkbtjsqb.exe ."	wikpwhs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vkpxhvjlui = "cykzqlgpfaslcmlxx.exe ."	wikpwhs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\nelvhxnrcsft = "wuizspmxpmgbughvxla.exe"	wikpwhs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\memxkbsxjaodq = "cykzqlgpfaslcmlxx.exe ."	sfquntntcpa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\cqubkxklt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vqbpfztbqkbtjsqb.exe"	wikpwhs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\memxkbsxjaodq = "vqbpfztbqkbtjsqb.exe ."	wikpwhs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\cqubkxklt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wuizspmxpmgbughvxla.exe"	wikpwhs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\nelvhxnrcsft = "livldzvfwslfxiivwj.exe"	wikpwhs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cqubkxklt = "jixpjhfrkidztgixapfe.exe"	wikpwhs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vkpxhvjlui = "wuizspmxpmgbughvxla.exe ."	wikpwhs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ngpbphzfskzpdk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vqbpfztbqkbtjsqb.exe ."	sfquntntcpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qkuhwpipdwmdsax = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yyohcbanhgczuilbfvmmc.exe"	wikpwhs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\cqubkxklt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\livldzvfwslfxiivwj.exe"	sfquntntcpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qkuhwpipdwmdsax = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wuizspmxpmgbughvxla.exe"	sfquntntcpa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\memxkbsxjaodq = "wuizspmxpmgbughvxla.exe ."	wikpwhs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\vkpxhvjlui = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yyohcbanhgczuilbfvmmc.exe ."	wikpwhs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\memxkbsxjaodq = "yyohcbanhgczuilbfvmmc.exe ."	wikpwhs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cqubkxklt = "yyohcbanhgczuilbfvmmc.exe"	wikpwhs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\vkpxhvjlui = "C:\\Users\\Admin\\AppData\\Local\\Temp\\livldzvfwslfxiivwj.exe ."	sfquntntcpa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\nelvhxnrcsft = "cykzqlgpfaslcmlxx.exe"	wikpwhs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cqubkxklt = "jixpjhfrkidztgixapfe.exe"	wikpwhs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\vkpxhvjlui = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cykzqlgpfaslcmlxx.exe ."	wikpwhs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\cqubkxklt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vqbpfztbqkbtjsqb.exe"	wikpwhs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qkuhwpipdwmdsax = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jixpjhfrkidztgixapfe.exe"	wikpwhs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cqubkxklt = "jixpjhfrkidztgixapfe.exe"	sfquntntcpa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\memxkbsxjaodq = "wuizspmxpmgbughvxla.exe ."	sfquntntcpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qkuhwpipdwmdsax = "C:\\Users\\Admin\\AppData\\Local\\Temp\\livldzvfwslfxiivwj.exe"	sfquntntcpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cqubkxklt = "livldzvfwslfxiivwj.exe"	sfquntntcpa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ngpbphzfskzpdk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jixpjhfrkidztgixapfe.exe ."	wikpwhs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\memxkbsxjaodq = "livldzvfwslfxiivwj.exe ."	wikpwhs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\ngpbphzfskzpdk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cykzqlgpfaslcmlxx.exe ."	sfquntntcpa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\cqubkxklt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jixpjhfrkidztgixapfe.exe"	wikpwhs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qkuhwpipdwmdsax = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vqbpfztbqkbtjsqb.exe"	wikpwhs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\qkuhwpipdwmdsax = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wuizspmxpmgbughvxla.exe"	wikpwhs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\memxkbsxjaodq = "jixpjhfrkidztgixapfe.exe ."	wikpwhs.exe

Checks whether UAC is enabled 1 TTPs 8 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wikpwhs.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wikpwhs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sfquntntcpa.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sfquntntcpa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sfquntntcpa.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sfquntntcpa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wikpwhs.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wikpwhs.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	whatismyipaddress.com
5	www.showmyipaddress.com
10	whatismyip.everdot.org

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	C:\autorun.inf	wikpwhs.exe
File opened for modification	F:\autorun.inf	wikpwhs.exe
File created	F:\autorun.inf	wikpwhs.exe
File opened for modification	C:\autorun.inf	wikpwhs.exe

Drops file in System32 directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\vqbpfztbqkbtjsqb.exe	sfquntntcpa.exe
File opened for modification	C:\Windows\SysWOW64\yyohcbanhgczuilbfvmmc.exe	wikpwhs.exe
File created	C:\Windows\SysWOW64\vqbpfztbqkbtjsqbalxsdrhbvdsmdvlusdcnzu.tjd	wikpwhs.exe
File opened for modification	C:\Windows\SysWOW64\wuizspmxpmgbughvxla.exe	sfquntntcpa.exe
File opened for modification	C:\Windows\SysWOW64\livldzvfwslfxiivwj.exe	sfquntntcpa.exe
File opened for modification	C:\Windows\SysWOW64\cykzqlgpfaslcmlxx.exe	wikpwhs.exe
File opened for modification	C:\Windows\SysWOW64\jixpjhfrkidztgixapfe.exe	sfquntntcpa.exe
File opened for modification	C:\Windows\SysWOW64\wuizspmxpmgbughvxla.exe	sfquntntcpa.exe
File opened for modification	C:\Windows\SysWOW64\yyohcbanhgczuilbfvmmc.exe	sfquntntcpa.exe
File opened for modification	C:\Windows\SysWOW64\pqhbxxxlggdbxmqhmdvwnh.exe	sfquntntcpa.exe
File opened for modification	C:\Windows\SysWOW64\livldzvfwslfxiivwj.exe	wikpwhs.exe
File opened for modification	C:\Windows\SysWOW64\pqhbxxxlggdbxmqhmdvwnh.exe	wikpwhs.exe
File opened for modification	C:\Windows\SysWOW64\wuizspmxpmgbughvxla.exe	wikpwhs.exe
File opened for modification	C:\Windows\SysWOW64\pqhbxxxlggdbxmqhmdvwnh.exe	wikpwhs.exe
File opened for modification	C:\Windows\SysWOW64\cykzqlgpfaslcmlxx.exe	wikpwhs.exe
File opened for modification	C:\Windows\SysWOW64\yiilqzifjsyfkivvjjkuuxclurv.krw	wikpwhs.exe
File opened for modification	C:\Windows\SysWOW64\jixpjhfrkidztgixapfe.exe	sfquntntcpa.exe
File opened for modification	C:\Windows\SysWOW64\livldzvfwslfxiivwj.exe	wikpwhs.exe
File opened for modification	C:\Windows\SysWOW64\cykzqlgpfaslcmlxx.exe	sfquntntcpa.exe
File opened for modification	C:\Windows\SysWOW64\yyohcbanhgczuilbfvmmc.exe	sfquntntcpa.exe
File opened for modification	C:\Windows\SysWOW64\vqbpfztbqkbtjsqb.exe	wikpwhs.exe
File opened for modification	C:\Windows\SysWOW64\jixpjhfrkidztgixapfe.exe	wikpwhs.exe
File created	C:\Windows\SysWOW64\yiilqzifjsyfkivvjjkuuxclurv.krw	wikpwhs.exe
File opened for modification	C:\Windows\SysWOW64\pqhbxxxlggdbxmqhmdvwnh.exe	sfquntntcpa.exe
File opened for modification	C:\Windows\SysWOW64\cykzqlgpfaslcmlxx.exe	sfquntntcpa.exe
File opened for modification	C:\Windows\SysWOW64\vqbpfztbqkbtjsqb.exe	wikpwhs.exe
File opened for modification	C:\Windows\SysWOW64\jixpjhfrkidztgixapfe.exe	wikpwhs.exe
File opened for modification	C:\Windows\SysWOW64\livldzvfwslfxiivwj.exe	sfquntntcpa.exe
File opened for modification	C:\Windows\SysWOW64\yyohcbanhgczuilbfvmmc.exe	wikpwhs.exe
File opened for modification	C:\Windows\SysWOW64\wuizspmxpmgbughvxla.exe	wikpwhs.exe
File opened for modification	C:\Windows\SysWOW64\vqbpfztbqkbtjsqbalxsdrhbvdsmdvlusdcnzu.tjd	wikpwhs.exe
File opened for modification	C:\Windows\SysWOW64\vqbpfztbqkbtjsqb.exe	sfquntntcpa.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\yiilqzifjsyfkivvjjkuuxclurv.krw	wikpwhs.exe
File created	C:\Program Files (x86)\yiilqzifjsyfkivvjjkuuxclurv.krw	wikpwhs.exe
File opened for modification	C:\Program Files (x86)\vqbpfztbqkbtjsqbalxsdrhbvdsmdvlusdcnzu.tjd	wikpwhs.exe
File created	C:\Program Files (x86)\vqbpfztbqkbtjsqbalxsdrhbvdsmdvlusdcnzu.tjd	wikpwhs.exe

Drops file in Windows directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Windows\livldzvfwslfxiivwj.exe	wikpwhs.exe
File opened for modification	C:\Windows\jixpjhfrkidztgixapfe.exe	wikpwhs.exe
File opened for modification	C:\Windows\vqbpfztbqkbtjsqb.exe	wikpwhs.exe
File opened for modification	C:\Windows\livldzvfwslfxiivwj.exe	wikpwhs.exe
File opened for modification	C:\Windows\pqhbxxxlggdbxmqhmdvwnh.exe	wikpwhs.exe
File created	C:\Windows\vqbpfztbqkbtjsqbalxsdrhbvdsmdvlusdcnzu.tjd	wikpwhs.exe
File opened for modification	C:\Windows\wuizspmxpmgbughvxla.exe	sfquntntcpa.exe
File opened for modification	C:\Windows\cykzqlgpfaslcmlxx.exe	wikpwhs.exe
File opened for modification	C:\Windows\livldzvfwslfxiivwj.exe	sfquntntcpa.exe
File opened for modification	C:\Windows\vqbpfztbqkbtjsqb.exe	sfquntntcpa.exe
File opened for modification	C:\Windows\jixpjhfrkidztgixapfe.exe	wikpwhs.exe
File opened for modification	C:\Windows\pqhbxxxlggdbxmqhmdvwnh.exe	wikpwhs.exe
File opened for modification	C:\Windows\wuizspmxpmgbughvxla.exe	wikpwhs.exe
File opened for modification	C:\Windows\cykzqlgpfaslcmlxx.exe	sfquntntcpa.exe
File opened for modification	C:\Windows\jixpjhfrkidztgixapfe.exe	sfquntntcpa.exe
File opened for modification	C:\Windows\yyohcbanhgczuilbfvmmc.exe	wikpwhs.exe
File created	C:\Windows\yiilqzifjsyfkivvjjkuuxclurv.krw	wikpwhs.exe
File opened for modification	C:\Windows\vqbpfztbqkbtjsqb.exe	sfquntntcpa.exe
File opened for modification	C:\Windows\yyohcbanhgczuilbfvmmc.exe	sfquntntcpa.exe
File opened for modification	C:\Windows\pqhbxxxlggdbxmqhmdvwnh.exe	sfquntntcpa.exe
File opened for modification	C:\Windows\yyohcbanhgczuilbfvmmc.exe	sfquntntcpa.exe
File opened for modification	C:\Windows\pqhbxxxlggdbxmqhmdvwnh.exe	sfquntntcpa.exe
File opened for modification	C:\Windows\yyohcbanhgczuilbfvmmc.exe	wikpwhs.exe
File opened for modification	C:\Windows\wuizspmxpmgbughvxla.exe	sfquntntcpa.exe
File opened for modification	C:\Windows\vqbpfztbqkbtjsqb.exe	wikpwhs.exe
File opened for modification	C:\Windows\wuizspmxpmgbughvxla.exe	wikpwhs.exe
File opened for modification	C:\Windows\livldzvfwslfxiivwj.exe	sfquntntcpa.exe
File opened for modification	C:\Windows\jixpjhfrkidztgixapfe.exe	sfquntntcpa.exe
File opened for modification	C:\Windows\cykzqlgpfaslcmlxx.exe	wikpwhs.exe
File opened for modification	C:\Windows\yiilqzifjsyfkivvjjkuuxclurv.krw	wikpwhs.exe
File opened for modification	C:\Windows\vqbpfztbqkbtjsqbalxsdrhbvdsmdvlusdcnzu.tjd	wikpwhs.exe
File opened for modification	C:\Windows\cykzqlgpfaslcmlxx.exe	sfquntntcpa.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1888	969b2dabe6080bc2da7236a0d455ced7.exe
1888	969b2dabe6080bc2da7236a0d455ced7.exe
1888	969b2dabe6080bc2da7236a0d455ced7.exe
1888	969b2dabe6080bc2da7236a0d455ced7.exe
1888	969b2dabe6080bc2da7236a0d455ced7.exe
1888	969b2dabe6080bc2da7236a0d455ced7.exe
1888	969b2dabe6080bc2da7236a0d455ced7.exe
1888	969b2dabe6080bc2da7236a0d455ced7.exe
1888	969b2dabe6080bc2da7236a0d455ced7.exe
2480	wikpwhs.exe
2480	wikpwhs.exe
1888	969b2dabe6080bc2da7236a0d455ced7.exe
1888	969b2dabe6080bc2da7236a0d455ced7.exe
1888	969b2dabe6080bc2da7236a0d455ced7.exe
2480	wikpwhs.exe
1888	969b2dabe6080bc2da7236a0d455ced7.exe
1888	969b2dabe6080bc2da7236a0d455ced7.exe
1888	969b2dabe6080bc2da7236a0d455ced7.exe
2480	wikpwhs.exe
1888	969b2dabe6080bc2da7236a0d455ced7.exe
1888	969b2dabe6080bc2da7236a0d455ced7.exe
1888	969b2dabe6080bc2da7236a0d455ced7.exe
2480	wikpwhs.exe
2480	wikpwhs.exe
1888	969b2dabe6080bc2da7236a0d455ced7.exe
1888	969b2dabe6080bc2da7236a0d455ced7.exe
1888	969b2dabe6080bc2da7236a0d455ced7.exe
2480	wikpwhs.exe
2480	wikpwhs.exe
1888	969b2dabe6080bc2da7236a0d455ced7.exe
1888	969b2dabe6080bc2da7236a0d455ced7.exe
1888	969b2dabe6080bc2da7236a0d455ced7.exe
2480	wikpwhs.exe
2480	wikpwhs.exe
1888	969b2dabe6080bc2da7236a0d455ced7.exe
1888	969b2dabe6080bc2da7236a0d455ced7.exe
1888	969b2dabe6080bc2da7236a0d455ced7.exe
2480	wikpwhs.exe
2480	wikpwhs.exe
1888	969b2dabe6080bc2da7236a0d455ced7.exe
1888	969b2dabe6080bc2da7236a0d455ced7.exe
1888	969b2dabe6080bc2da7236a0d455ced7.exe
2480	wikpwhs.exe
2480	wikpwhs.exe
1888	969b2dabe6080bc2da7236a0d455ced7.exe
1888	969b2dabe6080bc2da7236a0d455ced7.exe
1888	969b2dabe6080bc2da7236a0d455ced7.exe
1888	969b2dabe6080bc2da7236a0d455ced7.exe
2480	wikpwhs.exe
2480	wikpwhs.exe
1888	969b2dabe6080bc2da7236a0d455ced7.exe
1888	969b2dabe6080bc2da7236a0d455ced7.exe
1888	969b2dabe6080bc2da7236a0d455ced7.exe
2480	wikpwhs.exe
2480	wikpwhs.exe
1888	969b2dabe6080bc2da7236a0d455ced7.exe
1888	969b2dabe6080bc2da7236a0d455ced7.exe
1888	969b2dabe6080bc2da7236a0d455ced7.exe
2480	wikpwhs.exe
2480	wikpwhs.exe
1888	969b2dabe6080bc2da7236a0d455ced7.exe
1888	969b2dabe6080bc2da7236a0d455ced7.exe
1888	969b2dabe6080bc2da7236a0d455ced7.exe
2480	wikpwhs.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2480	wikpwhs.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 1888 wrote to memory of 2304	1888	969b2dabe6080bc2da7236a0d455ced7.exe	28
PID 1888 wrote to memory of 2304	1888	969b2dabe6080bc2da7236a0d455ced7.exe	28
PID 1888 wrote to memory of 2304	1888	969b2dabe6080bc2da7236a0d455ced7.exe	28
PID 1888 wrote to memory of 2304	1888	969b2dabe6080bc2da7236a0d455ced7.exe	28
PID 2304 wrote to memory of 2480	2304	sfquntntcpa.exe	29
PID 2304 wrote to memory of 2480	2304	sfquntntcpa.exe	29
PID 2304 wrote to memory of 2480	2304	sfquntntcpa.exe	29
PID 2304 wrote to memory of 2480	2304	sfquntntcpa.exe	29
PID 2304 wrote to memory of 2984	2304	sfquntntcpa.exe	30
PID 2304 wrote to memory of 2984	2304	sfquntntcpa.exe	30
PID 2304 wrote to memory of 2984	2304	sfquntntcpa.exe	30
PID 2304 wrote to memory of 2984	2304	sfquntntcpa.exe	30
PID 1888 wrote to memory of 2228	1888	969b2dabe6080bc2da7236a0d455ced7.exe	33
PID 1888 wrote to memory of 2228	1888	969b2dabe6080bc2da7236a0d455ced7.exe	33
PID 1888 wrote to memory of 2228	1888	969b2dabe6080bc2da7236a0d455ced7.exe	33
PID 1888 wrote to memory of 2228	1888	969b2dabe6080bc2da7236a0d455ced7.exe	33

System policy modification 1 TTPs 41 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	wikpwhs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	sfquntntcpa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	sfquntntcpa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	sfquntntcpa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wikpwhs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	wikpwhs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	wikpwhs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	wikpwhs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	sfquntntcpa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sfquntntcpa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	sfquntntcpa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	sfquntntcpa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	sfquntntcpa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	wikpwhs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	sfquntntcpa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	wikpwhs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wikpwhs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	wikpwhs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	wikpwhs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	wikpwhs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	wikpwhs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	wikpwhs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	wikpwhs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wikpwhs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	wikpwhs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	wikpwhs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	sfquntntcpa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	sfquntntcpa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	sfquntntcpa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wikpwhs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	wikpwhs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	sfquntntcpa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	sfquntntcpa.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	wikpwhs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	wikpwhs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	wikpwhs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	sfquntntcpa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	wikpwhs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	wikpwhs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	wikpwhs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	wikpwhs.exe

C:\Users\Admin\AppData\Local\Temp\969b2dabe6080bc2da7236a0d455ced7.exe
"C:\Users\Admin\AppData\Local\Temp\969b2dabe6080bc2da7236a0d455ced7.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Users\Admin\AppData\Local\Temp\sfquntntcpa.exe
  "C:\Users\Admin\AppData\Local\Temp\sfquntntcpa.exe" "c:\users\admin\appdata\local\temp\969b2dabe6080bc2da7236a0d455ced7.exe*"
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Adds policy Run key to start application
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2304
- - C:\Users\Admin\AppData\Local\Temp\wikpwhs.exe
    "C:\Users\Admin\AppData\Local\Temp\wikpwhs.exe" "-C:\Users\Admin\AppData\Local\Temp\vqbpfztbqkbtjsqb.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops autorun.inf file
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - System policy modification
    PID:2480
- - C:\Users\Admin\AppData\Local\Temp\wikpwhs.exe
    "C:\Users\Admin\AppData\Local\Temp\wikpwhs.exe" "-C:\Users\Admin\AppData\Local\Temp\vqbpfztbqkbtjsqb.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System policy modification
    PID:2984
- C:\Users\Admin\AppData\Local\Temp\sfquntntcpa.exe
  "C:\Users\Admin\AppData\Local\Temp\sfquntntcpa.exe" "c:\users\admin\appdata\local\temp\969b2dabe6080bc2da7236a0d455ced7.exe"
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Adds policy Run key to start application
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System policy modification
  PID:2228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\yiilqzifjsyfkivvjjkuuxclurv.krw

Filesize
272B

MD5
88e95deb352716a77cb004b8661c42bf

SHA1
972076260781a3d1b482f6a4f7a3f1a53c39820b

SHA256
be8c0dfea498fcda87875a10bce6392cc99d759935833e86d847d71101806bc3

SHA512
fc1d6808d4c6184302e7e0123526f9ad602649c450873a46c88e8bbc3a33b826c31c5a2af982f8a45848bba76b61c90ab3f615f033cc7a8f88b145373cfa71c1

Download Submit
C:\Program Files (x86)\yiilqzifjsyfkivvjjkuuxclurv.krw

Filesize
272B

MD5
f01fb83579d90b04fea75deae84dd37c

SHA1
730ba2dd37f4edf5476c833776e9224dc367fa9c

SHA256
222e911ed3f8b219a885f582036113fa0e1db2a7da83dca8c6015dd30947c400

SHA512
99396df384e1cad5603ab9d273d0bd49ed25609d3a6906051aa4f5ff24f6b2005945062fac1466ba28f4caa43655e8082ef1d5feb6b18cd99218626deeb12584

Download Submit
C:\Program Files (x86)\yiilqzifjsyfkivvjjkuuxclurv.krw

Filesize
272B

MD5
1482c2661f766237cc0fe603ff3beafe

SHA1
cd23542f8e6c4a47ec5157f5b5064973ec7146c1

SHA256
5b2fb2ffd361382da93ea34c38d8ff42825c7c2e0b0aae37a343b6911b3573f7

SHA512
fb31b6436026dc58dac03e6af44ceb0f0fb25f8fa06a70d417ea1ef9465f1cd11600d6c49047a2c59938f3a08c7e737999314ae178a4a37a069cdce79b58ce61

Download Submit
C:\Program Files (x86)\yiilqzifjsyfkivvjjkuuxclurv.krw

Filesize
272B

MD5
416ef557127a9d3379ae051818776d77

SHA1
985834526a062a166e6cd342e0a494a6ecf3d86c

SHA256
83645c903dc694d820596be1311b555a684ebd8e043cb5fd29e9204dd1318450

SHA512
fbdf730b43dbe4781defc479f6dbe99820a8a78bfe4f6fdf1786a3ccdd78deb0b5e9be6569ecca1651b1c1a2a87eb7d1af35efbe72059972e3ad707d6fdd0f57

Download Submit
C:\Program Files (x86)\yiilqzifjsyfkivvjjkuuxclurv.krw

Filesize
272B

MD5
39f73dd0e2e30750f01ad0c1ae1e9f8c

SHA1
e476ff9cfe52b135349158153d6891918111ad53

SHA256
9d100a0691591377559dc086ef2e8927117bed953cc24ddcd34f77e383ec657c

SHA512
6635c001f0aaabf8126080119cd0eb02ac5478875516e919a03fdbfd3f11f1abbe3ed0c34f64258001e6d38f5b45e94ea985abffc7ded8ce540a7a4ef9618cfa

Download Submit
C:\Program Files (x86)\yiilqzifjsyfkivvjjkuuxclurv.krw

Filesize
272B

MD5
e4b9ca30ca046c5acf044f3f1e006d31

SHA1
822dd572b5280d32c52f4a835527a94da8c5037e

SHA256
53e8eebc71398700c7f6826100879c21b9bb7a2c335836a3edf55aebfed68168

SHA512
ad40b24bb59fb7b68eb5fd7b558dfa83b793b1fb6c443772a0b9703888e32ac37e89862b6298e1ed57e0ef35fbf4151efe8eeb464a8e7f117fdeb61c8a7637ee

Download Submit
C:\Program Files (x86)\yiilqzifjsyfkivvjjkuuxclurv.krw

Filesize
272B

MD5
5fddeba64824012580166fb06062fbd0

SHA1
e64d496dacbcec5341cb89c02b1d59d311e85262

SHA256
090d395e7b0cdd4fb10fc872b265e077b272fe36f61ae5d5980cb48585bc846e

SHA512
55d96558e7107c7b4f6a6caacbc0da3d25fc646db6f7e6f1b9cda4951954c69ba22f130999354ffa8debd4dc302e855f21e381dd699c0ff6067e1e8a8778becb

Download Submit
C:\Users\Admin\AppData\Local\Temp\cykzqlgpfaslcmlxx.exe

Filesize
410KB

MD5
8bad2c9e93133d9864b1835c09a9f442

SHA1
2ccc3f838e8be9fb606a2ad0b08b7c2b1604d073

SHA256
525a8a930abf265959ab6e38e950c7b98e2505ef282ee4eeeef96ed3f9c82146

SHA512
3274c416e905dbda5875000a34908b7727ba921cece1f686b7668fc1916cea4da03a73d01c0a4128ac45f30bac83b380915c8c58700e35e3d2e9031660d20d5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\jixpjhfrkidztgixapfe.exe

Filesize
42KB

MD5
7b8efa63afdb5483675dc41fe2ac59f6

SHA1
0c3edc842be180252e68ea09b9c1373ce5465123

SHA256
acd56748e386d3763b269627cf0b882553e40cfc6a8e7528868adf94ab3bc2f1

SHA512
ab6da90c2a78d818ca133a23b9e9492d84222d3e9a32fa4dc681c55b82e4afe321e1f600769c661759bbb008c2c68bf6c662d06fded1d32683be10c0f6ef42f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\livldzvfwslfxiivwj.exe

Filesize
328KB

MD5
dede4c492515a8ac29d511a8ada60bd1

SHA1
f91059064a640821a00764b12f2636aace10c135

SHA256
7d0e1602b881bd52a67e2de8e3206b5591a3cd7359b2e30c609a0e219b466676

SHA512
9cadd0ab2c1d2dbf6cdfafa0c6ee717549fbad3b7b4b982a6462bb3c17dfc3a37a2d9c5ef8699bb4f91bf8d1e0edb4cc014636a5a8d6d164d3741ca8fd096e7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\pqhbxxxlggdbxmqhmdvwnh.exe

Filesize
20KB

MD5
609308a5798687be9d4e9750b8f607b3

SHA1
93e08711f028b41f88b38127d087d559c099fa11

SHA256
45fcb6f701537ef431cbaba5d57bb20a3fcb4749bd0fa0da4630844c55f6adb2

SHA512
a0e1908444b1de300b89dcc42be3dee6127ec7c8bf1d4096593f1fb7d09a3c41a4fbd7164ae81fa28f32e0edb48316d95a6a43dba660c2ae80ae8e5f9e639890

Download Submit
C:\Users\Admin\AppData\Local\Temp\sfquntntcpa.exe

Filesize
320KB

MD5
eb09c682903ecbd87f30b0366e008d8f

SHA1
59b0dc27c06ce536327490439a37751a3dbd5e38

SHA256
c4b122f7bab30363b472a3dffb8a7c61604c0ec4719ebd233ccbac8be0951be1

SHA512
83236c0955b81375666c10445d2cf5e4723b24e42e4ee5fb951f53945483be2fff5c8ef167f08cfad3accc162c61e750bb1039edbf09e26afe18cba2f994eb5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\sfquntntcpa.exe

Filesize
128KB

MD5
1cf9d96d6c581bbe47581e9289753135

SHA1
2ca86cfc45fcda94aee325f745435a8e94de6e86

SHA256
9a978fafb39adab06f7fbd5353bd79d307e2a857fa26ff4aea4d22e2e96fb148

SHA512
9029f01eacba27525ac46e99d52f943243bfe225174f1cddf81dff3f61726e46d7bc7b52e77a99f6c2555c9fe1203188bc95aac1a097c82a6367e58be940c545

Download Submit
C:\Users\Admin\AppData\Local\Temp\vqbpfztbqkbtjsqb.exe

Filesize
466KB

MD5
d8cc670403f6a65406116cb9b1855b7a

SHA1
02dc24e003e710272226313809b7eff3ed415869

SHA256
4f12f035ca279e0b0b57518f6a76d3513530a4b0023565fac92d82b135200fc8

SHA512
03f35067bdf900498b53bf482f3306f044e39f19cad9324e439424528f3a0c1af698ea40d2f0ea850ff1fde2b14019822bdb7f5421f2f5ee33eed740da1e98f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\wikpwhs.exe

Filesize
522KB

MD5
561409fbb793c5199cbbd169fba1d5b0

SHA1
a7732333ad414d78b11e419ded7c20903cf61068

SHA256
1ed0528a9a720ec3f0c5f725be8411c3013b03e44d121d1ea45f05087a24a360

SHA512
8bcc83fdc5bac4eb9108cbb33604f3b8f72c3ee4736120282c159ed702b8dd56c57c7b4156067e36665eddec5813bb2efa28f45aa4b1de9257c3e4fb7bfd646a

Download Submit
C:\Users\Admin\AppData\Local\Temp\wikpwhs.exe

Filesize
454KB

MD5
f75fee83240d2eed8bfb1ff90726a428

SHA1
5d68ff832bd7deb045b73e7cad2b405e5ee6754a

SHA256
e361a9e2cbcb906885fa3236fe9844a1695c21f28c77e5b790c407b971dffabb

SHA512
83b7236a629815a5a50f90e7829d6d49c235f2700d99aad08539ede97a69bf4cf5ac3ef5e5ac117499f1881877369d18027dd5954de45aa60f00e863ed241044

Download Submit
C:\Users\Admin\AppData\Local\Temp\wikpwhs.exe

Filesize
401KB

MD5
9793998e0611c872f6c3a7b404e540aa

SHA1
17c29a515ab75feeadbc152b61a9c748ff01d675

SHA256
f4df167c6f4900f025b08d4cd2e4784b78ecadd5d184cdfe1df1b3dc5e6bd0d6

SHA512
60001b8f901865e3f37ceb48d0cfbdaf361a88773461b867726a81f87a764fa8f9c6b2876f1bdc203315c6c6693722fff69414955b98f4f425a704b718a4786e

Download Submit
C:\Users\Admin\AppData\Local\Temp\wuizspmxpmgbughvxla.exe

Filesize
15KB

MD5
c2121a56e2eeaa704de0e89452757cde

SHA1
135998abdfe06eea251b7d943c05f13d1f15653b

SHA256
e2b0f721dc1a646f0164e4a1c37bec6afc1080ae39938022a703e7fb0b3124c7

SHA512
034c7b0571bd64add92c88b2ffde6d7199207ea3537eae28c2f1e778011560f436726dfcb7cd838f500367672e37b8a8fde952223e361357f86790b17c88d0f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\yyohcbanhgczuilbfvmmc.exe

Filesize
7KB

MD5
7df156943beffecec0d75a7c70822246

SHA1
486372e2ae5845576324c0005a5f99bd115677d0

SHA256
15eb45ec3b7aab3ee2ffff1db5d3a73d6e9c016dfda357e09d7a9e88e598a7c0

SHA512
67d0481c52056775bcb999cfbdd8647596991f6cd1e7ed6258213b6eed56f352916a5a5d002bfb8b7e3eae7fd4cd5769cc9a3163e2e853a60602f31fa7ef2a14

Download Submit
C:\Users\Admin\AppData\Local\vqbpfztbqkbtjsqbalxsdrhbvdsmdvlusdcnzu.tjd

Filesize
3KB

MD5
9ad099608f651d5598e0134e524f8676

SHA1
a7fb07e905973405e31351aa1062a07b0b5cd418

SHA256
186f05092e3cdd02a986bce78f51c038fcc6a70d224552e336fa95dce7c84403

SHA512
70f2def761743473fb1e4e47154868238e761cc6f9f8d50c7c149023969c02cf3969cdf63bdb0a240d3571cc75a20d8389d39bc2ae22aafaedc6a8ea0f20cf1c

Download Submit
C:\Users\Admin\AppData\Local\yiilqzifjsyfkivvjjkuuxclurv.krw

Filesize
272B

MD5
b481e850829ed692d913ec8406cece07

SHA1
0b15b59fe32504eb065312934a90b40e5caefd76

SHA256
4e27ca3da1642da6f526c40954dcec7956e2778425ce5fbb3246ca62f4441018

SHA512
d272ebca2337e49de43a56fd9d70884321b108dd463562da5638ecb4c12e3b87f681572552cfb1a48a33f9a6dcb13c4ef82ac0e8039e4ac3c4cbb874b7f25b0e

Download Submit
C:\Windows\SysWOW64\cykzqlgpfaslcmlxx.exe

Filesize
330KB

MD5
c4c346b5b09878eeb58eb9a5bbc7a48b

SHA1
03895692a1ecf89a6ad77d48540e846f63bd3033

SHA256
7e0203b87313d0ce09e35b549bed925cd400e53c7fa354d47992afc3f37ce0d5

SHA512
931f35c8dea42597b26186c7c4ed8ea4a616858819f1bc14e248c21943c113dd11f12629e4d8d14565f175420b1947b327f8b3f98b3da993724c8becd1b26955

Download Submit
C:\Windows\SysWOW64\jixpjhfrkidztgixapfe.exe

Filesize
8KB

MD5
5d94befac3e6c21ad8fd633f1868553d

SHA1
78fa2d0aaba052dcc4d627d1bd491dadf8f0bae3

SHA256
714b32beea8078f8a93c6cd9c45e5a38c45453849d0e0cdc078894b76219e040

SHA512
958a15520c95c0321b7999bbaf51496cf82f20e0d188d7b2f35fe2e8070f563eaef28d08e46bd7261f1f8e377fb42dacf47b1e42719349d5997f339f5798a55d

Download Submit
C:\Windows\SysWOW64\livldzvfwslfxiivwj.exe

Filesize
480KB

MD5
969b2dabe6080bc2da7236a0d455ced7

SHA1
f2b4c9c70bbb5e11ec823846ad88a20c235775cd

SHA256
4e7ae8c1b57d2178d7014c18b11a0d9ff1444f07d513ea8fdfa5af7a11f02873

SHA512
1218dab072f3144304196c98f1b3c0494448929b8e6be35d5db88ef3dee0d0c12191f8cf3c94d8287195cde1af9a2a910a230d2e96f987e196e34ba00ae247c0

Download Submit
C:\Windows\SysWOW64\pqhbxxxlggdbxmqhmdvwnh.exe

Filesize
346KB

MD5
fddd06ddc12c78cd444f694e1e90bde0

SHA1
fbe665ded53dc6f5ec12a2be1a0f7b9bede7798a

SHA256
47f607a8cc5becc0d35750de266dd752887da4bd074e175d2977713191fcf983

SHA512
c29083b4aca3bc16fa6e5a0c2f1a1ea71c1ec92970fc35631339d995fc25bb4c3b709a9bf226c185fc52f2b9d7be97b9f889f457072ecee0460b82f7b7d78dfa

Download Submit
C:\Windows\SysWOW64\vqbpfztbqkbtjsqb.exe

Filesize
383KB

MD5
8905609ab8486ab9b82b7bb679e23262

SHA1
aa923290caf664b6ad6f6e4fe3b2025eff1a3c17

SHA256
1fe9056b458827bd4e295fcf1845079d2fe77d81b4553a04e44c2bb602b111e5

SHA512
71b68208cfc0b53f7584ba9603318575ad3ac0274997a90615a08545a4d47d482a6bcd3c44a39576b72011783f5224a7ece4a53a254ef181e594ddc33e85f659

Download Submit
C:\Windows\SysWOW64\wuizspmxpmgbughvxla.exe

Filesize
60KB

MD5
d3b85bb9d196e72698be344ac96002e7

SHA1
c298e4ea9027a35145f44f8c7d19a67c0ed12153

SHA256
d20130ad085156d26c8e5c65721b7bc576d6c2d68d9cfc76a9ffdca839d049fb

SHA512
e08d4e1e350c548bc7542a4951a032e048407cb17a81d4e3286fd25d7e7f792c97a1f414a58c757263111e073080e7bbd36c6baad1a89d5292f1235eef271adb

Download Submit
C:\Windows\SysWOW64\yyohcbanhgczuilbfvmmc.exe

Filesize
473KB

MD5
b33c85b85ea534306b6c224aafca6288

SHA1
30afbda92782a4db21698dd91d220794dbb6c290

SHA256
8bbe00be71f37a463b07e5c5bce647602910da21a401dbda6fbf68f2a3b272c2

SHA512
179630255685a210451956ae2071cb0441938496d81eeed816251d4deb39b7069ec0d13cdbfe33d315692c6f5b3150c39248d24ad53e67c6a860935c95ecb86d

Download Submit
C:\Windows\cykzqlgpfaslcmlxx.exe

Filesize
231KB

MD5
46533812270c38fdad0333fac33a40e0

SHA1
67f1a29d8f11e3fa8bf67cf54eaa9c7c8baab306

SHA256
388722ccd3182df4b7a70643810a2a9b6cad9005e0e5fb6ad99de72b747a7795

SHA512
a51636f73a6089a434f7486721fa5bf423ed477b9c07a8bf43591c3c82dc836395c1666f6dd9ba61ade436b3190d2cef0c011eb8c5ab71dada8d2fed4d6515f3

Download Submit
C:\Windows\cykzqlgpfaslcmlxx.exe

Filesize
281KB

MD5
16a84aa029c8d009f41d9799efcde815

SHA1
47f00029672deb459c13f857ae8d8cfd66725b4e

SHA256
be198d380f2925dfd09a75cac067f13b8c0e084dd8db4d1977a1cf5ad0ce342e

SHA512
b193e509e4dc2014eeb7571073f92931aab3854f6a994d18475b9eb1c7114d40e2a627bbfcdb9158e33aad0844071fe905e0f96e09f86980ccafa52fe09d8826

Download Submit
C:\Windows\jixpjhfrkidztgixapfe.exe

Filesize
266KB

MD5
2a0fdb56bcdac9d0f35ebdda719af1a3

SHA1
9aebde91ccb628e93e87b74705e153f28df68d3f

SHA256
6fe98abebe8d188da079921f2a75dd0844cf6ab19c0c09789e8c855fedbb7874

SHA512
361d21a95d6644142d2e45d7c1a40e352081041e58f2fa679d6f8dad9d0bbca965d6c676bcdcd5ecd0b8a1503a0da821aa65988b7903b44f6904f4e59132cf9e

Download Submit
C:\Windows\jixpjhfrkidztgixapfe.exe

Filesize
1KB

MD5
a85e3ec970d604e74a4f6cb886831a10

SHA1
df59d472d35aafec3b1dea821798045e73ce7840

SHA256
3171cea157d515f7b0fe2c21a4a1fb824e58d5a3edaaef0b1307fb5eb39cc35e

SHA512
e81225e2bd01a30a2d74395bdde4ca095758e11eb4a4a1973dea9e7b6c2b884c3d5d599f95441d23d36d9e1d236459dd3c35b815637f1f415946794dc852b0a1

Download Submit
C:\Windows\livldzvfwslfxiivwj.exe

Filesize
164KB

MD5
e15ee1ad793c23936edf78e6cf880275

SHA1
3c4adf17ad230cdf1c673e4508838cf9413aa06b

SHA256
ef4516d9efa14547dcfbd998e9b1242bdb4390ee96647923e895ebebc6696677

SHA512
c9c5498f8ec339600d8e71f27350b0932fcbbd179ba534afbac63f8cd61ad6857edd98c7e3345b632f59031d68821704cdf63f38aa40b714365f9d67e4a06fea

Download Submit
C:\Windows\livldzvfwslfxiivwj.exe

Filesize
327KB

MD5
3e402fd865c5356193d10a2d3c2a4bbc

SHA1
548b616550c30c4314f981afdad93c709ceff07b

SHA256
e7e39fa56d35570795fc94938b54cfbc3d66caa00bffc6bb61038cc1251fd59d

SHA512
3ed4ad92cda15c51d7103a88cc9d25ecc9ba3ccc8be1d75382d2fda285f040df61fe20347c45a2a2feebe592eaa26b11fb3e3449b8a7e9e32f8bb23cfd7be2d4

Download Submit
C:\Windows\pqhbxxxlggdbxmqhmdvwnh.exe

Filesize
293KB

MD5
56969fe407f70167d6bf073484b8aca4

SHA1
d13e271130912319c0eeb2d8ce333ff203d96ef2

SHA256
460345fa518fd9b89c947305acec34620b2ef2f94edd608e51bc393bc6bf35ec

SHA512
e4405955f73f2299d2b0c37498a56bcc9e90ee28fb127c7b4cb29fd3c341000f86cfcef9bafdff591de9c08259e1a23fccbdca29a2fe918c87c66066e1429c2c

Download Submit
C:\Windows\pqhbxxxlggdbxmqhmdvwnh.exe

Filesize
19KB

MD5
53cfeb28fbaa062fe013a8a2bdd24389

SHA1
01ce9e164e719363f2ec6bf49ef92b9987cb3893

SHA256
75e13cbab08d30fddd122ce9f2876737609685c54f497adc5161bdb79d7c64d0

SHA512
ba86ce01801d539fc1c8424d702e409d6c6acf1c282f85055966aeee0d232a1ac960d9ea8c5af33f6f576b01ffd9b94e02e5285c2c47f91529db0fd49144383f

Download Submit
C:\Windows\vqbpfztbqkbtjsqb.exe

Filesize
228KB

MD5
50fd695a115c2e5de457ccc2d0693726

SHA1
16cc62c618bd71e5092cf332008ec41157092981

SHA256
fde0c95694e63e24826522ed44bc668868ae6454326b0f6ca17e242f9275b6d6

SHA512
90ec5c04e766733d2baa289c822928672f7ff20a4c07b84ade4673122a386589ae5c2a54805bf52d23f58c3b908ec85b2c6f544826f0199c512386e10773a097

Download Submit
C:\Windows\vqbpfztbqkbtjsqb.exe

Filesize
314KB

MD5
54f4a3bb00ab2de372fc279a232e5112

SHA1
3e0e9ab2046f5c4154e31d75d833b81de95ec370

SHA256
d9bc2d224f8dbd24fb272bc9dfc2be67ad7354baed790187371fdcb302b67a22

SHA512
2319ba394ebf4df89bcbd6f450a70fb9410ec0679fa391a87eb65a8c13f0c17b089049573509eaf607a1c01945f6e56bf28be322b026fdd01ebef9feb8ff360b

Download Submit
C:\Windows\wuizspmxpmgbughvxla.exe

Filesize
161KB

MD5
e06e217fbc4c1bd8d42d8d454cb93b55

SHA1
ba7df5a5298107755c6fff9bd04df45d8cea18eb

SHA256
43726232712430a7a98e29ff43a3eef7272c0c19c8a22027878ee8c0bd5aa6a4

SHA512
3f16e5e2f0936f25dff9252be1b2a0aa15440f1b4c8d63455a1fbbbe2e49ec6b88b6c117125d355314a64171660ab4870bd1826262dcac8281a519ea793f04af

Download Submit
C:\Windows\wuizspmxpmgbughvxla.exe

Filesize
293KB

MD5
ad19b52f28c0465a293cac7387845aa1

SHA1
7fa6c31ead15e1b7ce6f545ae155e06216d0f90e

SHA256
ab07ff31a061abd5ed050f4b950f67fe25c1fbd2939daf296a2799f035182ef8

SHA512
140b27235796b07f9eea8db2eebac64f676fa4bd5d5ea48bb9175674d5f397c8d9b57ecb9c3a471e939ca359ed0a8d278c0393584daa4339e75d466d3f66b069

Download Submit
C:\Windows\yyohcbanhgczuilbfvmmc.exe

Filesize
448KB

MD5
515015f2146b26dfd70cc0969c403234

SHA1
b70dde3d8ce0359d162ff41a394336a4e9e50d13

SHA256
4bf86eecc3aaa31883e4fe8737378379492076a5e97309ba56535ee3db27fc69

SHA512
50c42686284f6e41b339a93caecd185e3c246e68bb525b46cdff415441c362e977c167dfedf0df9140a53b6ed0664367a5fbe5e4e1cd803e00a46b12fcaf7864

Download Submit
C:\Windows\yyohcbanhgczuilbfvmmc.exe

Filesize
239KB

MD5
059c8f8c6dedc4f03bfa604d63470022

SHA1
fff95022b7e52d2400fb2780bd34b7ef62315cbb

SHA256
0de8b45a1ff973d28a049e0655717ab010943222488ffefd6419116b78446a1a

SHA512
a62e6592aad29e2baccab8976a4cbacf167548b6a6820320022940b06fe143c8e050f62cee7b46ed04bfb5298b4addde4116f2b836c71095c58e1e4a9aee4c6d

Download Submit
\Users\Admin\AppData\Local\Temp\sfquntntcpa.exe

Filesize
192KB

MD5
fbc1c7c361c9ebda5ca11c437f7844bb

SHA1
c395a3f08d760fb3f2e7be0ac071202bdbca4eb1

SHA256
60d30c4fb5a84ada692d05fc51b092d25fa3fb94329c22aabcae7d89e4c945e6

SHA512
c1e047ba452afc0c638c1e0ad494b69f7b774475b5b7d9a33cac24401b6de6738fa9a3b21365c56d8f5ef8b0c635a556c9a5120fbb56bd0547751f71c3eab2aa

Download Submit
\Users\Admin\AppData\Local\Temp\wikpwhs.exe

Filesize
712KB

MD5
8a9a9b464bfc1f3c8854a309c4e72841

SHA1
3341d2ad83e0ae8af8c935165e15a7ec88f1f40d

SHA256
7c6313f488a035aad5c29537773af52de5027104792173a7604bfacb990b8ece

SHA512
c0f15fd23e67f66ee51ff067ba2cade739a84e7a436ee2d9b62ad7c340c7726c07c3e63e5507df91a18056970510bf68d5088ecd55cb2bb58b054d12ad9d5667

Download Submit
\Users\Admin\AppData\Local\Temp\wikpwhs.exe

Filesize
654KB

MD5
6f6298a47c15bb6c2945214b34d6d8f2

SHA1
9b3ce76a228d880448fee9d05e86a4841078bbf2

SHA256
383f3ab0ecc3d4b7e32edf7188bd347ef448088aeecbdc384e632d4d22380fcc

SHA512
e2084feb50c7546d9a8bae1754c3cb3c7cadb08bd16e4d17be466471863cf890604f302a1e4a6d9f73556a7ee7f838a2dfab7e051f0af2db29aaebf273f1a012

Download Submit
\Users\Admin\AppData\Local\Temp\wikpwhs.exe

Filesize
267KB

MD5
e3e488562c04578e0a2faed8b0801d9b

SHA1
69843294ece6a0cbadfb48b912420a2a4a287f6f

SHA256
8a06a8b0b83f33d43e64abd2ae1f9f17bd8364750961619169e6de2875e022b5

SHA512
e429729cc84fdbd414b8991a8f823721958e6753a66f73c23efdb0dda4695ec7ccb0c3042e27b56974de32ad759f0b5e52da620b8726404a0700bc62d0a3ba64

Download Submit