Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30/10/2024, 13:32
Static task
static1
Behavioral task
behavioral1
Sample
5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe
Resource
win10v2004-20241007-en
General
-
Target
5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe
-
Size
608KB
-
MD5
db1b7ac55a245032f066060d23d00630
-
SHA1
8b968e1eee41e0f4b2f030e672a609e65a7f7618
-
SHA256
5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fd
-
SHA512
b78051b0d851c883afe6005c16e442ce48cd137aec83a8e3a4d24f11187d41706c42bc63483834d1bb51e2fb950ac253f385714f9cf8b466f4b61c915dea72eb
-
SSDEEP
12288:SpUJ3r6YkVwJgNnSykgb9cqWnw4q6ZmFhqsj:SpUNr6YkVRFkgbeqeo68FhqG
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" oqersrtnyao.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" ahoower.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" ahoower.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ahoower.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ahoower.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" ahoower.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" ahoower.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" ahoower.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" ahoower.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" oqersrtnyao.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" oqersrtnyao.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" oqersrtnyao.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" ahoower.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" ahoower.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" oqersrtnyao.exe -
Adds policy Run key to start application 2 TTPs 25 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run oqersrtnyao.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\gpyakujtu = "atmysmlfqawrahrtsle.exe" ahoower.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\gpyakujtu = "cxsgcyzviuspajvzavqea.exe" ahoower.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ntzyfm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nhbojeezlwtpzhsvvpjw.exe" ahoower.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ntzyfm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\atmysmlfqawrahrtsle.exe" ahoower.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\gpyakujtu = "phzkdwunxgbvdjstrj.exe" ahoower.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ntzyfm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zpfofwsjryrjptaz.exe" ahoower.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\gpyakujtu = "nhbojeezlwtpzhsvvpjw.exe" ahoower.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\gpyakujtu = "zpfofwsjryrjptaz.exe" oqersrtnyao.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run ahoower.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run ahoower.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\gpyakujtu = "atmysmlfqawrahrtsle.exe" ahoower.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\gpyakujtu = "zpfofwsjryrjptaz.exe" ahoower.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ntzyfm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\atmysmlfqawrahrtsle.exe" ahoower.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\gpyakujtu = "nhbojeezlwtpzhsvvpjw.exe" ahoower.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\gpyakujtu = "gxoyqifxgoibinvvs.exe" ahoower.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ntzyfm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gxoyqifxgoibinvvs.exe" ahoower.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\gpyakujtu = "zpfofwsjryrjptaz.exe" ahoower.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ntzyfm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nhbojeezlwtpzhsvvpjw.exe" ahoower.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ntzyfm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cxsgcyzviuspajvzavqea.exe" ahoower.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ntzyfm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cxsgcyzviuspajvzavqea.exe" ahoower.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ntzyfm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zpfofwsjryrjptaz.exe" oqersrtnyao.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ntzyfm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gxoyqifxgoibinvvs.exe" ahoower.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\gpyakujtu = "phzkdwunxgbvdjstrj.exe" ahoower.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ntzyfm = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zpfofwsjryrjptaz.exe" ahoower.exe -
Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" oqersrtnyao.exe Set value (int) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" ahoower.exe Set value (int) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" ahoower.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" ahoower.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" ahoower.exe Set value (int) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" oqersrtnyao.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation 5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation oqersrtnyao.exe -
Executes dropped EXE 3 IoCs
pid Process 3244 oqersrtnyao.exe 2472 ahoower.exe 2608 ahoower.exe -
Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iai2c.sys ahoower.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CBDHSvc ahoower.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UserManager ahoower.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SerCx2.sys ahoower.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc ahoower.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power ahoower.exe -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ahoower = "C:\\Users\\Admin\\AppData\\Local\\Temp\\phzkdwunxgbvdjstrj.exe" oqersrtnyao.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ufqugsjvyao = "zpfofwsjryrjptaz.exe ." ahoower.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ahoower = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gxoyqifxgoibinvvs.exe" ahoower.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ahoower = "zpfofwsjryrjptaz.exe" ahoower.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qdqwkyrfkoetw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zpfofwsjryrjptaz.exe" ahoower.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ahoower = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nhbojeezlwtpzhsvvpjw.exe" ahoower.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rdpuhumzdgvj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\atmysmlfqawrahrtsle.exe ." ahoower.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\pxfgpymv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cxsgcyzviuspajvzavqea.exe ." ahoower.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\pxfgpymv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\phzkdwunxgbvdjstrj.exe ." ahoower.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pxfgpymv = "cxsgcyzviuspajvzavqea.exe ." ahoower.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ufqugsjvyao = "cxsgcyzviuspajvzavqea.exe ." ahoower.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ufqugsjvyao = "phzkdwunxgbvdjstrj.exe ." ahoower.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\pxfgpymv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gxoyqifxgoibinvvs.exe ." ahoower.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qdqwkyrfkoetw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\phzkdwunxgbvdjstrj.exe" ahoower.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ahoower = "cxsgcyzviuspajvzavqea.exe" ahoower.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\pxfgpymv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gxoyqifxgoibinvvs.exe ." oqersrtnyao.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pxfgpymv = "nhbojeezlwtpzhsvvpjw.exe ." ahoower.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zjtwhsitvw = "gxoyqifxgoibinvvs.exe" ahoower.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rdpuhumzdgvj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cxsgcyzviuspajvzavqea.exe ." ahoower.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rdpuhumzdgvj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\atmysmlfqawrahrtsle.exe ." ahoower.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rdpuhumzdgvj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zpfofwsjryrjptaz.exe ." ahoower.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ufqugsjvyao = "atmysmlfqawrahrtsle.exe ." ahoower.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qdqwkyrfkoetw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cxsgcyzviuspajvzavqea.exe" ahoower.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ahoower = "atmysmlfqawrahrtsle.exe" ahoower.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\pxfgpymv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cxsgcyzviuspajvzavqea.exe ." ahoower.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ufqugsjvyao = "gxoyqifxgoibinvvs.exe ." ahoower.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ahoower = "C:\\Users\\Admin\\AppData\\Local\\Temp\\phzkdwunxgbvdjstrj.exe" ahoower.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\pxfgpymv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\atmysmlfqawrahrtsle.exe ." ahoower.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pxfgpymv = "zpfofwsjryrjptaz.exe ." ahoower.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zjtwhsitvw = "zpfofwsjryrjptaz.exe" ahoower.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pxfgpymv = "nhbojeezlwtpzhsvvpjw.exe ." ahoower.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zjtwhsitvw = "gxoyqifxgoibinvvs.exe" ahoower.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rdpuhumzdgvj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cxsgcyzviuspajvzavqea.exe ." ahoower.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ahoower = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cxsgcyzviuspajvzavqea.exe" ahoower.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pxfgpymv = "atmysmlfqawrahrtsle.exe ." ahoower.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zjtwhsitvw = "atmysmlfqawrahrtsle.exe" ahoower.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ufqugsjvyao = "nhbojeezlwtpzhsvvpjw.exe ." ahoower.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ahoower = "cxsgcyzviuspajvzavqea.exe" ahoower.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zjtwhsitvw = "phzkdwunxgbvdjstrj.exe" ahoower.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ahoower = "zpfofwsjryrjptaz.exe" ahoower.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zjtwhsitvw = "cxsgcyzviuspajvzavqea.exe" ahoower.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qdqwkyrfkoetw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\atmysmlfqawrahrtsle.exe" oqersrtnyao.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pxfgpymv = "gxoyqifxgoibinvvs.exe ." ahoower.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ahoower = "gxoyqifxgoibinvvs.exe" ahoower.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qdqwkyrfkoetw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zpfofwsjryrjptaz.exe" ahoower.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qdqwkyrfkoetw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gxoyqifxgoibinvvs.exe" ahoower.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ufqugsjvyao = "gxoyqifxgoibinvvs.exe ." ahoower.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\pxfgpymv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\atmysmlfqawrahrtsle.exe ." ahoower.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\pxfgpymv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nhbojeezlwtpzhsvvpjw.exe ." ahoower.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ahoower = "nhbojeezlwtpzhsvvpjw.exe" ahoower.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zjtwhsitvw = "phzkdwunxgbvdjstrj.exe" ahoower.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pxfgpymv = "gxoyqifxgoibinvvs.exe ." oqersrtnyao.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rdpuhumzdgvj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nhbojeezlwtpzhsvvpjw.exe ." oqersrtnyao.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ahoower = "phzkdwunxgbvdjstrj.exe" ahoower.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zjtwhsitvw = "atmysmlfqawrahrtsle.exe" ahoower.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zjtwhsitvw = "zpfofwsjryrjptaz.exe" ahoower.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ufqugsjvyao = "cxsgcyzviuspajvzavqea.exe ." ahoower.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ahoower = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zpfofwsjryrjptaz.exe" ahoower.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\pxfgpymv = "phzkdwunxgbvdjstrj.exe ." ahoower.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ufqugsjvyao = "gxoyqifxgoibinvvs.exe ." oqersrtnyao.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ufqugsjvyao = "atmysmlfqawrahrtsle.exe ." ahoower.exe Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zjtwhsitvw = "gxoyqifxgoibinvvs.exe" oqersrtnyao.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qdqwkyrfkoetw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cxsgcyzviuspajvzavqea.exe" ahoower.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rdpuhumzdgvj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\phzkdwunxgbvdjstrj.exe ." ahoower.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ahoower.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ahoower.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ahoower.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" oqersrtnyao.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA oqersrtnyao.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ahoower.exe -
Hijack Execution Flow: Executable Installer File Permissions Weakness 1 TTPs 3 IoCs
Possible Turn off User Account Control's privilege elevation for standard users.
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" ahoower.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" oqersrtnyao.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" ahoower.exe -
Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 32 whatismyipaddress.com 36 www.whatismyip.ca 43 www.whatismyip.ca 46 www.whatismyip.ca 23 www.showmyipaddress.com -
Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification F:\autorun.inf ahoower.exe File created F:\autorun.inf ahoower.exe File opened for modification C:\autorun.inf ahoower.exe File created C:\autorun.inf ahoower.exe -
Drops file in System32 directory 25 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\tplaxuwthutrdnafhdzoli.exe ahoower.exe File opened for modification C:\Windows\SysWOW64\tplaxuwthutrdnafhdzoli.exe ahoower.exe File opened for modification C:\Windows\SysWOW64\dddwxyefxortjxoxdddwxy.fxo ahoower.exe File opened for modification C:\Windows\SysWOW64\phzkdwunxgbvdjstrj.exe oqersrtnyao.exe File opened for modification C:\Windows\SysWOW64\atmysmlfqawrahrtsle.exe oqersrtnyao.exe File opened for modification C:\Windows\SysWOW64\phzkdwunxgbvdjstrj.exe ahoower.exe File opened for modification C:\Windows\SysWOW64\cxsgcyzviuspajvzavqea.exe ahoower.exe File opened for modification C:\Windows\SysWOW64\cxsgcyzviuspajvzavqea.exe ahoower.exe File opened for modification C:\Windows\SysWOW64\nhbojeezlwtpzhsvvpjw.exe oqersrtnyao.exe File opened for modification C:\Windows\SysWOW64\tplaxuwthutrdnafhdzoli.exe oqersrtnyao.exe File opened for modification C:\Windows\SysWOW64\gxoyqifxgoibinvvs.exe ahoower.exe File opened for modification C:\Windows\SysWOW64\atmysmlfqawrahrtsle.exe ahoower.exe File opened for modification C:\Windows\SysWOW64\zpfofwsjryrjptaz.exe ahoower.exe File opened for modification C:\Windows\SysWOW64\gxoyqifxgoibinvvs.exe ahoower.exe File opened for modification C:\Windows\SysWOW64\phzkdwunxgbvdjstrj.exe ahoower.exe File opened for modification C:\Windows\SysWOW64\nhbojeezlwtpzhsvvpjw.exe ahoower.exe File opened for modification C:\Windows\SysWOW64\gxoyqifxgoibinvvs.exe oqersrtnyao.exe File opened for modification C:\Windows\SysWOW64\cxsgcyzviuspajvzavqea.exe oqersrtnyao.exe File opened for modification C:\Windows\SysWOW64\zpfofwsjryrjptaz.exe ahoower.exe File opened for modification C:\Windows\SysWOW64\atmysmlfqawrahrtsle.exe ahoower.exe File created C:\Windows\SysWOW64\dddwxyefxortjxoxdddwxy.fxo ahoower.exe File created C:\Windows\SysWOW64\ufqugsjvyaobcbdxozkoamdpsuivwvxri.eiu ahoower.exe File opened for modification C:\Windows\SysWOW64\zpfofwsjryrjptaz.exe oqersrtnyao.exe File opened for modification C:\Windows\SysWOW64\nhbojeezlwtpzhsvvpjw.exe ahoower.exe File opened for modification C:\Windows\SysWOW64\ufqugsjvyaobcbdxozkoamdpsuivwvxri.eiu ahoower.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files (x86)\ufqugsjvyaobcbdxozkoamdpsuivwvxri.eiu ahoower.exe File opened for modification C:\Program Files (x86)\dddwxyefxortjxoxdddwxy.fxo ahoower.exe File created C:\Program Files (x86)\dddwxyefxortjxoxdddwxy.fxo ahoower.exe File opened for modification C:\Program Files (x86)\ufqugsjvyaobcbdxozkoamdpsuivwvxri.eiu ahoower.exe -
Drops file in Windows directory 25 IoCs
description ioc Process File opened for modification C:\Windows\cxsgcyzviuspajvzavqea.exe ahoower.exe File opened for modification C:\Windows\atmysmlfqawrahrtsle.exe ahoower.exe File opened for modification C:\Windows\dddwxyefxortjxoxdddwxy.fxo ahoower.exe File opened for modification C:\Windows\ufqugsjvyaobcbdxozkoamdpsuivwvxri.eiu ahoower.exe File opened for modification C:\Windows\nhbojeezlwtpzhsvvpjw.exe oqersrtnyao.exe File opened for modification C:\Windows\cxsgcyzviuspajvzavqea.exe oqersrtnyao.exe File opened for modification C:\Windows\tplaxuwthutrdnafhdzoli.exe oqersrtnyao.exe File opened for modification C:\Windows\phzkdwunxgbvdjstrj.exe ahoower.exe File opened for modification C:\Windows\nhbojeezlwtpzhsvvpjw.exe ahoower.exe File opened for modification C:\Windows\nhbojeezlwtpzhsvvpjw.exe ahoower.exe File opened for modification C:\Windows\cxsgcyzviuspajvzavqea.exe ahoower.exe File opened for modification C:\Windows\zpfofwsjryrjptaz.exe oqersrtnyao.exe File opened for modification C:\Windows\gxoyqifxgoibinvvs.exe oqersrtnyao.exe File opened for modification C:\Windows\phzkdwunxgbvdjstrj.exe oqersrtnyao.exe File opened for modification C:\Windows\atmysmlfqawrahrtsle.exe oqersrtnyao.exe File opened for modification C:\Windows\zpfofwsjryrjptaz.exe ahoower.exe File opened for modification C:\Windows\gxoyqifxgoibinvvs.exe ahoower.exe File opened for modification C:\Windows\atmysmlfqawrahrtsle.exe ahoower.exe File created C:\Windows\dddwxyefxortjxoxdddwxy.fxo ahoower.exe File opened for modification C:\Windows\tplaxuwthutrdnafhdzoli.exe ahoower.exe File opened for modification C:\Windows\zpfofwsjryrjptaz.exe ahoower.exe File opened for modification C:\Windows\gxoyqifxgoibinvvs.exe ahoower.exe File opened for modification C:\Windows\phzkdwunxgbvdjstrj.exe ahoower.exe File opened for modification C:\Windows\tplaxuwthutrdnafhdzoli.exe ahoower.exe File created C:\Windows\ufqugsjvyaobcbdxozkoamdpsuivwvxri.eiu ahoower.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language oqersrtnyao.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ahoower.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1840 5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe 1840 5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe 1840 5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe 1840 5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe 1840 5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe 1840 5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe 1840 5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe 1840 5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe 1840 5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe 1840 5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe 1840 5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe 1840 5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe 1840 5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe 1840 5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe 2472 ahoower.exe 2472 ahoower.exe 1840 5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe 1840 5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe 1840 5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe 1840 5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe 1840 5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe 1840 5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe 1840 5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe 1840 5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe 1840 5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe 1840 5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe 1840 5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe 1840 5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe 1840 5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe 1840 5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe 1840 5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe 1840 5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe 1840 5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe 1840 5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe 1840 5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe 1840 5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe 1840 5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe 1840 5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe 1840 5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe 1840 5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe 1840 5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe 1840 5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe 1840 5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe 1840 5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe 2472 ahoower.exe 2472 ahoower.exe 1840 5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe 1840 5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe 1840 5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe 1840 5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe 1840 5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe 1840 5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe 1840 5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe 1840 5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe 1840 5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe 1840 5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe 1840 5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe 1840 5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe 1840 5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe 1840 5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe 1840 5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe 1840 5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe 1840 5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe 1840 5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2472 ahoower.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1840 wrote to memory of 3244 1840 5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe 87 PID 1840 wrote to memory of 3244 1840 5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe 87 PID 1840 wrote to memory of 3244 1840 5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe 87 PID 3244 wrote to memory of 2472 3244 oqersrtnyao.exe 92 PID 3244 wrote to memory of 2472 3244 oqersrtnyao.exe 92 PID 3244 wrote to memory of 2472 3244 oqersrtnyao.exe 92 PID 3244 wrote to memory of 2608 3244 oqersrtnyao.exe 93 PID 3244 wrote to memory of 2608 3244 oqersrtnyao.exe 93 PID 3244 wrote to memory of 2608 3244 oqersrtnyao.exe 93 -
System policy modification 1 TTPs 36 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" ahoower.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" oqersrtnyao.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" ahoower.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" ahoower.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer ahoower.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" oqersrtnyao.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" oqersrtnyao.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" oqersrtnyao.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" oqersrtnyao.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System ahoower.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ahoower.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer oqersrtnyao.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" ahoower.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" oqersrtnyao.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" oqersrtnyao.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" ahoower.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System ahoower.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" ahoower.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" ahoower.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" ahoower.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" ahoower.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" oqersrtnyao.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" ahoower.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" ahoower.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" ahoower.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" ahoower.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer ahoower.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" oqersrtnyao.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" oqersrtnyao.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" ahoower.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" ahoower.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" ahoower.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System oqersrtnyao.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" ahoower.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" ahoower.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" ahoower.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe"C:\Users\Admin\AppData\Local\Temp\5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdN.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\oqersrtnyao.exe"C:\Users\Admin\AppData\Local\Temp\oqersrtnyao.exe" "c:\users\admin\appdata\local\temp\5af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fdn.exe*"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\ahoower.exe"C:\Users\Admin\AppData\Local\Temp\ahoower.exe" "-C:\Users\Admin\AppData\Local\Temp\zpfofwsjryrjptaz.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2472
-
-
C:\Users\Admin\AppData\Local\Temp\ahoower.exe"C:\Users\Admin\AppData\Local\Temp\ahoower.exe" "-C:\Users\Admin\AppData\Local\Temp\zpfofwsjryrjptaz.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- Drops file in System32 directory
- Drops file in Windows directory
- System policy modification
PID:2608
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Impair Defenses
2Disable or Modify Tools
1Safe Mode Boot
1Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
280B
MD53cba3380817da951da12aecd276f77b3
SHA18ec199379859c54d17252ebebac5aca9303fde6e
SHA25670c714ce334caaa9053d7bbc3e431350cdc3e82df4b95f5146a63a38a544b161
SHA5122f808b6676a94eafbd1234d29cac7d782a83360c0c376b35a9f63c9a72ec86a02ae56aa09e6a4b7a4f312512642d90d1838f4a776085eab13be9507b391d8f2c
-
Filesize
280B
MD5488ec01580ce2d04312e3e1c8923e951
SHA1ee90f5ed0d639439a1b4901439695689b00b609e
SHA25628402f02c4795cd927e0292294f92f1c9c0789b221f79dfff3be2268a0476b73
SHA5128e2af5b21b13f04a6cd762d6f76100440c880fb3b0719b701a0950e884a32559975810d7829b75b1732d407c28b46d889ecabe2e3a8a0fb08df16230f732f0ee
-
Filesize
280B
MD5468415442f1e0ff134a4a981033a254b
SHA1e67d788aad54099a0677edb42a698562573f7f74
SHA256e3de0755a8318921d4677d3b862e931052409f1437f5fbdfa7f31f60ed8d9663
SHA512c3f5c45edbb22891cefd1403de6afe070bc7129aef665a6447474cdba557377af034ee0527b0acc708c76a97b80b430df4c2b54604227a4906556cf77128528a
-
Filesize
280B
MD56defd78024d6fe2fde4e21d318c3f7c2
SHA16add3a9b93e00e355b1c14269cf04492adb194f6
SHA2568252314c2e0519fa4c200e102ff3671ea38b861b36c90c9e60eba5631a1780ee
SHA512cb6f86dc8e82b83097fcbc1d4183b5d22c02e7a8bac627b1e16c84a866ee91e3c07c2436e07e4439f527b8081e3257d157d428d104b19d57fdf54e5cfe637b67
-
Filesize
280B
MD5d2d5cffbf2f6e07ba43e017f6612a26f
SHA166e8e6976db61e6272f2613f43636445a5c21372
SHA2563c2b21fb060b7d6b176a693fe7632781860fa7a94ba89fa2c67987c24532a03a
SHA512384586c264b2b113d819f85ba4548d745dbe5aa822691c8931901fbe1bd069c7f107238d224852521aa0394a1c7c3a4c1a50b36c3088c9f9829a76bf8fd9007e
-
Filesize
696KB
MD55148bce28fd1bc7f6b23e61d45efbef2
SHA1523a00e12c40d52bff59f041cff96d202c6f0a47
SHA2561b1b4f59201354f38807cb1b1a4356818d15039c575e6de3b67c4b2e45946e6c
SHA512ab88175cbc36cd9eac46ce418e328bdab3c1124e416e678547d5621256945d015195cee0f0a0b10f4c42d1afb1215635001d0a498b31475162dd80bcc269b05f
-
Filesize
320KB
MD5e97bdffa3003bce29426e78ff0a9b89e
SHA14680bca864946d45d9c1ef9d195011bba8704380
SHA256856b0722fb88c9f9d25149acd22c499146077225b0177be47e7137810b39b6e1
SHA5126895ca6df7292f0b66d48f125570d7192ebc152a65749851c3fc68ddb0bf95a4ae025f43af7dd65d177856132c70cd70c846920a649a6055579acbfb1fa3c320
-
Filesize
280B
MD507a51e18b6a73fbaa71fc2f540875e1b
SHA10297a65ea93d774209e0751eecdd15a594442ce6
SHA2561474afd9f1b50b2ba266efcf92442fcbb4124de88c4e4d0851cf31e518b627ce
SHA512bf304565b0bf3211a134f8a59818eb7a90153cb7a2dcaaf1ff2bb0fa2d770b77cd0d3a3caeb590ecbb4a5e18efb92d75518c2d325629f1ab2f3af1756eb722c1
-
Filesize
4KB
MD5406ce504fdfa8eadaecb54f2506e2b32
SHA1113eacdee034471b67360bdb096718c33f10642d
SHA2567856ae62ab9bcbab8cc3b0192e6ce22e70d16b6baae24fc6ffa3e58b5b3b46fd
SHA512ec227775f25df57a8e44107c51d2a7979b958de833d4cd74590e04931635d8920ef97dcdb55bc64ab785db566d543276a35f9176f2888acf0fd37bbf1f20e4ee
-
Filesize
280B
MD5aabdb47094f2024cb1ea2d4c301cdbf1
SHA141cb7277daaa26d85aafc4f96595b266028487c6
SHA256540e2943357b8fab9d928a821784774a54c28212a6c636dcf868dc77685d9c5d
SHA512476cbba0759c3cd10aa5e5020fcc2df09313671874939ba29871fa4f9d42c5d4b99e8f1b447a2cfd58c175f42151a41240668be4d677d8b0053d4728fc28e095
-
Filesize
608KB
MD5db1b7ac55a245032f066060d23d00630
SHA18b968e1eee41e0f4b2f030e672a609e65a7f7618
SHA2565af9b60910a74aec64dc3c1e407411e7aff0f57bd8fed6fd3143606dea2d43fd
SHA512b78051b0d851c883afe6005c16e442ce48cd137aec83a8e3a4d24f11187d41706c42bc63483834d1bb51e2fb950ac253f385714f9cf8b466f4b61c915dea72eb
-
Filesize
648KB
MD5718ee4e1ab9b11ab9741db91eaf0f945
SHA1ce8bd9ee7d7f8531f5b54d5353b6e5e8a7618638
SHA256dd92fcc55737c783d17ead98c56d1f40ad16acba3fac147f5ba0ed12a2613140
SHA512dd78cedc694fa1fda5a6a998ca0c96bdbdfb0466ed95034a5706178850f39191705b925bd74733cacf2819697aeb3299e0b86896147c6d838f599b20fb0ef89b