Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
31/10/2024, 04:57
Static task
static1
Behavioral task
behavioral1
Sample
962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe
Resource
win10v2004-20241007-en
General
-
Target
962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe
-
Size
692KB
-
MD5
9f204136a8f8ecb9d4bd46eb5a531db0
-
SHA1
26b06fe7d8b65065090fc529fc80795a32a59a15
-
SHA256
962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437
-
SHA512
3159250cda528bed0f7ce897116c8726bedff840d4ce321459245ac049a5bb0ac1703070048096a2d087af8c0018639785817331ee8989544301353ac11bd9a6
-
SSDEEP
12288:rXgvmzFHi0mo5aH0qMzd5807FJTPJQPDHvd:rXgvOHi0mGaH0qSdPFJ14V
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" bhhrejn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" bhhrejn.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" bhhrejn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" bhhrejn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" bhhrejn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" bhhrejn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" bhhrejn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" bhhrejn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" bhhrejn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" bhhrejn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe -
Adds policy Run key to start application 2 TTPs 25 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ajmzpxeozg = "btfbarhaukcwrpsinbf.exe" 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run bhhrejn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run bhhrejn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ajmzpxeozg = "hxhbynbskyogzvwkn.exe" bhhrejn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bhhrejn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\apyrnboevixogbbo.exe" bhhrejn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bhhrejn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\apyrnboevixogbbo.exe" bhhrejn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bhhrejn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\apyrnboevixogbbo.exe" 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ajmzpxeozg = "apyrnboevixogbbo.exe" bhhrejn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ajmzpxeozg = "btfbarhaukcwrpsinbf.exe" bhhrejn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bhhrejn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ohurrjaupgzuqptkqfkd.exe" bhhrejn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ajmzpxeozg = "ohurrjaupgzuqptkqfkd.exe" bhhrejn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bhhrejn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ohurrjaupgzuqptkqfkd.exe" bhhrejn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ajmzpxeozg = "hxhbynbskyogzvwkn.exe" bhhrejn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bhhrejn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\btfbarhaukcwrpsinbf.exe" bhhrejn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ajmzpxeozg = "qhsnlbqibqhaurtimz.exe" bhhrejn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bhhrejn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dxljkdvqmeyurrwovlrlz.exe" bhhrejn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ajmzpxeozg = "ohurrjaupgzuqptkqfkd.exe" bhhrejn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bhhrejn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dxljkdvqmeyurrwovlrlz.exe" bhhrejn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bhhrejn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\btfbarhaukcwrpsinbf.exe" bhhrejn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ajmzpxeozg = "dxljkdvqmeyurrwovlrlz.exe" bhhrejn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bhhrejn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hxhbynbskyogzvwkn.exe" bhhrejn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ajmzpxeozg = "btfbarhaukcwrpsinbf.exe" bhhrejn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\bhhrejn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qhsnlbqibqhaurtimz.exe" bhhrejn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ajmzpxeozg = "apyrnboevixogbbo.exe" bhhrejn.exe -
Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" bhhrejn.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" bhhrejn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" bhhrejn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" bhhrejn.exe Set value (int) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe -
Executes dropped EXE 2 IoCs
pid Process 3996 bhhrejn.exe 1408 bhhrejn.exe -
Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UserManager bhhrejn.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SerCx2.sys bhhrejn.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc bhhrejn.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power bhhrejn.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iai2c.sys bhhrejn.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CBDHSvc bhhrejn.exe -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\hprdszfoy = "dxljkdvqmeyurrwovlrlz.exe ." 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\hprdszfoy = "qhsnlbqibqhaurtimz.exe ." bhhrejn.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qxyjxdiq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ohurrjaupgzuqptkqfkd.exe" bhhrejn.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\hprdszfoy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hxhbynbskyogzvwkn.exe ." bhhrejn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\hprdszfoy = "qhsnlbqibqhaurtimz.exe ." bhhrejn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\hprdszfoy = "hxhbynbskyogzvwkn.exe ." bhhrejn.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\sdixpziuhqbo = "btfbarhaukcwrpsinbf.exe ." bhhrejn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sfmdxjuixivkat = "C:\\Users\\Admin\\AppData\\Local\\Temp\\btfbarhaukcwrpsinbf.exe" 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vfjxoxfqcku = "qhsnlbqibqhaurtimz.exe" bhhrejn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sfmdxjuixivkat = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hxhbynbskyogzvwkn.exe" bhhrejn.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\sdixpziuhqbo = "hxhbynbskyogzvwkn.exe ." 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sfmdxjuixivkat = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ohurrjaupgzuqptkqfkd.exe" bhhrejn.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vfjxoxfqcku = "ohurrjaupgzuqptkqfkd.exe" bhhrejn.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\hprdszfoy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qhsnlbqibqhaurtimz.exe ." bhhrejn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qxyjxdiq = "hxhbynbskyogzvwkn.exe" bhhrejn.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\sdixpziuhqbo = "qhsnlbqibqhaurtimz.exe ." bhhrejn.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\hprdszfoy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\btfbarhaukcwrpsinbf.exe ." bhhrejn.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vfjxoxfqcku = "qhsnlbqibqhaurtimz.exe" 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\hprdszfoy = "apyrnboevixogbbo.exe ." bhhrejn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sfmdxjuixivkat = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hxhbynbskyogzvwkn.exe" bhhrejn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rdjzsdnaoykyn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qhsnlbqibqhaurtimz.exe ." bhhrejn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sfmdxjuixivkat = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ohurrjaupgzuqptkqfkd.exe" bhhrejn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sfmdxjuixivkat = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qhsnlbqibqhaurtimz.exe" bhhrejn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rdjzsdnaoykyn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\apyrnboevixogbbo.exe ." bhhrejn.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vfjxoxfqcku = "btfbarhaukcwrpsinbf.exe" bhhrejn.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\hprdszfoy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\apyrnboevixogbbo.exe ." bhhrejn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\hprdszfoy = "apyrnboevixogbbo.exe ." bhhrejn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qxyjxdiq = "apyrnboevixogbbo.exe" bhhrejn.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vfjxoxfqcku = "apyrnboevixogbbo.exe" bhhrejn.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\hprdszfoy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dxljkdvqmeyurrwovlrlz.exe ." bhhrejn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sfmdxjuixivkat = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dxljkdvqmeyurrwovlrlz.exe" bhhrejn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rdjzsdnaoykyn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hxhbynbskyogzvwkn.exe ." bhhrejn.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vfjxoxfqcku = "hxhbynbskyogzvwkn.exe" 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sfmdxjuixivkat = "C:\\Users\\Admin\\AppData\\Local\\Temp\\apyrnboevixogbbo.exe" bhhrejn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rdjzsdnaoykyn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ohurrjaupgzuqptkqfkd.exe ." bhhrejn.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qxyjxdiq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\btfbarhaukcwrpsinbf.exe" bhhrejn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qxyjxdiq = "apyrnboevixogbbo.exe" bhhrejn.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\sdixpziuhqbo = "btfbarhaukcwrpsinbf.exe ." bhhrejn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\hprdszfoy = "ohurrjaupgzuqptkqfkd.exe ." bhhrejn.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qxyjxdiq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\apyrnboevixogbbo.exe" bhhrejn.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\sdixpziuhqbo = "apyrnboevixogbbo.exe ." bhhrejn.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qxyjxdiq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dxljkdvqmeyurrwovlrlz.exe" bhhrejn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\hprdszfoy = "apyrnboevixogbbo.exe ." 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\sdixpziuhqbo = "hxhbynbskyogzvwkn.exe ." bhhrejn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sfmdxjuixivkat = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qhsnlbqibqhaurtimz.exe" bhhrejn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\hprdszfoy = "dxljkdvqmeyurrwovlrlz.exe ." bhhrejn.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qxyjxdiq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dxljkdvqmeyurrwovlrlz.exe" bhhrejn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rdjzsdnaoykyn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hxhbynbskyogzvwkn.exe ." bhhrejn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\hprdszfoy = "btfbarhaukcwrpsinbf.exe ." bhhrejn.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\hprdszfoy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dxljkdvqmeyurrwovlrlz.exe ." bhhrejn.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\sdixpziuhqbo = "dxljkdvqmeyurrwovlrlz.exe ." 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rdjzsdnaoykyn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ohurrjaupgzuqptkqfkd.exe ." 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\sdixpziuhqbo = "qhsnlbqibqhaurtimz.exe ." bhhrejn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qxyjxdiq = "ohurrjaupgzuqptkqfkd.exe" bhhrejn.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vfjxoxfqcku = "btfbarhaukcwrpsinbf.exe" bhhrejn.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\sdixpziuhqbo = "hxhbynbskyogzvwkn.exe ." bhhrejn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sfmdxjuixivkat = "C:\\Users\\Admin\\AppData\\Local\\Temp\\apyrnboevixogbbo.exe" bhhrejn.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vfjxoxfqcku = "qhsnlbqibqhaurtimz.exe" bhhrejn.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qxyjxdiq = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hxhbynbskyogzvwkn.exe" bhhrejn.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\hprdszfoy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ohurrjaupgzuqptkqfkd.exe ." bhhrejn.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vfjxoxfqcku = "apyrnboevixogbbo.exe" bhhrejn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\hprdszfoy = "dxljkdvqmeyurrwovlrlz.exe ." bhhrejn.exe Set value (str) \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\sdixpziuhqbo = "dxljkdvqmeyurrwovlrlz.exe ." bhhrejn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\hprdszfoy = "ohurrjaupgzuqptkqfkd.exe ." bhhrejn.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" bhhrejn.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA bhhrejn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" bhhrejn.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA bhhrejn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe -
Hijack Execution Flow: Executable Installer File Permissions Weakness 1 TTPs 3 IoCs
Possible Turn off User Account Control's privilege elevation for standard users.
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" bhhrejn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" bhhrejn.exe -
Looks up external IP address via web service 6 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 28 whatismyipaddress.com 34 www.whatismyip.ca 38 www.showmyipaddress.com 45 whatismyip.everdot.org 22 whatismyip.everdot.org 26 www.whatismyip.ca -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\ajmzpxeozgpambvcydyhkxnvcmxenykz.awb bhhrejn.exe File created C:\Windows\SysWOW64\ajmzpxeozgpambvcydyhkxnvcmxenykz.awb bhhrejn.exe File opened for modification C:\Windows\SysWOW64\fdvxczvuuqooptcyjdnld.khd bhhrejn.exe File created C:\Windows\SysWOW64\fdvxczvuuqooptcyjdnld.khd bhhrejn.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\fdvxczvuuqooptcyjdnld.khd bhhrejn.exe File created C:\Program Files (x86)\fdvxczvuuqooptcyjdnld.khd bhhrejn.exe File opened for modification C:\Program Files (x86)\ajmzpxeozgpambvcydyhkxnvcmxenykz.awb bhhrejn.exe File created C:\Program Files (x86)\ajmzpxeozgpambvcydyhkxnvcmxenykz.awb bhhrejn.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\fdvxczvuuqooptcyjdnld.khd bhhrejn.exe File created C:\Windows\fdvxczvuuqooptcyjdnld.khd bhhrejn.exe File opened for modification C:\Windows\ajmzpxeozgpambvcydyhkxnvcmxenykz.awb bhhrejn.exe File created C:\Windows\ajmzpxeozgpambvcydyhkxnvcmxenykz.awb bhhrejn.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhrejn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bhhrejn.exe -
Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings bhhrejn.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe Key created \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings bhhrejn.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 3996 bhhrejn.exe 3996 bhhrejn.exe 3996 bhhrejn.exe 3996 bhhrejn.exe 3996 bhhrejn.exe 3996 bhhrejn.exe 3996 bhhrejn.exe 3996 bhhrejn.exe 3996 bhhrejn.exe 3996 bhhrejn.exe 3996 bhhrejn.exe 3996 bhhrejn.exe 3996 bhhrejn.exe 3996 bhhrejn.exe 3996 bhhrejn.exe 3996 bhhrejn.exe 3996 bhhrejn.exe 3996 bhhrejn.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1408 bhhrejn.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3996 bhhrejn.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1676 wrote to memory of 3996 1676 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe 88 PID 1676 wrote to memory of 3996 1676 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe 88 PID 1676 wrote to memory of 3996 1676 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe 88 PID 1676 wrote to memory of 1408 1676 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe 89 PID 1676 wrote to memory of 1408 1676 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe 89 PID 1676 wrote to memory of 1408 1676 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe 89 -
System policy modification 1 TTPs 36 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" bhhrejn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" bhhrejn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" bhhrejn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" bhhrejn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" bhhrejn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" bhhrejn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" bhhrejn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" bhhrejn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" bhhrejn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" bhhrejn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" bhhrejn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System bhhrejn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System bhhrejn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" bhhrejn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" bhhrejn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" bhhrejn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer bhhrejn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" bhhrejn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" bhhrejn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer bhhrejn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" bhhrejn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" bhhrejn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" bhhrejn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" bhhrejn.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe"C:\Users\Admin\AppData\Local\Temp\962abe742b881b2b370f810a1d8955ae72ffd3410f53555cbfe68ed9644c2437N.exe"1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\bhhrejn.exe"C:\Users\Admin\AppData\Local\Temp\bhhrejn.exe" "-"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:3996
-
-
C:\Users\Admin\AppData\Local\Temp\bhhrejn.exe"C:\Users\Admin\AppData\Local\Temp\bhhrejn.exe" "-"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- System policy modification
PID:1408
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1960
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Impair Defenses
2Disable or Modify Tools
1Safe Mode Boot
1Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
280B
MD57e835d81dbb79b602ba8fe3b43471997
SHA18e9f529a62a1cf04283aacca0ec1384e1300c290
SHA25639a104e8b02c7eb35c15e6443138dae09b210ab43c49274f452d08e03d3df2d3
SHA512181e41124e53852e6842994fd6f63e1edee8220592beb01aefbbfc93a5147d99bd4a0ab2a8e15ae8ba50b7435b2c971580d70b43bd4c5a5e0be86b26fff317bd
-
Filesize
280B
MD5b728f74676dfc87628f6f9599010dac2
SHA14e296ba99521ce2776cc9924374056a22a866667
SHA256939298081be30fcb9aac7ccbf306dbe884fd3652475e511b12d36eb538eed11a
SHA512b3f5b078b3ab2be404edd8302fd5b2a560f0593cfafb60099123a399759f22f68aaefb59d9befb70c3ce0808accb7ec3e60e352b73b0b9ebf77dcbe757d5e4ab
-
Filesize
280B
MD58918ce30c8bf8f6255e5410daa42c135
SHA1da3e1f86abd31a71c3e6f9cb5ad12749c7922190
SHA256ff6d1a6645fa3e3b25aee3299ee81766cd053b42fa1e67a450cd17cbb2b21b1c
SHA5128cb4257bf4c7a76b0392cb37380200f4ccfd6b3db8fd840534bf8b33d887d3be8eee451cac8a9efbda28556ed7e194ae1a78c908babefbc2e211b8d458c7b3f1
-
Filesize
280B
MD5df5aa2624534cd11411c127bbe7eeb84
SHA188e049c829f58ebf5ca9639f23b4634a24be7952
SHA2562578a5bf688dc8ee78eebc26ae73138a524295040999b3f1501034d6598becc7
SHA512bf82ee46c03a35fed0d752188ae780945ee02d139b03a0833e306b382bf311ccb24a8301e31cafc63823120771d779e484bbbaf34afa32934b18082b17d1a560
-
Filesize
280B
MD5cef31abac405a5242d482de0585fd3e8
SHA1989751aed20af6ddd93a7c75e2e1ddb6dee87c66
SHA256186d3aff0d3fee32679cf6641d42c1f6ea61065592d1bfa1c52081093aa7ec53
SHA5124e9856cb46d777d93c55b849e5e6caa31dd4f409d896e5dc39ec16028b2a00447a460d24b557c0fc5a5e79a00138c67d310181ddfc08b880059e0426b4decc3e
-
Filesize
280B
MD5def9682b0acdaf1006737dec10c6b131
SHA1d59b43fa1e42cb64ba26b7b2e86228c3f1f2db14
SHA2561031071db80371e628841bbd8e137748bced0dd752067af6915a1bd57934bf3d
SHA512a62d5af33e48a5cf99df7893abddc7e90857bac3013325125a44c4202cd3ac207e52aa3ec5e5b642b4b79eca2a6a236e397b05d59afe40a8a0f5ca113d159c36
-
Filesize
1.2MB
MD592fed7521129bd635097c0790c2dee8a
SHA18548b39b7f34783d260cab61401413992cd0ae95
SHA256721eac4c690533ed896b3ec2c6251b59f07b10d10c8648d1681fcc94384b7a1a
SHA51264ff8ea5f00e24261214092dc3817cc6df5e1ea7dc2d75f785b5b19c280b6f26fd4f7643ce164514d5b3b505839f43f03a0e259049a0b43e0a619949af45ccca
-
Filesize
4KB
MD5229dd9c5581596dc76c4c61ffe7e6f44
SHA10eb307d98d0a83665709c3621eb92ae7de99220a
SHA256b51c192bac5849ddeec85f0bc9f65a692ba4332b5911cfcabaa8a1dc38ab4d04
SHA51238b4ce99a7b6f2661dd94e490a0e932d0862667d089a2adfe43abccc7c34af77affa71038afbb62bfd8e6acd63de3377a34483ae996159c8a302e10090dbcb3a
-
Filesize
280B
MD5ab8654b07f180f4dab536cee4622f81b
SHA1a93691167a1a8b0c601e798b8210193e5dac96ba
SHA256eda4080fa975f15201efba273bd58b690736dfb03aa0318a7862ff4b596fa902
SHA5122cc4cafba25e1dc44370417229daf861d4a9ab92204e326abc1bc999bc968e65609d264348b3949ceb2aa265d91d30603563956ae30fdfabefb11a816d47c3f6