Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
13-11-2024 01:03
Static task
static1
Behavioral task
behavioral1
Sample
c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe
Resource
win10v2004-20241007-en
General
-
Target
c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe
-
Size
9.4MB
-
MD5
c783a3b20315ef5554b629946af2e450
-
SHA1
d48a797b6186b0bda4bf4ba4b4981b8ebea17e07
-
SHA256
c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77f
-
SHA512
332d04fa682e7b12d3d2df697fa9e2209ff0dffa99535d2860c87cb38d4c6598a16ab75bdba31fbc07b8b2b160145bbc2fb75327264c25b6074e66bcc301fbb0
-
SSDEEP
6144:tSK/ymZ3ctTWQHf5ctj8jRi2WGKMSVT86JQPDHDdx/Qtqp:ue0TlHf55RShPJQPDHvd
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
Processes:
c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exenryzjt.exenryzjt.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" nryzjt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" nryzjt.exe -
Processes:
nryzjt.exec49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exenryzjt.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" nryzjt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" nryzjt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" nryzjt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" nryzjt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" nryzjt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" nryzjt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" nryzjt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" nryzjt.exe -
Adds policy Run key to start application 2 TTPs 29 IoCs
Processes:
nryzjt.exenryzjt.exec49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mnr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\znepjdnavjoduygg.exe" nryzjt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mnr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pfylhdpebrypioyapo.exe" nryzjt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mnr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cvrhgfummfpjfobgyaqjf.exe" nryzjt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mnr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gvnzupaokzfvnsbcq.exe" nryzjt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run nryzjt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mnr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\znepjdnavjoduygg.exe" nryzjt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mnr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gvnzupaokzfvnsbcq.exe" nryzjt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nryzjt = "gvnzupaokzfvnsbcq.exe" nryzjt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nryzjt = "znepjdnavjoduygg.exe" c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nryzjt = "pfylhdpebrypioyapo.exe" nryzjt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nryzjt = "nfapnlzqphqjemyctujb.exe" nryzjt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nryzjt = "cvrhgfummfpjfobgyaqjf.exe" nryzjt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nryzjt = "arlzwtgwultlfmxaqqe.exe" nryzjt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nryzjt = "arlzwtgwultlfmxaqqe.exe" nryzjt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mnr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pfylhdpebrypioyapo.exe" nryzjt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nryzjt = "znepjdnavjoduygg.exe" nryzjt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mnr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\arlzwtgwultlfmxaqqe.exe" nryzjt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mnr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nfapnlzqphqjemyctujb.exe" nryzjt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nryzjt = "cvrhgfummfpjfobgyaqjf.exe" nryzjt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mnr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cvrhgfummfpjfobgyaqjf.exe" nryzjt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run nryzjt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mnr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nfapnlzqphqjemyctujb.exe" c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nryzjt = "gvnzupaokzfvnsbcq.exe" nryzjt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nryzjt = "pfylhdpebrypioyapo.exe" nryzjt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nryzjt = "nfapnlzqphqjemyctujb.exe" c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mnr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cvrhgfummfpjfobgyaqjf.exe" c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mnr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nfapnlzqphqjemyctujb.exe" nryzjt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mnr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\arlzwtgwultlfmxaqqe.exe" nryzjt.exe -
Disables RegEdit via registry modification 6 IoCs
Processes:
c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exenryzjt.exenryzjt.exedescription ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" nryzjt.exe Set value (int) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" nryzjt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" nryzjt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" nryzjt.exe -
Executes dropped EXE 2 IoCs
Processes:
nryzjt.exenryzjt.exepid Process 1168 nryzjt.exe 2572 nryzjt.exe -
Impair Defenses: Safe Mode Boot 1 TTPs 3 IoCs
Processes:
nryzjt.exedescription ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\WinDefend nryzjt.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc nryzjt.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power nryzjt.exe -
Loads dropped DLL 4 IoCs
Processes:
c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exepid Process 1740 c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe 1740 c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe 1740 c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe 1740 c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe -
Adds Run key to start application 2 TTPs 64 IoCs
Processes:
nryzjt.exenryzjt.exec49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\zhsxlzdkzh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gvnzupaokzfvnsbcq.exe" nryzjt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\zhsxlzdkzh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gvnzupaokzfvnsbcq.exe" nryzjt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\tvaz = "pfylhdpebrypioyapo.exe" nryzjt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\afnpalm = "nfapnlzqphqjemyctujb.exe" nryzjt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\tvaz = "znepjdnavjoduygg.exe" nryzjt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\gnxbobeky = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cvrhgfummfpjfobgyaqjf.exe ." c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\afnpalm = "gvnzupaokzfvnsbcq.exe" nryzjt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\tvaz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cvrhgfummfpjfobgyaqjf.exe" nryzjt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\tvaz = "cvrhgfummfpjfobgyaqjf.exe" nryzjt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\cfllu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gvnzupaokzfvnsbcq.exe ." nryzjt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\gnxbobeky = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nfapnlzqphqjemyctujb.exe ." nryzjt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\cfllu = "gvnzupaokzfvnsbcq.exe ." c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\zhsxlzdkzh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pfylhdpebrypioyapo.exe" nryzjt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\cfllu = "pfylhdpebrypioyapo.exe ." nryzjt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\cfllu = "cvrhgfummfpjfobgyaqjf.exe ." nryzjt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\pvehtfhm = "cvrhgfummfpjfobgyaqjf.exe ." nryzjt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\tvaz = "nfapnlzqphqjemyctujb.exe" nryzjt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\gnxbobeky = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pfylhdpebrypioyapo.exe ." nryzjt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\cfllu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pfylhdpebrypioyapo.exe ." nryzjt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\pvehtfhm = "znepjdnavjoduygg.exe ." nryzjt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\gnxbobeky = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gvnzupaokzfvnsbcq.exe ." nryzjt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\tvaz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\arlzwtgwultlfmxaqqe.exe" c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\pvehtfhm = "pfylhdpebrypioyapo.exe ." nryzjt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\zhsxlzdkzh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cvrhgfummfpjfobgyaqjf.exe" nryzjt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\afnpalm = "nfapnlzqphqjemyctujb.exe" nryzjt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\cfllu = "znepjdnavjoduygg.exe ." nryzjt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\tvaz = "cvrhgfummfpjfobgyaqjf.exe" nryzjt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\cfllu = "nfapnlzqphqjemyctujb.exe ." nryzjt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\cfllu = "pfylhdpebrypioyapo.exe ." nryzjt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\tvaz = "pfylhdpebrypioyapo.exe" c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\tvaz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\znepjdnavjoduygg.exe" nryzjt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\gnxbobeky = "C:\\Users\\Admin\\AppData\\Local\\Temp\\znepjdnavjoduygg.exe ." nryzjt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\cfllu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\znepjdnavjoduygg.exe ." nryzjt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\cfllu = "znepjdnavjoduygg.exe ." nryzjt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\pvehtfhm = "pfylhdpebrypioyapo.exe ." c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\afnpalm = "pfylhdpebrypioyapo.exe" c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\zhsxlzdkzh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\znepjdnavjoduygg.exe" nryzjt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\pvehtfhm = "gvnzupaokzfvnsbcq.exe ." nryzjt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\gnxbobeky = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cvrhgfummfpjfobgyaqjf.exe ." nryzjt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\cfllu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\arlzwtgwultlfmxaqqe.exe ." nryzjt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\tvaz = "pfylhdpebrypioyapo.exe" nryzjt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\tvaz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nfapnlzqphqjemyctujb.exe" c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\cfllu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pfylhdpebrypioyapo.exe ." nryzjt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\cfllu = "gvnzupaokzfvnsbcq.exe ." nryzjt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\cfllu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nfapnlzqphqjemyctujb.exe ." nryzjt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\cfllu = "cvrhgfummfpjfobgyaqjf.exe ." nryzjt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\cfllu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cvrhgfummfpjfobgyaqjf.exe ." nryzjt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\tvaz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nfapnlzqphqjemyctujb.exe" nryzjt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\cfllu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\arlzwtgwultlfmxaqqe.exe ." c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\zhsxlzdkzh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cvrhgfummfpjfobgyaqjf.exe" c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\tvaz = "nfapnlzqphqjemyctujb.exe" nryzjt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\afnpalm = "pfylhdpebrypioyapo.exe" nryzjt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\tvaz = "gvnzupaokzfvnsbcq.exe" nryzjt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\afnpalm = "cvrhgfummfpjfobgyaqjf.exe" nryzjt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\cfllu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\znepjdnavjoduygg.exe ." nryzjt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\pvehtfhm = "nfapnlzqphqjemyctujb.exe ." nryzjt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\cfllu = "znepjdnavjoduygg.exe ." c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\cfllu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gvnzupaokzfvnsbcq.exe ." nryzjt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\gnxbobeky = "C:\\Users\\Admin\\AppData\\Local\\Temp\\arlzwtgwultlfmxaqqe.exe ." nryzjt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\cfllu = "gvnzupaokzfvnsbcq.exe ." nryzjt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\cfllu = "arlzwtgwultlfmxaqqe.exe ." nryzjt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\tvaz = "gvnzupaokzfvnsbcq.exe" nryzjt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\gnxbobeky = "C:\\Users\\Admin\\AppData\\Local\\Temp\\arlzwtgwultlfmxaqqe.exe ." nryzjt.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\pvehtfhm = "nfapnlzqphqjemyctujb.exe ." nryzjt.exe -
Processes:
nryzjt.exenryzjt.exec49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" nryzjt.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA nryzjt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" nryzjt.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA nryzjt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe -
Hijack Execution Flow: Executable Installer File Permissions Weakness 1 TTPs 3 IoCs
Possible Turn off User Account Control's privilege elevation for standard users.
Processes:
c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exenryzjt.exenryzjt.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" nryzjt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" nryzjt.exe -
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 3 whatismyipaddress.com 6 www.whatismyip.ca 10 whatismyip.everdot.org 12 www.showmyipaddress.com -
Drops file in System32 directory 4 IoCs
Processes:
nryzjt.exedescription ioc Process File opened for modification C:\Windows\SysWOW64\mnrpwdaaijbdhytggqoptryfc.kld nryzjt.exe File created C:\Windows\SysWOW64\mnrpwdaaijbdhytggqoptryfc.kld nryzjt.exe File opened for modification C:\Windows\SysWOW64\rdsbtltexjmzoqwufajvktldlwpbergiomxs.ncl nryzjt.exe File created C:\Windows\SysWOW64\rdsbtltexjmzoqwufajvktldlwpbergiomxs.ncl nryzjt.exe -
Drops file in Program Files directory 4 IoCs
Processes:
nryzjt.exedescription ioc Process File opened for modification C:\Program Files (x86)\mnrpwdaaijbdhytggqoptryfc.kld nryzjt.exe File created C:\Program Files (x86)\mnrpwdaaijbdhytggqoptryfc.kld nryzjt.exe File opened for modification C:\Program Files (x86)\rdsbtltexjmzoqwufajvktldlwpbergiomxs.ncl nryzjt.exe File created C:\Program Files (x86)\rdsbtltexjmzoqwufajvktldlwpbergiomxs.ncl nryzjt.exe -
Drops file in Windows directory 4 IoCs
Processes:
nryzjt.exedescription ioc Process File opened for modification C:\Windows\mnrpwdaaijbdhytggqoptryfc.kld nryzjt.exe File created C:\Windows\mnrpwdaaijbdhytggqoptryfc.kld nryzjt.exe File opened for modification C:\Windows\rdsbtltexjmzoqwufajvktldlwpbergiomxs.ncl nryzjt.exe File created C:\Windows\rdsbtltexjmzoqwufajvktldlwpbergiomxs.ncl nryzjt.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exenryzjt.exenryzjt.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nryzjt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nryzjt.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
nryzjt.exepid Process 1168 nryzjt.exe 1168 nryzjt.exe 1168 nryzjt.exe 1168 nryzjt.exe 1168 nryzjt.exe 1168 nryzjt.exe 1168 nryzjt.exe 1168 nryzjt.exe 1168 nryzjt.exe 1168 nryzjt.exe 1168 nryzjt.exe 1168 nryzjt.exe 1168 nryzjt.exe 1168 nryzjt.exe 1168 nryzjt.exe 1168 nryzjt.exe 1168 nryzjt.exe 1168 nryzjt.exe 1168 nryzjt.exe 1168 nryzjt.exe 1168 nryzjt.exe 1168 nryzjt.exe 1168 nryzjt.exe 1168 nryzjt.exe 1168 nryzjt.exe 1168 nryzjt.exe 1168 nryzjt.exe 1168 nryzjt.exe 1168 nryzjt.exe 1168 nryzjt.exe 1168 nryzjt.exe 1168 nryzjt.exe 1168 nryzjt.exe 1168 nryzjt.exe 1168 nryzjt.exe 1168 nryzjt.exe 1168 nryzjt.exe 1168 nryzjt.exe 1168 nryzjt.exe 1168 nryzjt.exe 1168 nryzjt.exe 1168 nryzjt.exe 1168 nryzjt.exe 1168 nryzjt.exe 1168 nryzjt.exe 1168 nryzjt.exe 1168 nryzjt.exe 1168 nryzjt.exe 1168 nryzjt.exe 1168 nryzjt.exe 1168 nryzjt.exe 1168 nryzjt.exe 1168 nryzjt.exe 1168 nryzjt.exe 1168 nryzjt.exe 1168 nryzjt.exe 1168 nryzjt.exe 1168 nryzjt.exe 1168 nryzjt.exe 1168 nryzjt.exe 1168 nryzjt.exe 1168 nryzjt.exe 1168 nryzjt.exe 1168 nryzjt.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
nryzjt.exedescription pid Process Token: SeDebugPrivilege 1168 nryzjt.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exedescription pid Process procid_target PID 1740 wrote to memory of 1168 1740 c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe 30 PID 1740 wrote to memory of 1168 1740 c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe 30 PID 1740 wrote to memory of 1168 1740 c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe 30 PID 1740 wrote to memory of 1168 1740 c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe 30 PID 1740 wrote to memory of 2572 1740 c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe 31 PID 1740 wrote to memory of 2572 1740 c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe 31 PID 1740 wrote to memory of 2572 1740 c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe 31 PID 1740 wrote to memory of 2572 1740 c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe 31 -
System policy modification 1 TTPs 36 IoCs
Processes:
nryzjt.exenryzjt.exec49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" nryzjt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" nryzjt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" nryzjt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" nryzjt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" nryzjt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer nryzjt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" nryzjt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" nryzjt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System nryzjt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" nryzjt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" nryzjt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" nryzjt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" nryzjt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System nryzjt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" nryzjt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" nryzjt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" nryzjt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer nryzjt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" nryzjt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" nryzjt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" nryzjt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" nryzjt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" nryzjt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" nryzjt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe"C:\Users\Admin\AppData\Local\Temp\c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe"1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\nryzjt.exe"C:\Users\Admin\AppData\Local\Temp\nryzjt.exe" "-"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:1168
-
-
C:\Users\Admin\AppData\Local\Temp\nryzjt.exe"C:\Users\Admin\AppData\Local\Temp\nryzjt.exe" "-"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- System Location Discovery: System Language Discovery
- System policy modification
PID:2572
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Impair Defenses
2Disable or Modify Tools
1Safe Mode Boot
1Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
272B
MD5c82ce69b1117a880fba4382db2735d7e
SHA196dbab6a6b8f8c58ccbf27d5bd99b734cabe5058
SHA25649d16449c0ad145197076195ef81198b200499feb262562d46b6ca130ccd965a
SHA51232e179844c30159d08a9223262734a14022e5acf5306640bbf0914a06d444dc93d5a5de138ecb1324e2160237e5ba4fb2f55b43852cbfcb158c56c9e8248610d
-
Filesize
272B
MD50d6989d87595f517da6abc50f84a845c
SHA139a2c635c30afd8b6d178cbff89c66b15f071708
SHA256a64aca9848eae61af5cda9dd378ea4bd8f1754c3ac5360a40f6a5a5feb713855
SHA5123fdb22d7752e42bf87d842832e8d90e2dfa78194a1c67d579e93a70ad6a8a884ba8c72a3ee9cd9cdc14eda9eda62bfbdb3a9043dc78ffc0e3bd1bfe013a88ddc
-
Filesize
272B
MD583483c53fdeab8632194a8a26f4f3e07
SHA1dc501dc0f9a988d2795bb7a3a2b11c2bee48bbb3
SHA2564625b22153da5543b99b5ee91b7e87683d89d03058f596f5f90bbecf809e0cd7
SHA51295eebdc83b6fe603881b28f26585a7a9f0c88c7c71a267ee5443f8c2e42a13efdc6403e8f97a6c8a7ebff43f1ebdbe674197be29004af290afcc352aef6fac2d
-
Filesize
272B
MD5efc7780f1415edbc86ee75d9e29ac464
SHA1a67f3415d8639c597a6da17bfb4796e341a7f2d2
SHA256ff0c45ac4c4449dc90d2ec6544f437025108bf6e364efcf8f12a46fd8bffeb44
SHA5126f356222eee92f88146a908ac30e404a94c3a4654bea233f541f2161af4778172277476bfb15ac1e0470a4df189a17fe69c29c6644a9523cab9765fbdd86982a
-
Filesize
272B
MD58bcd36f237932d771f9800c1a3a88497
SHA1da403f4bf632ab69c1aaf499636a3cfd65dc99af
SHA25615093a18785e9222ad32e1af42e82f5d9d86da01db0f8fff71e70ed76023380f
SHA512a1a163c22c17c8167eb07eb6a53edfb1742b577a878c35df82d8d884ce0ba1fa6fb62301f321c8e13231f8b61b25443fc1b2cdf76a2413125c11339ec6b16b63
-
Filesize
272B
MD56bae365319aa167e4e8750b6b3f087f0
SHA182e045c6b817e3e4b189e89e1f869e11a78a77b7
SHA2567ffd37c1028cea44621d83cd6e87171be5876149267a28103ec19d5b976dd0f5
SHA51250ed0d88645df4dc50e03237217ed943cd999ebe3420d5ed1334f3a1de9a660d5b92696eca77120e2c61d0b5bc59ab9e172bddc861cf708846c6b62328b44eb2
-
Filesize
272B
MD5370a1cd8ca098c91545f46e2aeb4ab50
SHA1053d1733c9ad9fcac3b660e6ff4ef1f4fe24439b
SHA2567a46351053ae8fcce49507e0407565209c5213892222b9734a2de4603c44f44b
SHA5129e7d6f9bcabd26f827ac0e87782a8942fc2cbf02abd3b026ac10e105520e1efbb3b38847edecb0813886f7e2bf67bc173bef576898894b3f67a87e3cf6564748
-
Filesize
272B
MD595060dfa7df1388e6c77ec3716e1f273
SHA1d379e7eee8bed2f2bf3c773a9370ba1a1fe82715
SHA25609f1ab13d8d7c41106ed6bc44096b4ba586b121b749219d1fa53c13b74a29869
SHA512a8d08fc907a6721e0ddcf299be25b89e1218572343fd7a096a6cc45b8e01ef939573441f07fd1e4a52662c253923ecaf3cb5d6608caa82d8ed15cc6fc10faf4a
-
Filesize
3KB
MD59e4959c191cc21500917d94bfa0dd2a3
SHA16e6cd855a9a43195d9ea66555019e50e6d14d768
SHA256bb4a7aa598ffdc5646801abfd50ad116ccf84be956819b42fad3d518386a68b9
SHA512de98cdb9c524545bce498719a8bfd935e3c241d896305229e62582470eba729009da01c55c4a657cdb1710c68a71251b2fc83eb58b39dd1a6aa872d31bb306af
-
Filesize
11.5MB
MD592f233373fbfaa8e15529c0f0defabbd
SHA1b5b829da61c59d468b1667548e4a37aecff5d608
SHA25604783e2335d9891f0a78cb79a6b22472bc965a9358d574d369f1b2bc8cd1220a
SHA5128cad0c2c3d2154e7481d729ff5adb3639bded42cf221d342d86f3ef4fd9f46be50ae116cda226d396060a2c611187b9e906f761524564b7656c72507c783b7b4