Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13-11-2024 01:03
Static task
static1
Behavioral task
behavioral1
Sample
c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe
Resource
win10v2004-20241007-en
General
-
Target
c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe
-
Size
9.4MB
-
MD5
c783a3b20315ef5554b629946af2e450
-
SHA1
d48a797b6186b0bda4bf4ba4b4981b8ebea17e07
-
SHA256
c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77f
-
SHA512
332d04fa682e7b12d3d2df697fa9e2209ff0dffa99535d2860c87cb38d4c6598a16ab75bdba31fbc07b8b2b160145bbc2fb75327264c25b6074e66bcc301fbb0
-
SSDEEP
6144:tSK/ymZ3ctTWQHf5ctj8jRi2WGKMSVT86JQPDHDdx/Qtqp:ue0TlHf55RShPJQPDHvd
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
Processes:
c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exevgnqbcl.exevgnqbcl.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" vgnqbcl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" vgnqbcl.exe -
Processes:
vgnqbcl.exevgnqbcl.exec49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" vgnqbcl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" vgnqbcl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" vgnqbcl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" vgnqbcl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" vgnqbcl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" vgnqbcl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" vgnqbcl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" vgnqbcl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe -
Adds policy Run key to start application 2 TTPs 23 IoCs
Processes:
vgnqbcl.exevgnqbcl.exec49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\isyakk = "xwrihwtnjggzwuwbjtlkf.exe" vgnqbcl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run vgnqbcl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\isyakk = "xwrihwtnjggzwuwbjtlkf.exe" vgnqbcl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hor = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bwnavgzphawleywxb.exe" vgnqbcl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hor = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vslaxkfxrmkbwssvbjz.exe" vgnqbcl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\isyakk = "kgymiuofyspfzutvah.exe" c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hor = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xwrihwtnjggzwuwbjtlkf.exe" c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hor = "C:\\Users\\Admin\\AppData\\Local\\Temp\\uoeqkumbskftlebb.exe" vgnqbcl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hor = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vslaxkfxrmkbwssvbjz.exe" vgnqbcl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hor = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kgymiuofyspfzutvah.exe" vgnqbcl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\isyakk = "uoeqkumbskftlebb.exe" vgnqbcl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\isyakk = "vslaxkfxrmkbwssvbjz.exe" vgnqbcl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\isyakk = "vslaxkfxrmkbwssvbjz.exe" vgnqbcl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run vgnqbcl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\isyakk = "bwnavgzphawleywxb.exe" vgnqbcl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hor = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xwrihwtnjggzwuwbjtlkf.exe" vgnqbcl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\isyakk = "uoeqkumbskftlebb.exe" vgnqbcl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hor = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bwnavgzphawleywxb.exe" vgnqbcl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\isyakk = "kgymiuofyspfzutvah.exe" vgnqbcl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hor = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kgymiuofyspfzutvah.exe" vgnqbcl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\isyakk = "igaqocyrmihzvstxenec.exe" vgnqbcl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\isyakk = "igaqocyrmihzvstxenec.exe" vgnqbcl.exe -
Disables RegEdit via registry modification 6 IoCs
Processes:
vgnqbcl.exevgnqbcl.exec49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exedescription ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" vgnqbcl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" vgnqbcl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" vgnqbcl.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe Set value (int) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" vgnqbcl.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe -
Executes dropped EXE 2 IoCs
Processes:
vgnqbcl.exevgnqbcl.exepid Process 1604 vgnqbcl.exe 3500 vgnqbcl.exe -
Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs
Processes:
vgnqbcl.exedescription ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power vgnqbcl.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iai2c.sys vgnqbcl.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CBDHSvc vgnqbcl.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UserManager vgnqbcl.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SerCx2.sys vgnqbcl.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc vgnqbcl.exe -
Adds Run key to start application 2 TTPs 64 IoCs
Processes:
vgnqbcl.exec49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exevgnqbcl.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\boxcpsdlv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\uoeqkumbskftlebb.exe ." vgnqbcl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\owaa = "uoeqkumbskftlebb.exe" c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\boxcpsdlv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\uoeqkumbskftlebb.exe ." vgnqbcl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\boxcpsdlv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xwrihwtnjggzwuwbjtlkf.exe ." vgnqbcl.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\xglmv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xwrihwtnjggzwuwbjtlkf.exe ." vgnqbcl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\uisymqclwi = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xwrihwtnjggzwuwbjtlkf.exe" vgnqbcl.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vgnqbcl = "bwnavgzphawleywxb.exe" vgnqbcl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\boxcpsdlv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kgymiuofyspfzutvah.exe ." vgnqbcl.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\owaa = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vslaxkfxrmkbwssvbjz.exe" vgnqbcl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\uisymqclwi = "C:\\Users\\Admin\\AppData\\Local\\Temp\\uoeqkumbskftlebb.exe" vgnqbcl.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vgnqbcl = "igaqocyrmihzvstxenec.exe" vgnqbcl.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vgnqbcl = "uoeqkumbskftlebb.exe" vgnqbcl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\owaa = "uoeqkumbskftlebb.exe" vgnqbcl.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vgnqbcl = "igaqocyrmihzvstxenec.exe" vgnqbcl.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\kweiuwgn = "bwnavgzphawleywxb.exe ." vgnqbcl.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vgnqbcl = "xwrihwtnjggzwuwbjtlkf.exe" c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\xglmv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\igaqocyrmihzvstxenec.exe ." c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xglmv = "bwnavgzphawleywxb.exe ." vgnqbcl.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vgnqbcl = "uoeqkumbskftlebb.exe" vgnqbcl.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\xglmv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vslaxkfxrmkbwssvbjz.exe ." vgnqbcl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\uisymqclwi = "C:\\Users\\Admin\\AppData\\Local\\Temp\\igaqocyrmihzvstxenec.exe" vgnqbcl.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\xglmv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kgymiuofyspfzutvah.exe ." vgnqbcl.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vgnqbcl = "vslaxkfxrmkbwssvbjz.exe" vgnqbcl.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\kweiuwgn = "vslaxkfxrmkbwssvbjz.exe ." c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xglmv = "bwnavgzphawleywxb.exe ." vgnqbcl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\owaa = "kgymiuofyspfzutvah.exe" vgnqbcl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\owaa = "kgymiuofyspfzutvah.exe" vgnqbcl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\uisymqclwi = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bwnavgzphawleywxb.exe" vgnqbcl.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\kweiuwgn = "xwrihwtnjggzwuwbjtlkf.exe ." vgnqbcl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xglmv = "uoeqkumbskftlebb.exe ." vgnqbcl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\uisymqclwi = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kgymiuofyspfzutvah.exe" vgnqbcl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\boxcpsdlv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bwnavgzphawleywxb.exe ." vgnqbcl.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\owaa = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kgymiuofyspfzutvah.exe" vgnqbcl.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\owaa = "C:\\Users\\Admin\\AppData\\Local\\Temp\\uoeqkumbskftlebb.exe" vgnqbcl.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\owaa = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bwnavgzphawleywxb.exe" vgnqbcl.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\xglmv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\uoeqkumbskftlebb.exe ." vgnqbcl.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\owaa = "C:\\Users\\Admin\\AppData\\Local\\Temp\\uoeqkumbskftlebb.exe" vgnqbcl.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\owaa = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xwrihwtnjggzwuwbjtlkf.exe" vgnqbcl.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\xglmv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xwrihwtnjggzwuwbjtlkf.exe ." vgnqbcl.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\kweiuwgn = "kgymiuofyspfzutvah.exe ." vgnqbcl.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\owaa = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xwrihwtnjggzwuwbjtlkf.exe" vgnqbcl.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vgnqbcl = "xwrihwtnjggzwuwbjtlkf.exe" vgnqbcl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\uisymqclwi = "C:\\Users\\Admin\\AppData\\Local\\Temp\\igaqocyrmihzvstxenec.exe" vgnqbcl.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\xglmv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\uoeqkumbskftlebb.exe ." vgnqbcl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\owaa = "xwrihwtnjggzwuwbjtlkf.exe" vgnqbcl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\uisymqclwi = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kgymiuofyspfzutvah.exe" c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\kweiuwgn = "igaqocyrmihzvstxenec.exe ." vgnqbcl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xglmv = "xwrihwtnjggzwuwbjtlkf.exe ." vgnqbcl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xglmv = "kgymiuofyspfzutvah.exe ." vgnqbcl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\uisymqclwi = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bwnavgzphawleywxb.exe" vgnqbcl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\boxcpsdlv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vslaxkfxrmkbwssvbjz.exe ." vgnqbcl.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vgnqbcl = "kgymiuofyspfzutvah.exe" vgnqbcl.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\xglmv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bwnavgzphawleywxb.exe ." vgnqbcl.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\owaa = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bwnavgzphawleywxb.exe" c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\owaa = "igaqocyrmihzvstxenec.exe" vgnqbcl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\uisymqclwi = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vslaxkfxrmkbwssvbjz.exe" vgnqbcl.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\owaa = "C:\\Users\\Admin\\AppData\\Local\\Temp\\igaqocyrmihzvstxenec.exe" vgnqbcl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\uisymqclwi = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vslaxkfxrmkbwssvbjz.exe" vgnqbcl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xglmv = "igaqocyrmihzvstxenec.exe ." vgnqbcl.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vgnqbcl = "kgymiuofyspfzutvah.exe" vgnqbcl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\boxcpsdlv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kgymiuofyspfzutvah.exe ." c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\xglmv = "vslaxkfxrmkbwssvbjz.exe ." vgnqbcl.exe Set value (str) \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\xglmv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kgymiuofyspfzutvah.exe ." vgnqbcl.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\uisymqclwi = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kgymiuofyspfzutvah.exe" vgnqbcl.exe -
Processes:
vgnqbcl.exevgnqbcl.exec49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" vgnqbcl.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA vgnqbcl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" vgnqbcl.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA vgnqbcl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe -
Hijack Execution Flow: Executable Installer File Permissions Weakness 1 TTPs 3 IoCs
Possible Turn off User Account Control's privilege elevation for standard users.
Processes:
vgnqbcl.exevgnqbcl.exec49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" vgnqbcl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" vgnqbcl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe -
Looks up external IP address via web service 7 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 12 whatismyipaddress.com 15 whatismyip.everdot.org 25 whatismyip.everdot.org 31 www.showmyipaddress.com 34 www.whatismyip.ca 37 whatismyip.everdot.org 41 www.whatismyip.ca -
Drops file in System32 directory 4 IoCs
Processes:
vgnqbcl.exedescription ioc Process File opened for modification C:\Windows\SysWOW64\uoeqkumbskftlebbejwqgsmwodumhvngddglys.uoy vgnqbcl.exe File created C:\Windows\SysWOW64\uoeqkumbskftlebbejwqgsmwodumhvngddglys.uoy vgnqbcl.exe File opened for modification C:\Windows\SysWOW64\xglmvubflscfmugvnhjsxyhgnrx.ory vgnqbcl.exe File created C:\Windows\SysWOW64\xglmvubflscfmugvnhjsxyhgnrx.ory vgnqbcl.exe -
Drops file in Program Files directory 4 IoCs
Processes:
vgnqbcl.exedescription ioc Process File created C:\Program Files (x86)\xglmvubflscfmugvnhjsxyhgnrx.ory vgnqbcl.exe File opened for modification C:\Program Files (x86)\uoeqkumbskftlebbejwqgsmwodumhvngddglys.uoy vgnqbcl.exe File created C:\Program Files (x86)\uoeqkumbskftlebbejwqgsmwodumhvngddglys.uoy vgnqbcl.exe File opened for modification C:\Program Files (x86)\xglmvubflscfmugvnhjsxyhgnrx.ory vgnqbcl.exe -
Drops file in Windows directory 4 IoCs
Processes:
vgnqbcl.exedescription ioc Process File opened for modification C:\Windows\xglmvubflscfmugvnhjsxyhgnrx.ory vgnqbcl.exe File created C:\Windows\xglmvubflscfmugvnhjsxyhgnrx.ory vgnqbcl.exe File opened for modification C:\Windows\uoeqkumbskftlebbejwqgsmwodumhvngddglys.uoy vgnqbcl.exe File created C:\Windows\uoeqkumbskftlebbejwqgsmwodumhvngddglys.uoy vgnqbcl.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exevgnqbcl.exevgnqbcl.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vgnqbcl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vgnqbcl.exe -
Modifies registry class 3 IoCs
Processes:
vgnqbcl.exec49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exevgnqbcl.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings vgnqbcl.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe Key created \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000_Classes\Local Settings vgnqbcl.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
vgnqbcl.exepid Process 1604 vgnqbcl.exe 1604 vgnqbcl.exe 1604 vgnqbcl.exe 1604 vgnqbcl.exe 1604 vgnqbcl.exe 1604 vgnqbcl.exe 1604 vgnqbcl.exe 1604 vgnqbcl.exe 1604 vgnqbcl.exe 1604 vgnqbcl.exe 1604 vgnqbcl.exe 1604 vgnqbcl.exe 1604 vgnqbcl.exe 1604 vgnqbcl.exe 1604 vgnqbcl.exe 1604 vgnqbcl.exe 1604 vgnqbcl.exe 1604 vgnqbcl.exe 1604 vgnqbcl.exe 1604 vgnqbcl.exe 1604 vgnqbcl.exe 1604 vgnqbcl.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
vgnqbcl.exevgnqbcl.exepid Process 3500 vgnqbcl.exe 1604 vgnqbcl.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
vgnqbcl.exedescription pid Process Token: SeDebugPrivilege 1604 vgnqbcl.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exedescription pid Process procid_target PID 2268 wrote to memory of 1604 2268 c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe 89 PID 2268 wrote to memory of 1604 2268 c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe 89 PID 2268 wrote to memory of 1604 2268 c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe 89 PID 2268 wrote to memory of 3500 2268 c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe 91 PID 2268 wrote to memory of 3500 2268 c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe 91 PID 2268 wrote to memory of 3500 2268 c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe 91 -
System policy modification 1 TTPs 36 IoCs
Processes:
c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exevgnqbcl.exevgnqbcl.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System vgnqbcl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" vgnqbcl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" vgnqbcl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" vgnqbcl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" vgnqbcl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" vgnqbcl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" vgnqbcl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" vgnqbcl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" vgnqbcl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer vgnqbcl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" vgnqbcl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" vgnqbcl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" vgnqbcl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer vgnqbcl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" vgnqbcl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" vgnqbcl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" vgnqbcl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" vgnqbcl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" vgnqbcl.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System vgnqbcl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" vgnqbcl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" vgnqbcl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" vgnqbcl.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" vgnqbcl.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe"C:\Users\Admin\AppData\Local\Temp\c49a6d6259d7090608badcb4853eefb1be958577dc417ec124fa313c71f8c77fN.exe"1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\vgnqbcl.exe"C:\Users\Admin\AppData\Local\Temp\vgnqbcl.exe" "-"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:1604
-
-
C:\Users\Admin\AppData\Local\Temp\vgnqbcl.exe"C:\Users\Admin\AppData\Local\Temp\vgnqbcl.exe" "-"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- System policy modification
PID:3500
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1192
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Impair Defenses
2Disable or Modify Tools
1Safe Mode Boot
1Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
272B
MD5e4d5df84363f10fe1887282ea658f2d2
SHA1d9d45dab9f7b1212c2ef5310a2de93302e3f06ab
SHA2567c7ba3195df813fcb65ea69fe1eb1a71e6c791cee6efd651feb5f714dd450725
SHA512d75aa6b741a34c554e0610613d09ed157a5b74df7d17e241a51136135ae790b8df19c30407b45288aebda91d8394093ae055ac241060b9c2685d05e4bc34a362
-
Filesize
272B
MD5da6eb16282df61aeb6d9471663d7bf19
SHA1358e11d883a3d425402df9408b8a51e86c43e34d
SHA256e059c8c2cc5324e692786237708038a3e836e56e8cb04c3f23ae5556b4e27200
SHA512912cd741a7add78cd4d308d61fb52c152a1b44de92612278e3ecd038eda5dcfd73042b84861ed15b441ba23e5e4ace9b54db597e10fc9eb82a5f3b5f0a383d81
-
Filesize
272B
MD53614f4fd8f8ae81a679a3a92f159f61a
SHA189d18ea94888111ea55be19ca3213e5d85eb76ec
SHA256ad2fe6fee8d470142ffe53acca85faefa5e89899a143192fcbf91ac3229e36e4
SHA51227db87ea15457d9a17297742e02fac99a10cb858a22b11caf50ba30e830b56179341596df06dd62a660fa2aad0cec10b7e44765b4b65a69a76a068d7687d8717
-
Filesize
272B
MD5e85559fa97cbb6eea28a9d4a6e67b6c4
SHA1dd408916e09e72f80fa6af6b1e79ccf76b4fe6c2
SHA2569a4617a12ee6c95b261bbbf444e07b49d5911621fa3d3029b52c83e1b08aa19e
SHA5123dcaa027a2a0d43884d6e340a1c194f75a4cfc79be6b52ac615b2f2f4914da4a09fe047faf01e140605be24cdff1b6eb8e6a6d760486e8ce09231732d1adc333
-
Filesize
272B
MD535dd0a7e937db0d9cbbe9de9c27314b7
SHA10c44703beb5ab6224e95debe0dc518a390712405
SHA25671cd47e5d658624c00eb211f48731d134de1107b72472e32e0fb2de819e5d8c7
SHA512e44c7974dbbbe52f54b6ad65002032d506dca0cbf81c2667b745150c8af502342ffdbbe685bb4a0ede52e3e7c4134eb31656e1f2bdd08ae04b986afea5763b02
-
Filesize
272B
MD52a7fac9a7b049d3d99dd98e7736bc8e8
SHA127b8d1705fb5128d07a4405d27761deede505bf1
SHA25619acfe81863de4327c3d910647c48f9caabc8be636567738e755689b26e1cbb5
SHA5121862a425b1fd52ca51bf91cdc46a62cb49749ec10a9c06ec54e44ccce22a9ad1483bf23ca768df77605d9a7ac96421f58ddba8540e25534f6564413f786faf8b
-
Filesize
272B
MD59a492cdd49a6c6d07a5fcdcac2f78bf9
SHA19df2b8624044d73b9c8fed80df8df53eaa2b3704
SHA256d3bc60af5378c05efd9b2a31ef6a42758bb40a9d23e4da47356fac8429858aab
SHA512e332bd2b782a1f12716301ffe8cb505f91e8de6359112a5cdff2d1270b224c003422134dc9153c50557b3f5d6fb2f4639e178253f636f3316820b6856d6bd4e0
-
Filesize
11.5MB
MD5386d3d81c643fad2c7c9d8bc3d640869
SHA168eb7717394fd0f7e7fd00abb729c9b9fdf6d6de
SHA2562183d45504d667aed0461ea2b29a1bc2520ca08f727343d54260b50be0c6c5a4
SHA5120e16bf91aadebd41d76d2b0af66207ecacd66ac173589b1a9688f9c4c125f6e0457e5381ef06ee8d74b9a26f3f3833c67a91a351f4c45705a28bd04cc81c0dbc
-
Filesize
3KB
MD5214b298e4140daa50884ec898bd07042
SHA1303119da26fdad7c15a696ef94e1d469069a30a4
SHA2560ce086524f7fe6f4b34f4f5ce5bbb51a6cdcc89cc006ee7983c27630358fda31
SHA512aed8729aeb5233ab435b01cfa1bc1a919d913e8830483b105b050592c518798f4e8f2d03285f15ce5ce9ace49a7dc61b01cb5115692c20a166aaab174b20ed94
-
Filesize
272B
MD5139608fd2050d639dfb895211611c742
SHA199a03bb015676d175c4a74e329a7a3679f2e6f4b
SHA2560b40c063f9abb223fc4323b26366961f58d4a79e53dac500eb5fc62b6b21c1ea
SHA5124f83fa0e30e2dfbbc6f2cda104792204beda4895fd12d6c8ccfaa047353177f8807948b9b86432a8b7241ee200cd7968e75e132464b4a736138f2f5a675de5d5
-
Filesize
272B
MD5e1451aa52509ebe777c3f04333026d47
SHA19fceb6fd378bab8ca569657fae5752902096daee
SHA25650c04c6a80d7218c4537c6f1f7cb9ab6adf5fdc1d3aad770b3b02cf90b5916b4
SHA512a33ce7451d07880aab032e891c24d0b85b1ea7aea378a160082d3c29dc254e9753139b122fe91cec972d7263168386dd3f8699f9178f219074431032d3051ebf