Analysis
- max time kernel
120s - max time network
127s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
14/11/2024, 00:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7bf69188ae195642b23a8903128726200413395d607643f85fd8921ada3919e0.exe
Resource
win7-20240903-en
windows7-x64
20 signatures
120 seconds
Behavioral task
behavioral2
Sample
7bf69188ae195642b23a8903128726200413395d607643f85fd8921ada3919e0.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
22 signatures
120 seconds
General
- Target 7bf69188ae195642b23a8903128726200413395d607643f85fd8921ada3919e0.exe
- Size 9.4MB
- Sample241114-abc3kasajr
- SHA256 7bf69188ae195642b23a8903128726200413395d607643f85fd8921ada3919e0
- MD5 fb9c9db7c6587c9f13a89b05dcee02e6
- SHA1 7ec8e1aa1e0f94293a74fdb7383c6a8e23bfd11e
- SHA512 0bc5f24a143615c68330887b85ba1fd022ed6fae49ee79b1aae1e1c017394d3c6fd040f245064a128ed57d9407e38c6a711d12b0c1b57fbb3745fe1426514f86
- SSDEEP 6144:tSK/ymZ3ctTWQHf5ctj8jRi2WGKMSVT86JQPDHDdx/QtqpS:ue0TlHf55RShPJQPDHvdM
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" 7bf69188ae195642b23a8903128726200413395d607643f85fd8921ada3919e0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" chgru.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" chgru.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" chgru.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" chgru.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" chgru.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 7bf69188ae195642b23a8903128726200413395d607643f85fd8921ada3919e0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" chgru.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" chgru.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" chgru.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" chgru.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" chgru.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 7bf69188ae195642b23a8903128726200413395d607643f85fd8921ada3919e0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 7bf69188ae195642b23a8903128726200413395d607643f85fd8921ada3919e0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" 7bf69188ae195642b23a8903128726200413395d607643f85fd8921ada3919e0.exe - Adds policy Run key to start application 2 TTPs 23 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\txvf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\phtrhcslwpeuykcbus.exe" chgru.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ahivakp = "phtrhcslwpeuykcbus.exe" chgru.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\txvf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cxmngexthdvovkfhdeqla.exe" chgru.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ahivakp = "atgfwsjdpjzqvibbvue.exe" chgru.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\txvf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nhvvnkcxkfwouicdyyjd.exe" chgru.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 7bf69188ae195642b23a8903128726200413395d607643f85fd8921ada3919e0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ahivakp = "zpzvjcqhqhuikukh.exe" chgru.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\txvf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gxifuodvfxladofdv.exe" chgru.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ahivakp = "nhvvnkcxkfwouicdyyjd.exe" chgru.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\txvf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cxmngexthdvovkfhdeqla.exe" chgru.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\txvf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zpzvjcqhqhuikukh.exe" chgru.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\txvf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\phtrhcslwpeuykcbus.exe" chgru.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ahivakp = "phtrhcslwpeuykcbus.exe" chgru.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\txvf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nhvvnkcxkfwouicdyyjd.exe" chgru.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ahivakp = "cxmngexthdvovkfhdeqla.exe" chgru.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run chgru.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ahivakp = "gxifuodvfxladofdv.exe" chgru.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run chgru.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ahivakp = "nhvvnkcxkfwouicdyyjd.exe" chgru.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\txvf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\atgfwsjdpjzqvibbvue.exe" chgru.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ahivakp = "zpzvjcqhqhuikukh.exe" chgru.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ahivakp = "gxifuodvfxladofdv.exe" 7bf69188ae195642b23a8903128726200413395d607643f85fd8921ada3919e0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\txvf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\atgfwsjdpjzqvibbvue.exe" 7bf69188ae195642b23a8903128726200413395d607643f85fd8921ada3919e0.exe - Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 7bf69188ae195642b23a8903128726200413395d607643f85fd8921ada3919e0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 7bf69188ae195642b23a8903128726200413395d607643f85fd8921ada3919e0.exe Set value (int) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" chgru.exe Set value (int) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" chgru.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" chgru.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" chgru.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation 7bf69188ae195642b23a8903128726200413395d607643f85fd8921ada3919e0.exe - Executes dropped EXE 2 IoCs
pid Process 812 chgru.exe 1032 chgru.exe - Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CBDHSvc chgru.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UserManager chgru.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SerCx2.sys chgru.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc chgru.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power chgru.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iai2c.sys chgru.exe - Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nttfjs = "gxifuodvfxladofdv.exe ." 7bf69188ae195642b23a8903128726200413395d607643f85fd8921ada3919e0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pxzntekt = "gxifuodvfxladofdv.exe" 7bf69188ae195642b23a8903128726200413395d607643f85fd8921ada3919e0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\nttfjs = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gxifuodvfxladofdv.exe ." 7bf69188ae195642b23a8903128726200413395d607643f85fd8921ada3919e0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\nttfjs = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gxifuodvfxladofdv.exe ." chgru.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nttfjs = "zpzvjcqhqhuikukh.exe ." chgru.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ufkbkyhtxjr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\atgfwsjdpjzqvibbvue.exe" chgru.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zjndlygruf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\atgfwsjdpjzqvibbvue.exe ." chgru.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zjndlygruf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gxifuodvfxladofdv.exe ." chgru.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\nttfjs = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zpzvjcqhqhuikukh.exe ." chgru.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pxzntekt = "cxmngexthdvovkfhdeqla.exe" chgru.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ufkbkyhtxjr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zpzvjcqhqhuikukh.exe" chgru.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nttfjs = "gxifuodvfxladofdv.exe ." chgru.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ufkbkyhtxjr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gxifuodvfxladofdv.exe" chgru.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\nttfjs = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gxifuodvfxladofdv.exe ." chgru.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pxzntekt = "nhvvnkcxkfwouicdyyjd.exe" chgru.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\gpshoahrt = "cxmngexthdvovkfhdeqla.exe ." chgru.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pxzntekt = "zpzvjcqhqhuikukh.exe" chgru.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zjndlygruf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zpzvjcqhqhuikukh.exe ." chgru.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zjndlygruf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zpzvjcqhqhuikukh.exe ." chgru.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ufkbkyhtxjr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cxmngexthdvovkfhdeqla.exe" chgru.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chgru = "C:\\Users\\Admin\\AppData\\Local\\Temp\\atgfwsjdpjzqvibbvue.exe" chgru.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nttfjs = "nhvvnkcxkfwouicdyyjd.exe ." chgru.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\gpshoahrt = "gxifuodvfxladofdv.exe ." chgru.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nttfjs = "atgfwsjdpjzqvibbvue.exe ." chgru.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pxzntekt = "atgfwsjdpjzqvibbvue.exe" chgru.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chgru = "C:\\Users\\Admin\\AppData\\Local\\Temp\\atgfwsjdpjzqvibbvue.exe" chgru.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\gpshoahrt = "nhvvnkcxkfwouicdyyjd.exe ." 7bf69188ae195642b23a8903128726200413395d607643f85fd8921ada3919e0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chgru = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zpzvjcqhqhuikukh.exe" 7bf69188ae195642b23a8903128726200413395d607643f85fd8921ada3919e0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nttfjs = "zpzvjcqhqhuikukh.exe ." chgru.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chgru = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nhvvnkcxkfwouicdyyjd.exe" chgru.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ufkbkyhtxjr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gxifuodvfxladofdv.exe" chgru.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\gpshoahrt = "gxifuodvfxladofdv.exe ." chgru.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zjndlygruf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gxifuodvfxladofdv.exe ." chgru.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pxzntekt = "phtrhcslwpeuykcbus.exe" chgru.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nttfjs = "cxmngexthdvovkfhdeqla.exe ." chgru.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\nttfjs = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cxmngexthdvovkfhdeqla.exe ." chgru.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\chgru = "gxifuodvfxladofdv.exe" chgru.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pxzntekt = "phtrhcslwpeuykcbus.exe" chgru.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\gpshoahrt = "cxmngexthdvovkfhdeqla.exe ." chgru.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pxzntekt = "gxifuodvfxladofdv.exe" chgru.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\gpshoahrt = "zpzvjcqhqhuikukh.exe ." chgru.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nttfjs = "cxmngexthdvovkfhdeqla.exe ." chgru.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chgru = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cxmngexthdvovkfhdeqla.exe" chgru.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chgru = "C:\\Users\\Admin\\AppData\\Local\\Temp\\phtrhcslwpeuykcbus.exe" chgru.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chgru = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nhvvnkcxkfwouicdyyjd.exe" chgru.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\nttfjs = "C:\\Users\\Admin\\AppData\\Local\\Temp\\atgfwsjdpjzqvibbvue.exe ." chgru.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ufkbkyhtxjr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nhvvnkcxkfwouicdyyjd.exe" chgru.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\nttfjs = "C:\\Users\\Admin\\AppData\\Local\\Temp\\phtrhcslwpeuykcbus.exe ." chgru.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\nttfjs = "phtrhcslwpeuykcbus.exe ." chgru.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ufkbkyhtxjr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zpzvjcqhqhuikukh.exe" chgru.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ufkbkyhtxjr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zpzvjcqhqhuikukh.exe" 7bf69188ae195642b23a8903128726200413395d607643f85fd8921ada3919e0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zjndlygruf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\phtrhcslwpeuykcbus.exe ." chgru.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\chgru = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zpzvjcqhqhuikukh.exe" chgru.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pxzntekt = "gxifuodvfxladofdv.exe" chgru.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\gpshoahrt = "zpzvjcqhqhuikukh.exe ." chgru.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pxzntekt = "atgfwsjdpjzqvibbvue.exe" chgru.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\nttfjs = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cxmngexthdvovkfhdeqla.exe ." chgru.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zjndlygruf = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nhvvnkcxkfwouicdyyjd.exe ." chgru.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\chgru = "zpzvjcqhqhuikukh.exe" chgru.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\chgru = "atgfwsjdpjzqvibbvue.exe" chgru.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pxzntekt = "cxmngexthdvovkfhdeqla.exe" chgru.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\chgru = "phtrhcslwpeuykcbus.exe" chgru.exe Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\gpshoahrt = "phtrhcslwpeuykcbus.exe ." chgru.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\chgru = "nhvvnkcxkfwouicdyyjd.exe" chgru.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" chgru.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA chgru.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" chgru.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA chgru.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 7bf69188ae195642b23a8903128726200413395d607643f85fd8921ada3919e0.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 7bf69188ae195642b23a8903128726200413395d607643f85fd8921ada3919e0.exe - Hijack Execution Flow: Executable Installer File Permissions Weakness 1 TTPs 3 IoCs
Possible Turn off User Account Control's privilege elevation for standard users.
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" 7bf69188ae195642b23a8903128726200413395d607643f85fd8921ada3919e0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" chgru.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" chgru.exe - Looks up external IP address via web service 6 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 27 www.showmyipaddress.com 31 www.whatismyip.ca 34 whatismyip.everdot.org 16 whatismyip.everdot.org 20 whatismyipaddress.com 22 www.whatismyip.ca - Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\chgrucfljprulkpbhsotsdgorxv.dgx chgru.exe File created C:\Windows\SysWOW64\chgrucfljprulkpbhsotsdgorxv.dgx chgru.exe File opened for modification C:\Windows\SysWOW64\zpzvjcqhqhuikukhyubrbxlesjsjwkmwmjawdt.zng chgru.exe File created C:\Windows\SysWOW64\zpzvjcqhqhuikukhyubrbxlesjsjwkmwmjawdt.zng chgru.exe - Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\zpzvjcqhqhuikukhyubrbxlesjsjwkmwmjawdt.zng chgru.exe File created C:\Program Files (x86)\zpzvjcqhqhuikukhyubrbxlesjsjwkmwmjawdt.zng chgru.exe File opened for modification C:\Program Files (x86)\chgrucfljprulkpbhsotsdgorxv.dgx chgru.exe File created C:\Program Files (x86)\chgrucfljprulkpbhsotsdgorxv.dgx chgru.exe - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\zpzvjcqhqhuikukhyubrbxlesjsjwkmwmjawdt.zng chgru.exe File opened for modification C:\Windows\chgrucfljprulkpbhsotsdgorxv.dgx chgru.exe File created C:\Windows\chgrucfljprulkpbhsotsdgorxv.dgx chgru.exe File opened for modification C:\Windows\zpzvjcqhqhuikukhyubrbxlesjsjwkmwmjawdt.zng chgru.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7bf69188ae195642b23a8903128726200413395d607643f85fd8921ada3919e0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chgru.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language chgru.exe - Modifies registry class 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings chgru.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings 7bf69188ae195642b23a8903128726200413395d607643f85fd8921ada3919e0.exe Key created \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000_Classes\Local Settings chgru.exe - Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 812 chgru.exe 812 chgru.exe 812 chgru.exe 812 chgru.exe 812 chgru.exe 812 chgru.exe 812 chgru.exe 812 chgru.exe 812 chgru.exe 812 chgru.exe 812 chgru.exe 812 chgru.exe 812 chgru.exe 812 chgru.exe 812 chgru.exe 812 chgru.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1032 chgru.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 812 chgru.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4040 wrote to memory of 812 4040 7bf69188ae195642b23a8903128726200413395d607643f85fd8921ada3919e0.exe 86 PID 4040 wrote to memory of 812 4040 7bf69188ae195642b23a8903128726200413395d607643f85fd8921ada3919e0.exe 86 PID 4040 wrote to memory of 812 4040 7bf69188ae195642b23a8903128726200413395d607643f85fd8921ada3919e0.exe 86 PID 4040 wrote to memory of 1032 4040 7bf69188ae195642b23a8903128726200413395d607643f85fd8921ada3919e0.exe 87 PID 4040 wrote to memory of 1032 4040 7bf69188ae195642b23a8903128726200413395d607643f85fd8921ada3919e0.exe 87 PID 4040 wrote to memory of 1032 4040 7bf69188ae195642b23a8903128726200413395d607643f85fd8921ada3919e0.exe 87 - System policy modification 1 TTPs 36 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 7bf69188ae195642b23a8903128726200413395d607643f85fd8921ada3919e0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" 7bf69188ae195642b23a8903128726200413395d607643f85fd8921ada3919e0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" chgru.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" 7bf69188ae195642b23a8903128726200413395d607643f85fd8921ada3919e0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System chgru.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" chgru.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" chgru.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" chgru.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" chgru.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" chgru.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 7bf69188ae195642b23a8903128726200413395d607643f85fd8921ada3919e0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" 7bf69188ae195642b23a8903128726200413395d607643f85fd8921ada3919e0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" chgru.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 7bf69188ae195642b23a8903128726200413395d607643f85fd8921ada3919e0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" 7bf69188ae195642b23a8903128726200413395d607643f85fd8921ada3919e0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer chgru.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System chgru.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" chgru.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" chgru.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" chgru.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" chgru.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 7bf69188ae195642b23a8903128726200413395d607643f85fd8921ada3919e0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" 7bf69188ae195642b23a8903128726200413395d607643f85fd8921ada3919e0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 7bf69188ae195642b23a8903128726200413395d607643f85fd8921ada3919e0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" chgru.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" chgru.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer chgru.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" chgru.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" chgru.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" 7bf69188ae195642b23a8903128726200413395d607643f85fd8921ada3919e0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" chgru.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" chgru.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" chgru.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 7bf69188ae195642b23a8903128726200413395d607643f85fd8921ada3919e0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" chgru.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" chgru.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7bf69188ae195642b23a8903128726200413395d607643f85fd8921ada3919e0.exe"C:\Users\Admin\AppData\Local\Temp\7bf69188ae195642b23a8903128726200413395d607643f85fd8921ada3919e0.exe"1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\chgru.exe"C:\Users\Admin\AppData\Local\Temp\chgru.exe" "-"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:812
-
-
C:\Users\Admin\AppData\Local\Temp\chgru.exe"C:\Users\Admin\AppData\Local\Temp\chgru.exe" "-"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- System policy modification
PID:1032
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4864
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Impair Defenses
2Disable or Modify Tools
1Safe Mode Boot
1Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\chgrucfljprulkpbhsotsdgorxv.dgx
- Size 272B
- SHA256 eed99bb98fce31271fd8cddd65e441d3fe3721d4493ad80a069d556c1ae35c48
- MD5 0cbf8b7745b2198ee5831b64c45a9e5e
- SHA1 6d6eaa4566334f4a4d9a7fd82df90c1b941690d7
- SHA512 2e446b9a99e5c1f217007bdac063ab6b39b117f1bb90a7b437c632ad8f95863dd6cb3b0eaa7ee795f466df12adec412e0942d1ed63cb942f07796a5d0a53326e
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\chgrucfljprulkpbhsotsdgorxv.dgx
- Size 272B
- SHA256 00609e81039dee1922a83cf922446d342940690fab5f5c88ccc0b360fc221c1b
- MD5 4f85af66c2f97e982caf49712bb21fa9
- SHA1 894a2ed4ad8aa7c90ebd49ddc140654b768348cc
- SHA512 5e412a4864c3da0d32079eacd2c8587f575a810a1bd9121117add0070617b206170508a8af4d956d7028a6f2b06ab404034cd97fdc55ab34127bc12ede489ae3
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\chgrucfljprulkpbhsotsdgorxv.dgx
- Size 272B
- SHA256 bcdb10661e9eef6614aa26d9a26aec739edfe18fd23f657e795793cc599d3712
- MD5 0c0bda58522cdcf438101500bc98cb77
- SHA1 796b49ba688ecb2fa46a194015ab9d539a2b19b4
- SHA512 24d398edff7b0cdf6444efb94dc5476b1820ce2cabe735858e67be99b8bca27a7ae63c97a1b38ad33b792dae3c183479416c57ee43262c4315026dd14a963f14
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\chgrucfljprulkpbhsotsdgorxv.dgx
- Size 272B
- SHA256 8b4ff85a2a515ecefe847aebcb55edef01b1eef8187c2ac407bf0e3cca75e353
- MD5 55bd07524142ff2d00b5b460ebb413db
- SHA1 1084b8c89aef9515200b110e72d8582dfcdad36e
- SHA512 12f138e541d307a8c625d81ea4c0c9aa98c8b8c37081f86912d48a1ac3327ac20901d3bf0a25b3d5fb03cc0e6a890ce3b503f9eaa730496d5d59c2146e9b0cbf
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\chgrucfljprulkpbhsotsdgorxv.dgx
- Size 272B
- SHA256 986e2aa5c888275ad7785f6d9c1de87a05e8ebbd2add563dbdc3c38e3dce321b
- MD5 bab34a6fedd7f85d16815d64b7bb3612
- SHA1 83b850bb60ff13b7a0550a8c5d1ac75bc3c181d8
- SHA512 2a12b04de34661394f0b8bd1434c5347d46267464a02723a2bfd2b66fbc6a4a671a649553cc915ac80985bd1246e4edab2161a82ccebeb776430f23f918fda71
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\chgrucfljprulkpbhsotsdgorxv.dgx
- Size 272B
- SHA256 c17d35a63e7a012af473c304b9f6f9291f66a7e59eaf883b37ad414d23683180
- MD5 99b5258b1ac0ddabe562f99294723b49
- SHA1 729531a431d0d4fa4394b77097357fdb0dcd15fb
- SHA512 1a392cf6c532ea627721801810e2cda4fcb3a73d457fdd02983062ab4d847d21f65c34167898ce294ba97e9a4f565d0cd006cac158640a50ed1e534fb5a6a6ca
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\chgru.exe
- Size 11.5MB
- SHA256 cd83123c94b45409b84d82f6fc5264be7d95676d558669f3da9d130c99214a41
- MD5 2ba04f16c330ef19c5f5dbabda3f43f6
- SHA1 d8b92263abc609722f38f14cb993c52da6c7b096
- SHA512 d86dbc05e703068618aa2e555778bd59add660b3ef5b4c079fd18fb55a6ae87f15cc83cbfd1226f4d5dedd2348f020b62348035265ce873ab3dbaadc89d0bf42
- SSDEEP 6144:oSK/ymZ3ctTWQHf5sVU8zKKMSVT86JQPDHDdx/Qtqp:1e0TlHf5bRShPJQPDHvd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\chgrucfljprulkpbhsotsdgorxv.dgx
- Size 272B
- SHA256 32e8124bb5e486da9f66b2921339891747e6f1cd56583d42887a818900345b95
- MD5 e095bfbaa7123984eacd6343ef62341a
- SHA1 cdb76ac68678f2e583b15e8e5e58a0e8700cf4d0
- SHA512 085f662796160f9b9700f5c378225a26d6911143af0126c8fd4749cfd3fae2c339af5cb29cce2a2e8ec62604ceb87b777bab5879ebd7ef2622e699de2b1afb33
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\zpzvjcqhqhuikukhyubrbxlesjsjwkmwmjawdt.zng
- Size 3KB
- SHA256 6411d5ef118e2cf6a332cf884e5c645eefec783cd73e4ad7ddc7193907fd0477
- MD5 fd0c7763635aacac1cf5e4ecfb4fc01d
- SHA1 d998ec4ed316d29ea72c6a5543e54570642beed1
- SHA512 a4a6709d7a6dae29ee3ec62aae2cc9aac0b56b815142a7b37e9b963a41f83b4048fbbd52a5db5b19f1e05f17df650d815513c07120bbdc7c3e2f82b2121e9753
- MD5 SHA1 SHA512