Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21-11-2024 01:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
93c55deeee3cd963b82fea8d32b0848f35bb4679921045b07f8116c21c6634b7.exe
Resource
win7-20240903-en
windows7-x64
20 signatures
150 seconds
Behavioral task
behavioral2
Sample
93c55deeee3cd963b82fea8d32b0848f35bb4679921045b07f8116c21c6634b7.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
22 signatures
150 seconds
General
-
Target
93c55deeee3cd963b82fea8d32b0848f35bb4679921045b07f8116c21c6634b7.exe
-
Size
704KB
-
MD5
906593a62b364af3cbebf6d28d595531
-
SHA1
97f124e6394796b8020e5162b04cafcc6ebdf11a
-
SHA256
93c55deeee3cd963b82fea8d32b0848f35bb4679921045b07f8116c21c6634b7
-
SHA512
cb419c171cdeb5f034e35f7337dee26718b47c6cc55b167e4da79210f34cfa28e843b5a65a5260d9ce96a5a1688d8fdf2d57f4c44d56a8d667ea46ba9b451bd2
-
SSDEEP
12288:mXgvmzFHi0mo5aH0qMzd5807FIjPJQPDHvd:mXgvOHi0mGaH0qSdPFIl4V
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" 93c55deeee3cd963b82fea8d32b0848f35bb4679921045b07f8116c21c6634b7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" behmv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" behmv.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 93c55deeee3cd963b82fea8d32b0848f35bb4679921045b07f8116c21c6634b7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 93c55deeee3cd963b82fea8d32b0848f35bb4679921045b07f8116c21c6634b7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" behmv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 93c55deeee3cd963b82fea8d32b0848f35bb4679921045b07f8116c21c6634b7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" 93c55deeee3cd963b82fea8d32b0848f35bb4679921045b07f8116c21c6634b7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" behmv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" behmv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" behmv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" behmv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" behmv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" behmv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" behmv.exe -
Adds policy Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mquakk = "oeumiumnwqvxanajqq.exe" 93c55deeee3cd963b82fea8d32b0848f35bb4679921045b07f8116c21c6634b7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run behmv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lmn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\oeumiumnwqvxanajqq.exe" behmv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run behmv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lmn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fujavgxxfycdfrdlr.exe" behmv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mquakk = "ymaqkukjqillmxip.exe" behmv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mquakk = "oeumiumnwqvxanajqq.exe" behmv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mquakk = "zqhaxkdfpkqtxlzjrsd.exe" behmv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mquakk = "ymaqkukjqillmxip.exe" behmv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lmn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ymaqkukjqillmxip.exe" behmv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mquakk = "fujavgxxfycdfrdlr.exe" behmv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mquakk = "fujavgxxfycdfrdlr.exe" behmv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lmn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mewqocwzkgnrwlaluwia.exe" behmv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lmn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mewqocwzkgnrwlaluwia.exe" behmv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mquakk = "mewqocwzkgnrwlaluwia.exe" behmv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mquakk = "bunihwrvhemrxndpzcpib.exe" behmv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lmn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bunihwrvhemrxndpzcpib.exe" behmv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mquakk = "zqhaxkdfpkqtxlzjrsd.exe" behmv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mquakk = "mewqocwzkgnrwlaluwia.exe" behmv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lmn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\oeumiumnwqvxanajqq.exe" behmv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 93c55deeee3cd963b82fea8d32b0848f35bb4679921045b07f8116c21c6634b7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lmn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zqhaxkdfpkqtxlzjrsd.exe" behmv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lmn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zqhaxkdfpkqtxlzjrsd.exe" behmv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lmn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mewqocwzkgnrwlaluwia.exe" 93c55deeee3cd963b82fea8d32b0848f35bb4679921045b07f8116c21c6634b7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lmn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fujavgxxfycdfrdlr.exe" behmv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\lmn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ymaqkukjqillmxip.exe" behmv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\mquakk = "bunihwrvhemrxndpzcpib.exe" behmv.exe -
Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 93c55deeee3cd963b82fea8d32b0848f35bb4679921045b07f8116c21c6634b7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 93c55deeee3cd963b82fea8d32b0848f35bb4679921045b07f8116c21c6634b7.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" behmv.exe Set value (int) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" behmv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" behmv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" behmv.exe -
Executes dropped EXE 2 IoCs
pid Process 2692 behmv.exe 1680 behmv.exe -
Impair Defenses: Safe Mode Boot 1 TTPs 3 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\WinDefend behmv.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc behmv.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power behmv.exe -
Loads dropped DLL 4 IoCs
pid Process 2556 93c55deeee3cd963b82fea8d32b0848f35bb4679921045b07f8116c21c6634b7.exe 2556 93c55deeee3cd963b82fea8d32b0848f35bb4679921045b07f8116c21c6634b7.exe 2556 93c55deeee3cd963b82fea8d32b0848f35bb4679921045b07f8116c21c6634b7.exe 2556 93c55deeee3cd963b82fea8d32b0848f35bb4679921045b07f8116c21c6634b7.exe -
Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\suwa = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ymaqkukjqillmxip.exe" behmv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ouaiuwev = "mewqocwzkgnrwlaluwia.exe ." behmv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\behmv = "fujavgxxfycdfrdlr.exe ." behmv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ygoymqatug = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bunihwrvhemrxndpzcpib.exe" 93c55deeee3cd963b82fea8d32b0848f35bb4679921045b07f8116c21c6634b7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ygoymqatug = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bunihwrvhemrxndpzcpib.exe" behmv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\suwa = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mewqocwzkgnrwlaluwia.exe" behmv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\behmv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ymaqkukjqillmxip.exe ." behmv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fmtcpsbtt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ymaqkukjqillmxip.exe ." behmv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\behmv = "bunihwrvhemrxndpzcpib.exe ." behmv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\suwa = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zqhaxkdfpkqtxlzjrsd.exe" behmv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\behmv = "mewqocwzkgnrwlaluwia.exe ." behmv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\behmv = "ymaqkukjqillmxip.exe ." behmv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ouaiuwev = "ymaqkukjqillmxip.exe ." behmv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\suwa = "mewqocwzkgnrwlaluwia.exe" behmv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\behmv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bunihwrvhemrxndpzcpib.exe ." behmv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ouaiuwev = "oeumiumnwqvxanajqq.exe ." behmv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\behmv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zqhaxkdfpkqtxlzjrsd.exe ." 93c55deeee3cd963b82fea8d32b0848f35bb4679921045b07f8116c21c6634b7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\behmv = "bunihwrvhemrxndpzcpib.exe ." behmv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\behmv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ymaqkukjqillmxip.exe ." behmv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\suwa = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ymaqkukjqillmxip.exe" behmv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fmtcpsbtt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fujavgxxfycdfrdlr.exe ." behmv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\zejqbcj = "bunihwrvhemrxndpzcpib.exe" behmv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fmtcpsbtt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fujavgxxfycdfrdlr.exe ." behmv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\suwa = "C:\\Users\\Admin\\AppData\\Local\\Temp\\oeumiumnwqvxanajqq.exe" behmv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\suwa = "bunihwrvhemrxndpzcpib.exe" 93c55deeee3cd963b82fea8d32b0848f35bb4679921045b07f8116c21c6634b7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\suwa = "oeumiumnwqvxanajqq.exe" 93c55deeee3cd963b82fea8d32b0848f35bb4679921045b07f8116c21c6634b7.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\behmv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mewqocwzkgnrwlaluwia.exe ." behmv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\suwa = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fujavgxxfycdfrdlr.exe" behmv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\behmv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zqhaxkdfpkqtxlzjrsd.exe ." behmv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\suwa = "mewqocwzkgnrwlaluwia.exe" behmv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ouaiuwev = "fujavgxxfycdfrdlr.exe ." behmv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\behmv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fujavgxxfycdfrdlr.exe ." behmv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\behmv = "fujavgxxfycdfrdlr.exe ." 93c55deeee3cd963b82fea8d32b0848f35bb4679921045b07f8116c21c6634b7.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\zejqbcj = "zqhaxkdfpkqtxlzjrsd.exe" behmv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fmtcpsbtt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\oeumiumnwqvxanajqq.exe ." behmv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\zejqbcj = "ymaqkukjqillmxip.exe" behmv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\behmv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\oeumiumnwqvxanajqq.exe ." behmv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\zejqbcj = "fujavgxxfycdfrdlr.exe" behmv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fmtcpsbtt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mewqocwzkgnrwlaluwia.exe ." behmv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ygoymqatug = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zqhaxkdfpkqtxlzjrsd.exe" behmv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\behmv = "zqhaxkdfpkqtxlzjrsd.exe ." behmv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ygoymqatug = "C:\\Users\\Admin\\AppData\\Local\\Temp\\oeumiumnwqvxanajqq.exe" behmv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\zejqbcj = "mewqocwzkgnrwlaluwia.exe" behmv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\zejqbcj = "bunihwrvhemrxndpzcpib.exe" behmv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\suwa = "fujavgxxfycdfrdlr.exe" behmv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ygoymqatug = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fujavgxxfycdfrdlr.exe" behmv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fmtcpsbtt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bunihwrvhemrxndpzcpib.exe ." behmv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\behmv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\oeumiumnwqvxanajqq.exe ." behmv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\behmv = "oeumiumnwqvxanajqq.exe ." behmv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\behmv = "zqhaxkdfpkqtxlzjrsd.exe ." behmv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ygoymqatug = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ymaqkukjqillmxip.exe" behmv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fmtcpsbtt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bunihwrvhemrxndpzcpib.exe ." behmv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ygoymqatug = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ymaqkukjqillmxip.exe" behmv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\suwa = "zqhaxkdfpkqtxlzjrsd.exe" behmv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fmtcpsbtt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mewqocwzkgnrwlaluwia.exe ." behmv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\zejqbcj = "ymaqkukjqillmxip.exe" 93c55deeee3cd963b82fea8d32b0848f35bb4679921045b07f8116c21c6634b7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\suwa = "zqhaxkdfpkqtxlzjrsd.exe" behmv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fmtcpsbtt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\oeumiumnwqvxanajqq.exe ." behmv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\fmtcpsbtt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zqhaxkdfpkqtxlzjrsd.exe ." behmv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\suwa = "C:\\Users\\Admin\\AppData\\Local\\Temp\\oeumiumnwqvxanajqq.exe" 93c55deeee3cd963b82fea8d32b0848f35bb4679921045b07f8116c21c6634b7.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\ouaiuwev = "ymaqkukjqillmxip.exe ." behmv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ygoymqatug = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zqhaxkdfpkqtxlzjrsd.exe" behmv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\behmv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zqhaxkdfpkqtxlzjrsd.exe ." behmv.exe Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\zejqbcj = "mewqocwzkgnrwlaluwia.exe" 93c55deeee3cd963b82fea8d32b0848f35bb4679921045b07f8116c21c6634b7.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 93c55deeee3cd963b82fea8d32b0848f35bb4679921045b07f8116c21c6634b7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" behmv.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA behmv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" behmv.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA behmv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 93c55deeee3cd963b82fea8d32b0848f35bb4679921045b07f8116c21c6634b7.exe -
Hijack Execution Flow: Executable Installer File Permissions Weakness 1 TTPs 3 IoCs
Possible Turn off User Account Control's privilege elevation for standard users.
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" 93c55deeee3cd963b82fea8d32b0848f35bb4679921045b07f8116c21c6634b7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" behmv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" behmv.exe -
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 www.whatismyip.ca 4 whatismyipaddress.com 6 whatismyip.everdot.org 9 www.showmyipaddress.com -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\daxwzsrzpqclvpjznulif.haz behmv.exe File created C:\Windows\SysWOW64\daxwzsrzpqclvpjznulif.haz behmv.exe File opened for modification C:\Windows\SysWOW64\ygoymqatugdxsxcdcuwemwkoyrsebvqv.bas behmv.exe File created C:\Windows\SysWOW64\ygoymqatugdxsxcdcuwemwkoyrsebvqv.bas behmv.exe -
Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\daxwzsrzpqclvpjznulif.haz behmv.exe File created C:\Program Files (x86)\daxwzsrzpqclvpjznulif.haz behmv.exe File opened for modification C:\Program Files (x86)\ygoymqatugdxsxcdcuwemwkoyrsebvqv.bas behmv.exe File created C:\Program Files (x86)\ygoymqatugdxsxcdcuwemwkoyrsebvqv.bas behmv.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\ygoymqatugdxsxcdcuwemwkoyrsebvqv.bas behmv.exe File created C:\Windows\ygoymqatugdxsxcdcuwemwkoyrsebvqv.bas behmv.exe File opened for modification C:\Windows\daxwzsrzpqclvpjznulif.haz behmv.exe File created C:\Windows\daxwzsrzpqclvpjznulif.haz behmv.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language behmv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language behmv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 93c55deeee3cd963b82fea8d32b0848f35bb4679921045b07f8116c21c6634b7.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2692 behmv.exe 2692 behmv.exe 2692 behmv.exe 2692 behmv.exe 2692 behmv.exe 2692 behmv.exe 2692 behmv.exe 2692 behmv.exe 2692 behmv.exe 2692 behmv.exe 2692 behmv.exe 2692 behmv.exe 2692 behmv.exe 2692 behmv.exe 2692 behmv.exe 2692 behmv.exe 2692 behmv.exe 2692 behmv.exe 2692 behmv.exe 2692 behmv.exe 2692 behmv.exe 2692 behmv.exe 2692 behmv.exe 2692 behmv.exe 2692 behmv.exe 2692 behmv.exe 2692 behmv.exe 2692 behmv.exe 2692 behmv.exe 2692 behmv.exe 2692 behmv.exe 2692 behmv.exe 2692 behmv.exe 2692 behmv.exe 2692 behmv.exe 2692 behmv.exe 2692 behmv.exe 2692 behmv.exe 2692 behmv.exe 2692 behmv.exe 2692 behmv.exe 2692 behmv.exe 2692 behmv.exe 2692 behmv.exe 2692 behmv.exe 2692 behmv.exe 2692 behmv.exe 2692 behmv.exe 2692 behmv.exe 2692 behmv.exe 2692 behmv.exe 2692 behmv.exe 2692 behmv.exe 2692 behmv.exe 2692 behmv.exe 2692 behmv.exe 2692 behmv.exe 2692 behmv.exe 2692 behmv.exe 2692 behmv.exe 2692 behmv.exe 2692 behmv.exe 2692 behmv.exe 2692 behmv.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2692 behmv.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2556 wrote to memory of 2692 2556 93c55deeee3cd963b82fea8d32b0848f35bb4679921045b07f8116c21c6634b7.exe 30 PID 2556 wrote to memory of 2692 2556 93c55deeee3cd963b82fea8d32b0848f35bb4679921045b07f8116c21c6634b7.exe 30 PID 2556 wrote to memory of 2692 2556 93c55deeee3cd963b82fea8d32b0848f35bb4679921045b07f8116c21c6634b7.exe 30 PID 2556 wrote to memory of 2692 2556 93c55deeee3cd963b82fea8d32b0848f35bb4679921045b07f8116c21c6634b7.exe 30 PID 2556 wrote to memory of 1680 2556 93c55deeee3cd963b82fea8d32b0848f35bb4679921045b07f8116c21c6634b7.exe 31 PID 2556 wrote to memory of 1680 2556 93c55deeee3cd963b82fea8d32b0848f35bb4679921045b07f8116c21c6634b7.exe 31 PID 2556 wrote to memory of 1680 2556 93c55deeee3cd963b82fea8d32b0848f35bb4679921045b07f8116c21c6634b7.exe 31 PID 2556 wrote to memory of 1680 2556 93c55deeee3cd963b82fea8d32b0848f35bb4679921045b07f8116c21c6634b7.exe 31 -
System policy modification 1 TTPs 36 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 93c55deeee3cd963b82fea8d32b0848f35bb4679921045b07f8116c21c6634b7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" behmv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" 93c55deeee3cd963b82fea8d32b0848f35bb4679921045b07f8116c21c6634b7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" behmv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" behmv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" behmv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" behmv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" 93c55deeee3cd963b82fea8d32b0848f35bb4679921045b07f8116c21c6634b7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 93c55deeee3cd963b82fea8d32b0848f35bb4679921045b07f8116c21c6634b7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System behmv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" behmv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" behmv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" behmv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" behmv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 93c55deeee3cd963b82fea8d32b0848f35bb4679921045b07f8116c21c6634b7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" behmv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" behmv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" behmv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" behmv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 93c55deeee3cd963b82fea8d32b0848f35bb4679921045b07f8116c21c6634b7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" 93c55deeee3cd963b82fea8d32b0848f35bb4679921045b07f8116c21c6634b7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" behmv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" behmv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer behmv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" 93c55deeee3cd963b82fea8d32b0848f35bb4679921045b07f8116c21c6634b7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" 93c55deeee3cd963b82fea8d32b0848f35bb4679921045b07f8116c21c6634b7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" behmv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 93c55deeee3cd963b82fea8d32b0848f35bb4679921045b07f8116c21c6634b7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 93c55deeee3cd963b82fea8d32b0848f35bb4679921045b07f8116c21c6634b7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System behmv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" behmv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" behmv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" behmv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer behmv.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" 93c55deeee3cd963b82fea8d32b0848f35bb4679921045b07f8116c21c6634b7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" behmv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\93c55deeee3cd963b82fea8d32b0848f35bb4679921045b07f8116c21c6634b7.exe"C:\Users\Admin\AppData\Local\Temp\93c55deeee3cd963b82fea8d32b0848f35bb4679921045b07f8116c21c6634b7.exe"1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\behmv.exe"C:\Users\Admin\AppData\Local\Temp\behmv.exe" "-"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2692
-
-
C:\Users\Admin\AppData\Local\Temp\behmv.exe"C:\Users\Admin\AppData\Local\Temp\behmv.exe" "-"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- System Location Discovery: System Language Discovery
- System policy modification
PID:1680
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Impair Defenses
2Disable or Modify Tools
1Safe Mode Boot
1Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
280B
MD5e7ec6fa5d4daf6b71b8cf8db80f5cb83
SHA1585dffa4432cfff6f48867767e4a77b519db3532
SHA2567364ce06652a7f333406010c4866e7acfb896c7e058170c2345716fae5b24137
SHA512b3307ef0cbfadedde0da4656ec88a21a5485f5a33c4d0da436d09067d7b24c033ef63c7147de674938fbdc59fa10b454548dfc0e68c401ac3f1ec39df135e2b1
-
Filesize
280B
MD5098b9e4ddb9a5b4149ceec76c8d6a5c3
SHA161764459fa17ab3182316adc89fbaf1c28600b7b
SHA256eec0e72b64e66f2656de8297b2e0098e3d0a14793d1f55312435b01260829502
SHA512c4328080a53bdce1ef26420fee26f996c6651f7a07b42634c5d991f1f9847a68fe83283936b243f0fa16f42477812ace3ac651e63265e6b709c9cfe9dd6edde8
-
Filesize
280B
MD5c152d40a4254f8963607255be80dba2a
SHA168e95064b76d4f9bac1848cf89903ff9b86c997c
SHA2561033a780ad5c808e1b00d563d0faa499b22b56413f546df33d2a80d707b6f2ec
SHA5123a840361f525949da4f4662adf91e55e06a1203a6de82b8b53b2eada18314206a6824194597111cfa3d23232e6a2ac18b3cb28c95136afb295bca4ec197f1560
-
Filesize
280B
MD50cbaa8d6a67c107e840d04173c8abd77
SHA1706b1073b1bc792bce6a5af0710af2837645d32d
SHA256a3b813c5f492ad6b62f2297e110b7d1383a66bdaf5aeaa4643916a99fb54e730
SHA512e8cfba2355878386cedf1713db311c85147f6df8a37b38a694f6d69a2b96dde066b2504198a1f25cdd397de2d644b9cfa2147ba361dd30204cb049da7f465e45
-
Filesize
280B
MD510eaec5254c943644fb63a0343f1d52e
SHA12f3ed94204648c57f718b9e4825f1f2f221ca7e5
SHA25627644ff81f3776ded59a29b327081ebc21af18447aa3677032f5777c4bd8ab89
SHA512b8ed4dc5886e3f0e49619ffdc88c532efce229054bebf27119ae0725a9db21beeb292059c4aeca465c4f382086cde41edf986b0b3ccc8068140282249ee51ad2
-
Filesize
280B
MD554501f6f0f3703b573f041d0e29298bd
SHA1cfd7e2a58d17caf231aca1942d81ee5eb38058a5
SHA256cf6b44daa42b5161d2722e5caf225691b7349c30412ec9054e1a0a9af3c81ffe
SHA512253d832e30cab2ac84c181702a092ae521f496b6ccd358ab67335afbfb08d243e48de5805d9e3cf0592fb05d1e71cbff363714b025a66286fdb10b9d6a55808f
-
Filesize
280B
MD5b3266570de108058b91f97bf3ccdfc41
SHA18f79b6f66fb34599bba67080593aab1cf44d07c0
SHA256c88dc4e44d1967effc8c2a738326f5e62480c1732f3fb702afb53920e9c65919
SHA512dbefdcdce6bf3e2a4717f99bd29ff88dab30b64471cfc2b5e62fbdc5e25150583cd32cd59be9291c0af0ee86bd884f4e594b853c445dff9c8d86a62ce14611d3
-
Filesize
280B
MD53dc34aab928bc9fc57b014e9d855f74c
SHA19743f877a54a6d2396e6cdbf8e95acb6582a5733
SHA256fa2562a1f855fb36c72b6991f6fc3fac754c26a698db08fb0f30068f363905a4
SHA512816c06aa7064972e54e10b79dfe41338834aa49886145031d1835d4a4766cdc5c6a3ea64929495bece9c3fdfe45c7317076be4627723e3d41882d046fb100e8c
-
Filesize
4KB
MD5ef43a2cde914fd8c6494ce3ef2da27be
SHA1d294e3ee18060bb5aa2c8590131c91e5a81c8fe0
SHA256b4640375716dc06e4f4bbc129bf32d6a944c892cb84334a555da5b69947106c0
SHA512865a92400dff6e9ea336fa074d4646591ca96373ef8af711636298fbc01cf111ebb7d9d6cf61b7bc755604c502a5eaf35d325dfaf370bc8f68f49a7e1114d031
-
Filesize
1.3MB
MD506b9342900050e273413d7f91a1f1310
SHA162149296967f5b5205d9b3aada7a1313664d4d30
SHA25672faf095d3b8390ca1088bda0e257303d3ffec5dbcf09a3715eb659e9078d5dc
SHA5123173e5fc9575ea6185598190a401980a105d8b117793bcd87c73c9719b07c96fd8f46eed2605eea4b88afa79277f1c64d76c7ee301737b0be2dcf9e563c204ce