Analysis
- max time kernel
150s - max time network
157s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
22/05/2026, 14:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
tmpt7adq8_c.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
23 signatures
150 seconds
Behavioral task
behavioral2
Sample
tmpt7adq8_c.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
24 signatures
150 seconds
Behavioral task
behavioral3
Sample
tmpt7adq8_c.exe
Resource
win11-20260513-en
windows11-21h2-x64
23 signatures
150 seconds
General
- Target tmpt7adq8_c.exe
- Size 556KB
- Sample260522-r6d2saev4l
- SHA256 4f2e79bff34a37383bcc555b0ca392660d4f2354ce6d0fd1ed4146989745f391
- MD5 f670af7cf3e34f9e83a066d42d15f69f
- SHA1 07ff77c32864d3bd86b3c7871650e23a481b8d4f
- SHA512 a8b642d40c2d059b72859347f6db63795cf7691a2ac7b9500f901d692bb9aeb01d1afd690eaa46be18b071a04a7ccfb4ad1ebfb6dcf48a0571203ab8946b0fa8
- SSDEEP 6144:5j6/wndfF/gl0LQIk8DR3dEuAI7pEfxsZozAm9TMdGQLUg1nYmefPImdrionr:p6onxOp8FySpE5zvIdtU+Ymef
- TLSH T1B6C4F1189A433B7BED13C9FC918E54F916DACC9323C5011B9BF0A7D689F02E5841ED9A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detect Pykspa worm 2 IoCs
resource yara_rule behavioral3/files/0x0014000000028df4-4.dat family_pykspa behavioral3/files/0x001a00000002b54a-73.dat family_pykspa - Modifies WinLogon for persistence 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" umtekhkhewd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" adqoegr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" adqoegr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" umtekhkhewd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" umtekhkhewd.exe - UAC bypass 3 TTPs 14 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" adqoegr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" umtekhkhewd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" adqoegr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" adqoegr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" adqoegr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" umtekhkhewd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" adqoegr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" adqoegr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" umtekhkhewd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" umtekhkhewd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" umtekhkhewd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" umtekhkhewd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" adqoegr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" adqoegr.exe - Adds policy Run key to start application 2 TTPs 31 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run adqoegr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ttdy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nddorgetolmcwlrdjpff.exe" adqoegr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\adqoegr = "nddorgetolmcwlrdjpff.exe" adqoegr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ttdy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zlhonysdunkwmxzh.exe" adqoegr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ttdy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\apoyaolztppexlqbgla.exe" adqoegr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run umtekhkhewd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\adqoegr = "apoyaolztppexlqbgla.exe" umtekhkhewd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\adqoegr = "ctugkazpljlcxnuhovmnz.exe" adqoegr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ttdy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ctugkazpljlcxnuhovmnz.exe" umtekhkhewd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\adqoegr = "gtqyykfrjdbofrudg.exe" adqoegr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ttdy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\apoyaolztppexlqbgla.exe" adqoegr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\adqoegr = "pdbklyuhavuianrbfj.exe" umtekhkhewd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ttdy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nddorgetolmcwlrdjpff.exe" umtekhkhewd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ttdy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gtqyykfrjdbofrudg.exe" adqoegr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ttdy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zlhonysdunkwmxzh.exe" adqoegr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ttdy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\apoyaolztppexlqbgla.exe" umtekhkhewd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run adqoegr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ttdy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ctugkazpljlcxnuhovmnz.exe" adqoegr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ttdy = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ctugkazpljlcxnuhovmnz.exe" adqoegr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\adqoegr = "apoyaolztppexlqbgla.exe" adqoegr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\adqoegr = "pdbklyuhavuianrbfj.exe" adqoegr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\adqoegr = "apoyaolztppexlqbgla.exe" adqoegr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\adqoegr = "pdbklyuhavuianrbfj.exe" adqoegr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\adqoegr = "gtqyykfrjdbofrudg.exe" adqoegr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run umtekhkhewd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\adqoegr = "zlhonysdunkwmxzh.exe" adqoegr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\adqoegr = "ctugkazpljlcxnuhovmnz.exe" adqoegr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\adqoegr = "nddorgetolmcwlrdjpff.exe" adqoegr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run umtekhkhewd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\adqoegr = "ctugkazpljlcxnuhovmnz.exe" umtekhkhewd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\adqoegr = "zlhonysdunkwmxzh.exe" adqoegr.exe - Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" adqoegr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" adqoegr.exe Set value (int) \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" umtekhkhewd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" umtekhkhewd.exe Set value (int) \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" adqoegr.exe Set value (int) \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" adqoegr.exe - Executes dropped EXE 28 IoCs
pid Process 800 umtekhkhewd.exe 5888 gtqyykfrjdbofrudg.exe 3960 zlhonysdunkwmxzh.exe 856 zlhonysdunkwmxzh.exe 652 apoyaolztppexlqbgla.exe 3308 nddorgetolmcwlrdjpff.exe 3984 umtekhkhewd.exe 884 umtekhkhewd.exe 1696 ctugkazpljlcxnuhovmnz.exe 4512 adqoegr.exe 5056 adqoegr.exe 2136 apoyaolztppexlqbgla.exe 1608 umtekhkhewd.exe 3964 zlhonysdunkwmxzh.exe 3484 pdbklyuhavuianrbfj.exe 6052 apoyaolztppexlqbgla.exe 4544 ctugkazpljlcxnuhovmnz.exe 5872 gtqyykfrjdbofrudg.exe 2884 umtekhkhewd.exe 4848 nddorgetolmcwlrdjpff.exe 2960 ctugkazpljlcxnuhovmnz.exe 3084 umtekhkhewd.exe 2404 umtekhkhewd.exe 5088 pdbklyuhavuianrbfj.exe 2168 nddorgetolmcwlrdjpff.exe 3228 pdbklyuhavuianrbfj.exe 4764 gtqyykfrjdbofrudg.exe 5200 umtekhkhewd.exe - Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UserManager adqoegr.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SerCx2.sys adqoegr.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc adqoegr.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power adqoegr.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iai2c.sys adqoegr.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CBDHSvc adqoegr.exe - Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\glaaswjnx = "zlhonysdunkwmxzh.exe ." adqoegr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ubsuoujpbph = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zlhonysdunkwmxzh.exe" adqoegr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\cdoky = "nddorgetolmcwlrdjpff.exe" adqoegr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\npbyno = "zlhonysdunkwmxzh.exe ." adqoegr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ubsuoujpbph = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ctugkazpljlcxnuhovmnz.exe" adqoegr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\cdoky = "apoyaolztppexlqbgla.exe" umtekhkhewd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\npbyno = "zlhonysdunkwmxzh.exe ." adqoegr.exe Set value (str) \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\glaaswjnx = "pdbklyuhavuianrbfj.exe ." adqoegr.exe Set value (str) \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\npbyno = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nddorgetolmcwlrdjpff.exe ." umtekhkhewd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zfvwpuinyl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zlhonysdunkwmxzh.exe ." adqoegr.exe Set value (str) \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\glaaswjnx = "ctugkazpljlcxnuhovmnz.exe ." adqoegr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ubsuoujpbph = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gtqyykfrjdbofrudg.exe" adqoegr.exe Set value (str) \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\Run\pthgxamp = "apoyaolztppexlqbgla.exe" adqoegr.exe Set value (str) \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\Run\pthgxamp = "zlhonysdunkwmxzh.exe" umtekhkhewd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zfvwpuinyl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nddorgetolmcwlrdjpff.exe ." umtekhkhewd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ubsuoujpbph = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gtqyykfrjdbofrudg.exe" umtekhkhewd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\npbyno = "ctugkazpljlcxnuhovmnz.exe ." adqoegr.exe Set value (str) \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\Run\pthgxamp = "nddorgetolmcwlrdjpff.exe" adqoegr.exe Set value (str) \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\glaaswjnx = "apoyaolztppexlqbgla.exe ." adqoegr.exe Set value (str) \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\Run\cdoky = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ctugkazpljlcxnuhovmnz.exe" adqoegr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ubsuoujpbph = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nddorgetolmcwlrdjpff.exe" umtekhkhewd.exe Set value (str) \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\Run\cdoky = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gtqyykfrjdbofrudg.exe" adqoegr.exe Set value (str) \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\Run\cdoky = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nddorgetolmcwlrdjpff.exe" adqoegr.exe Set value (str) \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\npbyno = "C:\\Users\\Admin\\AppData\\Local\\Temp\\apoyaolztppexlqbgla.exe ." adqoegr.exe Set value (str) \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\Run\cdoky = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ctugkazpljlcxnuhovmnz.exe" adqoegr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zfvwpuinyl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ctugkazpljlcxnuhovmnz.exe ." adqoegr.exe Set value (str) \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\npbyno = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zlhonysdunkwmxzh.exe ." adqoegr.exe Set value (str) \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\glaaswjnx = "pdbklyuhavuianrbfj.exe ." adqoegr.exe Set value (str) \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\Run\pthgxamp = "nddorgetolmcwlrdjpff.exe" adqoegr.exe Set value (str) \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\glaaswjnx = "gtqyykfrjdbofrudg.exe ." adqoegr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\cdoky = "pdbklyuhavuianrbfj.exe" adqoegr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zfvwpuinyl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\apoyaolztppexlqbgla.exe ." adqoegr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zfvwpuinyl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gtqyykfrjdbofrudg.exe ." adqoegr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ubsuoujpbph = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gtqyykfrjdbofrudg.exe" adqoegr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\cdoky = "apoyaolztppexlqbgla.exe" umtekhkhewd.exe Set value (str) \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\glaaswjnx = "gtqyykfrjdbofrudg.exe ." adqoegr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zfvwpuinyl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\apoyaolztppexlqbgla.exe ." adqoegr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\npbyno = "apoyaolztppexlqbgla.exe ." adqoegr.exe Set value (str) \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\glaaswjnx = "zlhonysdunkwmxzh.exe ." adqoegr.exe Set value (str) \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\glaaswjnx = "nddorgetolmcwlrdjpff.exe ." umtekhkhewd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\cdoky = "zlhonysdunkwmxzh.exe" adqoegr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\npbyno = "apoyaolztppexlqbgla.exe ." adqoegr.exe Set value (str) \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\glaaswjnx = "ctugkazpljlcxnuhovmnz.exe ." umtekhkhewd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\npbyno = "pdbklyuhavuianrbfj.exe ." adqoegr.exe Set value (str) \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\Run\cdoky = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gtqyykfrjdbofrudg.exe" adqoegr.exe Set value (str) \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\Run\pthgxamp = "gtqyykfrjdbofrudg.exe" adqoegr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zfvwpuinyl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pdbklyuhavuianrbfj.exe ." adqoegr.exe Set value (str) \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\Run\cdoky = "C:\\Users\\Admin\\AppData\\Local\\Temp\\apoyaolztppexlqbgla.exe" adqoegr.exe Set value (str) \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\Run\pthgxamp = "zlhonysdunkwmxzh.exe" umtekhkhewd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\cdoky = "ctugkazpljlcxnuhovmnz.exe" adqoegr.exe Set value (str) \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\npbyno = "C:\\Users\\Admin\\AppData\\Local\\Temp\\apoyaolztppexlqbgla.exe ." adqoegr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ubsuoujpbph = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nddorgetolmcwlrdjpff.exe" adqoegr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zfvwpuinyl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nddorgetolmcwlrdjpff.exe ." adqoegr.exe Set value (str) \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\glaaswjnx = "apoyaolztppexlqbgla.exe ." adqoegr.exe Set value (str) \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\npbyno = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gtqyykfrjdbofrudg.exe ." adqoegr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ubsuoujpbph = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ctugkazpljlcxnuhovmnz.exe" adqoegr.exe Set value (str) \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\npbyno = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gtqyykfrjdbofrudg.exe ." adqoegr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\npbyno = "pdbklyuhavuianrbfj.exe ." adqoegr.exe Set value (str) \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\npbyno = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nddorgetolmcwlrdjpff.exe ." adqoegr.exe Set value (str) \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\Run\cdoky = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ctugkazpljlcxnuhovmnz.exe" umtekhkhewd.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\cdoky = "pdbklyuhavuianrbfj.exe" adqoegr.exe Set value (str) \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\Run\cdoky = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pdbklyuhavuianrbfj.exe" adqoegr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zfvwpuinyl = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pdbklyuhavuianrbfj.exe ." adqoegr.exe Set value (str) \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\npbyno = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nddorgetolmcwlrdjpff.exe ." adqoegr.exe - Checks whether UAC is enabled 1 TTPs 10 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA adqoegr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" adqoegr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" umtekhkhewd.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA umtekhkhewd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" umtekhkhewd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" umtekhkhewd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" adqoegr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA adqoegr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA umtekhkhewd.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA umtekhkhewd.exe - Hijack Execution Flow: Executable Installer File Permissions Weakness 1 TTPs 3 IoCs
Possible Turn off User Account Control's privilege elevation for standard users.
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" adqoegr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" adqoegr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" umtekhkhewd.exe - Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 whatismyipaddress.com 1 www.showmyipaddress.com 1 whatismyip.everdot.org 1 www.whatismyip.ca - Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created C:\autorun.inf adqoegr.exe File opened for modification F:\autorun.inf adqoegr.exe File created F:\autorun.inf adqoegr.exe File opened for modification C:\autorun.inf adqoegr.exe - Drops file in System32 directory 39 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\zlhonysdunkwmxzh.exe umtekhkhewd.exe File opened for modification C:\Windows\SysWOW64\pdbklyuhavuianrbfj.exe umtekhkhewd.exe File opened for modification C:\Windows\SysWOW64\nddorgetolmcwlrdjpff.exe umtekhkhewd.exe File opened for modification C:\Windows\SysWOW64\zlhonysdunkwmxzh.exe adqoegr.exe File opened for modification C:\Windows\SysWOW64\nddorgetolmcwlrdjpff.exe adqoegr.exe File opened for modification C:\Windows\SysWOW64\ctugkazpljlcxnuhovmnz.exe adqoegr.exe File opened for modification C:\Windows\SysWOW64\nddorgetolmcwlrdjpff.exe umtekhkhewd.exe File opened for modification C:\Windows\SysWOW64\tlnafwwnkjmearznvdvxkp.exe umtekhkhewd.exe File opened for modification C:\Windows\SysWOW64\nddorgetolmcwlrdjpff.exe adqoegr.exe File opened for modification C:\Windows\SysWOW64\apoyaolztppexlqbgla.exe adqoegr.exe File opened for modification C:\Windows\SysWOW64\pdbklyuhavuianrbfj.exe umtekhkhewd.exe File opened for modification C:\Windows\SysWOW64\zlhonysdunkwmxzh.exe umtekhkhewd.exe File opened for modification C:\Windows\SysWOW64\zlhonysdunkwmxzh.exe adqoegr.exe File opened for modification C:\Windows\SysWOW64\ctugkazpljlcxnuhovmnz.exe adqoegr.exe File opened for modification C:\Windows\SysWOW64\ttdylksrwdoosrhdtjjtobaihm.eei adqoegr.exe File created C:\Windows\SysWOW64\ufageohrhzvgvfgnopavbzjcmcuqbqabijkvq.uex adqoegr.exe File opened for modification C:\Windows\SysWOW64\gtqyykfrjdbofrudg.exe umtekhkhewd.exe File opened for modification C:\Windows\SysWOW64\gtqyykfrjdbofrudg.exe umtekhkhewd.exe File opened for modification C:\Windows\SysWOW64\apoyaolztppexlqbgla.exe umtekhkhewd.exe File opened for modification C:\Windows\SysWOW64\gtqyykfrjdbofrudg.exe adqoegr.exe File opened for modification C:\Windows\SysWOW64\apoyaolztppexlqbgla.exe adqoegr.exe File opened for modification C:\Windows\SysWOW64\pdbklyuhavuianrbfj.exe adqoegr.exe File opened for modification C:\Windows\SysWOW64\apoyaolztppexlqbgla.exe umtekhkhewd.exe File opened for modification C:\Windows\SysWOW64\nddorgetolmcwlrdjpff.exe umtekhkhewd.exe File opened for modification C:\Windows\SysWOW64\pdbklyuhavuianrbfj.exe adqoegr.exe File opened for modification C:\Windows\SysWOW64\gtqyykfrjdbofrudg.exe adqoegr.exe File opened for modification C:\Windows\SysWOW64\tlnafwwnkjmearznvdvxkp.exe adqoegr.exe File opened for modification C:\Windows\SysWOW64\zlhonysdunkwmxzh.exe umtekhkhewd.exe File opened for modification C:\Windows\SysWOW64\ctugkazpljlcxnuhovmnz.exe umtekhkhewd.exe File opened for modification C:\Windows\SysWOW64\tlnafwwnkjmearznvdvxkp.exe umtekhkhewd.exe File created C:\Windows\SysWOW64\ttdylksrwdoosrhdtjjtobaihm.eei adqoegr.exe File opened for modification C:\Windows\SysWOW64\ufageohrhzvgvfgnopavbzjcmcuqbqabijkvq.uex adqoegr.exe File opened for modification C:\Windows\SysWOW64\ctugkazpljlcxnuhovmnz.exe umtekhkhewd.exe File opened for modification C:\Windows\SysWOW64\tlnafwwnkjmearznvdvxkp.exe umtekhkhewd.exe File opened for modification C:\Windows\SysWOW64\apoyaolztppexlqbgla.exe umtekhkhewd.exe File opened for modification C:\Windows\SysWOW64\tlnafwwnkjmearznvdvxkp.exe adqoegr.exe File opened for modification C:\Windows\SysWOW64\gtqyykfrjdbofrudg.exe umtekhkhewd.exe File opened for modification C:\Windows\SysWOW64\pdbklyuhavuianrbfj.exe umtekhkhewd.exe File opened for modification C:\Windows\SysWOW64\ctugkazpljlcxnuhovmnz.exe umtekhkhewd.exe - Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\ttdylksrwdoosrhdtjjtobaihm.eei adqoegr.exe File created C:\Program Files (x86)\ttdylksrwdoosrhdtjjtobaihm.eei adqoegr.exe File opened for modification C:\Program Files (x86)\ufageohrhzvgvfgnopavbzjcmcuqbqabijkvq.uex adqoegr.exe File created C:\Program Files (x86)\ufageohrhzvgvfgnopavbzjcmcuqbqabijkvq.uex adqoegr.exe - Drops file in Windows directory 39 IoCs
description ioc Process File opened for modification C:\Windows\pdbklyuhavuianrbfj.exe umtekhkhewd.exe File opened for modification C:\Windows\ctugkazpljlcxnuhovmnz.exe umtekhkhewd.exe File opened for modification C:\Windows\zlhonysdunkwmxzh.exe adqoegr.exe File opened for modification C:\Windows\apoyaolztppexlqbgla.exe adqoegr.exe File opened for modification C:\Windows\tlnafwwnkjmearznvdvxkp.exe adqoegr.exe File opened for modification C:\Windows\nddorgetolmcwlrdjpff.exe umtekhkhewd.exe File opened for modification C:\Windows\apoyaolztppexlqbgla.exe umtekhkhewd.exe File opened for modification C:\Windows\nddorgetolmcwlrdjpff.exe adqoegr.exe File created C:\Windows\ttdylksrwdoosrhdtjjtobaihm.eei adqoegr.exe File created C:\Windows\ufageohrhzvgvfgnopavbzjcmcuqbqabijkvq.uex adqoegr.exe File opened for modification C:\Windows\pdbklyuhavuianrbfj.exe umtekhkhewd.exe File opened for modification C:\Windows\zlhonysdunkwmxzh.exe umtekhkhewd.exe File opened for modification C:\Windows\pdbklyuhavuianrbfj.exe umtekhkhewd.exe File opened for modification C:\Windows\nddorgetolmcwlrdjpff.exe adqoegr.exe File opened for modification C:\Windows\gtqyykfrjdbofrudg.exe umtekhkhewd.exe File opened for modification C:\Windows\nddorgetolmcwlrdjpff.exe umtekhkhewd.exe File opened for modification C:\Windows\tlnafwwnkjmearznvdvxkp.exe umtekhkhewd.exe File opened for modification C:\Windows\apoyaolztppexlqbgla.exe umtekhkhewd.exe File opened for modification C:\Windows\zlhonysdunkwmxzh.exe umtekhkhewd.exe File opened for modification C:\Windows\gtqyykfrjdbofrudg.exe adqoegr.exe File opened for modification C:\Windows\ufageohrhzvgvfgnopavbzjcmcuqbqabijkvq.uex adqoegr.exe File opened for modification C:\Windows\zlhonysdunkwmxzh.exe umtekhkhewd.exe File opened for modification C:\Windows\tlnafwwnkjmearznvdvxkp.exe umtekhkhewd.exe File opened for modification C:\Windows\gtqyykfrjdbofrudg.exe umtekhkhewd.exe File opened for modification C:\Windows\apoyaolztppexlqbgla.exe umtekhkhewd.exe File opened for modification C:\Windows\nddorgetolmcwlrdjpff.exe umtekhkhewd.exe File opened for modification C:\Windows\ctugkazpljlcxnuhovmnz.exe umtekhkhewd.exe File opened for modification C:\Windows\apoyaolztppexlqbgla.exe adqoegr.exe File opened for modification C:\Windows\zlhonysdunkwmxzh.exe adqoegr.exe File opened for modification C:\Windows\gtqyykfrjdbofrudg.exe adqoegr.exe File opened for modification C:\Windows\pdbklyuhavuianrbfj.exe adqoegr.exe File opened for modification C:\Windows\gtqyykfrjdbofrudg.exe umtekhkhewd.exe File opened for modification C:\Windows\ctugkazpljlcxnuhovmnz.exe umtekhkhewd.exe File opened for modification C:\Windows\pdbklyuhavuianrbfj.exe adqoegr.exe File opened for modification C:\Windows\ctugkazpljlcxnuhovmnz.exe adqoegr.exe File opened for modification C:\Windows\tlnafwwnkjmearznvdvxkp.exe adqoegr.exe File opened for modification C:\Windows\ctugkazpljlcxnuhovmnz.exe adqoegr.exe File opened for modification C:\Windows\ttdylksrwdoosrhdtjjtobaihm.eei adqoegr.exe File opened for modification C:\Windows\tlnafwwnkjmearznvdvxkp.exe umtekhkhewd.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 18 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zlhonysdunkwmxzh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language adqoegr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language apoyaolztppexlqbgla.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zlhonysdunkwmxzh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdbklyuhavuianrbfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ctugkazpljlcxnuhovmnz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gtqyykfrjdbofrudg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ctugkazpljlcxnuhovmnz.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language gtqyykfrjdbofrudg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdbklyuhavuianrbfj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language umtekhkhewd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language apoyaolztppexlqbgla.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language apoyaolztppexlqbgla.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nddorgetolmcwlrdjpff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpt7adq8_c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zlhonysdunkwmxzh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nddorgetolmcwlrdjpff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ctugkazpljlcxnuhovmnz.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings explorer.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1028 tmpt7adq8_c.exe 1028 tmpt7adq8_c.exe 1028 tmpt7adq8_c.exe 1028 tmpt7adq8_c.exe 1028 tmpt7adq8_c.exe 1028 tmpt7adq8_c.exe 1028 tmpt7adq8_c.exe 1028 tmpt7adq8_c.exe 1028 tmpt7adq8_c.exe 1028 tmpt7adq8_c.exe 1028 tmpt7adq8_c.exe 1028 tmpt7adq8_c.exe 1028 tmpt7adq8_c.exe 1028 tmpt7adq8_c.exe 1028 tmpt7adq8_c.exe 1028 tmpt7adq8_c.exe 4512 adqoegr.exe 4512 adqoegr.exe 1028 tmpt7adq8_c.exe 1028 tmpt7adq8_c.exe 1028 tmpt7adq8_c.exe 1028 tmpt7adq8_c.exe 1028 tmpt7adq8_c.exe 1028 tmpt7adq8_c.exe 1028 tmpt7adq8_c.exe 1028 tmpt7adq8_c.exe 1028 tmpt7adq8_c.exe 1028 tmpt7adq8_c.exe 1028 tmpt7adq8_c.exe 1028 tmpt7adq8_c.exe 1028 tmpt7adq8_c.exe 1028 tmpt7adq8_c.exe 1028 tmpt7adq8_c.exe 1028 tmpt7adq8_c.exe 1028 tmpt7adq8_c.exe 1028 tmpt7adq8_c.exe 1028 tmpt7adq8_c.exe 1028 tmpt7adq8_c.exe 1028 tmpt7adq8_c.exe 1028 tmpt7adq8_c.exe 1028 tmpt7adq8_c.exe 1028 tmpt7adq8_c.exe 1028 tmpt7adq8_c.exe 1028 tmpt7adq8_c.exe 4512 adqoegr.exe 4512 adqoegr.exe 1028 tmpt7adq8_c.exe 1028 tmpt7adq8_c.exe 1028 tmpt7adq8_c.exe 1028 tmpt7adq8_c.exe 1028 tmpt7adq8_c.exe 1028 tmpt7adq8_c.exe 1028 tmpt7adq8_c.exe 1028 tmpt7adq8_c.exe 1028 tmpt7adq8_c.exe 1028 tmpt7adq8_c.exe 1028 tmpt7adq8_c.exe 1028 tmpt7adq8_c.exe 1028 tmpt7adq8_c.exe 1028 tmpt7adq8_c.exe 1028 tmpt7adq8_c.exe 1028 tmpt7adq8_c.exe 1028 tmpt7adq8_c.exe 1028 tmpt7adq8_c.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4512 adqoegr.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 1028 wrote to memory of 800 1028 tmpt7adq8_c.exe 80 PID 5888 wrote to memory of 3984 5888 gtqyykfrjdbofrudg.exe 95 PID 856 wrote to memory of 884 856 zlhonysdunkwmxzh.exe 96 PID 800 wrote to memory of 4512 800 umtekhkhewd.exe 100 PID 800 wrote to memory of 5056 800 umtekhkhewd.exe 101 PID 2136 wrote to memory of 1608 2136 apoyaolztppexlqbgla.exe 104 PID 3484 wrote to memory of 2884 3484 pdbklyuhavuianrbfj.exe 117 PID 2960 wrote to memory of 3084 2960 ctugkazpljlcxnuhovmnz.exe 123 PID 4848 wrote to memory of 2404 4848 nddorgetolmcwlrdjpff.exe 124 PID 1028 wrote to memory of 5200 1028 tmpt7adq8_c.exe 134 - System policy modification 1 TTPs 40 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" adqoegr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" umtekhkhewd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" adqoegr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" adqoegr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" umtekhkhewd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" umtekhkhewd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer adqoegr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" adqoegr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System umtekhkhewd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" umtekhkhewd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" umtekhkhewd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" umtekhkhewd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System adqoegr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" adqoegr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" adqoegr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" adqoegr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" adqoegr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" adqoegr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" umtekhkhewd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" adqoegr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" umtekhkhewd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" adqoegr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" adqoegr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" adqoegr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System umtekhkhewd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System umtekhkhewd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" adqoegr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" adqoegr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" umtekhkhewd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" adqoegr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" adqoegr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer adqoegr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" adqoegr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System adqoegr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" adqoegr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" adqoegr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" umtekhkhewd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" umtekhkhewd.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" umtekhkhewd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer umtekhkhewd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmpt7adq8_c.exe"C:\Users\Admin\AppData\Local\Temp\tmpt7adq8_c.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\umtekhkhewd.exe"C:\Users\Admin\AppData\Local\Temp\umtekhkhewd.exe" "c:\users\admin\appdata\local\temp\tmpt7adq8_c.exe*"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
- System policy modification
PID:800 -
C:\Users\Admin\AppData\Local\Temp\adqoegr.exe"C:\Users\Admin\AppData\Local\Temp\adqoegr.exe" "-C:\Users\Admin\AppData\Local\Temp\zlhonysdunkwmxzh.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:4512
-
-
C:\Users\Admin\AppData\Local\Temp\adqoegr.exe"C:\Users\Admin\AppData\Local\Temp\adqoegr.exe" "-C:\Users\Admin\AppData\Local\Temp\zlhonysdunkwmxzh.exe"3⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- Drops file in System32 directory
- Drops file in Windows directory
- System policy modification
PID:5056
-
-
-
C:\Users\Admin\AppData\Local\Temp\umtekhkhewd.exe"C:\Users\Admin\AppData\Local\Temp\umtekhkhewd.exe" "c:\users\admin\appdata\local\temp\tmpt7adq8_c.exe"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- System policy modification
PID:5200
-
-
C:\Windows\explorer.exeExplorer.exe1⤵
- Modifies registry class
PID:5324
-
C:\Windows\gtqyykfrjdbofrudg.exegtqyykfrjdbofrudg.exe .1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5888 -
C:\Users\Admin\AppData\Local\Temp\umtekhkhewd.exe"C:\Users\Admin\AppData\Local\Temp\umtekhkhewd.exe" "c:\windows\gtqyykfrjdbofrudg.exe*."2⤵
- Executes dropped EXE
PID:3984
-
-
C:\Windows\zlhonysdunkwmxzh.exezlhonysdunkwmxzh.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3960
-
C:\Windows\zlhonysdunkwmxzh.exezlhonysdunkwmxzh.exe .1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Users\Admin\AppData\Local\Temp\umtekhkhewd.exe"C:\Users\Admin\AppData\Local\Temp\umtekhkhewd.exe" "c:\windows\zlhonysdunkwmxzh.exe*."2⤵
- Executes dropped EXE
PID:884
-
-
C:\Windows\apoyaolztppexlqbgla.exeapoyaolztppexlqbgla.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:652
-
C:\Users\Admin\AppData\Local\Temp\nddorgetolmcwlrdjpff.exeC:\Users\Admin\AppData\Local\Temp\nddorgetolmcwlrdjpff.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3308
-
C:\Users\Admin\AppData\Local\Temp\ctugkazpljlcxnuhovmnz.exeC:\Users\Admin\AppData\Local\Temp\ctugkazpljlcxnuhovmnz.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1696
-
C:\Windows\apoyaolztppexlqbgla.exeapoyaolztppexlqbgla.exe .1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\umtekhkhewd.exe"C:\Users\Admin\AppData\Local\Temp\umtekhkhewd.exe" "c:\windows\apoyaolztppexlqbgla.exe*."2⤵
- Executes dropped EXE
PID:1608
-
-
C:\Users\Admin\AppData\Local\Temp\zlhonysdunkwmxzh.exeC:\Users\Admin\AppData\Local\Temp\zlhonysdunkwmxzh.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3964
-
C:\Windows\pdbklyuhavuianrbfj.exepdbklyuhavuianrbfj.exe .1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\umtekhkhewd.exe"C:\Users\Admin\AppData\Local\Temp\umtekhkhewd.exe" "c:\windows\pdbklyuhavuianrbfj.exe*."2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Windows directory
- System policy modification
PID:2884
-
-
C:\Users\Admin\AppData\Local\Temp\apoyaolztppexlqbgla.exeC:\Users\Admin\AppData\Local\Temp\apoyaolztppexlqbgla.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6052
-
C:\Windows\ctugkazpljlcxnuhovmnz.exectugkazpljlcxnuhovmnz.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4544
-
C:\Users\Admin\AppData\Local\Temp\gtqyykfrjdbofrudg.exeC:\Users\Admin\AppData\Local\Temp\gtqyykfrjdbofrudg.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5872
-
C:\Windows\nddorgetolmcwlrdjpff.exenddorgetolmcwlrdjpff.exe .1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\umtekhkhewd.exe"C:\Users\Admin\AppData\Local\Temp\umtekhkhewd.exe" "c:\windows\nddorgetolmcwlrdjpff.exe*."2⤵
- Executes dropped EXE
PID:2404
-
-
C:\Windows\ctugkazpljlcxnuhovmnz.exectugkazpljlcxnuhovmnz.exe .1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\umtekhkhewd.exe"C:\Users\Admin\AppData\Local\Temp\umtekhkhewd.exe" "c:\windows\ctugkazpljlcxnuhovmnz.exe*."2⤵
- Executes dropped EXE
PID:3084
-
-
C:\Windows\pdbklyuhavuianrbfj.exepdbklyuhavuianrbfj.exe1⤵
- Executes dropped EXE
PID:5088
-
C:\Windows\nddorgetolmcwlrdjpff.exenddorgetolmcwlrdjpff.exe1⤵
- Executes dropped EXE
PID:2168
-
C:\Users\Admin\AppData\Local\Temp\pdbklyuhavuianrbfj.exeC:\Users\Admin\AppData\Local\Temp\pdbklyuhavuianrbfj.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3228
-
C:\Windows\gtqyykfrjdbofrudg.exegtqyykfrjdbofrudg.exe1⤵
- Executes dropped EXE
PID:4764
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Impair Defenses
2Disable or Modify Tools
1Safe Mode Boot
1Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\ttdylksrwdoosrhdtjjtobaihm.eei
- Size 272B
- SHA256 b9a1c4f339bfbfb706474945b71cf207af74a4b96d9726a074e0d6c75625f671
- MD5 3206e6af000d3cba703e10f4dd90e079
- SHA1 70cabdba7429f8885858910045581e580538b7e5
- SHA512 1fdc288c1b59a9e94d86fb728b22a960389db964f4ecf98eaa1e4c75c6baeead9132f5f11d7cdaff33cbc96810e37675c7367d790b645f7434111d181f65ff17
- TLSH T10CD02BDA4762DD6018E1D7164664AA077B2A33DC40F871864F790485B1B3EA0AE445C2
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ttdylksrwdoosrhdtjjtobaihm.eei
- Size 272B
- SHA256 c9cf31f057bb1f100bec0e4cc3bbccfc29c3f54f4205aaced4974b5e290e60cc
- MD5 690141e23524cc4477c95be90b7d7da8
- SHA1 2ea01c0659daed03c165e3bfe692c0adc0dde641
- SHA512 d766b68837d4a1762af7c9bc1708ed681d1ee33aa6e66c986e92a0d73facb45a591e30e79b3331f2177b87dae9ada7fff8079e9f7a4d2489825cfe13b7d79e1d
- TLSH T1EED02BDA4A62DD2014E1D7264664E6077F2A33D840F875864A791485B2B3EA0FE445C2
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ttdylksrwdoosrhdtjjtobaihm.eei
- Size 272B
- SHA256 67553d2da179adf79407c78a03548a4214d1b08196ab39c9519d9c28eaf1c160
- MD5 43a4acfac76665f1add8e5bb7e5b237a
- SHA1 a3623fdbaebb43cfee27fd680f9f66533a7716dc
- SHA512 81a15347e32658affe9bd8cd43a561d439144639c87b796a8d196410abc76cdeab85a52db2c6f21e7cdf603594bd3fe7cdaccc8596673317b8344aa0f5add302
- TLSH T1F8D02BDA0672DD2014E1D7164664AA077B2A37D840E871C64A790485B1B3EA1AE885C2
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\ttdylksrwdoosrhdtjjtobaihm.eei
- Size 272B
- SHA256 65a98d285200a49c5af0dd5b9fef7afd02d63edff2247dc4b238bc41a14030b0
- MD5 93b5347bfd3d9a23a134d0720a21df39
- SHA1 1ed66da527309fb820b3f488a1626aa23f9f69a1
- SHA512 25116b466138dfe8f429c2a1643f5379197e4bcfa6e80a54ed4ed2c2a72fb448db69ecfaccebdc59786ff782f32b3db5114b82381380383b3c0441315f9551b1
- TLSH T152D02BDA4762DD2014E1D7164665A60B7B2A33EC40E871864A790485B1B7EA1BE445C2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\adqoegr.exe
- Size 680KB
- SHA256 9abf3c7a29b7adab996c1bf34677f75937c166bfa3a9f1a6fd503f806442e185
- MD5 6198da579c83d61fc9ff148b65f78d0c
- SHA1 8a3cce7d3bdfc3c47b660275a3147d93a68fcd10
- SHA512 9fd949181624657a8f0b427867b8c0280c6b1c9b62730fe3240a83a898f00d0f23eae8716c77bb2bcabb08204068b08227da9d85bd4573a44fd663fe9479d419
- SSDEEP 6144:c3ve8ySm8hQAAIfFrRXuEE+0l97mKwKR6HVeQ86JQPDHDdx/Qtqa:j/zkFF+EExZmKbReVeQPJQPDHvd
- TLSH T162E4BF3AB7C0C8F1C48580317696AF136EF5AC300664EA5BDB60CE492EF55E4D72A74B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\umtekhkhewd.exe
- Size 320KB
- SHA256 0cc02d34d5fd4cf892fed282f98c1ad3e7dd6159a8877ae5c46d3f834ed36060
- MD5 5203b6ea0901877fbf2d8d6f6d8d338e
- SHA1 c803e92561921b38abe13239c1fd85605b570936
- SHA512 d48a41b4fc4c38a6473f789c02918fb7353a4b4199768a3624f3b685d91d38519887a1ccd3616e0d2b079a346afaec5a0f2ef2c46d72d3097ef561cedb476471
- SSDEEP 6144:W3ve8ySm8hQAAIfFrRXuEE+0l97mKwKR6HVCo86JQPDHDdx/Qtqa:d/zkFF+EExZmKbReV7PJQPDHvd
- TLSH T1FD64BF3AB780CCB1C49580317696AF136DF5AC300664EA6BDB60CE492EF51E4D72A34F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\ttdylksrwdoosrhdtjjtobaihm.eei
- Size 272B
- SHA256 e8974dda075dde25fa2fc20b3fe3e54eda3c9229e4a232f5621a336e2139f55b
- MD5 032e1b202c6ed9f3ae7038a4d34db105
- SHA1 cdb533d537eca97d87a3b3aced3e8f6ce482da2b
- SHA512 4e1b5c37ec2e3784f77f00ee852841d98eb1e3b8739d2e06c3e532657df67fbf94432aa9bcedee30481c6bb8ad21ff39b57040097235e689014d03ffa6786abb
- TLSH T1F5D02BD27B755CC29423C41B68630036BE6496A8A69A037386626535977552467C2121
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\ufageohrhzvgvfgnopavbzjcmcuqbqabijkvq.uex
- Size 3KB
- SHA256 9a107e3fc5110b459f73906d017da76bccf609aceb420f60160496375652f735
- MD5 90594c75019d45ec8b685ef83d70720a
- SHA1 fb95fa846a25b253e7f7ae9322a93af1562c9a90
- SHA512 4c4458ecc9ff9ee11f5286b6d18734138b1c7b68826c2e19982ac56786f0080355bd51b2dbaa05a75130e060041d3655217c7f79c8712cea88f014b3fa25ece4
- TLSH T1E4818F865B2F2E5CC2E8B3B25599BAE1CC39597581500105492D72478B4F8C9FF4CF37
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\pdbklyuhavuianrbfj.exe
- Size 556KB
- SHA256 4f2e79bff34a37383bcc555b0ca392660d4f2354ce6d0fd1ed4146989745f391
- MD5 f670af7cf3e34f9e83a066d42d15f69f
- SHA1 07ff77c32864d3bd86b3c7871650e23a481b8d4f
- SHA512 a8b642d40c2d059b72859347f6db63795cf7691a2ac7b9500f901d692bb9aeb01d1afd690eaa46be18b071a04a7ccfb4ad1ebfb6dcf48a0571203ab8946b0fa8
- SSDEEP 6144:5j6/wndfF/gl0LQIk8DR3dEuAI7pEfxsZozAm9TMdGQLUg1nYmefPImdrionr:p6onxOp8FySpE5zvIdtU+Ymef
- TLSH T1B6C4F1189A433B7BED13C9FC918E54F916DACC9323C5011B9BF0A7D689F02E5841ED9A
- MD5 SHA1 SHA512 SSDEEP TLSH