Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
22/05/2026, 14:36
Behavioral task
behavioral1
Sample
tmp2ck6ihji.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
21 signatures
150 seconds
Behavioral task
behavioral2
Sample
tmp2ck6ihji.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
21 signatures
150 seconds
Behavioral task
behavioral3
Sample
tmp2ck6ihji.exe
Resource
win11-20260513-en
windows11-21h2-x64
20 signatures
150 seconds
General
- Target tmp2ck6ihji.exe
- Size 668KB
- Sample260522-rymc7agv5w
- SHA256 5aca71ba22219f16e14b5b0a4591c4f85b3bac2f47de2446e9b9ec504d5cccb2
- MD5 09768dd9161fe1356118195518bd096a
- SHA1 5a71930347faf81a065f8a2330cc07cdd5919ea4
- SHA512 b28da7d087c33ae4b41bd7bdce16d64d5791dd57ead52e7281745a2b6ad2f6d0a87ed9694c30be769786b2fa29abbe44ce5520337709b298fd49ceaa288eb688
- SSDEEP 6144:RR8XcGxUEcNmnQ8/RtnmGcY3W2ANv4hituxp38u0:58cmnXJhmFY3W2ANv4h8u/8
- TLSH T165E4AF3677C0C0F2C0A280327199AF359DF6687213219567DFA49A092EB96F5D73B34B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" tmp2ck6ihji.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" zemps.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" zemps.exe - UAC bypass 3 TTPs 12 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" tmp2ck6ihji.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" zemps.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" zemps.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" zemps.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" zemps.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" zemps.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" tmp2ck6ihji.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" tmp2ck6ihji.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" tmp2ck6ihji.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" zemps.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" zemps.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" zemps.exe - Adds policy Run key to start application 2 TTPs 28 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\octfrkueajvrcm = "mezpfcqeerhhwkdphg.exe" zemps.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rcqziyfmflu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zusleevmpfybtkgvqsnle.exe" zemps.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rcqziyfmflu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zusleevmpfybtkgvqsnle.exe" zemps.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\octfrkueajvrcm = "kebtlkaqshzbsidrlmgd.exe" zemps.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\octfrkueajvrcm = "kebtlkaqshzbsidrlmgd.exe" zemps.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rcqziyfmflu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wmfthcoayjxviulv.exe" zemps.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rcqziyfmflu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xqmdushwxlcdticpiib.exe" zemps.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\octfrkueajvrcm = "wmfthcoayjxviulv.exe" zemps.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\octfrkueajvrcm = "zusleevmpfybtkgvqsnle.exe" zemps.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run tmp2ck6ihji.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rcqziyfmflu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\duodsobonzonbogri.exe" zemps.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rcqziyfmflu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mezpfcqeerhhwkdphg.exe" zemps.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\octfrkueajvrcm = "duodsobonzonbogri.exe" zemps.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\octfrkueajvrcm = "duodsobonzonbogri.exe" zemps.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\octfrkueajvrcm = "zusleevmpfybtkgvqsnle.exe" zemps.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rcqziyfmflu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kebtlkaqshzbsidrlmgd.exe" zemps.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\octfrkueajvrcm = "mezpfcqeerhhwkdphg.exe" zemps.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rcqziyfmflu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zusleevmpfybtkgvqsnle.exe" tmp2ck6ihji.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run zemps.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run zemps.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rcqziyfmflu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kebtlkaqshzbsidrlmgd.exe" zemps.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\octfrkueajvrcm = "wmfthcoayjxviulv.exe" tmp2ck6ihji.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\octfrkueajvrcm = "xqmdushwxlcdticpiib.exe" zemps.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\octfrkueajvrcm = "wmfthcoayjxviulv.exe" zemps.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rcqziyfmflu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\duodsobonzonbogri.exe" zemps.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\octfrkueajvrcm = "zusleevmpfybtkgvqsnle.exe" tmp2ck6ihji.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\octfrkueajvrcm = "xqmdushwxlcdticpiib.exe" zemps.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\rcqziyfmflu = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wmfthcoayjxviulv.exe" zemps.exe - Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" tmp2ck6ihji.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" tmp2ck6ihji.exe Set value (int) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" zemps.exe Set value (int) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" zemps.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" zemps.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" zemps.exe - Executes dropped EXE 2 IoCs
pid Process 3224 zemps.exe 2976 zemps.exe - Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc zemps.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power zemps.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iai2c.sys zemps.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CBDHSvc zemps.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UserManager zemps.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SerCx2.sys zemps.exe - Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mezpfcqeerhhwkdphg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zusleevmpfybtkgvqsnle.exe" zemps.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oapzjaiqkrbv = "zusleevmpfybtkgvqsnle.exe" tmp2ck6ihji.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\duodsobonzonbogri = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kebtlkaqshzbsidrlmgd.exe ." tmp2ck6ihji.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oapzjaiqkrbv = "mezpfcqeerhhwkdphg.exe" zemps.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\naqbmenwrzkfp = "kebtlkaqshzbsidrlmgd.exe ." zemps.exe Set value (str) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\wmfthcoayjxviulv = "zusleevmpfybtkgvqsnle.exe ." zemps.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mezpfcqeerhhwkdphg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wmfthcoayjxviulv.exe" zemps.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oapzjaiqkrbv = "kebtlkaqshzbsidrlmgd.exe" zemps.exe Set value (str) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\Run\rgylysdolvifrcs = "zusleevmpfybtkgvqsnle.exe" zemps.exe Set value (str) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\Run\rgylysdolvifrcs = "xqmdushwxlcdticpiib.exe" tmp2ck6ihji.exe Set value (str) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\Run\oapzjaiqkrbv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kebtlkaqshzbsidrlmgd.exe" zemps.exe Set value (str) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\naqbmenwrzkfp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mezpfcqeerhhwkdphg.exe ." zemps.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oapzjaiqkrbv = "xqmdushwxlcdticpiib.exe" zemps.exe Set value (str) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\Run\rgylysdolvifrcs = "mezpfcqeerhhwkdphg.exe" zemps.exe Set value (str) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\wmfthcoayjxviulv = "wmfthcoayjxviulv.exe ." zemps.exe Set value (str) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\Run\rgylysdolvifrcs = "duodsobonzonbogri.exe" zemps.exe Set value (str) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\Run\oapzjaiqkrbv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xqmdushwxlcdticpiib.exe" zemps.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\naqbmenwrzkfp = "mezpfcqeerhhwkdphg.exe ." tmp2ck6ihji.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mezpfcqeerhhwkdphg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kebtlkaqshzbsidrlmgd.exe" zemps.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oapzjaiqkrbv = "wmfthcoayjxviulv.exe" tmp2ck6ihji.exe Set value (str) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\naqbmenwrzkfp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zusleevmpfybtkgvqsnle.exe ." zemps.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oapzjaiqkrbv = "wmfthcoayjxviulv.exe" zemps.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mezpfcqeerhhwkdphg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xqmdushwxlcdticpiib.exe" zemps.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\duodsobonzonbogri = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mezpfcqeerhhwkdphg.exe ." zemps.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mezpfcqeerhhwkdphg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zusleevmpfybtkgvqsnle.exe" zemps.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oapzjaiqkrbv = "xqmdushwxlcdticpiib.exe" zemps.exe Set value (str) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\wmfthcoayjxviulv = "duodsobonzonbogri.exe ." zemps.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\duodsobonzonbogri = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wmfthcoayjxviulv.exe ." zemps.exe Set value (str) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\Run\oapzjaiqkrbv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zusleevmpfybtkgvqsnle.exe" zemps.exe Set value (str) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\naqbmenwrzkfp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kebtlkaqshzbsidrlmgd.exe ." zemps.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\naqbmenwrzkfp = "mezpfcqeerhhwkdphg.exe ." zemps.exe Set value (str) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\Run\rgylysdolvifrcs = "wmfthcoayjxviulv.exe" zemps.exe Set value (str) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\wmfthcoayjxviulv = "mezpfcqeerhhwkdphg.exe ." zemps.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\duodsobonzonbogri = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zusleevmpfybtkgvqsnle.exe ." zemps.exe Set value (str) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\Run\rgylysdolvifrcs = "kebtlkaqshzbsidrlmgd.exe" zemps.exe Set value (str) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\Run\oapzjaiqkrbv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\duodsobonzonbogri.exe" zemps.exe Set value (str) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\naqbmenwrzkfp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wmfthcoayjxviulv.exe ." zemps.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mezpfcqeerhhwkdphg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\duodsobonzonbogri.exe" zemps.exe Set value (str) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\Run\oapzjaiqkrbv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wmfthcoayjxviulv.exe" zemps.exe Set value (str) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\wmfthcoayjxviulv = "duodsobonzonbogri.exe ." zemps.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oapzjaiqkrbv = "mezpfcqeerhhwkdphg.exe" zemps.exe Set value (str) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\naqbmenwrzkfp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zusleevmpfybtkgvqsnle.exe ." zemps.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\duodsobonzonbogri = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kebtlkaqshzbsidrlmgd.exe ." zemps.exe Set value (str) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\Run\oapzjaiqkrbv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zusleevmpfybtkgvqsnle.exe" zemps.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\naqbmenwrzkfp = "zusleevmpfybtkgvqsnle.exe ." zemps.exe Set value (str) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\Run\oapzjaiqkrbv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wmfthcoayjxviulv.exe" zemps.exe Set value (str) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\Run\oapzjaiqkrbv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xqmdushwxlcdticpiib.exe" zemps.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\oapzjaiqkrbv = "duodsobonzonbogri.exe" zemps.exe Set value (str) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\Run\oapzjaiqkrbv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kebtlkaqshzbsidrlmgd.exe" zemps.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\duodsobonzonbogri = "C:\\Users\\Admin\\AppData\\Local\\Temp\\duodsobonzonbogri.exe ." zemps.exe Set value (str) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\naqbmenwrzkfp = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xqmdushwxlcdticpiib.exe ." zemps.exe Set value (str) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\Run\oapzjaiqkrbv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\duodsobonzonbogri.exe" zemps.exe Set value (str) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\Run\rgylysdolvifrcs = "kebtlkaqshzbsidrlmgd.exe" zemps.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mezpfcqeerhhwkdphg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\duodsobonzonbogri.exe" zemps.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\naqbmenwrzkfp = "wmfthcoayjxviulv.exe ." zemps.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\duodsobonzonbogri = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mezpfcqeerhhwkdphg.exe ." zemps.exe Set value (str) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\wmfthcoayjxviulv = "kebtlkaqshzbsidrlmgd.exe ." zemps.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\duodsobonzonbogri = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kebtlkaqshzbsidrlmgd.exe ." zemps.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mezpfcqeerhhwkdphg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\zusleevmpfybtkgvqsnle.exe" tmp2ck6ihji.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\naqbmenwrzkfp = "zusleevmpfybtkgvqsnle.exe ." zemps.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\naqbmenwrzkfp = "xqmdushwxlcdticpiib.exe ." zemps.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\duodsobonzonbogri = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xqmdushwxlcdticpiib.exe ." zemps.exe Set value (str) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\wmfthcoayjxviulv = "kebtlkaqshzbsidrlmgd.exe ." zemps.exe Set value (str) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\Run\rgylysdolvifrcs = "kebtlkaqshzbsidrlmgd.exe" tmp2ck6ihji.exe - Checks whether UAC is enabled 1 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" tmp2ck6ihji.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA tmp2ck6ihji.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" zemps.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA zemps.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" zemps.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA zemps.exe - Hijack Execution Flow: Executable Installer File Permissions Weakness 1 TTPs 3 IoCs
Possible Turn off User Account Control's privilege elevation for standard users.
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" tmp2ck6ihji.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" zemps.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" zemps.exe - Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 whatismyipaddress.com 1 whatismyip.everdot.org 1 www.showmyipaddress.com 1 www.whatismyip.ca - Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\eglllsqoyvvfecfbdmotttay.gdd zemps.exe File created C:\Windows\SysWOW64\eglllsqoyvvfecfbdmotttay.gdd zemps.exe File opened for modification C:\Windows\SysWOW64\naqbmenwrzkfpymtgandozrajemxsclzgtn.qbm zemps.exe File created C:\Windows\SysWOW64\naqbmenwrzkfpymtgandozrajemxsclzgtn.qbm zemps.exe - Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\eglllsqoyvvfecfbdmotttay.gdd zemps.exe File created C:\Program Files (x86)\eglllsqoyvvfecfbdmotttay.gdd zemps.exe File opened for modification C:\Program Files (x86)\naqbmenwrzkfpymtgandozrajemxsclzgtn.qbm zemps.exe File created C:\Program Files (x86)\naqbmenwrzkfpymtgandozrajemxsclzgtn.qbm zemps.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\eglllsqoyvvfecfbdmotttay.gdd zemps.exe File created C:\Windows\eglllsqoyvvfecfbdmotttay.gdd zemps.exe File opened for modification C:\Windows\naqbmenwrzkfpymtgandozrajemxsclzgtn.qbm zemps.exe File created C:\Windows\naqbmenwrzkfpymtgandozrajemxsclzgtn.qbm zemps.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp2ck6ihji.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language zemps.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\Local Settings explorer.exe - Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 3224 zemps.exe 3224 zemps.exe 3224 zemps.exe 3224 zemps.exe 3224 zemps.exe 3224 zemps.exe 3224 zemps.exe 3224 zemps.exe 3224 zemps.exe 3224 zemps.exe 3224 zemps.exe 3224 zemps.exe 3224 zemps.exe 3224 zemps.exe 3224 zemps.exe 3224 zemps.exe 3224 zemps.exe 3224 zemps.exe 3224 zemps.exe 3224 zemps.exe 3224 zemps.exe 3224 zemps.exe 3224 zemps.exe 3224 zemps.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3224 zemps.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 924 wrote to memory of 3224 924 tmp2ck6ihji.exe 91 PID 924 wrote to memory of 2976 924 tmp2ck6ihji.exe 92 - System policy modification 1 TTPs 36 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" tmp2ck6ihji.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System zemps.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" zemps.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" zemps.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" zemps.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" zemps.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer zemps.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" tmp2ck6ihji.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" zemps.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" zemps.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" zemps.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" tmp2ck6ihji.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" tmp2ck6ihji.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" zemps.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" zemps.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" zemps.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System tmp2ck6ihji.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" tmp2ck6ihji.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System zemps.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer tmp2ck6ihji.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" zemps.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" zemps.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" zemps.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" zemps.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" zemps.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" zemps.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" tmp2ck6ihji.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" zemps.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" zemps.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" zemps.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" tmp2ck6ihji.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" tmp2ck6ihji.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" zemps.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" tmp2ck6ihji.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" tmp2ck6ihji.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer zemps.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp2ck6ihji.exe"C:\Users\Admin\AppData\Local\Temp\tmp2ck6ihji.exe"1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
- System policy modification
PID:924 -
C:\Users\Admin\AppData\Local\Temp\zemps.exe"C:\Users\Admin\AppData\Local\Temp\zemps.exe" "-"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:3224
-
-
C:\Users\Admin\AppData\Local\Temp\zemps.exe"C:\Users\Admin\AppData\Local\Temp\zemps.exe" "-"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- System policy modification
PID:2976
-
-
C:\Windows\explorer.exeExplorer.exe1⤵
- Modifies registry class
PID:3256
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Impair Defenses
2Disable or Modify Tools
1Safe Mode Boot
1Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\zemps.exe
- Size 1.2MB
- SHA256 b91f5711271803bcc348acdd1099f0873e8d5559a362a3babce0ba03e73fe6dc
- MD5 5ca3cb8af77fff80115d41064b52627c
- SHA1 b69460888e608d21f24fde0fb07e2ea473394fe3
- SHA512 06b32c3a90498c2499921533b28f7eabed7af24783dce2664b49cd4da959dcd523611e055bf4cfd165f58be748938233595d511c70fb41edc2cbc4f8f18cf489
- SSDEEP 6144:LR8XcGxUEcNmnQ8/RtnmGcY3W2ANv4hituxp38u0:v8cmnXJhmFY3W2ANv4h8u/8
- TLSH T1B845AF3677C0C0F2C0A280327199AF359DF6687213219567DFA49A092EB96F5D73B34B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\eglllsqoyvvfecfbdmotttay.gdd
- Size 116B
- SHA256 b556bfec59659eb0214e753759ed247cd446758ceb0b42085b576e13587948e9
- MD5 ca1ae7a68022b5f8f61212893731e352
- SHA1 aaed83aff98aeab583c33c77a2ad62bdf502422a
- SHA512 996be786dfa6bb8423286707513eb9e0e56d1232ae87c6256dd81d2f1a17c52bc9c0c1c31f5fb4a4a0db3f4b345b5f032f35c131e142f55bb361e3e8235b6f30
- TLSH T13CB092EEA18862981632792AA3C235628B5A49B864528D866D95E98C1CB26012B13ED6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\naqbmenwrzkfpymtgandozrajemxsclzgtn.qbm
- Size 3KB
- SHA256 4478a6fd6e9298a05403c8d00da932e01c7742153722ceb7b009a25bb62e6d4d
- MD5 fe3a995bbac704de3363d6416e5e0235
- SHA1 3fa1d5b16d7b778124fc262580d285858a54d6da
- SHA512 be4e8768c6930de5f9efc2203b48f42a3c81c2b86bf79b0c83dc904ed33371c6bc4ef2c9f066585a92fdfb5575a7618a73e38531dede1bce43c11741e1a62caf
- TLSH T16B816D159CC88D0F85916F1D1EAB9C26CDBB26C175C73353206C1F09CC20AAF33C8581
- MD5 SHA1 SHA512 TLSH