Analysis
- max time kernel
150s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
02/06/2026, 02:46
Behavioral task
behavioral1
Sample
tmpl8d6tlxb.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
24 signatures
150 seconds
Behavioral task
behavioral2
Sample
tmpl8d6tlxb.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
24 signatures
150 seconds
Behavioral task
behavioral3
Sample
tmpl8d6tlxb.exe
Resource
win11-20260513-en
windows11-21h2-x64
23 signatures
150 seconds
General
- Target tmpl8d6tlxb.exe
- Size 320KB
- Sample260602-c9bcqscs3x
- SHA256 87ff097ec2c7999dbfda23c162e5e7245543cde546c84c7137b7e3c176fb9e0a
- MD5 1308534dc4352feb854eedb71166ca16
- SHA1 29e852fd7379b241f7f19a4004a972fc90728cc1
- SHA512 edbca34a1d2e037dfe7790ddc990e5ccc79ef76e67514c9bd8685dcf74a0e779b89504709e5dbc9925f930c14a5b32d2fabc15583205e2e87071868247c4d2c3
- SSDEEP 6144:ZTwZo1IV3puaibGKFHi0mofhaH05kipz016580bHFbl86JQPDHDdx/QtqR:hXgvmzFHi0mo5aH0qMzd5807FRPJQPDV
- TLSH T18C64B03BB780C8F2C485803176996E136EF56C301625EA5BDB60DE0A2EF55E4D72A34F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detect Pykspa worm 1 IoCs
resource yara_rule behavioral3/files/0x001900000002b563-8.dat family_pykspa - Modifies WinLogon for persistence 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" tmpl8d6tlxb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" afoxccj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" afoxccj.exe - UAC bypass 3 TTPs 12 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" afoxccj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" tmpl8d6tlxb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" tmpl8d6tlxb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" afoxccj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" afoxccj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" afoxccj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" afoxccj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" tmpl8d6tlxb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" tmpl8d6tlxb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" afoxccj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" afoxccj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" afoxccj.exe - Adds policy Run key to start application 2 TTPs 27 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\udqdmqbobkr = "cvspiwrolevzomujhjqjg.exe" tmpl8d6tlxb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run afoxccj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\pvfpvweo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pfztjumgaqefrmrdyx.exe" afoxccj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\udqdmqbobkr = "gvohwgxqjyllwqufz.exe" tmpl8d6tlxb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\pvfpvweo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cvspiwrolevzomujhjqjg.exe" afoxccj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\udqdmqbobkr = "nfbxpcwsogwznkrfcdjb.exe" afoxccj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\pvfpvweo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pfztjumgaqefrmrdyx.exe" afoxccj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\udqdmqbobkr = "pfztjumgaqefrmrdyx.exe" afoxccj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\pvfpvweo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nfbxpcwsogwznkrfcdjb.exe" afoxccj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\udqdmqbobkr = "gvohwgxqjyllwqufz.exe" afoxccj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\udqdmqbobkr = "gvohwgxqjyllwqufz.exe" afoxccj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\pvfpvweo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\armhykdytkzbokqdzze.exe" afoxccj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\pvfpvweo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cvspiwrolevzomujhjqjg.exe" afoxccj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\pvfpvweo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\znfxlukcuiutdwzj.exe" afoxccj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run tmpl8d6tlxb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run afoxccj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\pvfpvweo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nfbxpcwsogwznkrfcdjb.exe" afoxccj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\udqdmqbobkr = "znfxlukcuiutdwzj.exe" afoxccj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\pvfpvweo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\znfxlukcuiutdwzj.exe" afoxccj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\pvfpvweo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gvohwgxqjyllwqufz.exe" afoxccj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\pvfpvweo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\znfxlukcuiutdwzj.exe" tmpl8d6tlxb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\udqdmqbobkr = "armhykdytkzbokqdzze.exe" afoxccj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\udqdmqbobkr = "nfbxpcwsogwznkrfcdjb.exe" afoxccj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\udqdmqbobkr = "pfztjumgaqefrmrdyx.exe" afoxccj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\udqdmqbobkr = "znfxlukcuiutdwzj.exe" afoxccj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\udqdmqbobkr = "cvspiwrolevzomujhjqjg.exe" afoxccj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\udqdmqbobkr = "armhykdytkzbokqdzze.exe" afoxccj.exe - Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" afoxccj.exe Set value (int) \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" afoxccj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" afoxccj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" afoxccj.exe Set value (int) \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" tmpl8d6tlxb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" tmpl8d6tlxb.exe - Executes dropped EXE 2 IoCs
pid Process 2768 afoxccj.exe 4732 afoxccj.exe - Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iai2c.sys afoxccj.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CBDHSvc afoxccj.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UserManager afoxccj.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SerCx2.sys afoxccj.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc afoxccj.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power afoxccj.exe - Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zhtfnqamyg = "pfztjumgaqefrmrdyx.exe ." afoxccj.exe Set value (str) \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\Run\gnyjqsbmx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cvspiwrolevzomujhjqjg.exe" afoxccj.exe Set value (str) \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\qbqfqwjynyhdk = "pfztjumgaqefrmrdyx.exe ." afoxccj.exe Set value (str) \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\Run\rbpdnsesgqyt = "pfztjumgaqefrmrdyx.exe" afoxccj.exe Set value (str) \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\zhtfnqamyg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cvspiwrolevzomujhjqjg.exe ." afoxccj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rdtjvcqgwispxo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nfbxpcwsogwznkrfcdjb.exe ." afoxccj.exe Set value (str) \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\zhtfnqamyg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pfztjumgaqefrmrdyx.exe ." afoxccj.exe Set value (str) \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\zhtfnqamyg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cvspiwrolevzomujhjqjg.exe ." afoxccj.exe Set value (str) \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\qbqfqwjynyhdk = "cvspiwrolevzomujhjqjg.exe ." afoxccj.exe Set value (str) \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\zhtfnqamyg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nfbxpcwsogwznkrfcdjb.exe ." tmpl8d6tlxb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\Run\rbpdnsesgqyt = "pfztjumgaqefrmrdyx.exe" afoxccj.exe Set value (str) \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\qbqfqwjynyhdk = "armhykdytkzbokqdzze.exe ." afoxccj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\gnyjqsbmx = "gvohwgxqjyllwqufz.exe" afoxccj.exe Set value (str) \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\Run\rbpdnsesgqyt = "nfbxpcwsogwznkrfcdjb.exe" afoxccj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rdtjvcqgwispxo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cvspiwrolevzomujhjqjg.exe ." afoxccj.exe Set value (str) \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\qbqfqwjynyhdk = "nfbxpcwsogwznkrfcdjb.exe ." afoxccj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rdtjvcqgwispxo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\znfxlukcuiutdwzj.exe ." afoxccj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\uhypckzqhufdmeg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nfbxpcwsogwznkrfcdjb.exe" afoxccj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rdtjvcqgwispxo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gvohwgxqjyllwqufz.exe ." afoxccj.exe Set value (str) \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\Run\gnyjqsbmx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\armhykdytkzbokqdzze.exe" afoxccj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zhtfnqamyg = "gvohwgxqjyllwqufz.exe ." afoxccj.exe Set value (str) \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\Run\gnyjqsbmx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\znfxlukcuiutdwzj.exe" afoxccj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zhtfnqamyg = "pfztjumgaqefrmrdyx.exe ." afoxccj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\uhypckzqhufdmeg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\znfxlukcuiutdwzj.exe" afoxccj.exe Set value (str) \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\zhtfnqamyg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\znfxlukcuiutdwzj.exe ." afoxccj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rdtjvcqgwispxo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\znfxlukcuiutdwzj.exe ." afoxccj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zhtfnqamyg = "gvohwgxqjyllwqufz.exe ." afoxccj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\uhypckzqhufdmeg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nfbxpcwsogwznkrfcdjb.exe" afoxccj.exe Set value (str) \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\qbqfqwjynyhdk = "pfztjumgaqefrmrdyx.exe ." afoxccj.exe Set value (str) \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\zhtfnqamyg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\znfxlukcuiutdwzj.exe ." afoxccj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\gnyjqsbmx = "pfztjumgaqefrmrdyx.exe" afoxccj.exe Set value (str) \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\Run\rbpdnsesgqyt = "gvohwgxqjyllwqufz.exe" afoxccj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\uhypckzqhufdmeg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\armhykdytkzbokqdzze.exe" afoxccj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rdtjvcqgwispxo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pfztjumgaqefrmrdyx.exe ." afoxccj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rdtjvcqgwispxo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cvspiwrolevzomujhjqjg.exe ." afoxccj.exe Set value (str) \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\Run\gnyjqsbmx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pfztjumgaqefrmrdyx.exe" afoxccj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zhtfnqamyg = "nfbxpcwsogwznkrfcdjb.exe ." afoxccj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rdtjvcqgwispxo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nfbxpcwsogwznkrfcdjb.exe ." afoxccj.exe Set value (str) \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\qbqfqwjynyhdk = "znfxlukcuiutdwzj.exe ." afoxccj.exe Set value (str) \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\Run\gnyjqsbmx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cvspiwrolevzomujhjqjg.exe" afoxccj.exe Set value (str) \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\Run\gnyjqsbmx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gvohwgxqjyllwqufz.exe" afoxccj.exe Set value (str) \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\zhtfnqamyg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pfztjumgaqefrmrdyx.exe ." afoxccj.exe Set value (str) \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\qbqfqwjynyhdk = "cvspiwrolevzomujhjqjg.exe ." afoxccj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rdtjvcqgwispxo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\armhykdytkzbokqdzze.exe ." afoxccj.exe Set value (str) \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\qbqfqwjynyhdk = "armhykdytkzbokqdzze.exe ." afoxccj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\gnyjqsbmx = "cvspiwrolevzomujhjqjg.exe" afoxccj.exe Set value (str) \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\Run\gnyjqsbmx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nfbxpcwsogwznkrfcdjb.exe" afoxccj.exe Set value (str) \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\qbqfqwjynyhdk = "armhykdytkzbokqdzze.exe ." tmpl8d6tlxb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\uhypckzqhufdmeg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nfbxpcwsogwznkrfcdjb.exe" tmpl8d6tlxb.exe Set value (str) \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\Run\rbpdnsesgqyt = "armhykdytkzbokqdzze.exe" afoxccj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\rdtjvcqgwispxo = "C:\\Users\\Admin\\AppData\\Local\\Temp\\armhykdytkzbokqdzze.exe ." afoxccj.exe Set value (str) \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\Run\rbpdnsesgqyt = "armhykdytkzbokqdzze.exe" tmpl8d6tlxb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\uhypckzqhufdmeg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\pfztjumgaqefrmrdyx.exe" afoxccj.exe Set value (str) \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\zhtfnqamyg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\armhykdytkzbokqdzze.exe ." afoxccj.exe Set value (str) \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\qbqfqwjynyhdk = "znfxlukcuiutdwzj.exe ." afoxccj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\uhypckzqhufdmeg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\armhykdytkzbokqdzze.exe" afoxccj.exe Set value (str) \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\Run\gnyjqsbmx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nfbxpcwsogwznkrfcdjb.exe" tmpl8d6tlxb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\gnyjqsbmx = "nfbxpcwsogwznkrfcdjb.exe" afoxccj.exe Set value (str) \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\Run\rbpdnsesgqyt = "cvspiwrolevzomujhjqjg.exe" afoxccj.exe Set value (str) \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\zhtfnqamyg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\armhykdytkzbokqdzze.exe ." afoxccj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\zhtfnqamyg = "cvspiwrolevzomujhjqjg.exe ." afoxccj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\uhypckzqhufdmeg = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cvspiwrolevzomujhjqjg.exe" afoxccj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\gnyjqsbmx = "znfxlukcuiutdwzj.exe" afoxccj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\gnyjqsbmx = "znfxlukcuiutdwzj.exe" tmpl8d6tlxb.exe - Checks whether UAC is enabled 1 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" afoxccj.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA afoxccj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" afoxccj.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA afoxccj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" tmpl8d6tlxb.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA tmpl8d6tlxb.exe - Hijack Execution Flow: Executable Installer File Permissions Weakness 1 TTPs 3 IoCs
Possible Turn off User Account Control's privilege elevation for standard users.
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" tmpl8d6tlxb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" afoxccj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" afoxccj.exe - Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 www.showmyipaddress.com 2 whatismyip.everdot.org 2 www.whatismyip.ca 2 whatismyipaddress.com - Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\tvbhjgkqwyyljqhfmxnpvbdaek.ssf afoxccj.exe File created C:\Windows\SysWOW64\tvbhjgkqwyyljqhfmxnpvbdaek.ssf afoxccj.exe File opened for modification C:\Windows\SysWOW64\uhypckzqhufdmegphderizmujarepnwoqzrno.sjw afoxccj.exe File created C:\Windows\SysWOW64\uhypckzqhufdmegphderizmujarepnwoqzrno.sjw afoxccj.exe - Drops file in Program Files directory 4 IoCs
description ioc Process File created C:\Program Files (x86)\uhypckzqhufdmegphderizmujarepnwoqzrno.sjw afoxccj.exe File opened for modification C:\Program Files (x86)\tvbhjgkqwyyljqhfmxnpvbdaek.ssf afoxccj.exe File created C:\Program Files (x86)\tvbhjgkqwyyljqhfmxnpvbdaek.ssf afoxccj.exe File opened for modification C:\Program Files (x86)\uhypckzqhufdmegphderizmujarepnwoqzrno.sjw afoxccj.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\tvbhjgkqwyyljqhfmxnpvbdaek.ssf afoxccj.exe File created C:\Windows\tvbhjgkqwyyljqhfmxnpvbdaek.ssf afoxccj.exe File opened for modification C:\Windows\uhypckzqhufdmegphderizmujarepnwoqzrno.sjw afoxccj.exe File created C:\Windows\uhypckzqhufdmegphderizmujarepnwoqzrno.sjw afoxccj.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language afoxccj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpl8d6tlxb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language afoxccj.exe - Modifies registry class 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings tmpl8d6tlxb.exe Key created \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings afoxccj.exe Key created \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\Local Settings afoxccj.exe - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 2768 afoxccj.exe 2768 afoxccj.exe 2768 afoxccj.exe 2768 afoxccj.exe 2768 afoxccj.exe 2768 afoxccj.exe 2768 afoxccj.exe 2768 afoxccj.exe 2768 afoxccj.exe 2768 afoxccj.exe 2768 afoxccj.exe 2768 afoxccj.exe 2768 afoxccj.exe 2768 afoxccj.exe 2768 afoxccj.exe 2768 afoxccj.exe 2768 afoxccj.exe 2768 afoxccj.exe 2768 afoxccj.exe 2768 afoxccj.exe 2768 afoxccj.exe 2768 afoxccj.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4732 afoxccj.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2768 afoxccj.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 772 wrote to memory of 2768 772 tmpl8d6tlxb.exe 92 PID 772 wrote to memory of 4732 772 tmpl8d6tlxb.exe 93 - System policy modification 1 TTPs 36 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" tmpl8d6tlxb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System afoxccj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" afoxccj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" tmpl8d6tlxb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" afoxccj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" afoxccj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer afoxccj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" afoxccj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" afoxccj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" tmpl8d6tlxb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer tmpl8d6tlxb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" afoxccj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" afoxccj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" afoxccj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" afoxccj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" afoxccj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System tmpl8d6tlxb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" afoxccj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" afoxccj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" tmpl8d6tlxb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" tmpl8d6tlxb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" tmpl8d6tlxb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System afoxccj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" afoxccj.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer afoxccj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" afoxccj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" tmpl8d6tlxb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" afoxccj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" afoxccj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" afoxccj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" afoxccj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" afoxccj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" tmpl8d6tlxb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" tmpl8d6tlxb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" afoxccj.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" tmpl8d6tlxb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmpl8d6tlxb.exe"C:\Users\Admin\AppData\Local\Temp\tmpl8d6tlxb.exe"1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
- System policy modification
PID:772 -
C:\Users\Admin\AppData\Local\Temp\afoxccj.exe"C:\Users\Admin\AppData\Local\Temp\afoxccj.exe" "-"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2768
-
-
C:\Users\Admin\AppData\Local\Temp\afoxccj.exe"C:\Users\Admin\AppData\Local\Temp\afoxccj.exe" "-"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- System policy modification
PID:4732
-
-
C:\Windows\explorer.exeExplorer.exe1⤵
- Modifies registry class
PID:4892
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2392
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Impair Defenses
2Disable or Modify Tools
1Safe Mode Boot
1Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\tvbhjgkqwyyljqhfmxnpvbdaek.ssf
- Size 280B
- SHA256 03c8d84bad176dd85bd49c7ee6eb8cd843398969bcee5eb8551b3e913edfc2d5
- MD5 8011f35a399d956e796674eb8845f7b1
- SHA1 4bc3816995d4cebcf42ba76a3bb8e8e00490ad9e
- SHA512 bc78481793f07f4ef332f7a4c83e1e03d056468410bae66b2a768d0458356265c504b7ebc72817798e5e389fae6b3ecbb03e1087f622f1907cb13c46f8ace835
- TLSH T1FED02B0EAC252D63B64430576F59DD51A06182489D3D611BEBC489497F567D20DCA123
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\tvbhjgkqwyyljqhfmxnpvbdaek.ssf
- Size 280B
- SHA256 f8db74661a5e2354167ceb904ab9f862c8516acf2f03353c052a31dae39b3c15
- MD5 9905c227d90fd25975ea8a9271d81e07
- SHA1 4734124227933735532900ae5ca89eb3640864c4
- SHA512 6f391bb8617d99607e67ac4d01b6575317c5f44d0188c0fa91e447f7072361bcacd7777419c38670e75e0a37c8c7255d467ff30a4aa5655a4a9d5b05ba784ba4
- TLSH T12ED0EB0E9C102E62B20030676F08CD1160608208993D210BEB80CA4A7B527C20DCB023
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\tvbhjgkqwyyljqhfmxnpvbdaek.ssf
- Size 280B
- SHA256 c250230b294b4726e96ccee51e15a133352a05632652d48c7b984b535e18e7aa
- MD5 0df1f1e2b9b41f8642d3086f949fe5b7
- SHA1 62c12f4f2f10ea25b8f11cae0a61f7fbdcf8b69a
- SHA512 a47be5a305e4cc41cf1b3bbe892951ac63e35836aefb3fccf42a219c62df06ec84dfdb78b7641f4eb9a326bc37f940ad93b38ce4b19055df41497fe8953e6d29
- TLSH T199D02B0EAD112E92B649306B6F59CD5160A18248E939210BEBC08949BB567D20E8A123
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\tvbhjgkqwyyljqhfmxnpvbdaek.ssf
- Size 280B
- SHA256 7b2ae333f0168f7fdafc65fb91a52a943ebff0ca8b1dd770a68ca27f433e993f
- MD5 f8ee69d56b9f8c77ef6d9828db3a075b
- SHA1 30d846d532aa7b876ef55e5a11efbdf93c17174a
- SHA512 1233bd17588ebcd643927689a5298aac05f663081121ac17e90300cb45b945eb73dc5bed75c7474cabc5d3920450b2b9b0e5c49ac7b350f51431fe30c27fd807
- TLSH T122D02B1E9D112E92B645309B6F59CD55A0A18248A939210BFB848949BB567D20E8A127
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\tvbhjgkqwyyljqhfmxnpvbdaek.ssf
- Size 280B
- SHA256 e64c7f147fe082ecaa989e1907d810ee235273ee6fcde78d1f27505a6e950393
- MD5 29124e15a7e846882e3d57a21ff08dbc
- SHA1 be3a9cafba63a0fcf896982a8002f737a484731e
- SHA512 b6fb86606f65676d2c7ee808745bde7580d7fd9e7915cfce6ac479888c4a09d52268294dd19bd4fb74b60130b82afa9173a8d29f0ce7d657e67740ce1d91afb8
- TLSH T131D02B0EDC116E62B64430676F59CE62607582489D39210BEB8089497B577D20DCA123
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\afoxccj.exe
- Size 700KB
- SHA256 1e7e4131aaece18486adbd168059291ecdd3a5d4bbf49354acbf46d6ef8c4ca5
- MD5 c90332d5adcdbfabe5e810b8abcf0b4c
- SHA1 47dfb6dc73b1c32aeb467f38908f64f28f1fda45
- SHA512 bd9ac988bad22ee774c1816f32b347ff01d0f06390681791bbb0ed633a7414270906c1929f1f5da6c400103f07af193c1143ac4467f709c1fe8769eceb46814a
- SSDEEP 12288:gXgvmzFHi0mo5aH0qMzd5807FcgPJQPDHvd:gXgvOHi0mGaH0qSdPFcy4V
- TLSH T1A6E4B03AB780C8F1C48580317699AE136EF56C700525EA57DB60DE0A3EF91E5D72A38F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\tvbhjgkqwyyljqhfmxnpvbdaek.ssf
- Size 280B
- SHA256 1accbbeca0e194185c454b311a8e9df702a4a2c5d75f36002ed139e80d2e005a
- MD5 29ecffe0a039e39e7bcffd839f91122c
- SHA1 4b9e403000c8e62b64f415836fa978f559b01a0a
- SHA512 3fd51fb1322e5c4761c31edd3c6e23c5d871c97cf79f9cf516f0593e8b5e37f2bcc09f3343c5cf285c765b9c6ea40299f12f9ebbd98fb8ad6b294c31df1edb3a
- TLSH T1E0D0EB07804475247A132BCC80AE35D313C942EE3B0A805E735CB41A8C0E8294F6BC1F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\uhypckzqhufdmegphderizmujarepnwoqzrno.sjw
- Size 4KB
- SHA256 46a08cca703e585e13bac0e31c843584f33f6c2e1335df9774dd0468421ac38a
- MD5 ec61f4e30bfd7d3d9049a376fd688114
- SHA1 7370405a199fa9fd5b557e2d793dccc3eeadb318
- SHA512 be9169e734c394b700b67361a1a307c0ef35bf422b79d5b6e20aed1fc10c2053a93036cdac5276f60a432f98ee79d3b9e3c85d3367f6648a23b82cddc22ceac1
- SSDEEP 96:OYC6hkFCk2AFl/vU/aLv0gleB7hY072sPsIn+1o:OYsckFFDL87uABP7+1o
- TLSH T1BB918C0414529DE4812ECD4CB81F9669EAF30FB548EA8707B9BD16C6234A58C0F438A7
- MD5 SHA1 SHA512 SSDEEP TLSH