Analysis
- max time kernel
150s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
02/06/2026, 03:07
Behavioral task
behavioral1
Sample
tmpvyjrvx5i.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
21 signatures
150 seconds
Behavioral task
behavioral2
Sample
tmpvyjrvx5i.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
21 signatures
150 seconds
Behavioral task
behavioral3
Sample
tmpvyjrvx5i.exe
Resource
win11-20260513-en
windows11-21h2-x64
20 signatures
150 seconds
General
- Target tmpvyjrvx5i.exe
- Size 676KB
- Sample260602-dmembady5q
- SHA256 5f2b9ed2f71d70da18b6f8f25e34b942985a7c18ebd8e830c4e6723169baa8af
- MD5 06060b135230855494aa19a58efc4ec7
- SHA1 e9a214b0d10c68b4a909126384c36d981c758ca2
- SHA512 d4d19d01b8c8e91ef894dd40d0f762600d10de390c3fe5dfc5c88e55f782ddefe4f2ce53b2c126f17faeecca9e3b3ff71b32ac5a5179dac58de19e6a394f93ba
- SSDEEP 6144:zh3rzMYXh+02d1r5ZTYnQbc0HXXGtANv4hituxp38u0:JrgQmd195KQ403XYANv4h8u/8
- TLSH T1D5E4BF3677C0C0F1C0A280326299AF359DF6683213219567DFA59A092EB96F5D73B34B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" yhnxdkk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" tmpvyjrvx5i.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" yhnxdkk.exe - UAC bypass 3 TTPs 12 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" yhnxdkk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" yhnxdkk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" yhnxdkk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" tmpvyjrvx5i.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" yhnxdkk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" yhnxdkk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" yhnxdkk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" tmpvyjrvx5i.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" tmpvyjrvx5i.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" tmpvyjrvx5i.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" yhnxdkk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" yhnxdkk.exe - Adds policy Run key to start application 2 TTPs 29 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\yhnxdkk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lhaxqkxrogyvcactgchd.exe" yhnxdkk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\yhnxdkk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xpexmclbuiwpsmkx.exe" yhnxdkk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xjsfoyblyg = "axrpjesnlexvdcfxliolf.exe" tmpvyjrvx5i.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xjsfoyblyg = "ytlhzsextkbxdabrdyc.exe" yhnxdkk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\yhnxdkk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ytlhzsextkbxdabrdyc.exe" yhnxdkk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xjsfoyblyg = "xpexmclbuiwpsmkx.exe" tmpvyjrvx5i.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\yhnxdkk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ytlhzsextkbxdabrdyc.exe" yhnxdkk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run tmpvyjrvx5i.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run yhnxdkk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xjsfoyblyg = "nhytkcnfaqgbgccrcw.exe" yhnxdkk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xjsfoyblyg = "lhaxqkxrogyvcactgchd.exe" yhnxdkk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xjsfoyblyg = "lhaxqkxrogyvcactgchd.exe" yhnxdkk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\yhnxdkk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\exnhxoypjynhlgftd.exe" yhnxdkk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\yhnxdkk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lhaxqkxrogyvcactgchd.exe" yhnxdkk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\yhnxdkk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\axrpjesnlexvdcfxliolf.exe" yhnxdkk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xjsfoyblyg = "exnhxoypjynhlgftd.exe" yhnxdkk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\yhnxdkk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nhytkcnfaqgbgccrcw.exe" yhnxdkk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xjsfoyblyg = "ytlhzsextkbxdabrdyc.exe" yhnxdkk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\yhnxdkk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nhytkcnfaqgbgccrcw.exe" yhnxdkk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run yhnxdkk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xjsfoyblyg = "axrpjesnlexvdcfxliolf.exe" yhnxdkk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\yhnxdkk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xpexmclbuiwpsmkx.exe" yhnxdkk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\yhnxdkk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\exnhxoypjynhlgftd.exe" yhnxdkk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xjsfoyblyg = "exnhxoypjynhlgftd.exe" yhnxdkk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xjsfoyblyg = "nhytkcnfaqgbgccrcw.exe" yhnxdkk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\yhnxdkk = "C:\\Users\\Admin\\AppData\\Local\\Temp\\exnhxoypjynhlgftd.exe" tmpvyjrvx5i.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xjsfoyblyg = "xpexmclbuiwpsmkx.exe" yhnxdkk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xjsfoyblyg = "axrpjesnlexvdcfxliolf.exe" yhnxdkk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xjsfoyblyg = "xpexmclbuiwpsmkx.exe" yhnxdkk.exe - Disables RegEdit via registry modification 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" tmpvyjrvx5i.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" tmpvyjrvx5i.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" yhnxdkk.exe Set value (int) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" yhnxdkk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" yhnxdkk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" yhnxdkk.exe - Executes dropped EXE 2 IoCs
pid Process 3004 yhnxdkk.exe 4968 yhnxdkk.exe - Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UserManager yhnxdkk.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SerCx2.sys yhnxdkk.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc yhnxdkk.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power yhnxdkk.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iai2c.sys yhnxdkk.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CBDHSvc yhnxdkk.exe - Adds Run key to start application 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\epxjraclx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\exnhxoypjynhlgftd.exe ." yhnxdkk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\Run\nxepwefn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\exnhxoypjynhlgftd.exe" yhnxdkk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\Run\sfpdnycnbkt = "xpexmclbuiwpsmkx.exe" yhnxdkk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\pfsjwkrfwiulme = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xpexmclbuiwpsmkx.exe" yhnxdkk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\Run\nxepwefn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lhaxqkxrogyvcactgchd.exe" yhnxdkk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\epxjraclx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xpexmclbuiwpsmkx.exe ." yhnxdkk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\epxjraclx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ytlhzsextkbxdabrdyc.exe ." tmpvyjrvx5i.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\epxjraclx = "axrpjesnlexvdcfxliolf.exe ." yhnxdkk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\nxepwefn = "xpexmclbuiwpsmkx.exe" yhnxdkk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\odpfrekxnyjzz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\axrpjesnlexvdcfxliolf.exe ." yhnxdkk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\Run\sfpdnycnbkt = "xpexmclbuiwpsmkx.exe" yhnxdkk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\Run\sfpdnycnbkt = "nhytkcnfaqgbgccrcw.exe" yhnxdkk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\epxjraclx = "xpexmclbuiwpsmkx.exe ." tmpvyjrvx5i.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\nxepwefn = "exnhxoypjynhlgftd.exe" yhnxdkk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\odpfrekxnyjzz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nhytkcnfaqgbgccrcw.exe ." yhnxdkk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\Run\nxepwefn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xpexmclbuiwpsmkx.exe" yhnxdkk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\epxjraclx = "nhytkcnfaqgbgccrcw.exe ." yhnxdkk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\epxjraclx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lhaxqkxrogyvcactgchd.exe ." yhnxdkk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\odpfrekxnyjzz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\axrpjesnlexvdcfxliolf.exe ." tmpvyjrvx5i.exe Set value (str) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\Run\sfpdnycnbkt = "axrpjesnlexvdcfxliolf.exe" yhnxdkk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\pdodoafrgqap = "nhytkcnfaqgbgccrcw.exe ." yhnxdkk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\epxjraclx = "lhaxqkxrogyvcactgchd.exe ." yhnxdkk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\epxjraclx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ytlhzsextkbxdabrdyc.exe ." yhnxdkk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\nxepwefn = "ytlhzsextkbxdabrdyc.exe" yhnxdkk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\pfsjwkrfwiulme = "C:\\Users\\Admin\\AppData\\Local\\Temp\\axrpjesnlexvdcfxliolf.exe" yhnxdkk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\epxjraclx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xpexmclbuiwpsmkx.exe ." yhnxdkk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\pfsjwkrfwiulme = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nhytkcnfaqgbgccrcw.exe" yhnxdkk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\Run\nxepwefn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nhytkcnfaqgbgccrcw.exe" yhnxdkk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\epxjraclx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nhytkcnfaqgbgccrcw.exe ." yhnxdkk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\epxjraclx = "lhaxqkxrogyvcactgchd.exe ." yhnxdkk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\Run\sfpdnycnbkt = "nhytkcnfaqgbgccrcw.exe" yhnxdkk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\epxjraclx = "exnhxoypjynhlgftd.exe ." yhnxdkk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\Run\sfpdnycnbkt = "exnhxoypjynhlgftd.exe" yhnxdkk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\odpfrekxnyjzz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ytlhzsextkbxdabrdyc.exe ." yhnxdkk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\nxepwefn = "ytlhzsextkbxdabrdyc.exe" tmpvyjrvx5i.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\epxjraclx = "ytlhzsextkbxdabrdyc.exe ." yhnxdkk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\epxjraclx = "exnhxoypjynhlgftd.exe ." yhnxdkk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\pfsjwkrfwiulme = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ytlhzsextkbxdabrdyc.exe" yhnxdkk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\odpfrekxnyjzz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nhytkcnfaqgbgccrcw.exe ." yhnxdkk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\pfsjwkrfwiulme = "C:\\Users\\Admin\\AppData\\Local\\Temp\\exnhxoypjynhlgftd.exe" yhnxdkk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\Run\sfpdnycnbkt = "ytlhzsextkbxdabrdyc.exe" yhnxdkk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\Run\sfpdnycnbkt = "lhaxqkxrogyvcactgchd.exe" yhnxdkk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\pdodoafrgqap = "exnhxoypjynhlgftd.exe ." yhnxdkk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\nxepwefn = "lhaxqkxrogyvcactgchd.exe" yhnxdkk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\epxjraclx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lhaxqkxrogyvcactgchd.exe ." yhnxdkk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\nxepwefn = "axrpjesnlexvdcfxliolf.exe" yhnxdkk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\pdodoafrgqap = "lhaxqkxrogyvcactgchd.exe ." tmpvyjrvx5i.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\odpfrekxnyjzz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lhaxqkxrogyvcactgchd.exe ." yhnxdkk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\Run\nxepwefn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xpexmclbuiwpsmkx.exe" yhnxdkk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\Run\sfpdnycnbkt = "lhaxqkxrogyvcactgchd.exe" yhnxdkk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\pdodoafrgqap = "ytlhzsextkbxdabrdyc.exe ." yhnxdkk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\epxjraclx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\axrpjesnlexvdcfxliolf.exe ." yhnxdkk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\pdodoafrgqap = "axrpjesnlexvdcfxliolf.exe ." yhnxdkk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\Run\sfpdnycnbkt = "axrpjesnlexvdcfxliolf.exe" tmpvyjrvx5i.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\pfsjwkrfwiulme = "C:\\Users\\Admin\\AppData\\Local\\Temp\\axrpjesnlexvdcfxliolf.exe" tmpvyjrvx5i.exe Set value (str) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\pdodoafrgqap = "lhaxqkxrogyvcactgchd.exe ." yhnxdkk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\Run\sfpdnycnbkt = "ytlhzsextkbxdabrdyc.exe" yhnxdkk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\pfsjwkrfwiulme = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lhaxqkxrogyvcactgchd.exe" yhnxdkk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\pfsjwkrfwiulme = "C:\\Users\\Admin\\AppData\\Local\\Temp\\axrpjesnlexvdcfxliolf.exe" yhnxdkk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\pdodoafrgqap = "nhytkcnfaqgbgccrcw.exe ." yhnxdkk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\epxjraclx = "ytlhzsextkbxdabrdyc.exe ." yhnxdkk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\epxjraclx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\exnhxoypjynhlgftd.exe ." yhnxdkk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\Run\nxepwefn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\axrpjesnlexvdcfxliolf.exe" yhnxdkk.exe Set value (str) \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000\Software\Microsoft\Windows\CurrentVersion\Run\nxepwefn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\nhytkcnfaqgbgccrcw.exe" yhnxdkk.exe - Checks whether UAC is enabled 1 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" tmpvyjrvx5i.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA tmpvyjrvx5i.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" yhnxdkk.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA yhnxdkk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" yhnxdkk.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA yhnxdkk.exe - Hijack Execution Flow: Executable Installer File Permissions Weakness 1 TTPs 3 IoCs
Possible Turn off User Account Control's privilege elevation for standard users.
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" tmpvyjrvx5i.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" yhnxdkk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" yhnxdkk.exe - Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 www.showmyipaddress.com 1 whatismyip.everdot.org 1 whatismyipaddress.com 1 www.whatismyip.ca - Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\fjkpqsnpuuuzouedycptuzac.zee yhnxdkk.exe File created C:\Windows\SysWOW64\fjkpqsnpuuuzouedycptuzac.zee yhnxdkk.exe File opened for modification C:\Windows\SysWOW64\odpfrekxnyjzzqlvbqodpfrekxnyjzzqlvb.odp yhnxdkk.exe File created C:\Windows\SysWOW64\odpfrekxnyjzzqlvbqodpfrekxnyjzzqlvb.odp yhnxdkk.exe - Drops file in Program Files directory 4 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\fjkpqsnpuuuzouedycptuzac.zee yhnxdkk.exe File created C:\Program Files (x86)\fjkpqsnpuuuzouedycptuzac.zee yhnxdkk.exe File opened for modification C:\Program Files (x86)\odpfrekxnyjzzqlvbqodpfrekxnyjzzqlvb.odp yhnxdkk.exe File created C:\Program Files (x86)\odpfrekxnyjzzqlvbqodpfrekxnyjzzqlvb.odp yhnxdkk.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\fjkpqsnpuuuzouedycptuzac.zee yhnxdkk.exe File created C:\Windows\fjkpqsnpuuuzouedycptuzac.zee yhnxdkk.exe File opened for modification C:\Windows\odpfrekxnyjzzqlvbqodpfrekxnyjzzqlvb.odp yhnxdkk.exe File created C:\Windows\odpfrekxnyjzzqlvbqodpfrekxnyjzzqlvb.odp yhnxdkk.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmpvyjrvx5i.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language yhnxdkk.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings explorer.exe - Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 3004 yhnxdkk.exe 3004 yhnxdkk.exe 3004 yhnxdkk.exe 3004 yhnxdkk.exe 3004 yhnxdkk.exe 3004 yhnxdkk.exe 3004 yhnxdkk.exe 3004 yhnxdkk.exe 3004 yhnxdkk.exe 3004 yhnxdkk.exe 3004 yhnxdkk.exe 3004 yhnxdkk.exe 3004 yhnxdkk.exe 3004 yhnxdkk.exe 3004 yhnxdkk.exe 3004 yhnxdkk.exe 3004 yhnxdkk.exe 3004 yhnxdkk.exe 3004 yhnxdkk.exe 3004 yhnxdkk.exe 3004 yhnxdkk.exe 3004 yhnxdkk.exe 3004 yhnxdkk.exe 3004 yhnxdkk.exe 3004 yhnxdkk.exe 3004 yhnxdkk.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3004 yhnxdkk.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1500 wrote to memory of 3004 1500 tmpvyjrvx5i.exe 89 PID 1500 wrote to memory of 4968 1500 tmpvyjrvx5i.exe 90 - System policy modification 1 TTPs 36 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" tmpvyjrvx5i.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" yhnxdkk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" yhnxdkk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System yhnxdkk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" yhnxdkk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" yhnxdkk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" yhnxdkk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" yhnxdkk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" yhnxdkk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" yhnxdkk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" tmpvyjrvx5i.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" tmpvyjrvx5i.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" tmpvyjrvx5i.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" tmpvyjrvx5i.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System yhnxdkk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" yhnxdkk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" yhnxdkk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" yhnxdkk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" tmpvyjrvx5i.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" yhnxdkk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" yhnxdkk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer yhnxdkk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" tmpvyjrvx5i.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" tmpvyjrvx5i.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" yhnxdkk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" yhnxdkk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System tmpvyjrvx5i.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" tmpvyjrvx5i.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" tmpvyjrvx5i.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" yhnxdkk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" yhnxdkk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" yhnxdkk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer tmpvyjrvx5i.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" yhnxdkk.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" yhnxdkk.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer yhnxdkk.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmpvyjrvx5i.exe"C:\Users\Admin\AppData\Local\Temp\tmpvyjrvx5i.exe"1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\yhnxdkk.exe"C:\Users\Admin\AppData\Local\Temp\yhnxdkk.exe" "-"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:3004
-
-
C:\Users\Admin\AppData\Local\Temp\yhnxdkk.exe"C:\Users\Admin\AppData\Local\Temp\yhnxdkk.exe" "-"2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- System policy modification
PID:4968
-
-
C:\Windows\explorer.exeExplorer.exe1⤵
- Modifies registry class
PID:652
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
2Winlogon Helper DLL
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Hijack Execution Flow
1Executable Installer File Permissions Weakness
1Impair Defenses
2Disable or Modify Tools
1Safe Mode Boot
1Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\fjkpqsnpuuuzouedycptuzac.zee
- Size 120B
- SHA256 56dcd5abeac34d19998b233d3277626c45e644fe4d05b53765f518ffb59c1e47
- MD5 ca25dca64eaed019c65aa45d1c66e906
- SHA1 b7e6bcde1dc43f944567c80e9dfbd234db795854
- SHA512 292c5baabd22b97703d282e97b4f1cb9ab867b08a6afff639ac283d86e61bea0a94c4fe8a2df75628715a0669de0e19de3b1155db4e7e3b13c8be7530bf45721
- TLSH T137B02BC93F00004CC34810548A320350210194F01F045F51F208BC0E648400440622BA
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\fjkpqsnpuuuzouedycptuzac.zee
- Size 120B
- SHA256 908a32cd4948febda57521e5a7821bf7b6a2dfa9358e0be4f21c9e8dd229bbae
- MD5 63da1777681ea2e83e419b8a99b47534
- SHA1 a1459bfd33a035a895164fda56883f43a5294150
- SHA512 6d057d4dd8e3daec804a0ae739eb1ba5829d4e13b668d0bb59736a7c897e0c2a3460d27f181820fffc0d80342da13cab0040767271d5a88d5e0d976fb7620393
- TLSH T159B02BC93D04014CC34810548E330310130198F05B045F41F209B91E508C04440F21B8
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\fjkpqsnpuuuzouedycptuzac.zee
- Size 120B
- SHA256 d01603d6bb77a783100187609b476a1b6984600907e22a1721f43fa01b2e4aa9
- MD5 a27f91817db7a29a88ead6add0f61ccb
- SHA1 3956fbba04d0352747ab091bbc702f6f6dc999e1
- SHA512 472bc400f1bf5eab3a54b5e92edde6c89706a795c5d7c34481a28e757f31ada3414aaf7588e8e9efe9eb94c81b630149b2e8056736447ec93dce6fe24e392349
- TLSH T1B7B02BCD3D04014CC3481054CA3203101141D5F02B045F51F208BC0E748400440A21B8
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\fjkpqsnpuuuzouedycptuzac.zee
- Size 120B
- SHA256 1622ed2050f07aabbfaa02c6547fb86baaa7476cdebc4d87308611b765372dc9
- MD5 3eb7cb427bbb5e2eceb4e4efe2fb5844
- SHA1 76db72a6a13a4b4d87e5317b93db581011eb7330
- SHA512 7123768223944a5aeefb08c38a2a13ef1a2960aac05715ce08d62723d7d85ac6a792d166e8b98f906b27f69c511d6e77b252d87964dd26f740ce23cee6fd833a
- TLSH T171B02BCA3D00004CC74910D48F320310110298F01B047F52F218F90E508400440621B8
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files (x86)\fjkpqsnpuuuzouedycptuzac.zee
- Size 120B
- SHA256 71e91048dee012c4a66f0a5ddfde99b6925101a4adf0f306e84f6df65a165414
- MD5 3fd91805d8dda92d33599a2944cf6b2a
- SHA1 b773170946552d40d49e01de7041bad2853fb497
- SHA512 ed996980aa4109a6db3c6da7eef9d01c6f37a1dadf4bb882e62d655b21194b91702722953ff7e8db35f27cabbbc266b71c52364d15abf5830a8493541f5f14eb
- TLSH T111B02BC93D40004CC74810548B320311110194F09B445F81F209B80F908400444A21B8
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\yhnxdkk.exe
- Size 1.2MB
- SHA256 f0e56797f357089776b79caac5a918e899000b2294a4790034fd860c5da9889f
- MD5 6c4c59e2c71c444e02056010f42aff95
- SHA1 c2edd5b473c204310bd2b91e7f255a8d8743fa5c
- SHA512 6b77463639910bbdf31388f3c4e04d55350fb1808c9770368b499db85d07da8e28c4837fa2a98080bd09978db0e5c753d3f5f98d6ea624531064c1a65ca97864
- SSDEEP 6144:Hh3rzMYXh+02d1r5ZTYnQbc0HXXGtANv4hituxp38u0:NrgQmd195KQ403XYANv4h8u/8
- TLSH T1A345BF3677C0C0F1C0A280326299AF359DF6683313219567DFA59A092EB96F5D73B34B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\fjkpqsnpuuuzouedycptuzac.zee
- Size 120B
- SHA256 d3452b5bfb877f0d3b21193943e1dee8b9cd339fe79afe67c95b29bcfbf09341
- MD5 65067d3f2ba0be48fc2b28d6bddca973
- SHA1 8d0ea4bbd2c949531b9732f0551f680a8564c446
- SHA512 27a0301cdc6661cfa4407221f26a23a63bd0471c9e0e04e0dc1c6e120209a6bee91771c62d8db5aaf6962a8b5b9754d10a022f3d9282c0093f946d7d945223d3
- TLSH T133B02BD409AADD3008080C1AD69A4132D419CCC8544E1DCC2C8443D80487CD80200401
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\odpfrekxnyjzzqlvbqodpfrekxnyjzzqlvb.odp
- Size 3KB
- SHA256 bd1094e21c0cb371804e05e78d0d3dc1d28fe3462c05b12eccd056e8c5fd0488
- MD5 9c4e61e33b97b8516191dc03116789da
- SHA1 1a402eba5028c370c67cd215761acf3f63c34d2f
- SHA512 039afc7ae0b11f914d6bb58476a6a8db68e9738515eeddd56e9c0c8ed0c803adadbfa80ca00834d5b4f952ac337de4a944b8bd5310b4fca4396d19618793ef1c
- TLSH T141816D3B351A323469ABD5001204A9F8516124C4805724D1CFCEE3E5579ABFBA7ED8BB
- MD5 SHA1 SHA512 TLSH