pykspa | 1364c5f9a11996c761040823e43e41547f52147aafd7fc4bf910d98a4c30eacb

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	qaorinawaky.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	beiqcjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	beiqcjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	qaorinawaky.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	qaorinawaky.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	qaorinawaky.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	beiqcjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	qaorinawaky.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	qaorinawaky.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	qaorinawaky.exe

UAC bypass 3 TTPs 22 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	qaorinawaky.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	qaorinawaky.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	qaorinawaky.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	qaorinawaky.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	beiqcjp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	qaorinawaky.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	beiqcjp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	beiqcjp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	beiqcjp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	beiqcjp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	qaorinawaky.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	beiqcjp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	beiqcjp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	beiqcjp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	beiqcjp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	beiqcjp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	beiqcjp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	qaorinawaky.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	qaorinawaky.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	beiqcjp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	qaorinawaky.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	qaorinawaky.exe

Adds policy Run key to start application 2 TTPs 58 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\sajwnzktfrdo = "oevqpjctnhburddrnska.exe"	qaorinawaky.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	qaorinawaky.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hmscqzhnw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dumiidxpkfausfgvsyria.exe"	qaorinawaky.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\sajwnzktfrdo = "qetmjbshzrjavfdpjm.exe"	beiqcjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hmscqzhnw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qetmjbshzrjavfdpjm.exe"	qaorinawaky.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\sajwnzktfrdo = "dumiidxpkfausfgvsyria.exe"	beiqcjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\dahnv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\hqjbvobpnzpjspatv.exe"	beiqcjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\dahnv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bmhbxshxxldzkjwrvmx.exe"	beiqcjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hmscqzhnw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\amzqlbqdtjzohplv.exe"	beiqcjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\sajwnzktfrdo = "amzqlbqdtjzohplv.exe"	beiqcjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hmscqzhnw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qetmjbshzrjavfdpjm.exe"	qaorinawaky.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	qaorinawaky.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hmscqzhnw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bqgayrjzslewsdcpkof.exe"	beiqcjp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	qaorinawaky.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\dahnv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\aiarkcobyjyrzvfx.exe"	beiqcjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hmscqzhnw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qetmjbshzrjavfdpjm.exe"	beiqcjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qqajuein = "qaunicqferidnlxruk.exe"	beiqcjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\dahnv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qaunicqferidnlxruk.exe"	beiqcjp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	beiqcjp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	qaorinawaky.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\sajwnzktfrdo = "amzqlbqdtjzohplv.exe"	beiqcjp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	qaorinawaky.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hmscqzhnw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qetmjbshzrjavfdpjm.exe"	qaorinawaky.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hmscqzhnw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\huiawndrizqgajgrk.exe"	qaorinawaky.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hmscqzhnw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\oevqpjctnhburddrnska.exe"	beiqcjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hmscqzhnw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\huiawndrizqgajgrk.exe"	beiqcjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hmscqzhnw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bqgayrjzslewsdcpkof.exe"	qaorinawaky.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hmscqzhnw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\amzqlbqdtjzohplv.exe"	beiqcjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hmscqzhnw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qetmjbshzrjavfdpjm.exe"	beiqcjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qqajuein = "dqnjhevnpfzxklaxdwjgc.exe"	beiqcjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hmscqzhnw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dumiidxpkfausfgvsyria.exe"	beiqcjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\sajwnzktfrdo = "huiawndrizqgajgrk.exe"	beiqcjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\sajwnzktfrdo = "huiawndrizqgajgrk.exe"	qaorinawaky.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qqajuein = "bmhbxshxxldzkjwrvmx.exe"	beiqcjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qqajuein = "aiarkcobyjyrzvfx.exe"	beiqcjp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	beiqcjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hmscqzhnw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qetmjbshzrjavfdpjm.exe"	qaorinawaky.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\sajwnzktfrdo = "huiawndrizqgajgrk.exe"	qaorinawaky.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\sajwnzktfrdo = "qetmjbshzrjavfdpjm.exe"	qaorinawaky.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\sajwnzktfrdo = "qetmjbshzrjavfdpjm.exe"	beiqcjp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	beiqcjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\sajwnzktfrdo = "dumiidxpkfausfgvsyria.exe"	beiqcjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hmscqzhnw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dumiidxpkfausfgvsyria.exe"	qaorinawaky.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\sajwnzktfrdo = "bqgayrjzslewsdcpkof.exe"	beiqcjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\sajwnzktfrdo = "amzqlbqdtjzohplv.exe"	qaorinawaky.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hmscqzhnw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\oevqpjctnhburddrnska.exe"	beiqcjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\sajwnzktfrdo = "oevqpjctnhburddrnska.exe"	beiqcjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\sajwnzktfrdo = "huiawndrizqgajgrk.exe"	beiqcjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\dahnv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\oawrokarshaxjjxtyqcy.exe"	beiqcjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\sajwnzktfrdo = "oevqpjctnhburddrnska.exe"	beiqcjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\sajwnzktfrdo = "amzqlbqdtjzohplv.exe"	qaorinawaky.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hmscqzhnw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bqgayrjzslewsdcpkof.exe"	beiqcjp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	qaorinawaky.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\hmscqzhnw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\huiawndrizqgajgrk.exe"	beiqcjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\sajwnzktfrdo = "qetmjbshzrjavfdpjm.exe"	qaorinawaky.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\qqajuein = "hqjbvobpnzpjspatv.exe"	beiqcjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\sajwnzktfrdo = "bqgayrjzslewsdcpkof.exe"	beiqcjp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	qaorinawaky.exe

Disables RegEdit via registry modification 8 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	qaorinawaky.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	qaorinawaky.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	beiqcjp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	beiqcjp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	beiqcjp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	beiqcjp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	beiqcjp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	beiqcjp.exe

Checks computer location settings 2 TTPs 9 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	qaorinawaky.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	bqgayrjzslewsdcpkof.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	huiawndrizqgajgrk.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	beiqcjp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	oevqpjctnhburddrnska.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	qetmjbshzrjavfdpjm.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	amzqlbqdtjzohplv.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	dumiidxpkfausfgvsyria.exe
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	tmpwqfbwni_.exe

Executes dropped EXE 35 IoCs

pid	Process
8	qaorinawaky.exe
216	dumiidxpkfausfgvsyria.exe
4760	oevqpjctnhburddrnska.exe
2240	oevqpjctnhburddrnska.exe
3276	dumiidxpkfausfgvsyria.exe
868	qetmjbshzrjavfdpjm.exe
4072	qaorinawaky.exe
2932	qaorinawaky.exe
2788	oevqpjctnhburddrnska.exe
2548	beiqcjp.exe
3040	beiqcjp.exe
2324	qetmjbshzrjavfdpjm.exe
204	bqgayrjzslewsdcpkof.exe
1268	qaorinawaky.exe
4164	qaorinawaky.exe
3440	beiqcjp.exe
2476	amzqlbqdtjzohplv.exe
4136	qaorinawaky.exe
4876	amzqlbqdtjzohplv.exe
4988	huiawndrizqgajgrk.exe
4476	amzqlbqdtjzohplv.exe
4764	huiawndrizqgajgrk.exe
3500	qaorinawaky.exe
4180	qaorinawaky.exe
1160	qetmjbshzrjavfdpjm.exe
4316	huiawndrizqgajgrk.exe
1848	bqgayrjzslewsdcpkof.exe
2440	bqgayrjzslewsdcpkof.exe
2852	qaorinawaky.exe
700	dumiidxpkfausfgvsyria.exe
2324	qaorinawaky.exe
3084	qaorinawaky.exe
1340	qaorinawaky.exe
3524	qaorinawaky.exe
4592	qaorinawaky.exe

Impair Defenses: Safe Mode Boot 1 TTPs 6 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UserManager	beiqcjp.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SerCx2.sys	beiqcjp.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc	beiqcjp.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power	beiqcjp.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iai2c.sys	beiqcjp.exe
Key deleted	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CBDHSvc	beiqcjp.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

defense_evasion persistence privilege_escalation

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bajrbkn = "qaunicqferidnlxruk.exe ."	beiqcjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\swkxmairkrcr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qaunicqferidnlxruk.exe"	beiqcjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\agnynxgnxh = "huiawndrizqgajgrk.exe"	beiqcjp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rakyqdpzmzmyo = "huiawndrizqgajgrk.exe"	qaorinawaky.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rakyqdpzmzmyo = "oevqpjctnhburddrnska.exe"	beiqcjp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bajrbkn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bmhbxshxxldzkjwrvmx.exe ."	beiqcjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vckwmxhpalw = "dumiidxpkfausfgvsyria.exe ."	qaorinawaky.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vylxlyfnflv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bmhbxshxxldzkjwrvmx.exe ."	beiqcjp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\agnynxgnxh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qetmjbshzrjavfdpjm.exe"	qaorinawaky.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\scncvjwhvjxkbh = "dumiidxpkfausfgvsyria.exe ."	beiqcjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vylxlyfnflv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\aiarkcobyjyrzvfx.exe ."	beiqcjp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\vckwmxhpalw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\amzqlbqdtjzohplv.exe ."	beiqcjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bajrbkn = "dqnjhevnpfzxklaxdwjgc.exe ."	beiqcjp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rakyqdpzmzmyo = "amzqlbqdtjzohplv.exe"	qaorinawaky.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\omubks = "aiarkcobyjyrzvfx.exe"	beiqcjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\bajrbkn = "hqjbvobpnzpjspatv.exe ."	beiqcjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\swkxmairkrcr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\oawrokarshaxjjxtyqcy.exe"	beiqcjp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rakyqdpzmzmyo = "amzqlbqdtjzohplv.exe"	beiqcjp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\agnynxgnxh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\huiawndrizqgajgrk.exe"	beiqcjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vckwmxhpalw = "qetmjbshzrjavfdpjm.exe ."	qaorinawaky.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\vckwmxhpalw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bqgayrjzslewsdcpkof.exe ."	beiqcjp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\agnynxgnxh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\amzqlbqdtjzohplv.exe"	beiqcjp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\agnynxgnxh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qetmjbshzrjavfdpjm.exe"	beiqcjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vgsicrfrgvkyqxs = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dumiidxpkfausfgvsyria.exe ."	qaorinawaky.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\hitdpaflb = "hqjbvobpnzpjspatv.exe"	beiqcjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vckwmxhpalw = "huiawndrizqgajgrk.exe ."	qaorinawaky.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vgsicrfrgvkyqxs = "C:\\Users\\Admin\\AppData\\Local\\Temp\\oevqpjctnhburddrnska.exe ."	beiqcjp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\vckwmxhpalw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\oevqpjctnhburddrnska.exe ."	qaorinawaky.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\bajrbkn = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dqnjhevnpfzxklaxdwjgc.exe ."	beiqcjp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\vckwmxhpalw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\huiawndrizqgajgrk.exe ."	qaorinawaky.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\swkxmairkrcr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bmhbxshxxldzkjwrvmx.exe"	beiqcjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\omubks = "qaunicqferidnlxruk.exe"	beiqcjp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\scncvjwhvjxkbh = "huiawndrizqgajgrk.exe ."	qaorinawaky.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\scncvjwhvjxkbh = "qetmjbshzrjavfdpjm.exe ."	beiqcjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\amzqlbqdtjzohplv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\amzqlbqdtjzohplv.exe"	beiqcjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\agnynxgnxh = "dumiidxpkfausfgvsyria.exe"	qaorinawaky.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vckwmxhpalw = "qetmjbshzrjavfdpjm.exe ."	beiqcjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vgsicrfrgvkyqxs = "C:\\Users\\Admin\\AppData\\Local\\Temp\\amzqlbqdtjzohplv.exe ."	beiqcjp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rakyqdpzmzmyo = "bqgayrjzslewsdcpkof.exe"	beiqcjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vckwmxhpalw = "amzqlbqdtjzohplv.exe ."	beiqcjp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\vckwmxhpalw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\oevqpjctnhburddrnska.exe ."	qaorinawaky.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\agnynxgnxh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dumiidxpkfausfgvsyria.exe"	qaorinawaky.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\agnynxgnxh = "qetmjbshzrjavfdpjm.exe"	qaorinawaky.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\vckwmxhpalw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dumiidxpkfausfgvsyria.exe ."	beiqcjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\agnynxgnxh = "dumiidxpkfausfgvsyria.exe"	qaorinawaky.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\agnynxgnxh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\oevqpjctnhburddrnska.exe"	qaorinawaky.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\omubks = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qaunicqferidnlxruk.exe"	beiqcjp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rakyqdpzmzmyo = "amzqlbqdtjzohplv.exe"	qaorinawaky.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vckwmxhpalw = "dumiidxpkfausfgvsyria.exe ."	qaorinawaky.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\omubks = "C:\\Users\\Admin\\AppData\\Local\\Temp\\aiarkcobyjyrzvfx.exe"	beiqcjp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\vckwmxhpalw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bqgayrjzslewsdcpkof.exe ."	beiqcjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vgsicrfrgvkyqxs = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qetmjbshzrjavfdpjm.exe ."	beiqcjp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\scncvjwhvjxkbh = "huiawndrizqgajgrk.exe ."	qaorinawaky.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\omubks = "C:\\Users\\Admin\\AppData\\Local\\Temp\\oawrokarshaxjjxtyqcy.exe"	beiqcjp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\omubks = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dqnjhevnpfzxklaxdwjgc.exe"	beiqcjp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\vckwmxhpalw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\oevqpjctnhburddrnska.exe ."	qaorinawaky.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\agnynxgnxh = "huiawndrizqgajgrk.exe"	qaorinawaky.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\amzqlbqdtjzohplv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qetmjbshzrjavfdpjm.exe"	beiqcjp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\vckwmxhpalw = "C:\\Users\\Admin\\AppData\\Local\\Temp\\huiawndrizqgajgrk.exe ."	beiqcjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\amzqlbqdtjzohplv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bqgayrjzslewsdcpkof.exe"	beiqcjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\vckwmxhpalw = "oevqpjctnhburddrnska.exe ."	beiqcjp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\agnynxgnxh = "C:\\Users\\Admin\\AppData\\Local\\Temp\\qetmjbshzrjavfdpjm.exe"	beiqcjp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\agnynxgnxh = "huiawndrizqgajgrk.exe"	qaorinawaky.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\amzqlbqdtjzohplv = "C:\\Users\\Admin\\AppData\\Local\\Temp\\amzqlbqdtjzohplv.exe"	qaorinawaky.exe

Checks whether UAC is enabled 1 TTPs 20 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	qaorinawaky.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	qaorinawaky.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	beiqcjp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	beiqcjp.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	qaorinawaky.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	qaorinawaky.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	qaorinawaky.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	beiqcjp.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	beiqcjp.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	qaorinawaky.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	qaorinawaky.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	qaorinawaky.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	beiqcjp.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	beiqcjp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	qaorinawaky.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	qaorinawaky.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	qaorinawaky.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	qaorinawaky.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	qaorinawaky.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	qaorinawaky.exe

Hijack Execution Flow: Executable Installer File Permissions Weakness 1 TTPs 4 IoCs

Possible Turn off User Account Control's privilege elevation for standard users.

Executable Installer File Permissions Weakness

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	qaorinawaky.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	beiqcjp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	beiqcjp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	beiqcjp.exe

Looks up external IP address via web service 12 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
23	www.showmyipaddress.com
26	www.whatismyip.ca
27	whatismyip.everdot.org
30	whatismyipaddress.com
62	www.whatismyip.ca
64	whatismyip.everdot.org
72	www.whatismyip.ca
44	whatismyip.everdot.org
90	www.whatismyip.ca
91	whatismyip.everdot.org
139	whatismyip.everdot.org
144	www.whatismyip.ca

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\autorun.inf	beiqcjp.exe
File created	C:\autorun.inf	beiqcjp.exe
File opened for modification	F:\autorun.inf	beiqcjp.exe
File created	F:\autorun.inf	beiqcjp.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\oevqpjctnhburddrnska.exe	qaorinawaky.exe
File opened for modification	C:\Windows\SysWOW64\dumiidxpkfausfgvsyria.exe	beiqcjp.exe
File created	C:\Windows\SysWOW64\umfcdzunjfbwvjlbzgasli.exe	beiqcjp.exe
File created	C:\Windows\SysWOW64\dumiidxpkfausfgvsyria.exe	qaorinawaky.exe
File opened for modification	C:\Windows\SysWOW64\bqgayrjzslewsdcpkof.exe	qaorinawaky.exe
File opened for modification	C:\Windows\SysWOW64\amzqlbqdtjzohplv.exe	qaorinawaky.exe
File created	C:\Windows\SysWOW64\bqgayrjzslewsdcpkof.exe	qaorinawaky.exe
File created	C:\Windows\SysWOW64\amzqlbqdtjzohplv.exe	beiqcjp.exe
File created	C:\Windows\SysWOW64\umfcdzunjfbwvjlbzgasli.exe	beiqcjp.exe
File created	C:\Windows\SysWOW64\oevqpjctnhburddrnska.exe	qaorinawaky.exe
File opened for modification	C:\Windows\SysWOW64\amzqlbqdtjzohplv.exe	qaorinawaky.exe
File opened for modification	C:\Windows\SysWOW64\amzqlbqdtjzohplv.exe	beiqcjp.exe
File created	C:\Windows\SysWOW64\bqgayrjzslewsdcpkof.exe	qaorinawaky.exe
File created	C:\Windows\SysWOW64\amzqlbqdtjzohplv.exe	qaorinawaky.exe
File opened for modification	C:\Windows\SysWOW64\bqgayrjzslewsdcpkof.exe	beiqcjp.exe
File opened for modification	C:\Windows\SysWOW64\amzqlbqdtjzohplv.exe	qaorinawaky.exe
File opened for modification	C:\Windows\SysWOW64\bqgayrjzslewsdcpkof.exe	qaorinawaky.exe
File created	C:\Windows\SysWOW64\oevqpjctnhburddrnska.exe	qaorinawaky.exe
File created	C:\Windows\SysWOW64\umfcdzunjfbwvjlbzgasli.exe	qaorinawaky.exe
File opened for modification	C:\Windows\SysWOW64\amzqlbqdtjzohplv.exe	qaorinawaky.exe
File created	C:\Windows\SysWOW64\umfcdzunjfbwvjlbzgasli.exe	qaorinawaky.exe
File opened for modification	C:\Windows\SysWOW64\qetmjbshzrjavfdpjm.exe	qaorinawaky.exe
File created	C:\Windows\SysWOW64\umfcdzunjfbwvjlbzgasli.exe	qaorinawaky.exe
File opened for modification	C:\Windows\SysWOW64\dumiidxpkfausfgvsyria.exe	beiqcjp.exe
File created	C:\Windows\SysWOW64\amzqlbqdtjzohplv.exe	qaorinawaky.exe
File created	C:\Windows\SysWOW64\huiawndrizqgajgrk.exe	qaorinawaky.exe
File created	C:\Windows\SysWOW64\dumiidxpkfausfgvsyria.exe	qaorinawaky.exe
File created	C:\Windows\SysWOW64\amzqlbqdtjzohplv.exe	qaorinawaky.exe
File created	C:\Windows\SysWOW64\bqgayrjzslewsdcpkof.exe	qaorinawaky.exe
File opened for modification	C:\Windows\SysWOW64\umfcdzunjfbwvjlbzgasli.exe	beiqcjp.exe
File created	C:\Windows\SysWOW64\qetmjbshzrjavfdpjm.exe	qaorinawaky.exe
File created	C:\Windows\SysWOW64\bqgayrjzslewsdcpkof.exe	qaorinawaky.exe
File opened for modification	C:\Windows\SysWOW64\umfcdzunjfbwvjlbzgasli.exe	qaorinawaky.exe
File opened for modification	C:\Windows\SysWOW64\bqgayrjzslewsdcpkof.exe	qaorinawaky.exe
File created	C:\Windows\SysWOW64\qetmjbshzrjavfdpjm.exe	qaorinawaky.exe
File opened for modification	C:\Windows\SysWOW64\oevqpjctnhburddrnska.exe	qaorinawaky.exe
File created	C:\Windows\SysWOW64\dumiidxpkfausfgvsyria.exe	beiqcjp.exe
File created	C:\Windows\SysWOW64\dumiidxpkfausfgvsyria.exe	qaorinawaky.exe
File opened for modification	C:\Windows\SysWOW64\umfcdzunjfbwvjlbzgasli.exe	qaorinawaky.exe
File created	C:\Windows\SysWOW64\qetmjbshzrjavfdpjm.exe	qaorinawaky.exe
File opened for modification	C:\Windows\SysWOW64\oevqpjctnhburddrnska.exe	qaorinawaky.exe
File opened for modification	C:\Windows\SysWOW64\dumiidxpkfausfgvsyria.exe	qaorinawaky.exe
File opened for modification	C:\Windows\SysWOW64\huiawndrizqgajgrk.exe	qaorinawaky.exe
File created	C:\Windows\SysWOW64\umfcdzunjfbwvjlbzgasli.exe	qaorinawaky.exe
File created	C:\Windows\SysWOW64\oevqpjctnhburddrnska.exe	qaorinawaky.exe
File opened for modification	C:\Windows\SysWOW64\qetmjbshzrjavfdpjm.exe	qaorinawaky.exe
File created	C:\Windows\SysWOW64\dumiidxpkfausfgvsyria.exe	qaorinawaky.exe
File opened for modification	C:\Windows\SysWOW64\huiawndrizqgajgrk.exe	beiqcjp.exe
File opened for modification	C:\Windows\SysWOW64\bqgayrjzslewsdcpkof.exe	beiqcjp.exe
File created	C:\Windows\SysWOW64\dumiidxpkfausfgvsyria.exe	beiqcjp.exe
File opened for modification	C:\Windows\SysWOW64\vgsicrfrgvkyqxsbssfqcsmbpbqfuiahclccp.mcw	beiqcjp.exe
File created	C:\Windows\SysWOW64\vgsicrfrgvkyqxsbssfqcsmbpbqfuiahclccp.mcw	beiqcjp.exe
File created	C:\Windows\SysWOW64\umfcdzunjfbwvjlbzgasli.exe	qaorinawaky.exe
File created	C:\Windows\SysWOW64\qetmjbshzrjavfdpjm.exe	qaorinawaky.exe
File opened for modification	C:\Windows\SysWOW64\amzqlbqdtjzohplv.exe	qaorinawaky.exe
File created	C:\Windows\SysWOW64\oevqpjctnhburddrnska.exe	qaorinawaky.exe
File created	C:\Windows\SysWOW64\huiawndrizqgajgrk.exe	beiqcjp.exe
File opened for modification	C:\Windows\SysWOW64\amzqlbqdtjzohplv.exe	beiqcjp.exe
File created	C:\Windows\SysWOW64\huiawndrizqgajgrk.exe	beiqcjp.exe
File created	C:\Windows\SysWOW64\umfcdzunjfbwvjlbzgasli.exe	qaorinawaky.exe
File created	C:\Windows\SysWOW64\bqgayrjzslewsdcpkof.exe	qaorinawaky.exe
File opened for modification	C:\Windows\SysWOW64\dumiidxpkfausfgvsyria.exe	qaorinawaky.exe
File created	C:\Windows\SysWOW64\qetmjbshzrjavfdpjm.exe	beiqcjp.exe
File opened for modification	C:\Windows\SysWOW64\oevqpjctnhburddrnska.exe	beiqcjp.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\vgsicrfrgvkyqxsbssfqcsmbpbqfuiahclccp.mcw	beiqcjp.exe
File opened for modification	C:\Program Files (x86)\uuvajnqrvzdgnjtrxmoopudhkl.txa	beiqcjp.exe
File created	C:\Program Files (x86)\uuvajnqrvzdgnjtrxmoopudhkl.txa	beiqcjp.exe
File opened for modification	C:\Program Files (x86)\vgsicrfrgvkyqxsbssfqcsmbpbqfuiahclccp.mcw	beiqcjp.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\qetmjbshzrjavfdpjm.exe	beiqcjp.exe
File opened for modification	C:\Windows\dumiidxpkfausfgvsyria.exe	beiqcjp.exe
File created	C:\Windows\vgsicrfrgvkyqxsbssfqcsmbpbqfuiahclccp.mcw	beiqcjp.exe
File opened for modification	C:\Windows\oevqpjctnhburddrnska.exe	qaorinawaky.exe
File created	C:\Windows\amzqlbqdtjzohplv.exe	qaorinawaky.exe
File opened for modification	C:\Windows\oevqpjctnhburddrnska.exe	qaorinawaky.exe
File opened for modification	C:\Windows\amzqlbqdtjzohplv.exe	beiqcjp.exe
File opened for modification	C:\Windows\vgsicrfrgvkyqxsbssfqcsmbpbqfuiahclccp.mcw	beiqcjp.exe
File opened for modification	C:\Windows\qetmjbshzrjavfdpjm.exe	qaorinawaky.exe
File opened for modification	C:\Windows\umfcdzunjfbwvjlbzgasli.exe	qaorinawaky.exe
File opened for modification	C:\Windows\oevqpjctnhburddrnska.exe	qaorinawaky.exe
File opened for modification	C:\Windows\umfcdzunjfbwvjlbzgasli.exe	beiqcjp.exe
File created	C:\Windows\amzqlbqdtjzohplv.exe	qaorinawaky.exe
File opened for modification	C:\Windows\qetmjbshzrjavfdpjm.exe	beiqcjp.exe
File opened for modification	C:\Windows\amzqlbqdtjzohplv.exe	qaorinawaky.exe
File opened for modification	C:\Windows\huiawndrizqgajgrk.exe	qaorinawaky.exe
File opened for modification	C:\Windows\huiawndrizqgajgrk.exe	qaorinawaky.exe
File created	C:\Windows\bqgayrjzslewsdcpkof.exe	qaorinawaky.exe
File opened for modification	C:\Windows\amzqlbqdtjzohplv.exe	qaorinawaky.exe
File opened for modification	C:\Windows\huiawndrizqgajgrk.exe	qaorinawaky.exe
File opened for modification	C:\Windows\qetmjbshzrjavfdpjm.exe	qaorinawaky.exe
File opened for modification	C:\Windows\huiawndrizqgajgrk.exe	beiqcjp.exe
File opened for modification	C:\Windows\bqgayrjzslewsdcpkof.exe	qaorinawaky.exe
File opened for modification	C:\Windows\umfcdzunjfbwvjlbzgasli.exe	qaorinawaky.exe
File opened for modification	C:\Windows\qetmjbshzrjavfdpjm.exe	qaorinawaky.exe
File opened for modification	C:\Windows\bqgayrjzslewsdcpkof.exe	qaorinawaky.exe
File created	C:\Windows\huiawndrizqgajgrk.exe	qaorinawaky.exe
File opened for modification	C:\Windows\bqgayrjzslewsdcpkof.exe	beiqcjp.exe
File opened for modification	C:\Windows\umfcdzunjfbwvjlbzgasli.exe	qaorinawaky.exe
File opened for modification	C:\Windows\bqgayrjzslewsdcpkof.exe	qaorinawaky.exe
File opened for modification	C:\Windows\dumiidxpkfausfgvsyria.exe	qaorinawaky.exe
File opened for modification	C:\Windows\bqgayrjzslewsdcpkof.exe	qaorinawaky.exe
File created	C:\Windows\oevqpjctnhburddrnska.exe	qaorinawaky.exe
File created	C:\Windows\umfcdzunjfbwvjlbzgasli.exe	qaorinawaky.exe
File opened for modification	C:\Windows\umfcdzunjfbwvjlbzgasli.exe	beiqcjp.exe
File opened for modification	C:\Windows\qetmjbshzrjavfdpjm.exe	qaorinawaky.exe
File opened for modification	C:\Windows\dumiidxpkfausfgvsyria.exe	qaorinawaky.exe
File opened for modification	C:\Windows\umfcdzunjfbwvjlbzgasli.exe	qaorinawaky.exe
File opened for modification	C:\Windows\qetmjbshzrjavfdpjm.exe	qaorinawaky.exe
File opened for modification	C:\Windows\dumiidxpkfausfgvsyria.exe	qaorinawaky.exe
File opened for modification	C:\Windows\bqgayrjzslewsdcpkof.exe	beiqcjp.exe
File opened for modification	C:\Windows\huiawndrizqgajgrk.exe	qaorinawaky.exe
File opened for modification	C:\Windows\amzqlbqdtjzohplv.exe	qaorinawaky.exe
File opened for modification	C:\Windows\umfcdzunjfbwvjlbzgasli.exe	qaorinawaky.exe
File opened for modification	C:\Windows\oevqpjctnhburddrnska.exe	qaorinawaky.exe
File created	C:\Windows\dumiidxpkfausfgvsyria.exe	qaorinawaky.exe
File opened for modification	C:\Windows\amzqlbqdtjzohplv.exe	beiqcjp.exe
File opened for modification	C:\Windows\oevqpjctnhburddrnska.exe	beiqcjp.exe
File opened for modification	C:\Windows\oevqpjctnhburddrnska.exe	qaorinawaky.exe
File opened for modification	C:\Windows\dumiidxpkfausfgvsyria.exe	qaorinawaky.exe
File opened for modification	C:\Windows\amzqlbqdtjzohplv.exe	qaorinawaky.exe
File opened for modification	C:\Windows\huiawndrizqgajgrk.exe	qaorinawaky.exe
File opened for modification	C:\Windows\dumiidxpkfausfgvsyria.exe	qaorinawaky.exe
File opened for modification	C:\Windows\amzqlbqdtjzohplv.exe	qaorinawaky.exe
File opened for modification	C:\Windows\dumiidxpkfausfgvsyria.exe	beiqcjp.exe
File opened for modification	C:\Windows\uuvajnqrvzdgnjtrxmoopudhkl.txa	beiqcjp.exe
File created	C:\Windows\huiawndrizqgajgrk.exe	qaorinawaky.exe
File opened for modification	C:\Windows\huiawndrizqgajgrk.exe	qaorinawaky.exe
File opened for modification	C:\Windows\umfcdzunjfbwvjlbzgasli.exe	qaorinawaky.exe
File created	C:\Windows\dumiidxpkfausfgvsyria.exe	qaorinawaky.exe
File opened for modification	C:\Windows\amzqlbqdtjzohplv.exe	qaorinawaky.exe
File opened for modification	C:\Windows\amzqlbqdtjzohplv.exe	qaorinawaky.exe
File opened for modification	C:\Windows\bqgayrjzslewsdcpkof.exe	qaorinawaky.exe
File opened for modification	C:\Windows\qetmjbshzrjavfdpjm.exe	qaorinawaky.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 34 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dqnjhevnpfzxklaxdwjgc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bqgayrjzslewsdcpkof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bmhbxshxxldzkjwrvmx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bqgayrjzslewsdcpkof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bmhbxshxxldzkjwrvmx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qaunicqferidnlxruk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dumiidxpkfausfgvsyria.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmpwqfbwni_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oevqpjctnhburddrnska.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qetmjbshzrjavfdpjm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	beiqcjp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	huiawndrizqgajgrk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	huiawndrizqgajgrk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qaorinawaky.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dumiidxpkfausfgvsyria.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dqnjhevnpfzxklaxdwjgc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	huiawndrizqgajgrk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bajrbkn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dumiidxpkfausfgvsyria.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oevqpjctnhburddrnska.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hqjbvobpnzpjspatv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	amzqlbqdtjzohplv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oawrokarshaxjjxtyqcy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aiarkcobyjyrzvfx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	amzqlbqdtjzohplv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hqjbvobpnzpjspatv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qaunicqferidnlxruk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qetmjbshzrjavfdpjm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bmhbxshxxldzkjwrvmx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oawrokarshaxjjxtyqcy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dqnjhevnpfzxklaxdwjgc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aiarkcobyjyrzvfx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hqjbvobpnzpjspatv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	beiqcjp.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4244	tmpwqfbwni_.exe
4244	tmpwqfbwni_.exe
4244	tmpwqfbwni_.exe
4244	tmpwqfbwni_.exe
4244	tmpwqfbwni_.exe
4244	tmpwqfbwni_.exe
4244	tmpwqfbwni_.exe
4244	tmpwqfbwni_.exe
4244	tmpwqfbwni_.exe
4244	tmpwqfbwni_.exe
4244	tmpwqfbwni_.exe
4244	tmpwqfbwni_.exe
4244	tmpwqfbwni_.exe
4244	tmpwqfbwni_.exe
4244	tmpwqfbwni_.exe
4244	tmpwqfbwni_.exe
3040	beiqcjp.exe
3040	beiqcjp.exe
4244	tmpwqfbwni_.exe
4244	tmpwqfbwni_.exe
4244	tmpwqfbwni_.exe
4244	tmpwqfbwni_.exe
4244	tmpwqfbwni_.exe
4244	tmpwqfbwni_.exe
4244	tmpwqfbwni_.exe
4244	tmpwqfbwni_.exe
4244	tmpwqfbwni_.exe
4244	tmpwqfbwni_.exe
4244	tmpwqfbwni_.exe
4244	tmpwqfbwni_.exe
4244	tmpwqfbwni_.exe
4244	tmpwqfbwni_.exe
4244	tmpwqfbwni_.exe
4244	tmpwqfbwni_.exe
4244	tmpwqfbwni_.exe
4244	tmpwqfbwni_.exe
4244	tmpwqfbwni_.exe
4244	tmpwqfbwni_.exe
4244	tmpwqfbwni_.exe
4244	tmpwqfbwni_.exe
4244	tmpwqfbwni_.exe
4244	tmpwqfbwni_.exe
4244	tmpwqfbwni_.exe
4244	tmpwqfbwni_.exe
4244	tmpwqfbwni_.exe
4244	tmpwqfbwni_.exe
4244	tmpwqfbwni_.exe
4244	tmpwqfbwni_.exe
4244	tmpwqfbwni_.exe
4244	tmpwqfbwni_.exe
4244	tmpwqfbwni_.exe
4244	tmpwqfbwni_.exe
4244	tmpwqfbwni_.exe
4244	tmpwqfbwni_.exe
4244	tmpwqfbwni_.exe
4244	tmpwqfbwni_.exe
4244	tmpwqfbwni_.exe
4244	tmpwqfbwni_.exe
4244	tmpwqfbwni_.exe
4244	tmpwqfbwni_.exe
4244	tmpwqfbwni_.exe
4244	tmpwqfbwni_.exe
4244	tmpwqfbwni_.exe
4244	tmpwqfbwni_.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3040	beiqcjp.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 4244 wrote to memory of 8	4244	tmpwqfbwni_.exe	90
PID 4760 wrote to memory of 4072	4760	oevqpjctnhburddrnska.exe	105
PID 868 wrote to memory of 2932	868	qetmjbshzrjavfdpjm.exe	108
PID 8 wrote to memory of 2548	8	qaorinawaky.exe	110
PID 8 wrote to memory of 3040	8	qaorinawaky.exe	111
PID 3648 wrote to memory of 1268	3648	qaunicqferidnlxruk.exe	120
PID 204 wrote to memory of 4164	204	bqgayrjzslewsdcpkof.exe	121
PID 8 wrote to memory of 3440	8	qaorinawaky.exe	122
PID 4852 wrote to memory of 4136	4852	aiarkcobyjyrzvfx.exe	141
PID 4876 wrote to memory of 3500	4876	amzqlbqdtjzohplv.exe	146
PID 4764 wrote to memory of 4180	4764	huiawndrizqgajgrk.exe	147
PID 4732 wrote to memory of 2852	4732	oawrokarshaxjjxtyqcy.exe	161
PID 700 wrote to memory of 2324	700	dumiidxpkfausfgvsyria.exe	168
PID 2716 wrote to memory of 3084	2716	hqjbvobpnzpjspatv.exe	178
PID 3692 wrote to memory of 1340	3692	dqnjhevnpfzxklaxdwjgc.exe	185
PID 1836 wrote to memory of 3524	1836	bmhbxshxxldzkjwrvmx.exe	196
PID 4244 wrote to memory of 4592	4244	tmpwqfbwni_.exe	238

System policy modification 1 TTPs 60 IoCs

defense_evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	beiqcjp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	beiqcjp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	beiqcjp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	qaorinawaky.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	qaorinawaky.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	qaorinawaky.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	qaorinawaky.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	beiqcjp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	beiqcjp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	beiqcjp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	beiqcjp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	qaorinawaky.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	qaorinawaky.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	qaorinawaky.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	qaorinawaky.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	beiqcjp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	qaorinawaky.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	beiqcjp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	beiqcjp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	qaorinawaky.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	qaorinawaky.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	beiqcjp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	qaorinawaky.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	qaorinawaky.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	beiqcjp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	qaorinawaky.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	beiqcjp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	qaorinawaky.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	qaorinawaky.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	qaorinawaky.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	qaorinawaky.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	qaorinawaky.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0"	beiqcjp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	qaorinawaky.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	beiqcjp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	beiqcjp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	beiqcjp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	beiqcjp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	beiqcjp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	beiqcjp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	beiqcjp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	beiqcjp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	beiqcjp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	beiqcjp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	beiqcjp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	beiqcjp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	beiqcjp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	beiqcjp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	qaorinawaky.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1"	qaorinawaky.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	beiqcjp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	beiqcjp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0"	beiqcjp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	beiqcjp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	beiqcjp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0"	beiqcjp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	beiqcjp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	qaorinawaky.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	beiqcjp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0"	qaorinawaky.exe

C:\Users\Admin\AppData\Local\Temp\tmpwqfbwni_.exe
"C:\Users\Admin\AppData\Local\Temp\tmpwqfbwni_.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4244
- C:\Users\Admin\AppData\Local\Temp\qaorinawaky.exe
  "C:\Users\Admin\AppData\Local\Temp\qaorinawaky.exe" "c:\users\admin\appdata\local\temp\tmpwqfbwni_.exe*"
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Adds policy Run key to start application
  - Disables RegEdit via registry modification
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Hijack Execution Flow: Executable Installer File Permissions Weakness
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:8
- - C:\Users\Admin\AppData\Local\Temp\beiqcjp.exe
    "C:\Users\Admin\AppData\Local\Temp\beiqcjp.exe" "-c:\users\admin\appdata\local\temp\tmpwqfbwni_.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Checks computer location settings
    - Executes dropped EXE
    - Impair Defenses: Safe Mode Boot
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Hijack Execution Flow: Executable Installer File Permissions Weakness
    - System Location Discovery: System Language Discovery
    - System policy modification
    PID:2548
  - - C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe
      "C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe" "-c:\users\admin\appdata\local\temp\tmpwqfbwni_.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2364
  - - C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe
      "C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe" "-c:\users\admin\appdata\local\temp\tmpwqfbwni_.exe"
      4⤵
      PID:4716
  - - C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe
      "C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe" "-c:\users\admin\appdata\local\temp\tmpwqfbwni_.exe"
      4⤵
      PID:376
  - - C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe
      "C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe" "-c:\users\admin\appdata\local\temp\tmpwqfbwni_.exe"
      4⤵
      PID:4272
  - - C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe
      "C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe" "-c:\users\admin\appdata\local\temp\tmpwqfbwni_.exe"
      4⤵
      PID:3900
  - - C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe
      "C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe" "-c:\users\admin\appdata\local\temp\tmpwqfbwni_.exe"
      4⤵
      PID:680
  - - C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe
      "C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe" "-c:\users\admin\appdata\local\temp\tmpwqfbwni_.exe"
      4⤵
      PID:4484
  - - C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe
      "C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe" "-c:\users\admin\appdata\local\temp\tmpwqfbwni_.exe"
      4⤵
      PID:4160
  - - C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe
      "C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe" "-c:\users\admin\appdata\local\temp\tmpwqfbwni_.exe"
      4⤵
      PID:4456
  - - C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe
      "C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe" "-c:\users\admin\appdata\local\temp\tmpwqfbwni_.exe"
      4⤵
      PID:3276
  - - C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe
      "C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe" "-c:\users\admin\appdata\local\temp\tmpwqfbwni_.exe"
      4⤵
      PID:4036
  - - C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe
      "C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe" "-c:\users\admin\appdata\local\temp\tmpwqfbwni_.exe"
      4⤵
      PID:4560
  - - C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe
      "C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe" "-c:\users\admin\appdata\local\temp\tmpwqfbwni_.exe"
      4⤵
      PID:2160
  - - C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe
      "C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe" "-c:\users\admin\appdata\local\temp\tmpwqfbwni_.exe"
      4⤵
      PID:5056
  - - C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe
      "C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe" "-c:\users\admin\appdata\local\temp\tmpwqfbwni_.exe"
      4⤵
      PID:2880
  - - C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe
      "C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe" "-c:\users\admin\appdata\local\temp\tmpwqfbwni_.exe"
      4⤵
      PID:2416
  - - C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe
      "C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe" "-c:\users\admin\appdata\local\temp\tmpwqfbwni_.exe"
      4⤵
      PID:1192
  - - C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe
      "C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe" "-c:\users\admin\appdata\local\temp\tmpwqfbwni_.exe"
      4⤵
      PID:1844
  - - C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe
      "C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe" "-c:\users\admin\appdata\local\temp\tmpwqfbwni_.exe"
      4⤵
      PID:4184
  - - C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe
      "C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe" "-c:\users\admin\appdata\local\temp\tmpwqfbwni_.exe"
      4⤵
      PID:1896
  - - C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe
      "C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe" "-c:\users\admin\appdata\local\temp\tmpwqfbwni_.exe"
      4⤵
      PID:4468
  - - C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe
      "C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe" "-c:\users\admin\appdata\local\temp\tmpwqfbwni_.exe"
      4⤵
      PID:772
  - - C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe
      "C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe" "-c:\users\admin\appdata\local\temp\tmpwqfbwni_.exe"
      4⤵
      PID:4552
  - - C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe
      "C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe" "-c:\users\admin\appdata\local\temp\tmpwqfbwni_.exe"
      4⤵
      PID:2280
  - - C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe
      "C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe" "-c:\users\admin\appdata\local\temp\tmpwqfbwni_.exe"
      4⤵
      PID:4108
  - - C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe
      "C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe" "-c:\users\admin\appdata\local\temp\tmpwqfbwni_.exe"
      4⤵
      PID:4688
  - - C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe
      "C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe" "-c:\users\admin\appdata\local\temp\tmpwqfbwni_.exe"
      4⤵
      PID:3424
  - - C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe
      "C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe" "-c:\users\admin\appdata\local\temp\tmpwqfbwni_.exe"
      4⤵
      PID:488
  - - C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe
      "C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe" "-c:\users\admin\appdata\local\temp\tmpwqfbwni_.exe"
      4⤵
      PID:4800
  - - C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe
      "C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe" "-c:\users\admin\appdata\local\temp\tmpwqfbwni_.exe"
      4⤵
      PID:3872
  - - C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe
      "C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe" "-c:\users\admin\appdata\local\temp\tmpwqfbwni_.exe"
      4⤵
      PID:2712
  - - C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe
      "C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe" "-c:\users\admin\appdata\local\temp\tmpwqfbwni_.exe"
      4⤵
      PID:5036
  - - C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe
      "C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe" "-c:\users\admin\appdata\local\temp\tmpwqfbwni_.exe"
      4⤵
      PID:376
  - - C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe
      "C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe" "-c:\users\admin\appdata\local\temp\tmpwqfbwni_.exe"
      4⤵
      PID:4272
  - - C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe
      "C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe" "-c:\users\admin\appdata\local\temp\tmpwqfbwni_.exe"
      4⤵
      PID:4696
  - - C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe
      "C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe" "-c:\users\admin\appdata\local\temp\tmpwqfbwni_.exe"
      4⤵
      PID:4216
  - - C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe
      "C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe" "-c:\users\admin\appdata\local\temp\tmpwqfbwni_.exe"
      4⤵
      PID:1432
  - - C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe
      "C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe" "-c:\users\admin\appdata\local\temp\tmpwqfbwni_.exe"
      4⤵
      PID:3024
  - - C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe
      "C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe" "-c:\users\admin\appdata\local\temp\tmpwqfbwni_.exe"
      4⤵
      PID:2476
  - - C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe
      "C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe" "-c:\users\admin\appdata\local\temp\tmpwqfbwni_.exe"
      4⤵
      PID:4932
  - - C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe
      "C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe" "-c:\users\admin\appdata\local\temp\tmpwqfbwni_.exe"
      4⤵
      PID:828
  - - C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe
      "C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe" "-c:\users\admin\appdata\local\temp\tmpwqfbwni_.exe"
      4⤵
      PID:4160
  - - C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe
      "C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe" "-c:\users\admin\appdata\local\temp\tmpwqfbwni_.exe"
      4⤵
      PID:4456
  - - C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe
      "C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe" "-c:\users\admin\appdata\local\temp\tmpwqfbwni_.exe"
      4⤵
      PID:2012
  - - C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe
      "C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe" "-c:\users\admin\appdata\local\temp\tmpwqfbwni_.exe"
      4⤵
      PID:4036
  - - C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe
      "C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe" "-c:\users\admin\appdata\local\temp\tmpwqfbwni_.exe"
      4⤵
      PID:3968
  - - C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe
      "C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe" "-c:\users\admin\appdata\local\temp\tmpwqfbwni_.exe"
      4⤵
      PID:1576
  - - C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe
      "C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe" "-c:\users\admin\appdata\local\temp\tmpwqfbwni_.exe"
      4⤵
      PID:3252
  - - C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe
      "C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe" "-c:\users\admin\appdata\local\temp\tmpwqfbwni_.exe"
      4⤵
      PID:4528
  - - C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe
      "C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe" "-c:\users\admin\appdata\local\temp\tmpwqfbwni_.exe"
      4⤵
      PID:4900
  - - C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe
      "C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe" "-c:\users\admin\appdata\local\temp\tmpwqfbwni_.exe"
      4⤵
      PID:4544
  - - C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe
      "C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe" "-c:\users\admin\appdata\local\temp\tmpwqfbwni_.exe"
      4⤵
      PID:5108
  - - C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe
      "C:\Users\Admin\AppData\Local\Temp\bajrbkn.exe" "-c:\users\admin\appdata\local\temp\tmpwqfbwni_.exe"
      4⤵
      PID:4072
- - C:\Users\Admin\AppData\Local\Temp\beiqcjp.exe
    "C:\Users\Admin\AppData\Local\Temp\beiqcjp.exe" "-c:\users\admin\appdata\local\temp\tmpwqfbwni_.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Hijack Execution Flow: Executable Installer File Permissions Weakness
    - Drops autorun.inf file
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - System policy modification
    PID:3040
- - C:\Users\Admin\AppData\Local\Temp\beiqcjp.exe
    "C:\Users\Admin\AppData\Local\Temp\beiqcjp.exe" "-c:\users\admin\appdata\local\temp\tmpwqfbwni_.exe"
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Adds policy Run key to start application
    - Disables RegEdit via registry modification
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks whether UAC is enabled
    - Hijack Execution Flow: Executable Installer File Permissions Weakness
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System policy modification
    PID:3440
- C:\Users\Admin\AppData\Local\Temp\qaorinawaky.exe
  "C:\Users\Admin\AppData\Local\Temp\qaorinawaky.exe" "c:\users\admin\appdata\local\temp\tmpwqfbwni_.exe"
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Adds policy Run key to start application
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System policy modification
  PID:4592

C:\Windows\explorer.exe
Explorer.exe
1⤵
- Modifies registry class
PID:204

C:\Windows\dumiidxpkfausfgvsyria.exe
dumiidxpkfausfgvsyria.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:216

C:\Windows\oevqpjctnhburddrnska.exe
oevqpjctnhburddrnska.exe .
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Users\Admin\AppData\Local\Temp\qaorinawaky.exe
  "C:\Users\Admin\AppData\Local\Temp\qaorinawaky.exe" "c:\windows\oevqpjctnhburddrnska.exe*."
  2⤵
  - Executes dropped EXE
  PID:4072

C:\Windows\oevqpjctnhburddrnska.exe
oevqpjctnhburddrnska.exe
1⤵
- Executes dropped EXE
PID:2240

C:\Users\Admin\AppData\Local\Temp\dumiidxpkfausfgvsyria.exe
C:\Users\Admin\AppData\Local\Temp\dumiidxpkfausfgvsyria.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3276

C:\Windows\qetmjbshzrjavfdpjm.exe
qetmjbshzrjavfdpjm.exe .
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:868
- C:\Users\Admin\AppData\Local\Temp\qaorinawaky.exe
  "C:\Users\Admin\AppData\Local\Temp\qaorinawaky.exe" "c:\windows\qetmjbshzrjavfdpjm.exe*."
  2⤵
  - Executes dropped EXE
  PID:2932

C:\Users\Admin\AppData\Local\Temp\oevqpjctnhburddrnska.exe
C:\Users\Admin\AppData\Local\Temp\oevqpjctnhburddrnska.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2788

C:\Windows\dqnjhevnpfzxklaxdwjgc.exe
dqnjhevnpfzxklaxdwjgc.exe
1⤵
- System Location Discovery: System Language Discovery
PID:3852

C:\Windows\qetmjbshzrjavfdpjm.exe
qetmjbshzrjavfdpjm.exe
1⤵
- Executes dropped EXE
PID:2324

C:\Windows\qaunicqferidnlxruk.exe
qaunicqferidnlxruk.exe .
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3648
- C:\Users\Admin\AppData\Local\Temp\qaorinawaky.exe
  "C:\Users\Admin\AppData\Local\Temp\qaorinawaky.exe" "c:\windows\qaunicqferidnlxruk.exe*."
  2⤵
  - Executes dropped EXE
  PID:1268

C:\Windows\bqgayrjzslewsdcpkof.exe
bqgayrjzslewsdcpkof.exe .
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:204
- C:\Users\Admin\AppData\Local\Temp\qaorinawaky.exe
  "C:\Users\Admin\AppData\Local\Temp\qaorinawaky.exe" "c:\windows\bqgayrjzslewsdcpkof.exe*."
  2⤵
  - Executes dropped EXE
  PID:4164

C:\Windows\hqjbvobpnzpjspatv.exe
hqjbvobpnzpjspatv.exe
1⤵
- System Location Discovery: System Language Discovery
PID:712

C:\Users\Admin\AppData\Local\Temp\amzqlbqdtjzohplv.exe
C:\Users\Admin\AppData\Local\Temp\amzqlbqdtjzohplv.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2476

C:\Users\Admin\AppData\Local\Temp\dqnjhevnpfzxklaxdwjgc.exe
C:\Users\Admin\AppData\Local\Temp\dqnjhevnpfzxklaxdwjgc.exe
1⤵
- System Location Discovery: System Language Discovery
PID:1848

C:\Windows\aiarkcobyjyrzvfx.exe
aiarkcobyjyrzvfx.exe .
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Users\Admin\AppData\Local\Temp\qaorinawaky.exe
  "C:\Users\Admin\AppData\Local\Temp\qaorinawaky.exe" "c:\windows\aiarkcobyjyrzvfx.exe*."
  2⤵
  - Executes dropped EXE
  PID:4136

C:\Users\Admin\AppData\Local\Temp\qaunicqferidnlxruk.exe
C:\Users\Admin\AppData\Local\Temp\qaunicqferidnlxruk.exe
1⤵
- System Location Discovery: System Language Discovery
PID:2264

C:\Windows\amzqlbqdtjzohplv.exe
amzqlbqdtjzohplv.exe .
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Users\Admin\AppData\Local\Temp\qaorinawaky.exe
  "C:\Users\Admin\AppData\Local\Temp\qaorinawaky.exe" "c:\windows\amzqlbqdtjzohplv.exe*."
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Adds policy Run key to start application
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System policy modification
  PID:3500

C:\Windows\huiawndrizqgajgrk.exe
huiawndrizqgajgrk.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4988

C:\Windows\amzqlbqdtjzohplv.exe
amzqlbqdtjzohplv.exe
1⤵
- Executes dropped EXE
PID:4476

C:\Windows\huiawndrizqgajgrk.exe
huiawndrizqgajgrk.exe .
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Users\Admin\AppData\Local\Temp\qaorinawaky.exe
  "C:\Users\Admin\AppData\Local\Temp\qaorinawaky.exe" "c:\windows\huiawndrizqgajgrk.exe*."
  2⤵
  - Executes dropped EXE
  PID:4180

C:\Users\Admin\AppData\Local\Temp\qetmjbshzrjavfdpjm.exe
C:\Users\Admin\AppData\Local\Temp\qetmjbshzrjavfdpjm.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1160

C:\Users\Admin\AppData\Local\Temp\huiawndrizqgajgrk.exe
C:\Users\Admin\AppData\Local\Temp\huiawndrizqgajgrk.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4316

C:\Users\Admin\AppData\Local\Temp\bqgayrjzslewsdcpkof.exe
C:\Users\Admin\AppData\Local\Temp\bqgayrjzslewsdcpkof.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1848

C:\Windows\bqgayrjzslewsdcpkof.exe
bqgayrjzslewsdcpkof.exe
1⤵
- Executes dropped EXE
PID:2440

C:\Windows\oawrokarshaxjjxtyqcy.exe
oawrokarshaxjjxtyqcy.exe .
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4732
- C:\Users\Admin\AppData\Local\Temp\qaorinawaky.exe
  "C:\Users\Admin\AppData\Local\Temp\qaorinawaky.exe" "c:\windows\oawrokarshaxjjxtyqcy.exe*."
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Adds policy Run key to start application
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System policy modification
  PID:2852

C:\Windows\bmhbxshxxldzkjwrvmx.exe
bmhbxshxxldzkjwrvmx.exe
1⤵
- System Location Discovery: System Language Discovery
PID:5072

C:\Users\Admin\AppData\Local\Temp\bmhbxshxxldzkjwrvmx.exe
C:\Users\Admin\AppData\Local\Temp\bmhbxshxxldzkjwrvmx.exe
1⤵
- System Location Discovery: System Language Discovery
PID:1644

C:\Windows\dumiidxpkfausfgvsyria.exe
dumiidxpkfausfgvsyria.exe .
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:700
- C:\Users\Admin\AppData\Local\Temp\qaorinawaky.exe
  "C:\Users\Admin\AppData\Local\Temp\qaorinawaky.exe" "c:\windows\dumiidxpkfausfgvsyria.exe*."
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Adds policy Run key to start application
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System policy modification
  PID:2324

C:\Windows\aiarkcobyjyrzvfx.exe
aiarkcobyjyrzvfx.exe
1⤵
PID:3836

C:\Windows\qaunicqferidnlxruk.exe
qaunicqferidnlxruk.exe
1⤵
PID:4612

C:\Windows\hqjbvobpnzpjspatv.exe
hqjbvobpnzpjspatv.exe .
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Users\Admin\AppData\Local\Temp\qaorinawaky.exe
  "C:\Users\Admin\AppData\Local\Temp\qaorinawaky.exe" "c:\windows\hqjbvobpnzpjspatv.exe*."
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Adds policy Run key to start application
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System policy modification
  PID:3084

C:\Users\Admin\AppData\Local\Temp\oawrokarshaxjjxtyqcy.exe
C:\Users\Admin\AppData\Local\Temp\oawrokarshaxjjxtyqcy.exe
1⤵
- System Location Discovery: System Language Discovery
PID:3056

C:\Windows\dqnjhevnpfzxklaxdwjgc.exe
dqnjhevnpfzxklaxdwjgc.exe .
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3692
- C:\Users\Admin\AppData\Local\Temp\qaorinawaky.exe
  "C:\Users\Admin\AppData\Local\Temp\qaorinawaky.exe" "c:\windows\dqnjhevnpfzxklaxdwjgc.exe*."
  2⤵
  - Executes dropped EXE
  PID:1340

C:\Windows\oawrokarshaxjjxtyqcy.exe
oawrokarshaxjjxtyqcy.exe
1⤵
PID:2276

C:\Windows\bmhbxshxxldzkjwrvmx.exe
bmhbxshxxldzkjwrvmx.exe .
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1836
- C:\Users\Admin\AppData\Local\Temp\qaorinawaky.exe
  "C:\Users\Admin\AppData\Local\Temp\qaorinawaky.exe" "c:\windows\bmhbxshxxldzkjwrvmx.exe*."
  2⤵
  - Modifies WinLogon for persistence
  - UAC bypass
  - Adds policy Run key to start application
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System policy modification
  PID:3524

C:\Users\Admin\AppData\Local\Temp\aiarkcobyjyrzvfx.exe
C:\Users\Admin\AppData\Local\Temp\aiarkcobyjyrzvfx.exe
1⤵
- System Location Discovery: System Language Discovery
PID:1064

C:\Users\Admin\AppData\Local\Temp\hqjbvobpnzpjspatv.exe
C:\Users\Admin\AppData\Local\Temp\hqjbvobpnzpjspatv.exe
1⤵
- System Location Discovery: System Language Discovery
PID:3864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Winlogon Helper DLL

T1547.004

Hijack Execution Flow

T1574

Executable Installer File Permissions Weakness

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Winlogon Helper DLL

T1547.004

Hijack Execution Flow

T1574

Executable Installer File Permissions Weakness

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hijack Execution Flow

T1574

Executable Installer File Permissions Weakness

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Safe Mode Boot

T1562.009

Modify Registry