Analysis
-
max time kernel
152s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2022, 21:21
Behavioral task
behavioral1
Sample
b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe
Resource
win7-20220812-en
windows7-x64
25 signatures
150 seconds
General
-
Target
b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe
-
Size
255KB
-
MD5
4bd5c40959b71c897229aba22ef0f6a1
-
SHA1
a382a5864ddbc0b8728d18c232b39dd96f50c73f
-
SHA256
b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb
-
SHA512
e44cb9b23645c51b77caebf031ffd981c12939644a911f2fb387612cd4a9951c2274bfb42f5ec06f69002a63a5eccc5c0f8197eef6c147c35c9d62beb270a1c5
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJV:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIw
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" azpzdtitga.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" azpzdtitga.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" azpzdtitga.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" azpzdtitga.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" azpzdtitga.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" azpzdtitga.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" azpzdtitga.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" azpzdtitga.exe -
Executes dropped EXE 5 IoCs
pid Process 4124 azpzdtitga.exe 824 xuodikmqrnzmrxv.exe 3588 cvrfejwt.exe 5060 wpwzjuvtdueoo.exe 1656 cvrfejwt.exe -
resource yara_rule behavioral2/memory/4352-132-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x0009000000022e50-134.dat upx behavioral2/files/0x0009000000022e50-135.dat upx behavioral2/files/0x0006000000022e5e-138.dat upx behavioral2/files/0x0006000000022e5f-141.dat upx behavioral2/files/0x0006000000022e5f-140.dat upx behavioral2/files/0x0006000000022e60-144.dat upx behavioral2/files/0x0006000000022e60-143.dat upx behavioral2/files/0x0006000000022e5e-137.dat upx behavioral2/memory/4124-145-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/824-146-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/5060-148-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3588-147-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x0006000000022e5f-150.dat upx behavioral2/memory/4352-152-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1656-153-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x0006000000022e62-159.dat upx behavioral2/files/0x0006000000022e63-160.dat upx behavioral2/memory/4124-164-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/824-165-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3588-166-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/5060-167-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1656-168-0x0000000000400000-0x00000000004A0000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" azpzdtitga.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" azpzdtitga.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" azpzdtitga.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" azpzdtitga.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" azpzdtitga.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" azpzdtitga.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run xuodikmqrnzmrxv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\llacfjjz = "azpzdtitga.exe" xuodikmqrnzmrxv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ytodvjro = "xuodikmqrnzmrxv.exe" xuodikmqrnzmrxv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "wpwzjuvtdueoo.exe" xuodikmqrnzmrxv.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\s: cvrfejwt.exe File opened (read-only) \??\l: azpzdtitga.exe File opened (read-only) \??\y: azpzdtitga.exe File opened (read-only) \??\e: cvrfejwt.exe File opened (read-only) \??\k: cvrfejwt.exe File opened (read-only) \??\w: cvrfejwt.exe File opened (read-only) \??\y: cvrfejwt.exe File opened (read-only) \??\h: cvrfejwt.exe File opened (read-only) \??\y: cvrfejwt.exe File opened (read-only) \??\g: azpzdtitga.exe File opened (read-only) \??\n: azpzdtitga.exe File opened (read-only) \??\n: cvrfejwt.exe File opened (read-only) \??\i: cvrfejwt.exe File opened (read-only) \??\l: cvrfejwt.exe File opened (read-only) \??\o: cvrfejwt.exe File opened (read-only) \??\r: cvrfejwt.exe File opened (read-only) \??\v: cvrfejwt.exe File opened (read-only) \??\e: azpzdtitga.exe File opened (read-only) \??\f: cvrfejwt.exe File opened (read-only) \??\s: cvrfejwt.exe File opened (read-only) \??\x: cvrfejwt.exe File opened (read-only) \??\f: cvrfejwt.exe File opened (read-only) \??\g: cvrfejwt.exe File opened (read-only) \??\j: cvrfejwt.exe File opened (read-only) \??\n: cvrfejwt.exe File opened (read-only) \??\p: cvrfejwt.exe File opened (read-only) \??\g: cvrfejwt.exe File opened (read-only) \??\h: cvrfejwt.exe File opened (read-only) \??\a: azpzdtitga.exe File opened (read-only) \??\b: azpzdtitga.exe File opened (read-only) \??\t: azpzdtitga.exe File opened (read-only) \??\u: azpzdtitga.exe File opened (read-only) \??\x: azpzdtitga.exe File opened (read-only) \??\l: cvrfejwt.exe File opened (read-only) \??\r: cvrfejwt.exe File opened (read-only) \??\v: cvrfejwt.exe File opened (read-only) \??\k: cvrfejwt.exe File opened (read-only) \??\q: cvrfejwt.exe File opened (read-only) \??\x: cvrfejwt.exe File opened (read-only) \??\z: cvrfejwt.exe File opened (read-only) \??\r: azpzdtitga.exe File opened (read-only) \??\u: cvrfejwt.exe File opened (read-only) \??\a: cvrfejwt.exe File opened (read-only) \??\e: cvrfejwt.exe File opened (read-only) \??\q: cvrfejwt.exe File opened (read-only) \??\i: azpzdtitga.exe File opened (read-only) \??\k: azpzdtitga.exe File opened (read-only) \??\z: azpzdtitga.exe File opened (read-only) \??\j: cvrfejwt.exe File opened (read-only) \??\z: cvrfejwt.exe File opened (read-only) \??\t: cvrfejwt.exe File opened (read-only) \??\a: cvrfejwt.exe File opened (read-only) \??\m: cvrfejwt.exe File opened (read-only) \??\p: cvrfejwt.exe File opened (read-only) \??\f: azpzdtitga.exe File opened (read-only) \??\b: cvrfejwt.exe File opened (read-only) \??\h: azpzdtitga.exe File opened (read-only) \??\o: azpzdtitga.exe File opened (read-only) \??\s: azpzdtitga.exe File opened (read-only) \??\o: cvrfejwt.exe File opened (read-only) \??\u: cvrfejwt.exe File opened (read-only) \??\w: cvrfejwt.exe File opened (read-only) \??\j: azpzdtitga.exe File opened (read-only) \??\m: azpzdtitga.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" azpzdtitga.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" azpzdtitga.exe -
AutoIT Executable 11 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/4124-145-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/824-146-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/5060-148-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3588-147-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4352-152-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1656-153-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4124-164-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/824-165-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3588-166-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/5060-167-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1656-168-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe -
Drops file in System32 directory 9 IoCs
description ioc Process File created C:\Windows\SysWOW64\wpwzjuvtdueoo.exe b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll azpzdtitga.exe File opened for modification C:\Windows\SysWOW64\cvrfejwt.exe b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe File opened for modification C:\Windows\SysWOW64\wpwzjuvtdueoo.exe b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe File created C:\Windows\SysWOW64\azpzdtitga.exe b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe File opened for modification C:\Windows\SysWOW64\azpzdtitga.exe b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe File created C:\Windows\SysWOW64\xuodikmqrnzmrxv.exe b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe File opened for modification C:\Windows\SysWOW64\xuodikmqrnzmrxv.exe b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe File created C:\Windows\SysWOW64\cvrfejwt.exe b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe -
Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe cvrfejwt.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal cvrfejwt.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe cvrfejwt.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe cvrfejwt.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe cvrfejwt.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal cvrfejwt.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe cvrfejwt.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal cvrfejwt.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe cvrfejwt.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe cvrfejwt.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal cvrfejwt.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe cvrfejwt.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe cvrfejwt.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe cvrfejwt.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\mydoc.rtf b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BBDF9B1F962F1E283793B4A86963E90B38D02FA4262034FE2CC45E809D3" b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7F8FFCFE4F27821B9132D65B7E93BC90E136584267426331D79B" b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" azpzdtitga.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" azpzdtitga.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1949C77515EDDABFB9B97C97ECE734C6" b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat azpzdtitga.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh azpzdtitga.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs azpzdtitga.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" azpzdtitga.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FB1B02C4497399D53CBBAA73392D4BB" b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" azpzdtitga.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf azpzdtitga.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg azpzdtitga.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7FD6BB9FE1C21DBD209D0A48A089060" b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" azpzdtitga.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc azpzdtitga.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" azpzdtitga.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33422D0D9D5082556A4177D4702F2DDA7DF264D8" b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4276 WINWORD.EXE 4276 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4352 b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe 4352 b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe 4352 b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe 4352 b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe 4352 b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe 4352 b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe 4352 b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe 4352 b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe 4352 b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe 4352 b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe 4352 b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe 4352 b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe 4352 b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe 4352 b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe 4352 b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe 4352 b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe 3588 cvrfejwt.exe 3588 cvrfejwt.exe 4124 azpzdtitga.exe 4124 azpzdtitga.exe 3588 cvrfejwt.exe 3588 cvrfejwt.exe 4124 azpzdtitga.exe 4124 azpzdtitga.exe 3588 cvrfejwt.exe 3588 cvrfejwt.exe 3588 cvrfejwt.exe 3588 cvrfejwt.exe 4124 azpzdtitga.exe 4124 azpzdtitga.exe 4124 azpzdtitga.exe 4124 azpzdtitga.exe 824 xuodikmqrnzmrxv.exe 824 xuodikmqrnzmrxv.exe 4124 azpzdtitga.exe 4124 azpzdtitga.exe 824 xuodikmqrnzmrxv.exe 824 xuodikmqrnzmrxv.exe 824 xuodikmqrnzmrxv.exe 824 xuodikmqrnzmrxv.exe 824 xuodikmqrnzmrxv.exe 824 xuodikmqrnzmrxv.exe 824 xuodikmqrnzmrxv.exe 824 xuodikmqrnzmrxv.exe 5060 wpwzjuvtdueoo.exe 5060 wpwzjuvtdueoo.exe 5060 wpwzjuvtdueoo.exe 5060 wpwzjuvtdueoo.exe 5060 wpwzjuvtdueoo.exe 5060 wpwzjuvtdueoo.exe 5060 wpwzjuvtdueoo.exe 5060 wpwzjuvtdueoo.exe 5060 wpwzjuvtdueoo.exe 5060 wpwzjuvtdueoo.exe 5060 wpwzjuvtdueoo.exe 5060 wpwzjuvtdueoo.exe 824 xuodikmqrnzmrxv.exe 824 xuodikmqrnzmrxv.exe 5060 wpwzjuvtdueoo.exe 5060 wpwzjuvtdueoo.exe 5060 wpwzjuvtdueoo.exe 5060 wpwzjuvtdueoo.exe 1656 cvrfejwt.exe 1656 cvrfejwt.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 4352 b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe 4352 b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe 4352 b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe 4124 azpzdtitga.exe 4124 azpzdtitga.exe 4124 azpzdtitga.exe 824 xuodikmqrnzmrxv.exe 824 xuodikmqrnzmrxv.exe 824 xuodikmqrnzmrxv.exe 3588 cvrfejwt.exe 3588 cvrfejwt.exe 3588 cvrfejwt.exe 5060 wpwzjuvtdueoo.exe 5060 wpwzjuvtdueoo.exe 5060 wpwzjuvtdueoo.exe 1656 cvrfejwt.exe 1656 cvrfejwt.exe 1656 cvrfejwt.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 4352 b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe 4352 b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe 4352 b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe 4124 azpzdtitga.exe 4124 azpzdtitga.exe 4124 azpzdtitga.exe 824 xuodikmqrnzmrxv.exe 824 xuodikmqrnzmrxv.exe 824 xuodikmqrnzmrxv.exe 3588 cvrfejwt.exe 3588 cvrfejwt.exe 3588 cvrfejwt.exe 5060 wpwzjuvtdueoo.exe 5060 wpwzjuvtdueoo.exe 5060 wpwzjuvtdueoo.exe 1656 cvrfejwt.exe 1656 cvrfejwt.exe 1656 cvrfejwt.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 4276 WINWORD.EXE 4276 WINWORD.EXE 4276 WINWORD.EXE 4276 WINWORD.EXE 4276 WINWORD.EXE 4276 WINWORD.EXE 4276 WINWORD.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 4352 wrote to memory of 4124 4352 b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe 82 PID 4352 wrote to memory of 4124 4352 b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe 82 PID 4352 wrote to memory of 4124 4352 b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe 82 PID 4352 wrote to memory of 824 4352 b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe 83 PID 4352 wrote to memory of 824 4352 b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe 83 PID 4352 wrote to memory of 824 4352 b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe 83 PID 4352 wrote to memory of 3588 4352 b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe 84 PID 4352 wrote to memory of 3588 4352 b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe 84 PID 4352 wrote to memory of 3588 4352 b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe 84 PID 4352 wrote to memory of 5060 4352 b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe 85 PID 4352 wrote to memory of 5060 4352 b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe 85 PID 4352 wrote to memory of 5060 4352 b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe 85 PID 4352 wrote to memory of 4276 4352 b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe 86 PID 4352 wrote to memory of 4276 4352 b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe 86 PID 4124 wrote to memory of 1656 4124 azpzdtitga.exe 88 PID 4124 wrote to memory of 1656 4124 azpzdtitga.exe 88 PID 4124 wrote to memory of 1656 4124 azpzdtitga.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe"C:\Users\Admin\AppData\Local\Temp\b1964713a0feed48c132d06d2c6a11f3c41fd700efca283311a5133ba553a2fb.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Windows\SysWOW64\azpzdtitga.exeazpzdtitga.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Windows\SysWOW64\cvrfejwt.exeC:\Windows\system32\cvrfejwt.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1656
-
-
-
C:\Windows\SysWOW64\xuodikmqrnzmrxv.exexuodikmqrnzmrxv.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:824
-
-
C:\Windows\SysWOW64\cvrfejwt.execvrfejwt.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3588
-
-
C:\Windows\SysWOW64\wpwzjuvtdueoo.exewpwzjuvtdueoo.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5060
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4276
-
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Disabling Security Tools
2Hidden Files and Directories
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD5ab3f6f6cee0647046415924d3e041c17
SHA1e62019c628d96e44580aef979b37f09e58222ba4
SHA25648e7d2bb8bc8e7e20b56cca84ecd97f1eedd7150112a7f3bcbedac90f3018cc8
SHA5124e95adeacaa4049dd3da91803c8309b91bdbc7107a2f453c6e32f66a320d7f7d9614e97ca440005bf2e313f2f5e7856b3a61d9b20a23acced31fd4e3ca7176cc
-
Filesize
255KB
MD50d003e86a1ddda266481f7cc34d8d898
SHA19f1820ad01910f4062a5ca50cb470f13a2656908
SHA2565126417a05ca7b260d83e7e82655e8fc5a4003ce61b83b61649b7438ed4d50c7
SHA51276359b3c31f65a27d6cff0dfc1c1463ce51e607df6363bcb8628c14b97039263bb4f30f96656863a00b50ccb8062c9c116e658f540e5f308855d9c1058f1eb83
-
Filesize
255KB
MD5581ba2a14464e7e1b4eb867538d0ff09
SHA155464a1ffb6f3537d1fe9c4ac607816c2692ab90
SHA256c193ee56da1c811c663d136614706951d80aaeb88a711b9f843387daf824528d
SHA512807a4006834f099f3f9b4f89b2f40134d6ccc4bf2f555e758a11c64f4b551afd8a54fd86cdb569a3dbcc013e43e629d4987b175a56f3c0ed1296c099d7533198
-
Filesize
255KB
MD5581ba2a14464e7e1b4eb867538d0ff09
SHA155464a1ffb6f3537d1fe9c4ac607816c2692ab90
SHA256c193ee56da1c811c663d136614706951d80aaeb88a711b9f843387daf824528d
SHA512807a4006834f099f3f9b4f89b2f40134d6ccc4bf2f555e758a11c64f4b551afd8a54fd86cdb569a3dbcc013e43e629d4987b175a56f3c0ed1296c099d7533198
-
Filesize
255KB
MD515b23e0a853899cd252d2352b84461a7
SHA1b08ddd389c5b49d2d080a96d98d4e538a707f225
SHA25679e6905d773dc80a5b5b60ba1f5848f740eee4e73788c38a4d06ca28aa446069
SHA51242dbb384b3fcc9eb1228c8691381753945a421447b72a17f8c07748835195774e38a8ca632d8515439645b9ca34df37d0278bd93f4b8e682ae69599d17ff5b29
-
Filesize
255KB
MD515b23e0a853899cd252d2352b84461a7
SHA1b08ddd389c5b49d2d080a96d98d4e538a707f225
SHA25679e6905d773dc80a5b5b60ba1f5848f740eee4e73788c38a4d06ca28aa446069
SHA51242dbb384b3fcc9eb1228c8691381753945a421447b72a17f8c07748835195774e38a8ca632d8515439645b9ca34df37d0278bd93f4b8e682ae69599d17ff5b29
-
Filesize
255KB
MD515b23e0a853899cd252d2352b84461a7
SHA1b08ddd389c5b49d2d080a96d98d4e538a707f225
SHA25679e6905d773dc80a5b5b60ba1f5848f740eee4e73788c38a4d06ca28aa446069
SHA51242dbb384b3fcc9eb1228c8691381753945a421447b72a17f8c07748835195774e38a8ca632d8515439645b9ca34df37d0278bd93f4b8e682ae69599d17ff5b29
-
Filesize
255KB
MD5292955b255bbc233cbf119b439a5cd1d
SHA1839f7bce7f5e2e7273a4745da4ab6e393bf26e85
SHA2560eccd337adc36ffe8a3ad1e6206b6eea4966648314568fdd99bbd1ebcb467f6f
SHA512b2dc3e9cb64e6aff84a959e844b867f16d35534e46bbc72f1c469003c9d87ca58adfa97b899cafc6357bfba6f0aadba7cfa226568886584b6ce1abf3fb7c6742
-
Filesize
255KB
MD5292955b255bbc233cbf119b439a5cd1d
SHA1839f7bce7f5e2e7273a4745da4ab6e393bf26e85
SHA2560eccd337adc36ffe8a3ad1e6206b6eea4966648314568fdd99bbd1ebcb467f6f
SHA512b2dc3e9cb64e6aff84a959e844b867f16d35534e46bbc72f1c469003c9d87ca58adfa97b899cafc6357bfba6f0aadba7cfa226568886584b6ce1abf3fb7c6742
-
Filesize
255KB
MD545f803a229102880784f29b58144b7a8
SHA1cef334114675f412c03b1ca518c70c7ec3aa3f71
SHA256c8d43926ff525aed5abb3eb3e6e7a2693fe5fd953d857e8567658075f34a3087
SHA5122350d7df83f29e429ade7edd17f42593a48e2f42cfe82e9cfdc710b78febad3ced9750aab710b4a5f677c8399e82a0cec4d0dda56855d9c6c647968a3eeb9040
-
Filesize
255KB
MD545f803a229102880784f29b58144b7a8
SHA1cef334114675f412c03b1ca518c70c7ec3aa3f71
SHA256c8d43926ff525aed5abb3eb3e6e7a2693fe5fd953d857e8567658075f34a3087
SHA5122350d7df83f29e429ade7edd17f42593a48e2f42cfe82e9cfdc710b78febad3ced9750aab710b4a5f677c8399e82a0cec4d0dda56855d9c6c647968a3eeb9040
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7