Analysis
- max time kernel
152s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20220901-en - resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system - submitted
29/10/2022, 08:15
Behavioral task
behavioral1
Sample
345f89681fcb62ed85585fbea9f29e22957d3cbac3d6b4bb706b6676b9118489.exe
Resource
win7-20220812-en
windows7-x64
6 signatures
150 seconds
General
- Target 345f89681fcb62ed85585fbea9f29e22957d3cbac3d6b4bb706b6676b9118489.exe
- Size 255KB
- Sample221029-j5sjsaggh2
- SHA256 345f89681fcb62ed85585fbea9f29e22957d3cbac3d6b4bb706b6676b9118489
- MD5 ba9279253be9abb2081696c93729c21f
- SHA1 b9235104e8090408b0d72c6a533cfaa5419d4120
- SHA512 e3242ec0d5113de9e64df3f1231a0f23f70c5e8406fff4b3fe556098a832672253bb1439a17c11830285ff9e151584c7c69cfdd9caaec8868fec1200f2544126
- SSDEEP 6144:1xlZam+akqx6YQJXcNlEHUIQeE3mmBWFv6v:Plf5j6zCNa0xeE3mE
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" jsvtefqdcr.exe - Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" jsvtefqdcr.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" jsvtefqdcr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" jsvtefqdcr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" jsvtefqdcr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" jsvtefqdcr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" jsvtefqdcr.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" jsvtefqdcr.exe - Executes dropped EXE 5 IoCs
pid Process 4980 jsvtefqdcr.exe 2252 ttrdzcntvyjdyky.exe 2076 ngupejxd.exe 1376 wgbidfsnmwuei.exe 1508 ngupejxd.exe -
resource yara_rule behavioral2/memory/5012-132-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4980-136-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x0005000000022dc8-135.dat upx behavioral2/files/0x0005000000022dc8-134.dat upx behavioral2/files/0x0005000000022dcb-139.dat upx behavioral2/files/0x0005000000022dcb-138.dat upx behavioral2/files/0x0003000000022dd3-141.dat upx behavioral2/files/0x0003000000022dd3-142.dat upx behavioral2/files/0x0004000000022dd4-145.dat upx behavioral2/files/0x0004000000022dd4-144.dat upx behavioral2/files/0x0003000000022dd3-147.dat upx behavioral2/memory/2252-148-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2076-149-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1376-150-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1508-151-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/5012-153-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x0003000000022df8-160.dat upx behavioral2/files/0x0002000000022df9-161.dat upx behavioral2/memory/4980-164-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2252-165-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2076-166-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1376-167-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1508-168-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x000200000001e6ef-169.dat upx behavioral2/files/0x000200000001e6ef-171.dat upx behavioral2/files/0x000200000001e6ef-170.dat upx behavioral2/files/0x000200000001e6ef-172.dat upx behavioral2/files/0x000200000001e6ef-173.dat upx behavioral2/memory/2076-180-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1508-179-0x0000000000400000-0x00000000004A0000-memory.dmp upx - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 345f89681fcb62ed85585fbea9f29e22957d3cbac3d6b4bb706b6676b9118489.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" jsvtefqdcr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" jsvtefqdcr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" jsvtefqdcr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" jsvtefqdcr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" jsvtefqdcr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" jsvtefqdcr.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\thmxregq = "jsvtefqdcr.exe" ttrdzcntvyjdyky.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\gszggata = "ttrdzcntvyjdyky.exe" ttrdzcntvyjdyky.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "wgbidfsnmwuei.exe" ttrdzcntvyjdyky.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run ttrdzcntvyjdyky.exe - Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\r: ngupejxd.exe File opened (read-only) \??\t: ngupejxd.exe File opened (read-only) \??\z: ngupejxd.exe File opened (read-only) \??\n: ngupejxd.exe File opened (read-only) \??\q: jsvtefqdcr.exe File opened (read-only) \??\r: jsvtefqdcr.exe File opened (read-only) \??\s: jsvtefqdcr.exe File opened (read-only) \??\j: ngupejxd.exe File opened (read-only) \??\r: ngupejxd.exe File opened (read-only) \??\i: ngupejxd.exe File opened (read-only) \??\j: ngupejxd.exe File opened (read-only) \??\g: ngupejxd.exe File opened (read-only) \??\b: ngupejxd.exe File opened (read-only) \??\o: ngupejxd.exe File opened (read-only) \??\u: ngupejxd.exe File opened (read-only) \??\z: ngupejxd.exe File opened (read-only) \??\p: jsvtefqdcr.exe File opened (read-only) \??\t: jsvtefqdcr.exe File opened (read-only) \??\n: ngupejxd.exe File opened (read-only) \??\q: ngupejxd.exe File opened (read-only) \??\w: ngupejxd.exe File opened (read-only) \??\x: ngupejxd.exe File opened (read-only) \??\a: jsvtefqdcr.exe File opened (read-only) \??\f: jsvtefqdcr.exe File opened (read-only) \??\f: ngupejxd.exe File opened (read-only) \??\f: ngupejxd.exe File opened (read-only) \??\h: jsvtefqdcr.exe File opened (read-only) \??\v: jsvtefqdcr.exe File opened (read-only) \??\s: ngupejxd.exe File opened (read-only) \??\m: ngupejxd.exe File opened (read-only) \??\m: jsvtefqdcr.exe File opened (read-only) \??\a: ngupejxd.exe File opened (read-only) \??\g: ngupejxd.exe File opened (read-only) \??\o: ngupejxd.exe File opened (read-only) \??\t: ngupejxd.exe File opened (read-only) \??\x: ngupejxd.exe File opened (read-only) \??\k: jsvtefqdcr.exe File opened (read-only) \??\y: jsvtefqdcr.exe File opened (read-only) \??\b: ngupejxd.exe File opened (read-only) \??\o: jsvtefqdcr.exe File opened (read-only) \??\h: ngupejxd.exe File opened (read-only) \??\l: ngupejxd.exe File opened (read-only) \??\m: ngupejxd.exe File opened (read-only) \??\k: ngupejxd.exe File opened (read-only) \??\n: jsvtefqdcr.exe File opened (read-only) \??\u: jsvtefqdcr.exe File opened (read-only) \??\w: jsvtefqdcr.exe File opened (read-only) \??\w: ngupejxd.exe File opened (read-only) \??\g: jsvtefqdcr.exe File opened (read-only) \??\l: jsvtefqdcr.exe File opened (read-only) \??\e: ngupejxd.exe File opened (read-only) \??\p: ngupejxd.exe File opened (read-only) \??\q: ngupejxd.exe File opened (read-only) \??\v: ngupejxd.exe File opened (read-only) \??\y: ngupejxd.exe File opened (read-only) \??\b: jsvtefqdcr.exe File opened (read-only) \??\z: jsvtefqdcr.exe File opened (read-only) \??\h: ngupejxd.exe File opened (read-only) \??\x: jsvtefqdcr.exe File opened (read-only) \??\y: ngupejxd.exe File opened (read-only) \??\e: ngupejxd.exe File opened (read-only) \??\l: ngupejxd.exe File opened (read-only) \??\e: jsvtefqdcr.exe File opened (read-only) \??\k: ngupejxd.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" jsvtefqdcr.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" jsvtefqdcr.exe - AutoIT Executable 12 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/2252-148-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2076-149-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1376-150-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1508-151-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/5012-153-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4980-164-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2252-165-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2076-166-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1376-167-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1508-168-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2076-180-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1508-179-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe - Drops file in System32 directory 12 IoCs
description ioc Process File created C:\Windows\SysWOW64\jsvtefqdcr.exe 345f89681fcb62ed85585fbea9f29e22957d3cbac3d6b4bb706b6676b9118489.exe File created C:\Windows\SysWOW64\ngupejxd.exe 345f89681fcb62ed85585fbea9f29e22957d3cbac3d6b4bb706b6676b9118489.exe File opened for modification C:\Windows\SysWOW64\wgbidfsnmwuei.exe 345f89681fcb62ed85585fbea9f29e22957d3cbac3d6b4bb706b6676b9118489.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe ngupejxd.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe ngupejxd.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll jsvtefqdcr.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe ngupejxd.exe File opened for modification C:\Windows\SysWOW64\jsvtefqdcr.exe 345f89681fcb62ed85585fbea9f29e22957d3cbac3d6b4bb706b6676b9118489.exe File created C:\Windows\SysWOW64\ttrdzcntvyjdyky.exe 345f89681fcb62ed85585fbea9f29e22957d3cbac3d6b4bb706b6676b9118489.exe File opened for modification C:\Windows\SysWOW64\ttrdzcntvyjdyky.exe 345f89681fcb62ed85585fbea9f29e22957d3cbac3d6b4bb706b6676b9118489.exe File opened for modification C:\Windows\SysWOW64\ngupejxd.exe 345f89681fcb62ed85585fbea9f29e22957d3cbac3d6b4bb706b6676b9118489.exe File created C:\Windows\SysWOW64\wgbidfsnmwuei.exe 345f89681fcb62ed85585fbea9f29e22957d3cbac3d6b4bb706b6676b9118489.exe - Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe ngupejxd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal ngupejxd.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe ngupejxd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe ngupejxd.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe ngupejxd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe ngupejxd.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe ngupejxd.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe ngupejxd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal ngupejxd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe ngupejxd.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe ngupejxd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal ngupejxd.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe ngupejxd.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal ngupejxd.exe - Drops file in Windows directory 19 IoCs
description ioc Process File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe ngupejxd.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe ngupejxd.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe ngupejxd.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe ngupejxd.exe File opened for modification C:\Windows\mydoc.rtf 345f89681fcb62ed85585fbea9f29e22957d3cbac3d6b4bb706b6676b9118489.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe ngupejxd.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe ngupejxd.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe ngupejxd.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe ngupejxd.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe ngupejxd.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe ngupejxd.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe ngupejxd.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe ngupejxd.exe File created C:\Windows\~$mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe ngupejxd.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe ngupejxd.exe File opened for modification \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_f619255888acbca6\MsoIrmProtector.doc.exe ngupejxd.exe File created \??\c:\Windows\WinSxS\wow64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_ce10e80fc93afe5c\MsoIrmProtector.doc.exe ngupejxd.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE - Modifies registry class 20 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg jsvtefqdcr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" jsvtefqdcr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" jsvtefqdcr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs jsvtefqdcr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc jsvtefqdcr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" jsvtefqdcr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E0F56BC4FE6922D0D172D0D28A7E906B" 345f89681fcb62ed85585fbea9f29e22957d3cbac3d6b4bb706b6676b9118489.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat jsvtefqdcr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" jsvtefqdcr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh jsvtefqdcr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" jsvtefqdcr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf jsvtefqdcr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33302D7B9D5682206A4276D677272CDA7DF665DB" 345f89681fcb62ed85585fbea9f29e22957d3cbac3d6b4bb706b6676b9118489.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7F8FFFFB485D8518913CD7217E96BDE3E144584066426344D79D" 345f89681fcb62ed85585fbea9f29e22957d3cbac3d6b4bb706b6676b9118489.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "183EC70B1491DAC7B8BA7CE5ECE534C8" 345f89681fcb62ed85585fbea9f29e22957d3cbac3d6b4bb706b6676b9118489.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" jsvtefqdcr.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings 345f89681fcb62ed85585fbea9f29e22957d3cbac3d6b4bb706b6676b9118489.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 345f89681fcb62ed85585fbea9f29e22957d3cbac3d6b4bb706b6676b9118489.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BC8F9B0FE16F1E2847A3B4286EE3E95B38903FD4362033DE2BE42EB09A3" 345f89681fcb62ed85585fbea9f29e22957d3cbac3d6b4bb706b6676b9118489.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FC5B12D449238E253CBBAA7339DD7BB" 345f89681fcb62ed85585fbea9f29e22957d3cbac3d6b4bb706b6676b9118489.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 2228 WINWORD.EXE 2228 WINWORD.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5012 345f89681fcb62ed85585fbea9f29e22957d3cbac3d6b4bb706b6676b9118489.exe 5012 345f89681fcb62ed85585fbea9f29e22957d3cbac3d6b4bb706b6676b9118489.exe 5012 345f89681fcb62ed85585fbea9f29e22957d3cbac3d6b4bb706b6676b9118489.exe 5012 345f89681fcb62ed85585fbea9f29e22957d3cbac3d6b4bb706b6676b9118489.exe 5012 345f89681fcb62ed85585fbea9f29e22957d3cbac3d6b4bb706b6676b9118489.exe 5012 345f89681fcb62ed85585fbea9f29e22957d3cbac3d6b4bb706b6676b9118489.exe 5012 345f89681fcb62ed85585fbea9f29e22957d3cbac3d6b4bb706b6676b9118489.exe 5012 345f89681fcb62ed85585fbea9f29e22957d3cbac3d6b4bb706b6676b9118489.exe 5012 345f89681fcb62ed85585fbea9f29e22957d3cbac3d6b4bb706b6676b9118489.exe 5012 345f89681fcb62ed85585fbea9f29e22957d3cbac3d6b4bb706b6676b9118489.exe 5012 345f89681fcb62ed85585fbea9f29e22957d3cbac3d6b4bb706b6676b9118489.exe 5012 345f89681fcb62ed85585fbea9f29e22957d3cbac3d6b4bb706b6676b9118489.exe 5012 345f89681fcb62ed85585fbea9f29e22957d3cbac3d6b4bb706b6676b9118489.exe 5012 345f89681fcb62ed85585fbea9f29e22957d3cbac3d6b4bb706b6676b9118489.exe 5012 345f89681fcb62ed85585fbea9f29e22957d3cbac3d6b4bb706b6676b9118489.exe 5012 345f89681fcb62ed85585fbea9f29e22957d3cbac3d6b4bb706b6676b9118489.exe 4980 jsvtefqdcr.exe 4980 jsvtefqdcr.exe 4980 jsvtefqdcr.exe 4980 jsvtefqdcr.exe 4980 jsvtefqdcr.exe 4980 jsvtefqdcr.exe 4980 jsvtefqdcr.exe 4980 jsvtefqdcr.exe 4980 jsvtefqdcr.exe 4980 jsvtefqdcr.exe 2252 ttrdzcntvyjdyky.exe 2252 ttrdzcntvyjdyky.exe 2252 ttrdzcntvyjdyky.exe 2252 ttrdzcntvyjdyky.exe 2252 ttrdzcntvyjdyky.exe 2252 ttrdzcntvyjdyky.exe 2252 ttrdzcntvyjdyky.exe 2252 ttrdzcntvyjdyky.exe 2076 ngupejxd.exe 2076 ngupejxd.exe 2076 ngupejxd.exe 2076 ngupejxd.exe 2076 ngupejxd.exe 2076 ngupejxd.exe 2076 ngupejxd.exe 2076 ngupejxd.exe 1376 wgbidfsnmwuei.exe 1376 wgbidfsnmwuei.exe 1376 wgbidfsnmwuei.exe 1376 wgbidfsnmwuei.exe 2252 ttrdzcntvyjdyky.exe 2252 ttrdzcntvyjdyky.exe 1376 wgbidfsnmwuei.exe 1376 wgbidfsnmwuei.exe 1376 wgbidfsnmwuei.exe 1376 wgbidfsnmwuei.exe 1376 wgbidfsnmwuei.exe 1376 wgbidfsnmwuei.exe 1376 wgbidfsnmwuei.exe 1376 wgbidfsnmwuei.exe 1508 ngupejxd.exe 1508 ngupejxd.exe 1508 ngupejxd.exe 1508 ngupejxd.exe 1508 ngupejxd.exe 1508 ngupejxd.exe 1508 ngupejxd.exe 1508 ngupejxd.exe - Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 5012 345f89681fcb62ed85585fbea9f29e22957d3cbac3d6b4bb706b6676b9118489.exe 5012 345f89681fcb62ed85585fbea9f29e22957d3cbac3d6b4bb706b6676b9118489.exe 5012 345f89681fcb62ed85585fbea9f29e22957d3cbac3d6b4bb706b6676b9118489.exe 4980 jsvtefqdcr.exe 4980 jsvtefqdcr.exe 4980 jsvtefqdcr.exe 2252 ttrdzcntvyjdyky.exe 2252 ttrdzcntvyjdyky.exe 2252 ttrdzcntvyjdyky.exe 2076 ngupejxd.exe 2076 ngupejxd.exe 2076 ngupejxd.exe 1376 wgbidfsnmwuei.exe 1376 wgbidfsnmwuei.exe 1376 wgbidfsnmwuei.exe 1508 ngupejxd.exe 1508 ngupejxd.exe 1508 ngupejxd.exe - Suspicious use of SendNotifyMessage 18 IoCs
pid Process 5012 345f89681fcb62ed85585fbea9f29e22957d3cbac3d6b4bb706b6676b9118489.exe 5012 345f89681fcb62ed85585fbea9f29e22957d3cbac3d6b4bb706b6676b9118489.exe 5012 345f89681fcb62ed85585fbea9f29e22957d3cbac3d6b4bb706b6676b9118489.exe 4980 jsvtefqdcr.exe 4980 jsvtefqdcr.exe 4980 jsvtefqdcr.exe 2252 ttrdzcntvyjdyky.exe 2252 ttrdzcntvyjdyky.exe 2252 ttrdzcntvyjdyky.exe 2076 ngupejxd.exe 2076 ngupejxd.exe 2076 ngupejxd.exe 1376 wgbidfsnmwuei.exe 1376 wgbidfsnmwuei.exe 1376 wgbidfsnmwuei.exe 1508 ngupejxd.exe 1508 ngupejxd.exe 1508 ngupejxd.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 2228 WINWORD.EXE 2228 WINWORD.EXE 2228 WINWORD.EXE 2228 WINWORD.EXE 2228 WINWORD.EXE 2228 WINWORD.EXE 2228 WINWORD.EXE - Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 5012 wrote to memory of 4980 5012 345f89681fcb62ed85585fbea9f29e22957d3cbac3d6b4bb706b6676b9118489.exe 82 PID 5012 wrote to memory of 4980 5012 345f89681fcb62ed85585fbea9f29e22957d3cbac3d6b4bb706b6676b9118489.exe 82 PID 5012 wrote to memory of 4980 5012 345f89681fcb62ed85585fbea9f29e22957d3cbac3d6b4bb706b6676b9118489.exe 82 PID 5012 wrote to memory of 2252 5012 345f89681fcb62ed85585fbea9f29e22957d3cbac3d6b4bb706b6676b9118489.exe 83 PID 5012 wrote to memory of 2252 5012 345f89681fcb62ed85585fbea9f29e22957d3cbac3d6b4bb706b6676b9118489.exe 83 PID 5012 wrote to memory of 2252 5012 345f89681fcb62ed85585fbea9f29e22957d3cbac3d6b4bb706b6676b9118489.exe 83 PID 5012 wrote to memory of 2076 5012 345f89681fcb62ed85585fbea9f29e22957d3cbac3d6b4bb706b6676b9118489.exe 84 PID 5012 wrote to memory of 2076 5012 345f89681fcb62ed85585fbea9f29e22957d3cbac3d6b4bb706b6676b9118489.exe 84 PID 5012 wrote to memory of 2076 5012 345f89681fcb62ed85585fbea9f29e22957d3cbac3d6b4bb706b6676b9118489.exe 84 PID 5012 wrote to memory of 1376 5012 345f89681fcb62ed85585fbea9f29e22957d3cbac3d6b4bb706b6676b9118489.exe 85 PID 5012 wrote to memory of 1376 5012 345f89681fcb62ed85585fbea9f29e22957d3cbac3d6b4bb706b6676b9118489.exe 85 PID 5012 wrote to memory of 1376 5012 345f89681fcb62ed85585fbea9f29e22957d3cbac3d6b4bb706b6676b9118489.exe 85 PID 4980 wrote to memory of 1508 4980 jsvtefqdcr.exe 86 PID 4980 wrote to memory of 1508 4980 jsvtefqdcr.exe 86 PID 4980 wrote to memory of 1508 4980 jsvtefqdcr.exe 86 PID 5012 wrote to memory of 2228 5012 345f89681fcb62ed85585fbea9f29e22957d3cbac3d6b4bb706b6676b9118489.exe 87 PID 5012 wrote to memory of 2228 5012 345f89681fcb62ed85585fbea9f29e22957d3cbac3d6b4bb706b6676b9118489.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\345f89681fcb62ed85585fbea9f29e22957d3cbac3d6b4bb706b6676b9118489.exe"C:\Users\Admin\AppData\Local\Temp\345f89681fcb62ed85585fbea9f29e22957d3cbac3d6b4bb706b6676b9118489.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Windows\SysWOW64\jsvtefqdcr.exejsvtefqdcr.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Windows\SysWOW64\ngupejxd.exeC:\Windows\system32\ngupejxd.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1508
-
-
-
C:\Windows\SysWOW64\ttrdzcntvyjdyky.exettrdzcntvyjdyky.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2252
-
-
C:\Windows\SysWOW64\ngupejxd.exengupejxd.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2076
-
-
C:\Windows\SysWOW64\wgbidfsnmwuei.exewgbidfsnmwuei.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1376
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2228
-
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Disabling Security Tools
2Hidden Files and Directories
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe
- Size 255KB
- SHA256 fc32da6b84340f8aaca6a4da091bb500937ad0c3e4ca0e82a27f3660c85ed8e6
- MD5 3dfe1b717d07be1065abebb7ef96168e
- SHA1 3806a99b632c60fdc0c5a1615f7b374046c8b179
- SHA512 cc141d45366626d1b81c73d1fc552d8cfb6abb2f8027f65d1d365cdd45f8beedd1ad27f7bbf73965a28251798776c12644614cac2276e3146b8ea18bd8ee39d8
- SSDEEP 6144:1xlZam+akqx6YQJXcNlEHUIQeE3mmBWFv6Y:Plf5j6zCNa0xeE3mP
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe
- Size 255KB
- SHA256 0649a6837d7727da4e628aaeca36dc6b8bde0218bcdd1d3fc203d1bcecad56a1
- MD5 45c7126ef9f8497b66721c0a4b2bfc53
- SHA1 b6a1dc5842d79b004670b9303309bce4b318d4e9
- SHA512 83597d4322eddddaaadfbd038ea3778d0a77228fc935e03271e5c5348dba10bb30f585016b9da9905d3f0e72daa633d2767caf77fd6bff9785a7eeee4732caef
- SSDEEP 6144:1xlZam+akqx6YQJXcNlEHUIQeE3mmBWFv6i:Plf5j6zCNa0xeE3mt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\jsvtefqdcr.exe
- Size 255KB
- SHA256 4f161a2b37193015e3402a2f66b7256f1d362d9f0df5cb940b81ae7b6d393c4e
- MD5 7bc08a6a1d245c792167cdeb629c8c96
- SHA1 2479d99c89816b98fb30c2a0f841d612e5b8eb6f
- SHA512 2dc88a118753bff881dfd38022a47f8785c87d4038db046a68e9811d8e1d327f2c56b7c20dc9f104e79c536a5b4f6ad6e3b9cde5c9a49db082de65b0319f3242
- SSDEEP 6144:1xlZam+akqx6YQJXcNlEHUIQeE3mmBWFv61:Plf5j6zCNa0xeE3m6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\jsvtefqdcr.exe
- Size 255KB
- SHA256 4f161a2b37193015e3402a2f66b7256f1d362d9f0df5cb940b81ae7b6d393c4e
- MD5 7bc08a6a1d245c792167cdeb629c8c96
- SHA1 2479d99c89816b98fb30c2a0f841d612e5b8eb6f
- SHA512 2dc88a118753bff881dfd38022a47f8785c87d4038db046a68e9811d8e1d327f2c56b7c20dc9f104e79c536a5b4f6ad6e3b9cde5c9a49db082de65b0319f3242
- SSDEEP 6144:1xlZam+akqx6YQJXcNlEHUIQeE3mmBWFv61:Plf5j6zCNa0xeE3m6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\ngupejxd.exe
- Size 255KB
- SHA256 3480478ee42c516fcab1c4d214f83d9cab2b4b92eb7d284b46fa8994ff3fe81b
- MD5 86547c46e7c4b3ea300ae651b238b8d0
- SHA1 252aa215476660ff71d86fd972dd584a105a009e
- SHA512 2e1798ec037c9053a05a4cd22c305f415f20f4679d26b3a2ddd391b5662c3d6df686d3fc699499cf451a3b8da3eecdd0d92fd35abab6252bf5e3eb775173502b
- SSDEEP 6144:1xlZam+akqx6YQJXcNlEHUIQeE3mmBWFv6f:Plf5j6zCNa0xeE3mc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\ngupejxd.exe
- Size 255KB
- SHA256 3480478ee42c516fcab1c4d214f83d9cab2b4b92eb7d284b46fa8994ff3fe81b
- MD5 86547c46e7c4b3ea300ae651b238b8d0
- SHA1 252aa215476660ff71d86fd972dd584a105a009e
- SHA512 2e1798ec037c9053a05a4cd22c305f415f20f4679d26b3a2ddd391b5662c3d6df686d3fc699499cf451a3b8da3eecdd0d92fd35abab6252bf5e3eb775173502b
- SSDEEP 6144:1xlZam+akqx6YQJXcNlEHUIQeE3mmBWFv6f:Plf5j6zCNa0xeE3mc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\ngupejxd.exe
- Size 255KB
- SHA256 3480478ee42c516fcab1c4d214f83d9cab2b4b92eb7d284b46fa8994ff3fe81b
- MD5 86547c46e7c4b3ea300ae651b238b8d0
- SHA1 252aa215476660ff71d86fd972dd584a105a009e
- SHA512 2e1798ec037c9053a05a4cd22c305f415f20f4679d26b3a2ddd391b5662c3d6df686d3fc699499cf451a3b8da3eecdd0d92fd35abab6252bf5e3eb775173502b
- SSDEEP 6144:1xlZam+akqx6YQJXcNlEHUIQeE3mmBWFv6f:Plf5j6zCNa0xeE3mc
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\ttrdzcntvyjdyky.exe
- Size 255KB
- SHA256 8b27e6232ecf63d57c58c73cc1fee6bcb4bf6fc0cf35390d4c86c9c36bd344bd
- MD5 5f63f2e0f46f4d9e9670913a7a25a242
- SHA1 107baf69f1923efa3d48df8be009e34c00cb5b2a
- SHA512 d31a3671e88a2a454ba13cc37f533980439c8f5aeec00e088b0964cb36ac61c58436da0e4741ce4d06462d276887ea03ca375627d9a60af0b36e712edc3dcf74
- SSDEEP 6144:1xlZam+akqx6YQJXcNlEHUIQeE3mmBWFv6S:Plf5j6zCNa0xeE3mh
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\ttrdzcntvyjdyky.exe
- Size 255KB
- SHA256 8b27e6232ecf63d57c58c73cc1fee6bcb4bf6fc0cf35390d4c86c9c36bd344bd
- MD5 5f63f2e0f46f4d9e9670913a7a25a242
- SHA1 107baf69f1923efa3d48df8be009e34c00cb5b2a
- SHA512 d31a3671e88a2a454ba13cc37f533980439c8f5aeec00e088b0964cb36ac61c58436da0e4741ce4d06462d276887ea03ca375627d9a60af0b36e712edc3dcf74
- SSDEEP 6144:1xlZam+akqx6YQJXcNlEHUIQeE3mmBWFv6S:Plf5j6zCNa0xeE3mh
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\wgbidfsnmwuei.exe
- Size 255KB
- SHA256 589e7d589f8f9c44fdf5ddcc5777c515135cef68a69a1100a53a71cf584d3623
- MD5 96644a6f6276fce88e313aadf1072939
- SHA1 596f2fd42cd7a2f4e272f6bb1028fa67092748d3
- SHA512 763fb9e8e0cbf39fac0b2da6884bd45e7ad2422c8970dcd2b3bc574f6fee7cf0a72cac9f3d5281dd4eeb2dcfeb86e50696f67452f9abbdc3b855d829443cd291
- SSDEEP 6144:1xlZam+akqx6YQJXcNlEHUIQeE3mmBWFv6V:Plf5j6zCNa0xeE3mK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\wgbidfsnmwuei.exe
- Size 255KB
- SHA256 589e7d589f8f9c44fdf5ddcc5777c515135cef68a69a1100a53a71cf584d3623
- MD5 96644a6f6276fce88e313aadf1072939
- SHA1 596f2fd42cd7a2f4e272f6bb1028fa67092748d3
- SHA512 763fb9e8e0cbf39fac0b2da6884bd45e7ad2422c8970dcd2b3bc574f6fee7cf0a72cac9f3d5281dd4eeb2dcfeb86e50696f67452f9abbdc3b855d829443cd291
- SSDEEP 6144:1xlZam+akqx6YQJXcNlEHUIQeE3mmBWFv6V:Plf5j6zCNa0xeE3mK
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\mydoc.rtf
- Size 223B
- SHA256 85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
- MD5 06604e5941c126e2e7be02c5cd9f62ec
- SHA1 4eb9fdf8ff4e1e539236002bd363b82c8f8930e1
- SHA512 803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
- MD5 SHA1 SHA512
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 255KB
- SHA256 2d955f733a5d2319dc7fae696e2c6d4f5b88b3196021d20694785a160982d0ff
- MD5 8795eae6667336473d7b5c88ef1a6d1a
- SHA1 4c4aba6b0c58a63b1026d4eec575afb4c1b14cdf
- SHA512 ebb4eec35406dea406d18b611bb92674e53fc0f75da2dbf58b2be902c326d5d267e388e20a2f07c224ed5f2c5a2dd4ecbddd21b36efd5705b7296ca5269e72f4
- SSDEEP 6144:1xlZam+akqx6YQJXcNlEHUIQeE3mmBWFv6I:Plf5j6zCNa0xeE3mP
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 255KB
- SHA256 2d955f733a5d2319dc7fae696e2c6d4f5b88b3196021d20694785a160982d0ff
- MD5 8795eae6667336473d7b5c88ef1a6d1a
- SHA1 4c4aba6b0c58a63b1026d4eec575afb4c1b14cdf
- SHA512 ebb4eec35406dea406d18b611bb92674e53fc0f75da2dbf58b2be902c326d5d267e388e20a2f07c224ed5f2c5a2dd4ecbddd21b36efd5705b7296ca5269e72f4
- SSDEEP 6144:1xlZam+akqx6YQJXcNlEHUIQeE3mmBWFv6I:Plf5j6zCNa0xeE3mP
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 255KB
- SHA256 2d955f733a5d2319dc7fae696e2c6d4f5b88b3196021d20694785a160982d0ff
- MD5 8795eae6667336473d7b5c88ef1a6d1a
- SHA1 4c4aba6b0c58a63b1026d4eec575afb4c1b14cdf
- SHA512 ebb4eec35406dea406d18b611bb92674e53fc0f75da2dbf58b2be902c326d5d267e388e20a2f07c224ed5f2c5a2dd4ecbddd21b36efd5705b7296ca5269e72f4
- SSDEEP 6144:1xlZam+akqx6YQJXcNlEHUIQeE3mmBWFv6I:Plf5j6zCNa0xeE3mP
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 255KB
- SHA256 0c9bdcc858c2d9ba282761e3544ffce38911423413f4112e39e48bae399ab281
- MD5 ba95b264fe2c18f7fb7202d439a8ce6f
- SHA1 800a6b64add7c8384d0ab2b73fceb24eb783d457
- SHA512 563709a6d5b57a3c46ab180f866df9ad9fdb4a1e6ac5a1c9f9d85f773fea859f5813913091a1d5689e20e57d62b8445d32ea8f3645058b82126576c3df2b5e7f
- SSDEEP 6144:1xlZam+akqx6YQJXcNlEHUIQeE3mmBWFv6R:Plf5j6zCNa0xeE3mq
- MD5 SHA1 SHA512 SSDEEP
- Path \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe
- Size 255KB
- SHA256 0c9bdcc858c2d9ba282761e3544ffce38911423413f4112e39e48bae399ab281
- MD5 ba95b264fe2c18f7fb7202d439a8ce6f
- SHA1 800a6b64add7c8384d0ab2b73fceb24eb783d457
- SHA512 563709a6d5b57a3c46ab180f866df9ad9fdb4a1e6ac5a1c9f9d85f773fea859f5813913091a1d5689e20e57d62b8445d32ea8f3645058b82126576c3df2b5e7f
- SSDEEP 6144:1xlZam+akqx6YQJXcNlEHUIQeE3mmBWFv6R:Plf5j6zCNa0xeE3mq
- MD5 SHA1 SHA512 SSDEEP