Analysis
-
max time kernel
157s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
30/10/2022, 00:56
Behavioral task
behavioral1
Sample
ef6663a386947c3a2dfb1b0ec51050ef2b4b6d1e5cde8264e17c92282a159506.exe
Resource
win7-20220901-en
windows7-x64
26 signatures
150 seconds
General
-
Target
ef6663a386947c3a2dfb1b0ec51050ef2b4b6d1e5cde8264e17c92282a159506.exe
-
Size
255KB
-
MD5
a33e8a8c3463ad0c7f3962d4f6179880
-
SHA1
b850af32ab7d09da67c0caef424c718cecf0ad71
-
SHA256
ef6663a386947c3a2dfb1b0ec51050ef2b4b6d1e5cde8264e17c92282a159506
-
SHA512
2ea72ecc7a8030f15369807fb15b7aa2f1d6a6377bce01dd126cbc0e5f6863ad2b1bec34d341f051e29caa577c7860dda67028ed71b49f360f6ab65479af5877
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJ/:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIg
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" cepbyrqmko.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" cepbyrqmko.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" cepbyrqmko.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" cepbyrqmko.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" cepbyrqmko.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" cepbyrqmko.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" cepbyrqmko.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" cepbyrqmko.exe -
Executes dropped EXE 5 IoCs
pid Process 4168 cepbyrqmko.exe 1656 kskqfkgvjprqylb.exe 3960 bltfhvuj.exe 1428 tzpdvwlmmuvdu.exe 4676 bltfhvuj.exe -
resource yara_rule behavioral2/memory/372-132-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x0001000000022e18-135.dat upx behavioral2/files/0x0001000000022e18-134.dat upx behavioral2/files/0x0001000000022e1a-140.dat upx behavioral2/files/0x0001000000022e1a-141.dat upx behavioral2/files/0x0001000000022e19-138.dat upx behavioral2/files/0x0001000000022e19-137.dat upx behavioral2/files/0x0001000000022e1b-143.dat upx behavioral2/files/0x0001000000022e1b-144.dat upx behavioral2/memory/4168-146-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1656-147-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3960-148-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1428-149-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/372-150-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x0001000000022e1a-152.dat upx behavioral2/memory/4676-153-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x0001000000022e1d-161.dat upx behavioral2/files/0x0002000000009de9-160.dat upx behavioral2/files/0x0001000000022e1d-162.dat upx behavioral2/memory/4168-165-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1656-166-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3960-167-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1428-168-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4676-169-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x000600000001e0b6-170.dat upx behavioral2/files/0x000f00000001e785-171.dat upx behavioral2/files/0x000200000001e68a-172.dat upx behavioral2/files/0x000200000001e68a-173.dat upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation ef6663a386947c3a2dfb1b0ec51050ef2b4b6d1e5cde8264e17c92282a159506.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" cepbyrqmko.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" cepbyrqmko.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" cepbyrqmko.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" cepbyrqmko.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" cepbyrqmko.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" cepbyrqmko.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run kskqfkgvjprqylb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\sxiwupel = "cepbyrqmko.exe" kskqfkgvjprqylb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wfmkbiax = "kskqfkgvjprqylb.exe" kskqfkgvjprqylb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "tzpdvwlmmuvdu.exe" kskqfkgvjprqylb.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\o: bltfhvuj.exe File opened (read-only) \??\v: cepbyrqmko.exe File opened (read-only) \??\b: bltfhvuj.exe File opened (read-only) \??\e: bltfhvuj.exe File opened (read-only) \??\x: bltfhvuj.exe File opened (read-only) \??\a: bltfhvuj.exe File opened (read-only) \??\a: bltfhvuj.exe File opened (read-only) \??\f: bltfhvuj.exe File opened (read-only) \??\v: bltfhvuj.exe File opened (read-only) \??\g: cepbyrqmko.exe File opened (read-only) \??\k: bltfhvuj.exe File opened (read-only) \??\a: cepbyrqmko.exe File opened (read-only) \??\q: cepbyrqmko.exe File opened (read-only) \??\t: cepbyrqmko.exe File opened (read-only) \??\n: bltfhvuj.exe File opened (read-only) \??\b: cepbyrqmko.exe File opened (read-only) \??\r: cepbyrqmko.exe File opened (read-only) \??\u: cepbyrqmko.exe File opened (read-only) \??\v: bltfhvuj.exe File opened (read-only) \??\e: bltfhvuj.exe File opened (read-only) \??\y: cepbyrqmko.exe File opened (read-only) \??\g: bltfhvuj.exe File opened (read-only) \??\x: bltfhvuj.exe File opened (read-only) \??\z: cepbyrqmko.exe File opened (read-only) \??\l: bltfhvuj.exe File opened (read-only) \??\s: bltfhvuj.exe File opened (read-only) \??\b: bltfhvuj.exe File opened (read-only) \??\w: bltfhvuj.exe File opened (read-only) \??\j: cepbyrqmko.exe File opened (read-only) \??\p: cepbyrqmko.exe File opened (read-only) \??\f: bltfhvuj.exe File opened (read-only) \??\i: cepbyrqmko.exe File opened (read-only) \??\o: cepbyrqmko.exe File opened (read-only) \??\p: bltfhvuj.exe File opened (read-only) \??\j: bltfhvuj.exe File opened (read-only) \??\k: bltfhvuj.exe File opened (read-only) \??\u: bltfhvuj.exe File opened (read-only) \??\y: bltfhvuj.exe File opened (read-only) \??\n: cepbyrqmko.exe File opened (read-only) \??\j: bltfhvuj.exe File opened (read-only) \??\t: bltfhvuj.exe File opened (read-only) \??\l: bltfhvuj.exe File opened (read-only) \??\n: bltfhvuj.exe File opened (read-only) \??\t: bltfhvuj.exe File opened (read-only) \??\z: bltfhvuj.exe File opened (read-only) \??\x: cepbyrqmko.exe File opened (read-only) \??\e: cepbyrqmko.exe File opened (read-only) \??\y: bltfhvuj.exe File opened (read-only) \??\k: cepbyrqmko.exe File opened (read-only) \??\l: cepbyrqmko.exe File opened (read-only) \??\s: cepbyrqmko.exe File opened (read-only) \??\h: bltfhvuj.exe File opened (read-only) \??\i: bltfhvuj.exe File opened (read-only) \??\p: bltfhvuj.exe File opened (read-only) \??\r: bltfhvuj.exe File opened (read-only) \??\f: cepbyrqmko.exe File opened (read-only) \??\h: bltfhvuj.exe File opened (read-only) \??\i: bltfhvuj.exe File opened (read-only) \??\g: bltfhvuj.exe File opened (read-only) \??\m: bltfhvuj.exe File opened (read-only) \??\h: cepbyrqmko.exe File opened (read-only) \??\q: bltfhvuj.exe File opened (read-only) \??\o: bltfhvuj.exe File opened (read-only) \??\r: bltfhvuj.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" cepbyrqmko.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" cepbyrqmko.exe -
AutoIT Executable 12 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/372-132-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4168-146-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1656-147-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3960-148-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1428-149-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/372-150-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4676-153-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4168-165-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1656-166-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3960-167-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1428-168-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4676-169-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe -
Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe bltfhvuj.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe bltfhvuj.exe File opened for modification C:\Windows\SysWOW64\cepbyrqmko.exe ef6663a386947c3a2dfb1b0ec51050ef2b4b6d1e5cde8264e17c92282a159506.exe File created C:\Windows\SysWOW64\kskqfkgvjprqylb.exe ef6663a386947c3a2dfb1b0ec51050ef2b4b6d1e5cde8264e17c92282a159506.exe File opened for modification C:\Windows\SysWOW64\kskqfkgvjprqylb.exe ef6663a386947c3a2dfb1b0ec51050ef2b4b6d1e5cde8264e17c92282a159506.exe File created C:\Windows\SysWOW64\bltfhvuj.exe ef6663a386947c3a2dfb1b0ec51050ef2b4b6d1e5cde8264e17c92282a159506.exe File opened for modification C:\Windows\SysWOW64\bltfhvuj.exe ef6663a386947c3a2dfb1b0ec51050ef2b4b6d1e5cde8264e17c92282a159506.exe File created C:\Windows\SysWOW64\tzpdvwlmmuvdu.exe ef6663a386947c3a2dfb1b0ec51050ef2b4b6d1e5cde8264e17c92282a159506.exe File opened for modification C:\Windows\SysWOW64\tzpdvwlmmuvdu.exe ef6663a386947c3a2dfb1b0ec51050ef2b4b6d1e5cde8264e17c92282a159506.exe File created C:\Windows\SysWOW64\cepbyrqmko.exe ef6663a386947c3a2dfb1b0ec51050ef2b4b6d1e5cde8264e17c92282a159506.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe bltfhvuj.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe bltfhvuj.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll cepbyrqmko.exe -
Drops file in Program Files directory 21 IoCs
description ioc Process File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe bltfhvuj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe bltfhvuj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal bltfhvuj.exe File created \??\c:\Program Files\UninstallDisable.doc.exe bltfhvuj.exe File opened for modification C:\Program Files\UninstallDisable.nal bltfhvuj.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe bltfhvuj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal bltfhvuj.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe bltfhvuj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe bltfhvuj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal bltfhvuj.exe File opened for modification C:\Program Files\UninstallDisable.doc.exe bltfhvuj.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe bltfhvuj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe bltfhvuj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal bltfhvuj.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe bltfhvuj.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe bltfhvuj.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe bltfhvuj.exe File opened for modification \??\c:\Program Files\UninstallDisable.doc.exe bltfhvuj.exe File opened for modification C:\Program Files\UninstallDisable.doc.exe bltfhvuj.exe File opened for modification \??\c:\Program Files\UninstallDisable.doc.exe bltfhvuj.exe File opened for modification C:\Program Files\UninstallDisable.nal bltfhvuj.exe -
Drops file in Windows directory 11 IoCs
description ioc Process File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe bltfhvuj.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe bltfhvuj.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe bltfhvuj.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe bltfhvuj.exe File opened for modification C:\Windows\mydoc.rtf ef6663a386947c3a2dfb1b0ec51050ef2b4b6d1e5cde8264e17c92282a159506.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe bltfhvuj.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe bltfhvuj.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe bltfhvuj.exe File created C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe bltfhvuj.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E0F268C4FE6D22DFD10CD1D58A7C9166" ef6663a386947c3a2dfb1b0ec51050ef2b4b6d1e5cde8264e17c92282a159506.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat cepbyrqmko.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" cepbyrqmko.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh cepbyrqmko.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" cepbyrqmko.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7FF5FC8D4F5B856E9045D6207DE0BDE0E144584266416343D691" ef6663a386947c3a2dfb1b0ec51050ef2b4b6d1e5cde8264e17c92282a159506.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc cepbyrqmko.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf cepbyrqmko.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs cepbyrqmko.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg cepbyrqmko.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "193EC60C1594DAB0B8BD7C92ED9F37BA" ef6663a386947c3a2dfb1b0ec51050ef2b4b6d1e5cde8264e17c92282a159506.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings ef6663a386947c3a2dfb1b0ec51050ef2b4b6d1e5cde8264e17c92282a159506.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" cepbyrqmko.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" cepbyrqmko.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" cepbyrqmko.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes ef6663a386947c3a2dfb1b0ec51050ef2b4b6d1e5cde8264e17c92282a159506.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33402C7D9D5083226D3577D277272CAC7D8564D6" ef6663a386947c3a2dfb1b0ec51050ef2b4b6d1e5cde8264e17c92282a159506.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6ABEF9CEF966F298830F3B4A869C3E97B0FC038D42110238E2BE42EC08A8" ef6663a386947c3a2dfb1b0ec51050ef2b4b6d1e5cde8264e17c92282a159506.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FB2B15F4495399D53BDB9D433E9D7CC" ef6663a386947c3a2dfb1b0ec51050ef2b4b6d1e5cde8264e17c92282a159506.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" cepbyrqmko.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4624 WINWORD.EXE 4624 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 372 ef6663a386947c3a2dfb1b0ec51050ef2b4b6d1e5cde8264e17c92282a159506.exe 372 ef6663a386947c3a2dfb1b0ec51050ef2b4b6d1e5cde8264e17c92282a159506.exe 372 ef6663a386947c3a2dfb1b0ec51050ef2b4b6d1e5cde8264e17c92282a159506.exe 372 ef6663a386947c3a2dfb1b0ec51050ef2b4b6d1e5cde8264e17c92282a159506.exe 372 ef6663a386947c3a2dfb1b0ec51050ef2b4b6d1e5cde8264e17c92282a159506.exe 372 ef6663a386947c3a2dfb1b0ec51050ef2b4b6d1e5cde8264e17c92282a159506.exe 372 ef6663a386947c3a2dfb1b0ec51050ef2b4b6d1e5cde8264e17c92282a159506.exe 372 ef6663a386947c3a2dfb1b0ec51050ef2b4b6d1e5cde8264e17c92282a159506.exe 372 ef6663a386947c3a2dfb1b0ec51050ef2b4b6d1e5cde8264e17c92282a159506.exe 372 ef6663a386947c3a2dfb1b0ec51050ef2b4b6d1e5cde8264e17c92282a159506.exe 372 ef6663a386947c3a2dfb1b0ec51050ef2b4b6d1e5cde8264e17c92282a159506.exe 372 ef6663a386947c3a2dfb1b0ec51050ef2b4b6d1e5cde8264e17c92282a159506.exe 372 ef6663a386947c3a2dfb1b0ec51050ef2b4b6d1e5cde8264e17c92282a159506.exe 372 ef6663a386947c3a2dfb1b0ec51050ef2b4b6d1e5cde8264e17c92282a159506.exe 372 ef6663a386947c3a2dfb1b0ec51050ef2b4b6d1e5cde8264e17c92282a159506.exe 372 ef6663a386947c3a2dfb1b0ec51050ef2b4b6d1e5cde8264e17c92282a159506.exe 1656 kskqfkgvjprqylb.exe 1656 kskqfkgvjprqylb.exe 1656 kskqfkgvjprqylb.exe 1656 kskqfkgvjprqylb.exe 1656 kskqfkgvjprqylb.exe 1656 kskqfkgvjprqylb.exe 1656 kskqfkgvjprqylb.exe 1656 kskqfkgvjprqylb.exe 3960 bltfhvuj.exe 3960 bltfhvuj.exe 3960 bltfhvuj.exe 3960 bltfhvuj.exe 3960 bltfhvuj.exe 3960 bltfhvuj.exe 3960 bltfhvuj.exe 3960 bltfhvuj.exe 1656 kskqfkgvjprqylb.exe 1656 kskqfkgvjprqylb.exe 4168 cepbyrqmko.exe 4168 cepbyrqmko.exe 4168 cepbyrqmko.exe 4168 cepbyrqmko.exe 4168 cepbyrqmko.exe 4168 cepbyrqmko.exe 4168 cepbyrqmko.exe 4168 cepbyrqmko.exe 4168 cepbyrqmko.exe 4168 cepbyrqmko.exe 1428 tzpdvwlmmuvdu.exe 1428 tzpdvwlmmuvdu.exe 1428 tzpdvwlmmuvdu.exe 1428 tzpdvwlmmuvdu.exe 1428 tzpdvwlmmuvdu.exe 1428 tzpdvwlmmuvdu.exe 1428 tzpdvwlmmuvdu.exe 1428 tzpdvwlmmuvdu.exe 1428 tzpdvwlmmuvdu.exe 1428 tzpdvwlmmuvdu.exe 1428 tzpdvwlmmuvdu.exe 1428 tzpdvwlmmuvdu.exe 1656 kskqfkgvjprqylb.exe 1656 kskqfkgvjprqylb.exe 1428 tzpdvwlmmuvdu.exe 1428 tzpdvwlmmuvdu.exe 1428 tzpdvwlmmuvdu.exe 1428 tzpdvwlmmuvdu.exe 1656 kskqfkgvjprqylb.exe 1656 kskqfkgvjprqylb.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 372 ef6663a386947c3a2dfb1b0ec51050ef2b4b6d1e5cde8264e17c92282a159506.exe 372 ef6663a386947c3a2dfb1b0ec51050ef2b4b6d1e5cde8264e17c92282a159506.exe 372 ef6663a386947c3a2dfb1b0ec51050ef2b4b6d1e5cde8264e17c92282a159506.exe 4168 cepbyrqmko.exe 4168 cepbyrqmko.exe 4168 cepbyrqmko.exe 1656 kskqfkgvjprqylb.exe 3960 bltfhvuj.exe 1656 kskqfkgvjprqylb.exe 3960 bltfhvuj.exe 1656 kskqfkgvjprqylb.exe 3960 bltfhvuj.exe 1428 tzpdvwlmmuvdu.exe 1428 tzpdvwlmmuvdu.exe 1428 tzpdvwlmmuvdu.exe 4676 bltfhvuj.exe 4676 bltfhvuj.exe 4676 bltfhvuj.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 372 ef6663a386947c3a2dfb1b0ec51050ef2b4b6d1e5cde8264e17c92282a159506.exe 372 ef6663a386947c3a2dfb1b0ec51050ef2b4b6d1e5cde8264e17c92282a159506.exe 372 ef6663a386947c3a2dfb1b0ec51050ef2b4b6d1e5cde8264e17c92282a159506.exe 4168 cepbyrqmko.exe 4168 cepbyrqmko.exe 4168 cepbyrqmko.exe 1656 kskqfkgvjprqylb.exe 3960 bltfhvuj.exe 1656 kskqfkgvjprqylb.exe 3960 bltfhvuj.exe 1656 kskqfkgvjprqylb.exe 3960 bltfhvuj.exe 1428 tzpdvwlmmuvdu.exe 1428 tzpdvwlmmuvdu.exe 1428 tzpdvwlmmuvdu.exe 4676 bltfhvuj.exe 4676 bltfhvuj.exe 4676 bltfhvuj.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 4624 WINWORD.EXE 4624 WINWORD.EXE 4624 WINWORD.EXE 4624 WINWORD.EXE 4624 WINWORD.EXE 4624 WINWORD.EXE 4624 WINWORD.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 372 wrote to memory of 4168 372 ef6663a386947c3a2dfb1b0ec51050ef2b4b6d1e5cde8264e17c92282a159506.exe 81 PID 372 wrote to memory of 4168 372 ef6663a386947c3a2dfb1b0ec51050ef2b4b6d1e5cde8264e17c92282a159506.exe 81 PID 372 wrote to memory of 4168 372 ef6663a386947c3a2dfb1b0ec51050ef2b4b6d1e5cde8264e17c92282a159506.exe 81 PID 372 wrote to memory of 1656 372 ef6663a386947c3a2dfb1b0ec51050ef2b4b6d1e5cde8264e17c92282a159506.exe 82 PID 372 wrote to memory of 1656 372 ef6663a386947c3a2dfb1b0ec51050ef2b4b6d1e5cde8264e17c92282a159506.exe 82 PID 372 wrote to memory of 1656 372 ef6663a386947c3a2dfb1b0ec51050ef2b4b6d1e5cde8264e17c92282a159506.exe 82 PID 372 wrote to memory of 3960 372 ef6663a386947c3a2dfb1b0ec51050ef2b4b6d1e5cde8264e17c92282a159506.exe 83 PID 372 wrote to memory of 3960 372 ef6663a386947c3a2dfb1b0ec51050ef2b4b6d1e5cde8264e17c92282a159506.exe 83 PID 372 wrote to memory of 3960 372 ef6663a386947c3a2dfb1b0ec51050ef2b4b6d1e5cde8264e17c92282a159506.exe 83 PID 372 wrote to memory of 1428 372 ef6663a386947c3a2dfb1b0ec51050ef2b4b6d1e5cde8264e17c92282a159506.exe 84 PID 372 wrote to memory of 1428 372 ef6663a386947c3a2dfb1b0ec51050ef2b4b6d1e5cde8264e17c92282a159506.exe 84 PID 372 wrote to memory of 1428 372 ef6663a386947c3a2dfb1b0ec51050ef2b4b6d1e5cde8264e17c92282a159506.exe 84 PID 372 wrote to memory of 4624 372 ef6663a386947c3a2dfb1b0ec51050ef2b4b6d1e5cde8264e17c92282a159506.exe 85 PID 372 wrote to memory of 4624 372 ef6663a386947c3a2dfb1b0ec51050ef2b4b6d1e5cde8264e17c92282a159506.exe 85 PID 4168 wrote to memory of 4676 4168 cepbyrqmko.exe 87 PID 4168 wrote to memory of 4676 4168 cepbyrqmko.exe 87 PID 4168 wrote to memory of 4676 4168 cepbyrqmko.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\ef6663a386947c3a2dfb1b0ec51050ef2b4b6d1e5cde8264e17c92282a159506.exe"C:\Users\Admin\AppData\Local\Temp\ef6663a386947c3a2dfb1b0ec51050ef2b4b6d1e5cde8264e17c92282a159506.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:372 -
C:\Windows\SysWOW64\cepbyrqmko.execepbyrqmko.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Windows\SysWOW64\bltfhvuj.exeC:\Windows\system32\bltfhvuj.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4676
-
-
-
C:\Windows\SysWOW64\kskqfkgvjprqylb.exekskqfkgvjprqylb.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1656
-
-
C:\Windows\SysWOW64\bltfhvuj.exebltfhvuj.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3960
-
-
C:\Windows\SysWOW64\tzpdvwlmmuvdu.exetzpdvwlmmuvdu.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1428
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4624
-
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Disabling Security Tools
2Hidden Files and Directories
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD5c1a3c205c9a8308d68bc65cae777986a
SHA1357dae49fa9707b227ef3fdc1338ecbc4e24f5e2
SHA256980f8a3d8dc3d8861571cbb7cbca0b88d66cbc8fbfb023e6bc2b9b05218536f4
SHA5122639cf2b411567f674f333313d1c0985f687593c03246fa3d80cfa58688351b47d2c6f00f0305022f09653559d9020665fdc8149b47048d63057324bdfa53d72
-
Filesize
255KB
MD564f943d0d1679216eb3765e8e0b485b6
SHA1099f6e8505c2e26758b9a9e1dcd9becc2a11511a
SHA2563408674621fde875bec257a144adc3ca9a4536ebca99013d860051bc1263cd7c
SHA512cbf1639b77a12ea5dfb7aa8dfb288fa177282c42d7dec8e6609932b32304e330d479c887e7b969cf7386202d4a9fe2dfe5d7b6a685b7b3ef66ab34ceb94f1b3b
-
Filesize
255KB
MD5a3e42d82aa5e783a2cf9c0ef46d7d226
SHA1fe4e5909883653abfb7ea1eaa47b234b3e83ade7
SHA25616b4d2689b422d7b9193335468626a5b2e30dabd360e44d8e0f104e255ec9915
SHA5126863a6ba003442be2fa20273a1aa4d0103b20a00d20869d478d237548ee9f73199c0f9db96c1d7fec411f43ba90ffc3cd928f5f8bca4bcd06352f07783594d2d
-
Filesize
255KB
MD5b50820defe72b64531dedf7c26fdc172
SHA183b79516042eaaa7e482f020091cb909ee89786d
SHA25618a6ca4465b9cda11d489570bff9a7f2d0289d8d8c48551c831cefdabff0e81f
SHA512e34a7d71eba301cbdb14525e2fc83130088c0d6b9a704c2985c598f435d7e6e699037e02137c441b4bcb99f082e3c6881943713182686dd385cc5e4b5aa1ce54
-
Filesize
255KB
MD53b93c38476ebfc379344fce0a2c01250
SHA166d39475c75426f7db67201f07153f5725f1f4b5
SHA25612a7eb1dbcfa4a317365417a920aba5255496ac852891b8a88759bce207cd3dc
SHA512ef38350919081b42611f62d5fbfbc4daaf02a8b70a1d1ea5b81b7bf608a1cb83fe6082a5442af536390d92b0fbc9db88ad545e6cdf2f26867eb121bb2727be34
-
Filesize
255KB
MD53b93c38476ebfc379344fce0a2c01250
SHA166d39475c75426f7db67201f07153f5725f1f4b5
SHA25612a7eb1dbcfa4a317365417a920aba5255496ac852891b8a88759bce207cd3dc
SHA512ef38350919081b42611f62d5fbfbc4daaf02a8b70a1d1ea5b81b7bf608a1cb83fe6082a5442af536390d92b0fbc9db88ad545e6cdf2f26867eb121bb2727be34
-
Filesize
255KB
MD53b93c38476ebfc379344fce0a2c01250
SHA166d39475c75426f7db67201f07153f5725f1f4b5
SHA25612a7eb1dbcfa4a317365417a920aba5255496ac852891b8a88759bce207cd3dc
SHA512ef38350919081b42611f62d5fbfbc4daaf02a8b70a1d1ea5b81b7bf608a1cb83fe6082a5442af536390d92b0fbc9db88ad545e6cdf2f26867eb121bb2727be34
-
Filesize
255KB
MD53d48828e5a9df6b14bf2c61fe6d8af8b
SHA146b3731f29ed463ac7d6ae6403aaa0760d260c9d
SHA2566624f54232ef8146f09ed0d129f1da1fca1945efb97705cb7754e761137a5725
SHA512634cfeaba028b36a502de2015865cb4e617fc4c6ae5e8d2d1804a0064feb49ab8d5cdd261af5e9018d1031fdff46c6b0c5370093d2aee67352cd0beb6df7588c
-
Filesize
255KB
MD53d48828e5a9df6b14bf2c61fe6d8af8b
SHA146b3731f29ed463ac7d6ae6403aaa0760d260c9d
SHA2566624f54232ef8146f09ed0d129f1da1fca1945efb97705cb7754e761137a5725
SHA512634cfeaba028b36a502de2015865cb4e617fc4c6ae5e8d2d1804a0064feb49ab8d5cdd261af5e9018d1031fdff46c6b0c5370093d2aee67352cd0beb6df7588c
-
Filesize
255KB
MD5d770ca3e05542a51c7949afb938dbcdd
SHA1a3148985fe76593adde0c74b7cdcd45076b70506
SHA25692a61e6338c49f2e6b35cde73f6b910de4c9c0b979d9826eb4b9af332a4c7888
SHA512c1b6969d2e0c6f3fbacbcb2d221ac890a13f4ec99b65e9ac8fc94fdc5b0ad889383025b43e95d5ace1ba390d5dbf93d91bf9328fc357adf41da1a05908f7b5c0
-
Filesize
255KB
MD5d770ca3e05542a51c7949afb938dbcdd
SHA1a3148985fe76593adde0c74b7cdcd45076b70506
SHA25692a61e6338c49f2e6b35cde73f6b910de4c9c0b979d9826eb4b9af332a4c7888
SHA512c1b6969d2e0c6f3fbacbcb2d221ac890a13f4ec99b65e9ac8fc94fdc5b0ad889383025b43e95d5ace1ba390d5dbf93d91bf9328fc357adf41da1a05908f7b5c0
-
Filesize
255KB
MD5a23c6f3aa3ca4d21227b7deebc4e28d2
SHA1114b2570164db10bc7847f1b25f9f5cd790842df
SHA2560e26383890390057233421c9e78e1817006a7cace1a6fa76c3de774483160fca
SHA512dafd006cd2c059f9514a65fb4ac489bc39ddca6a2071d6df415ee00fb132c35c761b23b19c528e65ecc8a266358539d0383b15a9da7b0a8290ee7996fe5c9339
-
Filesize
255KB
MD5a23c6f3aa3ca4d21227b7deebc4e28d2
SHA1114b2570164db10bc7847f1b25f9f5cd790842df
SHA2560e26383890390057233421c9e78e1817006a7cace1a6fa76c3de774483160fca
SHA512dafd006cd2c059f9514a65fb4ac489bc39ddca6a2071d6df415ee00fb132c35c761b23b19c528e65ecc8a266358539d0383b15a9da7b0a8290ee7996fe5c9339
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
255KB
MD564f943d0d1679216eb3765e8e0b485b6
SHA1099f6e8505c2e26758b9a9e1dcd9becc2a11511a
SHA2563408674621fde875bec257a144adc3ca9a4536ebca99013d860051bc1263cd7c
SHA512cbf1639b77a12ea5dfb7aa8dfb288fa177282c42d7dec8e6609932b32304e330d479c887e7b969cf7386202d4a9fe2dfe5d7b6a685b7b3ef66ab34ceb94f1b3b
-
Filesize
255KB
MD57888b6d4234ea3484e9de5848529ef2f
SHA144f3d10ab25ca191c2f1c34e6c569eec199f2cb7
SHA2562d9089d10438f921a045a0b328d6fb26c5b8f0de630bbe5dac84f516492ae1a4
SHA512ac6e3e917c79673bb51866b971b02243146810bde9c83f1fceb636a2407776457b5441f6222a5bb4a60f5a2285cb8a6a2b95ca3a854e60affad44c348f370341
-
Filesize
255KB
MD5c68aa2397bc954f37d8ca4325146afe8
SHA1f8a670550fb3e7170afa4368a4a55dbcc067ce68
SHA25634905f8d3da3d74e38977980974362a11e2429369dc5b2750d2ff80e22926a9d
SHA512916da612329b777c8d77ea25043b9cf8cf10ba77ad7681b75ee809c9703a639e4eb086343c8ec3e4272bba2f1b21455d7424fcd58caa831b1f88d2cd78abbe50