Analysis
-
max time kernel
151s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30/10/2022, 20:57
Behavioral task
behavioral1
Sample
045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe
Resource
win7-20220812-en
windows7-x64
26 signatures
150 seconds
General
-
Target
045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe
-
Size
256KB
-
MD5
a19e86bcc2a7e337772b0a4b872cf600
-
SHA1
dddfce9b3b20046267f1513510867da139881b90
-
SHA256
045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad
-
SHA512
3d8b7d2f6dcb7699970b3ea1c72438b1dd2f35d0c7278544d9bcf177f3fa70b4f60e079a7678f77764fff09cf20fdd0983a2e915b9272ed67ea20b407799dcf2
-
SSDEEP
6144:1xlZam+akqx6YQJXcNlEHUIQeE3mmBWFv6k:Plf5j6zCNa0xeE3mR
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" lgvklbaqwa.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" lgvklbaqwa.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" lgvklbaqwa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" lgvklbaqwa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" lgvklbaqwa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" lgvklbaqwa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" lgvklbaqwa.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" lgvklbaqwa.exe -
Executes dropped EXE 5 IoCs
pid Process 2432 lgvklbaqwa.exe 4088 anmwgslhddceean.exe 1268 npdynssl.exe 3416 mnatztjpilqaw.exe 4936 npdynssl.exe -
resource yara_rule behavioral2/memory/852-132-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x0008000000022e06-134.dat upx behavioral2/files/0x0007000000022e09-138.dat upx behavioral2/files/0x0007000000022e09-137.dat upx behavioral2/files/0x0008000000022e06-135.dat upx behavioral2/files/0x0006000000022e0e-141.dat upx behavioral2/files/0x0006000000022e0e-140.dat upx behavioral2/files/0x0006000000022e0f-143.dat upx behavioral2/files/0x0006000000022e0f-144.dat upx behavioral2/memory/2432-145-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4088-146-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1268-147-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3416-148-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x0006000000022e0e-150.dat upx behavioral2/memory/852-152-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4936-153-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x001b00000001d9f9-159.dat upx behavioral2/memory/2432-163-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4088-164-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1268-165-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3416-166-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4936-167-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x0003000000000723-173.dat upx behavioral2/files/0x0003000000000723-175.dat upx behavioral2/files/0x0003000000000723-174.dat upx behavioral2/files/0x0003000000000723-176.dat upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" lgvklbaqwa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" lgvklbaqwa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" lgvklbaqwa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" lgvklbaqwa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" lgvklbaqwa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" lgvklbaqwa.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run anmwgslhddceean.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\zqenrajk = "lgvklbaqwa.exe" anmwgslhddceean.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\hrwzxlao = "anmwgslhddceean.exe" anmwgslhddceean.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "mnatztjpilqaw.exe" anmwgslhddceean.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\y: npdynssl.exe File opened (read-only) \??\a: lgvklbaqwa.exe File opened (read-only) \??\z: lgvklbaqwa.exe File opened (read-only) \??\p: npdynssl.exe File opened (read-only) \??\q: npdynssl.exe File opened (read-only) \??\j: npdynssl.exe File opened (read-only) \??\l: npdynssl.exe File opened (read-only) \??\u: npdynssl.exe File opened (read-only) \??\f: npdynssl.exe File opened (read-only) \??\s: lgvklbaqwa.exe File opened (read-only) \??\u: npdynssl.exe File opened (read-only) \??\q: lgvklbaqwa.exe File opened (read-only) \??\h: npdynssl.exe File opened (read-only) \??\l: lgvklbaqwa.exe File opened (read-only) \??\k: npdynssl.exe File opened (read-only) \??\z: npdynssl.exe File opened (read-only) \??\f: lgvklbaqwa.exe File opened (read-only) \??\h: lgvklbaqwa.exe File opened (read-only) \??\m: npdynssl.exe File opened (read-only) \??\e: lgvklbaqwa.exe File opened (read-only) \??\i: lgvklbaqwa.exe File opened (read-only) \??\a: npdynssl.exe File opened (read-only) \??\q: npdynssl.exe File opened (read-only) \??\p: lgvklbaqwa.exe File opened (read-only) \??\o: npdynssl.exe File opened (read-only) \??\x: npdynssl.exe File opened (read-only) \??\y: lgvklbaqwa.exe File opened (read-only) \??\n: npdynssl.exe File opened (read-only) \??\v: npdynssl.exe File opened (read-only) \??\m: npdynssl.exe File opened (read-only) \??\v: npdynssl.exe File opened (read-only) \??\y: npdynssl.exe File opened (read-only) \??\p: npdynssl.exe File opened (read-only) \??\g: npdynssl.exe File opened (read-only) \??\i: npdynssl.exe File opened (read-only) \??\x: lgvklbaqwa.exe File opened (read-only) \??\g: npdynssl.exe File opened (read-only) \??\r: lgvklbaqwa.exe File opened (read-only) \??\v: lgvklbaqwa.exe File opened (read-only) \??\j: lgvklbaqwa.exe File opened (read-only) \??\w: lgvklbaqwa.exe File opened (read-only) \??\x: npdynssl.exe File opened (read-only) \??\r: npdynssl.exe File opened (read-only) \??\s: npdynssl.exe File opened (read-only) \??\w: npdynssl.exe File opened (read-only) \??\n: lgvklbaqwa.exe File opened (read-only) \??\e: npdynssl.exe File opened (read-only) \??\r: npdynssl.exe File opened (read-only) \??\t: npdynssl.exe File opened (read-only) \??\i: npdynssl.exe File opened (read-only) \??\o: npdynssl.exe File opened (read-only) \??\b: lgvklbaqwa.exe File opened (read-only) \??\b: npdynssl.exe File opened (read-only) \??\g: lgvklbaqwa.exe File opened (read-only) \??\o: lgvklbaqwa.exe File opened (read-only) \??\a: npdynssl.exe File opened (read-only) \??\j: npdynssl.exe File opened (read-only) \??\z: npdynssl.exe File opened (read-only) \??\k: npdynssl.exe File opened (read-only) \??\n: npdynssl.exe File opened (read-only) \??\t: npdynssl.exe File opened (read-only) \??\m: lgvklbaqwa.exe File opened (read-only) \??\t: lgvklbaqwa.exe File opened (read-only) \??\f: npdynssl.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" lgvklbaqwa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" lgvklbaqwa.exe -
AutoIT Executable 11 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/2432-145-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4088-146-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1268-147-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3416-148-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/852-152-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4936-153-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2432-163-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4088-164-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1268-165-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3416-166-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4936-167-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe -
Drops file in System32 directory 12 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\lgvklbaqwa.exe 045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe File created C:\Windows\SysWOW64\anmwgslhddceean.exe 045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe File opened for modification C:\Windows\SysWOW64\anmwgslhddceean.exe 045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe File created C:\Windows\SysWOW64\npdynssl.exe 045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe File opened for modification C:\Windows\SysWOW64\npdynssl.exe 045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe File created C:\Windows\SysWOW64\lgvklbaqwa.exe 045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe File created C:\Windows\SysWOW64\mnatztjpilqaw.exe 045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe File opened for modification C:\Windows\SysWOW64\mnatztjpilqaw.exe 045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll lgvklbaqwa.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe npdynssl.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe npdynssl.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe npdynssl.exe -
Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe npdynssl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe npdynssl.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe npdynssl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal npdynssl.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe npdynssl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal npdynssl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal npdynssl.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe npdynssl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe npdynssl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe npdynssl.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe npdynssl.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal npdynssl.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe npdynssl.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe npdynssl.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE File opened for modification C:\Windows\mydoc.rtf 045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Modifies registry class 20 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings 045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "334F2C7F9D5683546A3076D270272DDF7CF264D8" 045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FC5B02A479538EB53BFB9D133EFD7CA" 045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E08068B4FE1821ADD172D0D68A089161" 045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc lgvklbaqwa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1848C70814E5DBB1B9CC7CE8ED9F34C6" 045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" lgvklbaqwa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" lgvklbaqwa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" lgvklbaqwa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" lgvklbaqwa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6AB4FABAF960F2E7830C3A4286973999B08B02F04312033CE1CB429A08A4" 045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7EFCFF894858826E9032D6587DE6BC94E140594B6646633FD6EA" 045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat lgvklbaqwa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs lgvklbaqwa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg lgvklbaqwa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" lgvklbaqwa.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh lgvklbaqwa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" lgvklbaqwa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf lgvklbaqwa.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 4912 WINWORD.EXE 4912 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 852 045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe 852 045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe 852 045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe 852 045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe 852 045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe 852 045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe 852 045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe 852 045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe 852 045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe 852 045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe 852 045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe 852 045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe 852 045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe 852 045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe 852 045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe 852 045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe 2432 lgvklbaqwa.exe 2432 lgvklbaqwa.exe 2432 lgvklbaqwa.exe 2432 lgvklbaqwa.exe 2432 lgvklbaqwa.exe 2432 lgvklbaqwa.exe 2432 lgvklbaqwa.exe 2432 lgvklbaqwa.exe 2432 lgvklbaqwa.exe 2432 lgvklbaqwa.exe 4088 anmwgslhddceean.exe 4088 anmwgslhddceean.exe 4088 anmwgslhddceean.exe 4088 anmwgslhddceean.exe 4088 anmwgslhddceean.exe 4088 anmwgslhddceean.exe 4088 anmwgslhddceean.exe 4088 anmwgslhddceean.exe 4088 anmwgslhddceean.exe 4088 anmwgslhddceean.exe 1268 npdynssl.exe 1268 npdynssl.exe 1268 npdynssl.exe 1268 npdynssl.exe 1268 npdynssl.exe 1268 npdynssl.exe 1268 npdynssl.exe 1268 npdynssl.exe 3416 mnatztjpilqaw.exe 3416 mnatztjpilqaw.exe 3416 mnatztjpilqaw.exe 3416 mnatztjpilqaw.exe 3416 mnatztjpilqaw.exe 3416 mnatztjpilqaw.exe 3416 mnatztjpilqaw.exe 3416 mnatztjpilqaw.exe 3416 mnatztjpilqaw.exe 3416 mnatztjpilqaw.exe 3416 mnatztjpilqaw.exe 3416 mnatztjpilqaw.exe 4088 anmwgslhddceean.exe 4088 anmwgslhddceean.exe 3416 mnatztjpilqaw.exe 3416 mnatztjpilqaw.exe 3416 mnatztjpilqaw.exe 3416 mnatztjpilqaw.exe 4088 anmwgslhddceean.exe 4088 anmwgslhddceean.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 852 045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe 852 045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe 852 045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe 2432 lgvklbaqwa.exe 2432 lgvklbaqwa.exe 2432 lgvklbaqwa.exe 4088 anmwgslhddceean.exe 4088 anmwgslhddceean.exe 4088 anmwgslhddceean.exe 1268 npdynssl.exe 1268 npdynssl.exe 1268 npdynssl.exe 3416 mnatztjpilqaw.exe 3416 mnatztjpilqaw.exe 3416 mnatztjpilqaw.exe 4936 npdynssl.exe 4936 npdynssl.exe 4936 npdynssl.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 852 045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe 852 045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe 852 045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe 2432 lgvklbaqwa.exe 2432 lgvklbaqwa.exe 2432 lgvklbaqwa.exe 4088 anmwgslhddceean.exe 4088 anmwgslhddceean.exe 4088 anmwgslhddceean.exe 1268 npdynssl.exe 1268 npdynssl.exe 1268 npdynssl.exe 3416 mnatztjpilqaw.exe 3416 mnatztjpilqaw.exe 3416 mnatztjpilqaw.exe 4936 npdynssl.exe 4936 npdynssl.exe 4936 npdynssl.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 4912 WINWORD.EXE 4912 WINWORD.EXE 4912 WINWORD.EXE 4912 WINWORD.EXE 4912 WINWORD.EXE 4912 WINWORD.EXE 4912 WINWORD.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 852 wrote to memory of 2432 852 045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe 80 PID 852 wrote to memory of 2432 852 045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe 80 PID 852 wrote to memory of 2432 852 045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe 80 PID 852 wrote to memory of 4088 852 045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe 81 PID 852 wrote to memory of 4088 852 045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe 81 PID 852 wrote to memory of 4088 852 045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe 81 PID 852 wrote to memory of 1268 852 045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe 82 PID 852 wrote to memory of 1268 852 045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe 82 PID 852 wrote to memory of 1268 852 045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe 82 PID 852 wrote to memory of 3416 852 045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe 83 PID 852 wrote to memory of 3416 852 045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe 83 PID 852 wrote to memory of 3416 852 045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe 83 PID 2432 wrote to memory of 4936 2432 lgvklbaqwa.exe 84 PID 2432 wrote to memory of 4936 2432 lgvklbaqwa.exe 84 PID 2432 wrote to memory of 4936 2432 lgvklbaqwa.exe 84 PID 852 wrote to memory of 4912 852 045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe 85 PID 852 wrote to memory of 4912 852 045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe"C:\Users\Admin\AppData\Local\Temp\045ffe688ea2a65ddec136151f868445a7f6e97f7515101031e723be556c15ad.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Windows\SysWOW64\lgvklbaqwa.exelgvklbaqwa.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\SysWOW64\npdynssl.exeC:\Windows\system32\npdynssl.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4936
-
-
-
C:\Windows\SysWOW64\anmwgslhddceean.exeanmwgslhddceean.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4088
-
-
C:\Windows\SysWOW64\npdynssl.exenpdynssl.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1268
-
-
C:\Windows\SysWOW64\mnatztjpilqaw.exemnatztjpilqaw.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3416
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4912
-
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Disabling Security Tools
2Hidden Files and Directories
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
256KB
MD5b26b5fa4c66b8c029b80c62221ba4e2d
SHA1401ebb3f13ce1ae8d5d96938eb52faf437269a0f
SHA256ccfe18d49711df70320778b013716433e0d9ccdecab6805da83d041c4d53fe50
SHA51239b17a9729543410b75c48cf949c1b926e986e77b3aba3f5d71670a707ea35c0e5fa01e94f086a39312531098b0195a2167829a1892781e1ec57fffe774f6465
-
Filesize
256KB
MD529739dd8f3b357cbb504b072765ef462
SHA109430d29bc136271df2c416db7de861724b4628d
SHA2563ac0e9196a537d352111a766314e1ea2ea25e8834153224787d0aa6d257d9a18
SHA5125161573038f73ba506c7589cc1163bd674b21b19319a62c6558d01bb8ec8d218fe9c0701bc2c608553722cfa064cbec230991b8474a9c94eaa5bb7e6b89ab756
-
Filesize
256KB
MD529739dd8f3b357cbb504b072765ef462
SHA109430d29bc136271df2c416db7de861724b4628d
SHA2563ac0e9196a537d352111a766314e1ea2ea25e8834153224787d0aa6d257d9a18
SHA5125161573038f73ba506c7589cc1163bd674b21b19319a62c6558d01bb8ec8d218fe9c0701bc2c608553722cfa064cbec230991b8474a9c94eaa5bb7e6b89ab756
-
Filesize
256KB
MD581472b4ddf1c52699a0ff7cc7ae3df2b
SHA134806c31bb59c3d40166719632583efbbf228b5f
SHA2563e0ad4b5bf44d1ea23ceac1a91da47775e374923765ea7421cdf2065631d06ca
SHA5126cd0d47f710b128f84da8e2b9d558700150a1cb5a2c6cd4df3e5bbae8a43356a3a4b3f9c9f7c941e6d6d00f0a4a2ca1a40b5f72a579e0b1a78ef1e9afc1158dd
-
Filesize
256KB
MD581472b4ddf1c52699a0ff7cc7ae3df2b
SHA134806c31bb59c3d40166719632583efbbf228b5f
SHA2563e0ad4b5bf44d1ea23ceac1a91da47775e374923765ea7421cdf2065631d06ca
SHA5126cd0d47f710b128f84da8e2b9d558700150a1cb5a2c6cd4df3e5bbae8a43356a3a4b3f9c9f7c941e6d6d00f0a4a2ca1a40b5f72a579e0b1a78ef1e9afc1158dd
-
Filesize
256KB
MD5cffe0226bb4afa52ed4b5be165bd3cbb
SHA185cabd91bc1e8c7ac881e5d5388ff77bd0f75e82
SHA256c83751fabb1f1e8244cae5bc2087fb1619b1e17f250e1c4cbd9b6c077ae1dc3d
SHA512ef152fcd9257194fdea2f3e5fd4aef49970742153117d65c54dd0e873e2b4d7fad7a4b5a2b01959c13bb37da44aac76c2c860ba18b896cf8f584b50f4d98670b
-
Filesize
256KB
MD5cffe0226bb4afa52ed4b5be165bd3cbb
SHA185cabd91bc1e8c7ac881e5d5388ff77bd0f75e82
SHA256c83751fabb1f1e8244cae5bc2087fb1619b1e17f250e1c4cbd9b6c077ae1dc3d
SHA512ef152fcd9257194fdea2f3e5fd4aef49970742153117d65c54dd0e873e2b4d7fad7a4b5a2b01959c13bb37da44aac76c2c860ba18b896cf8f584b50f4d98670b
-
Filesize
256KB
MD5476aed645dd4cc5b8c0ba352cec58e85
SHA1bd93d7ed7225756a62e9d9642fd64af27dda1f2d
SHA25669922be802f4c3cbb06ca8130b4cb6ac1e13d4480ed055ace22486b741cb9953
SHA512f3ae88d8924a0fc3612e9bc2292c1d1e84229ad736af88b676d2e569dda9dcbe11469b0d992c68922cba53fb956219a52d9c9c7a875bfd8d3b6672967007f733
-
Filesize
256KB
MD5476aed645dd4cc5b8c0ba352cec58e85
SHA1bd93d7ed7225756a62e9d9642fd64af27dda1f2d
SHA25669922be802f4c3cbb06ca8130b4cb6ac1e13d4480ed055ace22486b741cb9953
SHA512f3ae88d8924a0fc3612e9bc2292c1d1e84229ad736af88b676d2e569dda9dcbe11469b0d992c68922cba53fb956219a52d9c9c7a875bfd8d3b6672967007f733
-
Filesize
256KB
MD5476aed645dd4cc5b8c0ba352cec58e85
SHA1bd93d7ed7225756a62e9d9642fd64af27dda1f2d
SHA25669922be802f4c3cbb06ca8130b4cb6ac1e13d4480ed055ace22486b741cb9953
SHA512f3ae88d8924a0fc3612e9bc2292c1d1e84229ad736af88b676d2e569dda9dcbe11469b0d992c68922cba53fb956219a52d9c9c7a875bfd8d3b6672967007f733
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
256KB
MD57f09cb92e3a4aaca929eae02114516df
SHA167ce394ce7c89adac7664a49b1c88c458de3f232
SHA256e72beee1e8ac2d0c5cdb2455b9bb580b26202caf593f74857aa7d3ff32446508
SHA512526c24a1b60772b9c53a0019ec6cc998f1beba7957fd841c1e5d9d049d91fd2ad70d96204e85a7dbf883d1143903e7cad655790d3df1219105ea79c7d10460e8
-
Filesize
256KB
MD57f09cb92e3a4aaca929eae02114516df
SHA167ce394ce7c89adac7664a49b1c88c458de3f232
SHA256e72beee1e8ac2d0c5cdb2455b9bb580b26202caf593f74857aa7d3ff32446508
SHA512526c24a1b60772b9c53a0019ec6cc998f1beba7957fd841c1e5d9d049d91fd2ad70d96204e85a7dbf883d1143903e7cad655790d3df1219105ea79c7d10460e8
-
Filesize
256KB
MD57f09cb92e3a4aaca929eae02114516df
SHA167ce394ce7c89adac7664a49b1c88c458de3f232
SHA256e72beee1e8ac2d0c5cdb2455b9bb580b26202caf593f74857aa7d3ff32446508
SHA512526c24a1b60772b9c53a0019ec6cc998f1beba7957fd841c1e5d9d049d91fd2ad70d96204e85a7dbf883d1143903e7cad655790d3df1219105ea79c7d10460e8
-
Filesize
256KB
MD54b47296679e7870629faf4baf493fd73
SHA1a8df3bb7a3cb7c2641d8e852fe02b3c041ccf943
SHA256f9fa1bf267408099aacf334c3f7d6093e5873e4aae39a46721d6fc7f4a215f7e
SHA5126cf57b349f00cbbfe12391fef032a3580ea22cf42ea8d83613b39e74048be03a6d525209ce2e07bebf634c63b19bd05ea44ff80476d4e5ae9070ea077911f627