Analysis
-
max time kernel
152s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
30-10-2022 21:00
Behavioral task
behavioral1
Sample
5f1f593a6022d0e6e61cf521b2a944efa9255c79e26d67c6723d31c6f9886837.exe
Resource
win7-20220901-en
windows7-x64
26 signatures
150 seconds
General
-
Target
5f1f593a6022d0e6e61cf521b2a944efa9255c79e26d67c6723d31c6f9886837.exe
-
Size
255KB
-
MD5
a17c4d5605e703cd930fffe4a41b7c40
-
SHA1
5dd0163c2073b69e92db26310d563fb82c932160
-
SHA256
5f1f593a6022d0e6e61cf521b2a944efa9255c79e26d67c6723d31c6f9886837
-
SHA512
3f37372e7303d44346ecd2ad54ac27eb569df15ca7e9bc266ff7c457602f1b6bd93ee7637e51ac9d47b3310d680d6c840241ac77424ebc97e21d7ed4035085ac
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJm:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIB
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" tijzyjajae.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" tijzyjajae.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" tijzyjajae.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" tijzyjajae.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" tijzyjajae.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" tijzyjajae.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" tijzyjajae.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" tijzyjajae.exe -
Executes dropped EXE 5 IoCs
pid Process 4844 tijzyjajae.exe 4800 kalcmoxaohkofkf.exe 2948 cpzswpcq.exe 2868 fmydisepscbon.exe 4544 cpzswpcq.exe -
resource yara_rule behavioral2/memory/1848-132-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x0003000000022d9f-134.dat upx behavioral2/files/0x0003000000022d9f-135.dat upx behavioral2/memory/4844-136-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x0002000000022da5-138.dat upx behavioral2/memory/4800-140-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x0002000000022da5-139.dat upx behavioral2/files/0x0002000000022da6-142.dat upx behavioral2/files/0x0002000000022da6-143.dat upx behavioral2/files/0x0004000000022dc1-145.dat upx behavioral2/files/0x0004000000022dc1-146.dat upx behavioral2/files/0x0002000000022da6-148.dat upx behavioral2/memory/2948-149-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2868-150-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4544-151-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1848-153-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x0002000000022dc6-160.dat upx behavioral2/files/0x0002000000022dc5-159.dat upx behavioral2/memory/4844-164-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4800-165-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2948-166-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2868-167-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4544-168-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x000500000001da0b-169.dat upx behavioral2/files/0x000500000001da0b-171.dat upx behavioral2/files/0x000500000001da0b-170.dat upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 5f1f593a6022d0e6e61cf521b2a944efa9255c79e26d67c6723d31c6f9886837.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" tijzyjajae.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" tijzyjajae.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" tijzyjajae.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" tijzyjajae.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" tijzyjajae.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" tijzyjajae.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run kalcmoxaohkofkf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\lzbvvcto = "tijzyjajae.exe" kalcmoxaohkofkf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\btavrliu = "kalcmoxaohkofkf.exe" kalcmoxaohkofkf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "fmydisepscbon.exe" kalcmoxaohkofkf.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\r: cpzswpcq.exe File opened (read-only) \??\v: tijzyjajae.exe File opened (read-only) \??\e: cpzswpcq.exe File opened (read-only) \??\m: cpzswpcq.exe File opened (read-only) \??\b: tijzyjajae.exe File opened (read-only) \??\l: cpzswpcq.exe File opened (read-only) \??\j: cpzswpcq.exe File opened (read-only) \??\e: cpzswpcq.exe File opened (read-only) \??\l: cpzswpcq.exe File opened (read-only) \??\h: cpzswpcq.exe File opened (read-only) \??\v: cpzswpcq.exe File opened (read-only) \??\w: cpzswpcq.exe File opened (read-only) \??\w: tijzyjajae.exe File opened (read-only) \??\b: cpzswpcq.exe File opened (read-only) \??\g: cpzswpcq.exe File opened (read-only) \??\q: tijzyjajae.exe File opened (read-only) \??\f: cpzswpcq.exe File opened (read-only) \??\h: cpzswpcq.exe File opened (read-only) \??\o: cpzswpcq.exe File opened (read-only) \??\w: cpzswpcq.exe File opened (read-only) \??\e: tijzyjajae.exe File opened (read-only) \??\m: tijzyjajae.exe File opened (read-only) \??\n: tijzyjajae.exe File opened (read-only) \??\m: cpzswpcq.exe File opened (read-only) \??\u: cpzswpcq.exe File opened (read-only) \??\g: tijzyjajae.exe File opened (read-only) \??\o: tijzyjajae.exe File opened (read-only) \??\k: cpzswpcq.exe File opened (read-only) \??\b: cpzswpcq.exe File opened (read-only) \??\o: cpzswpcq.exe File opened (read-only) \??\u: tijzyjajae.exe File opened (read-only) \??\x: tijzyjajae.exe File opened (read-only) \??\r: cpzswpcq.exe File opened (read-only) \??\p: tijzyjajae.exe File opened (read-only) \??\r: tijzyjajae.exe File opened (read-only) \??\g: cpzswpcq.exe File opened (read-only) \??\u: cpzswpcq.exe File opened (read-only) \??\y: cpzswpcq.exe File opened (read-only) \??\a: cpzswpcq.exe File opened (read-only) \??\a: tijzyjajae.exe File opened (read-only) \??\y: tijzyjajae.exe File opened (read-only) \??\n: cpzswpcq.exe File opened (read-only) \??\s: tijzyjajae.exe File opened (read-only) \??\n: cpzswpcq.exe File opened (read-only) \??\t: cpzswpcq.exe File opened (read-only) \??\f: tijzyjajae.exe File opened (read-only) \??\i: tijzyjajae.exe File opened (read-only) \??\l: tijzyjajae.exe File opened (read-only) \??\j: cpzswpcq.exe File opened (read-only) \??\q: cpzswpcq.exe File opened (read-only) \??\x: cpzswpcq.exe File opened (read-only) \??\k: cpzswpcq.exe File opened (read-only) \??\q: cpzswpcq.exe File opened (read-only) \??\p: cpzswpcq.exe File opened (read-only) \??\h: tijzyjajae.exe File opened (read-only) \??\t: tijzyjajae.exe File opened (read-only) \??\i: cpzswpcq.exe File opened (read-only) \??\a: cpzswpcq.exe File opened (read-only) \??\z: cpzswpcq.exe File opened (read-only) \??\f: cpzswpcq.exe File opened (read-only) \??\p: cpzswpcq.exe File opened (read-only) \??\y: cpzswpcq.exe File opened (read-only) \??\s: cpzswpcq.exe File opened (read-only) \??\x: cpzswpcq.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" tijzyjajae.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" tijzyjajae.exe -
AutoIT Executable 11 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/4844-136-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4800-140-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2948-149-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2868-150-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4544-151-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1848-153-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4844-164-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4800-165-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2948-166-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2868-167-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4544-168-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe -
Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\tijzyjajae.exe 5f1f593a6022d0e6e61cf521b2a944efa9255c79e26d67c6723d31c6f9886837.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll tijzyjajae.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe cpzswpcq.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe cpzswpcq.exe File created C:\Windows\SysWOW64\tijzyjajae.exe 5f1f593a6022d0e6e61cf521b2a944efa9255c79e26d67c6723d31c6f9886837.exe File created C:\Windows\SysWOW64\kalcmoxaohkofkf.exe 5f1f593a6022d0e6e61cf521b2a944efa9255c79e26d67c6723d31c6f9886837.exe File opened for modification C:\Windows\SysWOW64\kalcmoxaohkofkf.exe 5f1f593a6022d0e6e61cf521b2a944efa9255c79e26d67c6723d31c6f9886837.exe File created C:\Windows\SysWOW64\cpzswpcq.exe 5f1f593a6022d0e6e61cf521b2a944efa9255c79e26d67c6723d31c6f9886837.exe File opened for modification C:\Windows\SysWOW64\cpzswpcq.exe 5f1f593a6022d0e6e61cf521b2a944efa9255c79e26d67c6723d31c6f9886837.exe File created C:\Windows\SysWOW64\fmydisepscbon.exe 5f1f593a6022d0e6e61cf521b2a944efa9255c79e26d67c6723d31c6f9886837.exe File opened for modification C:\Windows\SysWOW64\fmydisepscbon.exe 5f1f593a6022d0e6e61cf521b2a944efa9255c79e26d67c6723d31c6f9886837.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe cpzswpcq.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe cpzswpcq.exe -
Drops file in Program Files directory 14 IoCs
description ioc Process File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe cpzswpcq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal cpzswpcq.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe cpzswpcq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal cpzswpcq.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe cpzswpcq.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe cpzswpcq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe cpzswpcq.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe cpzswpcq.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe cpzswpcq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal cpzswpcq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe cpzswpcq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal cpzswpcq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe cpzswpcq.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe cpzswpcq.exe -
Drops file in Windows directory 11 IoCs
description ioc Process File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe cpzswpcq.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe cpzswpcq.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe cpzswpcq.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe cpzswpcq.exe File opened for modification C:\Windows\mydoc.rtf 5f1f593a6022d0e6e61cf521b2a944efa9255c79e26d67c6723d31c6f9886837.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.1_none_c3bc3dbd94da3c61\MsoIrmProtector.doc.exe cpzswpcq.exe File created \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe cpzswpcq.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe cpzswpcq.exe File opened for modification \??\c:\Windows\WinSxS\amd64_microsoft-windows-r..t-office-protectors_31bf3856ad364e35_10.0.19041.746_none_ebc47b06544bfaab\MsoIrmProtector.doc.exe cpzswpcq.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7E8CFF8A4F29856E9131D65D7D90BC94E631594467456331D79A" 5f1f593a6022d0e6e61cf521b2a944efa9255c79e26d67c6723d31c6f9886837.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7FD68C6FE6622DED109D0D48B7D9165" 5f1f593a6022d0e6e61cf521b2a944efa9255c79e26d67c6723d31c6f9886837.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1839C77515E3DBC4B9BD7CE8ED9737CC" 5f1f593a6022d0e6e61cf521b2a944efa9255c79e26d67c6723d31c6f9886837.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" tijzyjajae.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh tijzyjajae.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" tijzyjajae.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" tijzyjajae.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg tijzyjajae.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" tijzyjajae.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings 5f1f593a6022d0e6e61cf521b2a944efa9255c79e26d67c6723d31c6f9886837.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32472C089C2382556D3576A170272CAD7D8F64DC" 5f1f593a6022d0e6e61cf521b2a944efa9255c79e26d67c6723d31c6f9886837.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FB1B02A44E4389A52C9B9D232EFD4BC" 5f1f593a6022d0e6e61cf521b2a944efa9255c79e26d67c6723d31c6f9886837.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat tijzyjajae.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" tijzyjajae.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf tijzyjajae.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs tijzyjajae.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 5f1f593a6022d0e6e61cf521b2a944efa9255c79e26d67c6723d31c6f9886837.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6ABEFACCF961F1E3837D3B3781EC3990B08002FC43630349E1C842EB08D3" 5f1f593a6022d0e6e61cf521b2a944efa9255c79e26d67c6723d31c6f9886837.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" tijzyjajae.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc tijzyjajae.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 2724 WINWORD.EXE 2724 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1848 5f1f593a6022d0e6e61cf521b2a944efa9255c79e26d67c6723d31c6f9886837.exe 1848 5f1f593a6022d0e6e61cf521b2a944efa9255c79e26d67c6723d31c6f9886837.exe 1848 5f1f593a6022d0e6e61cf521b2a944efa9255c79e26d67c6723d31c6f9886837.exe 1848 5f1f593a6022d0e6e61cf521b2a944efa9255c79e26d67c6723d31c6f9886837.exe 1848 5f1f593a6022d0e6e61cf521b2a944efa9255c79e26d67c6723d31c6f9886837.exe 1848 5f1f593a6022d0e6e61cf521b2a944efa9255c79e26d67c6723d31c6f9886837.exe 1848 5f1f593a6022d0e6e61cf521b2a944efa9255c79e26d67c6723d31c6f9886837.exe 1848 5f1f593a6022d0e6e61cf521b2a944efa9255c79e26d67c6723d31c6f9886837.exe 1848 5f1f593a6022d0e6e61cf521b2a944efa9255c79e26d67c6723d31c6f9886837.exe 1848 5f1f593a6022d0e6e61cf521b2a944efa9255c79e26d67c6723d31c6f9886837.exe 1848 5f1f593a6022d0e6e61cf521b2a944efa9255c79e26d67c6723d31c6f9886837.exe 1848 5f1f593a6022d0e6e61cf521b2a944efa9255c79e26d67c6723d31c6f9886837.exe 1848 5f1f593a6022d0e6e61cf521b2a944efa9255c79e26d67c6723d31c6f9886837.exe 1848 5f1f593a6022d0e6e61cf521b2a944efa9255c79e26d67c6723d31c6f9886837.exe 4844 tijzyjajae.exe 4844 tijzyjajae.exe 4844 tijzyjajae.exe 4844 tijzyjajae.exe 4844 tijzyjajae.exe 4844 tijzyjajae.exe 4844 tijzyjajae.exe 4844 tijzyjajae.exe 4844 tijzyjajae.exe 4844 tijzyjajae.exe 1848 5f1f593a6022d0e6e61cf521b2a944efa9255c79e26d67c6723d31c6f9886837.exe 1848 5f1f593a6022d0e6e61cf521b2a944efa9255c79e26d67c6723d31c6f9886837.exe 4800 kalcmoxaohkofkf.exe 4800 kalcmoxaohkofkf.exe 4800 kalcmoxaohkofkf.exe 4800 kalcmoxaohkofkf.exe 4800 kalcmoxaohkofkf.exe 4800 kalcmoxaohkofkf.exe 4800 kalcmoxaohkofkf.exe 4800 kalcmoxaohkofkf.exe 4800 kalcmoxaohkofkf.exe 4800 kalcmoxaohkofkf.exe 2948 cpzswpcq.exe 2948 cpzswpcq.exe 2948 cpzswpcq.exe 2948 cpzswpcq.exe 2948 cpzswpcq.exe 2948 cpzswpcq.exe 2948 cpzswpcq.exe 2948 cpzswpcq.exe 2868 fmydisepscbon.exe 2868 fmydisepscbon.exe 2868 fmydisepscbon.exe 2868 fmydisepscbon.exe 2868 fmydisepscbon.exe 2868 fmydisepscbon.exe 2868 fmydisepscbon.exe 2868 fmydisepscbon.exe 2868 fmydisepscbon.exe 2868 fmydisepscbon.exe 2868 fmydisepscbon.exe 2868 fmydisepscbon.exe 4544 cpzswpcq.exe 4544 cpzswpcq.exe 4544 cpzswpcq.exe 4544 cpzswpcq.exe 4544 cpzswpcq.exe 4544 cpzswpcq.exe 4544 cpzswpcq.exe 4544 cpzswpcq.exe -
Suspicious use of FindShellTrayWindow 19 IoCs
pid Process 1848 5f1f593a6022d0e6e61cf521b2a944efa9255c79e26d67c6723d31c6f9886837.exe 1848 5f1f593a6022d0e6e61cf521b2a944efa9255c79e26d67c6723d31c6f9886837.exe 1848 5f1f593a6022d0e6e61cf521b2a944efa9255c79e26d67c6723d31c6f9886837.exe 4844 tijzyjajae.exe 4844 tijzyjajae.exe 4844 tijzyjajae.exe 4844 tijzyjajae.exe 4800 kalcmoxaohkofkf.exe 4800 kalcmoxaohkofkf.exe 4800 kalcmoxaohkofkf.exe 2948 cpzswpcq.exe 2948 cpzswpcq.exe 2948 cpzswpcq.exe 2868 fmydisepscbon.exe 2868 fmydisepscbon.exe 2868 fmydisepscbon.exe 4544 cpzswpcq.exe 4544 cpzswpcq.exe 4544 cpzswpcq.exe -
Suspicious use of SendNotifyMessage 19 IoCs
pid Process 1848 5f1f593a6022d0e6e61cf521b2a944efa9255c79e26d67c6723d31c6f9886837.exe 1848 5f1f593a6022d0e6e61cf521b2a944efa9255c79e26d67c6723d31c6f9886837.exe 1848 5f1f593a6022d0e6e61cf521b2a944efa9255c79e26d67c6723d31c6f9886837.exe 4844 tijzyjajae.exe 4844 tijzyjajae.exe 4844 tijzyjajae.exe 4844 tijzyjajae.exe 4800 kalcmoxaohkofkf.exe 4800 kalcmoxaohkofkf.exe 4800 kalcmoxaohkofkf.exe 2948 cpzswpcq.exe 2948 cpzswpcq.exe 2948 cpzswpcq.exe 2868 fmydisepscbon.exe 2868 fmydisepscbon.exe 2868 fmydisepscbon.exe 4544 cpzswpcq.exe 4544 cpzswpcq.exe 4544 cpzswpcq.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 2724 WINWORD.EXE 2724 WINWORD.EXE 2724 WINWORD.EXE 2724 WINWORD.EXE 2724 WINWORD.EXE 2724 WINWORD.EXE 2724 WINWORD.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1848 wrote to memory of 4844 1848 5f1f593a6022d0e6e61cf521b2a944efa9255c79e26d67c6723d31c6f9886837.exe 80 PID 1848 wrote to memory of 4844 1848 5f1f593a6022d0e6e61cf521b2a944efa9255c79e26d67c6723d31c6f9886837.exe 80 PID 1848 wrote to memory of 4844 1848 5f1f593a6022d0e6e61cf521b2a944efa9255c79e26d67c6723d31c6f9886837.exe 80 PID 1848 wrote to memory of 4800 1848 5f1f593a6022d0e6e61cf521b2a944efa9255c79e26d67c6723d31c6f9886837.exe 81 PID 1848 wrote to memory of 4800 1848 5f1f593a6022d0e6e61cf521b2a944efa9255c79e26d67c6723d31c6f9886837.exe 81 PID 1848 wrote to memory of 4800 1848 5f1f593a6022d0e6e61cf521b2a944efa9255c79e26d67c6723d31c6f9886837.exe 81 PID 1848 wrote to memory of 2948 1848 5f1f593a6022d0e6e61cf521b2a944efa9255c79e26d67c6723d31c6f9886837.exe 82 PID 1848 wrote to memory of 2948 1848 5f1f593a6022d0e6e61cf521b2a944efa9255c79e26d67c6723d31c6f9886837.exe 82 PID 1848 wrote to memory of 2948 1848 5f1f593a6022d0e6e61cf521b2a944efa9255c79e26d67c6723d31c6f9886837.exe 82 PID 1848 wrote to memory of 2868 1848 5f1f593a6022d0e6e61cf521b2a944efa9255c79e26d67c6723d31c6f9886837.exe 83 PID 1848 wrote to memory of 2868 1848 5f1f593a6022d0e6e61cf521b2a944efa9255c79e26d67c6723d31c6f9886837.exe 83 PID 1848 wrote to memory of 2868 1848 5f1f593a6022d0e6e61cf521b2a944efa9255c79e26d67c6723d31c6f9886837.exe 83 PID 4844 wrote to memory of 4544 4844 tijzyjajae.exe 84 PID 4844 wrote to memory of 4544 4844 tijzyjajae.exe 84 PID 4844 wrote to memory of 4544 4844 tijzyjajae.exe 84 PID 1848 wrote to memory of 2724 1848 5f1f593a6022d0e6e61cf521b2a944efa9255c79e26d67c6723d31c6f9886837.exe 85 PID 1848 wrote to memory of 2724 1848 5f1f593a6022d0e6e61cf521b2a944efa9255c79e26d67c6723d31c6f9886837.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f1f593a6022d0e6e61cf521b2a944efa9255c79e26d67c6723d31c6f9886837.exe"C:\Users\Admin\AppData\Local\Temp\5f1f593a6022d0e6e61cf521b2a944efa9255c79e26d67c6723d31c6f9886837.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Windows\SysWOW64\tijzyjajae.exetijzyjajae.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4844 -
C:\Windows\SysWOW64\cpzswpcq.exeC:\Windows\system32\cpzswpcq.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4544
-
-
-
C:\Windows\SysWOW64\kalcmoxaohkofkf.exekalcmoxaohkofkf.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4800
-
-
C:\Windows\SysWOW64\cpzswpcq.execpzswpcq.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2948
-
-
C:\Windows\SysWOW64\fmydisepscbon.exefmydisepscbon.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2868
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2724
-
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Disabling Security Tools
2Hidden Files and Directories
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
255KB
MD5575cb3f3b3f03b6ff26f039850599a75
SHA1e5d02dd1dda6f6d0104f50218023fe1810b71d3f
SHA256aab73fd1c1690650aa328a2c477e23091c11132336dee9ca76b0ce677e503c5b
SHA51268551b286ce0a075e39785712786b1b7ba5711ba9c0f880e6b9e512fa38a3c7104320502ba26d46ab6ea06add5419ca95572c51e26b583d35eae04397e7849d9
-
Filesize
255KB
MD51849fd7569e52d45c4e877a92edb22d9
SHA134568800822e226a9430d337769f97691aabb74b
SHA256826ef5481777f997e94d28adccae9c6e8f34820f54b022ebc7375f6e13ef5727
SHA5122f1cb5adbb7e6a8730bf9531d777c2bd8c880be9ee0a9331ec35565cc84774391c785b623f416d85d494c1c3dde5bed4de665a3bc9bd105b74322c0a17e3cef6
-
Filesize
255KB
MD5cb89729b1c715dd52336f133f64468ff
SHA1f5279139dffe056d157aaa26fc81f0348d87b164
SHA256dddb84f380ad0c582014a7d9beb9d72cc8f0a502d1a64124d497a61cde80dbd3
SHA512d206c4cda798fc28e9d2975fe1cf5361ecfc80172bf32ae68976ff1ab1b0b85c7618e6101295e119226a97b2863a26e78b48ee6b693aa8827ccb51ca193ba726
-
Filesize
255KB
MD5cb89729b1c715dd52336f133f64468ff
SHA1f5279139dffe056d157aaa26fc81f0348d87b164
SHA256dddb84f380ad0c582014a7d9beb9d72cc8f0a502d1a64124d497a61cde80dbd3
SHA512d206c4cda798fc28e9d2975fe1cf5361ecfc80172bf32ae68976ff1ab1b0b85c7618e6101295e119226a97b2863a26e78b48ee6b693aa8827ccb51ca193ba726
-
Filesize
255KB
MD5cb89729b1c715dd52336f133f64468ff
SHA1f5279139dffe056d157aaa26fc81f0348d87b164
SHA256dddb84f380ad0c582014a7d9beb9d72cc8f0a502d1a64124d497a61cde80dbd3
SHA512d206c4cda798fc28e9d2975fe1cf5361ecfc80172bf32ae68976ff1ab1b0b85c7618e6101295e119226a97b2863a26e78b48ee6b693aa8827ccb51ca193ba726
-
Filesize
255KB
MD50e35fa3159c33cc4b5d00fbf65c105a1
SHA15a0fcc258db459202081e7c54f9f6fe23be895e6
SHA2560d1d8096bc4af94b0a57ef0878d5f0b5d308c106816547e6ec3d0f75056c715a
SHA5127540c3ff5d56eefb262c42082f738db6d9df399b36fb9840cf501ee4004215cc06941df5ac1ab9e653931712399c76b23864f797bf608509ff446e1117dc48af
-
Filesize
255KB
MD50e35fa3159c33cc4b5d00fbf65c105a1
SHA15a0fcc258db459202081e7c54f9f6fe23be895e6
SHA2560d1d8096bc4af94b0a57ef0878d5f0b5d308c106816547e6ec3d0f75056c715a
SHA5127540c3ff5d56eefb262c42082f738db6d9df399b36fb9840cf501ee4004215cc06941df5ac1ab9e653931712399c76b23864f797bf608509ff446e1117dc48af
-
Filesize
255KB
MD5b4e018c0a5b1ded4f690e74a6e76b64c
SHA18cdc7fe9012311d5ea0e662925c757352f40feba
SHA25662408ff8e891c3479cd549b9555ee452aa5576bbf941665a24950d97b61a14d9
SHA5128a0eaf9e49aeb7b3ab4e2b1bf7e4dd6936e285a2e3650762aded5914d4c5f4b98a3e55ca5435b38d645450f73a684d70d2d9a13fb9707cf0378fb837381ab070
-
Filesize
255KB
MD5b4e018c0a5b1ded4f690e74a6e76b64c
SHA18cdc7fe9012311d5ea0e662925c757352f40feba
SHA25662408ff8e891c3479cd549b9555ee452aa5576bbf941665a24950d97b61a14d9
SHA5128a0eaf9e49aeb7b3ab4e2b1bf7e4dd6936e285a2e3650762aded5914d4c5f4b98a3e55ca5435b38d645450f73a684d70d2d9a13fb9707cf0378fb837381ab070
-
Filesize
255KB
MD55eb26b8e438d014f91959a8ff2cc224e
SHA15106e2d112ff63cf6804a8ef86152daa3c8704a1
SHA256c591648c8f0db19f7bbba408bc47cbe8a329eab820bcb139454544cbddc0e112
SHA5121fbdafa7401b01f7e5f183405e7ca5160fae516d47885cc2ed678d97fe606b5c8036e50233520e747c1c4cdb9039f3ae249e6b0478de74c5d92d6ec68964de33
-
Filesize
255KB
MD55eb26b8e438d014f91959a8ff2cc224e
SHA15106e2d112ff63cf6804a8ef86152daa3c8704a1
SHA256c591648c8f0db19f7bbba408bc47cbe8a329eab820bcb139454544cbddc0e112
SHA5121fbdafa7401b01f7e5f183405e7ca5160fae516d47885cc2ed678d97fe606b5c8036e50233520e747c1c4cdb9039f3ae249e6b0478de74c5d92d6ec68964de33
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
Filesize
255KB
MD5a463476b888e50b3103df6703c98faac
SHA1660abdfbcd68391f339237a3b867206a6b024ae8
SHA25663801132d8047742507ba65dba149d3f5a8847ae17ee8fb50f0718b1903c0331
SHA5121ac2273f87e0275235560518fe5230390f0a24dbdc6644d877c11a75d3b99978bee268346ab1205f30981955d356ce6b0c0b98571b1bd930317edcf80d2e9a2d
-
Filesize
255KB
MD570a2aa852df616e546f3b9c1a7972a36
SHA11fab3a268548d2f3d7c2e89575f3de17abc97be4
SHA256a2dc92a81efa8b11ce2770a03b5f1485376258b2a3121e7fa7f75e1523d0d7d6
SHA512ed20763c4afc5e374ed78a5252934fe91a096f6e2aacf2c0ef4f024d4283c13ef420626db5e484fa7aeca9359f854711fb212a45aaa625177c9d23079fd653ff
-
Filesize
255KB
MD570a2aa852df616e546f3b9c1a7972a36
SHA11fab3a268548d2f3d7c2e89575f3de17abc97be4
SHA256a2dc92a81efa8b11ce2770a03b5f1485376258b2a3121e7fa7f75e1523d0d7d6
SHA512ed20763c4afc5e374ed78a5252934fe91a096f6e2aacf2c0ef4f024d4283c13ef420626db5e484fa7aeca9359f854711fb212a45aaa625177c9d23079fd653ff