Analysis
-
max time kernel
156s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06/11/2022, 16:07
Behavioral task
behavioral1
Sample
8c8f0dac5b4b18f8004c348b3e76199be88367c31e28cffcf13e41885f88bf56.exe
Resource
win7-20220812-en
windows7-x64
26 signatures
150 seconds
General
-
Target
8c8f0dac5b4b18f8004c348b3e76199be88367c31e28cffcf13e41885f88bf56.exe
-
Size
256KB
-
MD5
044d5ca7daafeca66ac936cf582f1ab0
-
SHA1
cc219e015dad31d9bc1f4b9cc9f5f778233feb27
-
SHA256
8c8f0dac5b4b18f8004c348b3e76199be88367c31e28cffcf13e41885f88bf56
-
SHA512
1cd579c8521845c83c35645f49e971cdf6b7577367a700dd6a0f8983f8b18e63aee8a001c7837759bc1695a395a0777ef8ce811cc89a1a824c85203114c85e79
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJz:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIA
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" pmnzmbqtrn.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" pmnzmbqtrn.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" pmnzmbqtrn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" pmnzmbqtrn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" pmnzmbqtrn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" pmnzmbqtrn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" pmnzmbqtrn.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" pmnzmbqtrn.exe -
Executes dropped EXE 5 IoCs
pid Process 3208 pmnzmbqtrn.exe 820 jdabzoxdbtufhav.exe 5084 adglqpaw.exe 4292 xkiscybwgaspv.exe 4900 adglqpaw.exe -
resource yara_rule behavioral2/memory/660-132-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x0008000000022e13-134.dat upx behavioral2/files/0x0008000000022e13-135.dat upx behavioral2/files/0x0006000000022e18-137.dat upx behavioral2/files/0x0006000000022e18-138.dat upx behavioral2/files/0x0006000000022e19-141.dat upx behavioral2/files/0x0006000000022e19-140.dat upx behavioral2/files/0x0006000000022e1a-144.dat upx behavioral2/files/0x0006000000022e1a-143.dat upx behavioral2/memory/3208-145-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/820-146-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/5084-147-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4292-148-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x0006000000022e19-150.dat upx behavioral2/memory/660-152-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4900-153-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x0006000000022e1d-160.dat upx behavioral2/files/0x0006000000022e1c-159.dat upx behavioral2/memory/3208-162-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/820-163-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/5084-164-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4292-165-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4900-166-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/files/0x000200000001e6bb-169.dat upx behavioral2/files/0x000200000001e6bc-170.dat upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 8c8f0dac5b4b18f8004c348b3e76199be88367c31e28cffcf13e41885f88bf56.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" pmnzmbqtrn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" pmnzmbqtrn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" pmnzmbqtrn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" pmnzmbqtrn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" pmnzmbqtrn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" pmnzmbqtrn.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run jdabzoxdbtufhav.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\xuoyksma = "pmnzmbqtrn.exe" jdabzoxdbtufhav.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\hdgatcry = "jdabzoxdbtufhav.exe" jdabzoxdbtufhav.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "xkiscybwgaspv.exe" jdabzoxdbtufhav.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\j: adglqpaw.exe File opened (read-only) \??\z: adglqpaw.exe File opened (read-only) \??\p: adglqpaw.exe File opened (read-only) \??\y: adglqpaw.exe File opened (read-only) \??\e: adglqpaw.exe File opened (read-only) \??\q: adglqpaw.exe File opened (read-only) \??\t: adglqpaw.exe File opened (read-only) \??\j: pmnzmbqtrn.exe File opened (read-only) \??\o: adglqpaw.exe File opened (read-only) \??\u: adglqpaw.exe File opened (read-only) \??\u: adglqpaw.exe File opened (read-only) \??\a: adglqpaw.exe File opened (read-only) \??\n: pmnzmbqtrn.exe File opened (read-only) \??\s: pmnzmbqtrn.exe File opened (read-only) \??\s: adglqpaw.exe File opened (read-only) \??\v: adglqpaw.exe File opened (read-only) \??\l: pmnzmbqtrn.exe File opened (read-only) \??\m: adglqpaw.exe File opened (read-only) \??\w: adglqpaw.exe File opened (read-only) \??\q: pmnzmbqtrn.exe File opened (read-only) \??\t: adglqpaw.exe File opened (read-only) \??\v: adglqpaw.exe File opened (read-only) \??\f: adglqpaw.exe File opened (read-only) \??\l: adglqpaw.exe File opened (read-only) \??\b: adglqpaw.exe File opened (read-only) \??\o: adglqpaw.exe File opened (read-only) \??\p: adglqpaw.exe File opened (read-only) \??\b: pmnzmbqtrn.exe File opened (read-only) \??\z: pmnzmbqtrn.exe File opened (read-only) \??\m: adglqpaw.exe File opened (read-only) \??\y: adglqpaw.exe File opened (read-only) \??\v: pmnzmbqtrn.exe File opened (read-only) \??\j: adglqpaw.exe File opened (read-only) \??\a: pmnzmbqtrn.exe File opened (read-only) \??\g: pmnzmbqtrn.exe File opened (read-only) \??\p: pmnzmbqtrn.exe File opened (read-only) \??\n: adglqpaw.exe File opened (read-only) \??\l: adglqpaw.exe File opened (read-only) \??\k: pmnzmbqtrn.exe File opened (read-only) \??\r: pmnzmbqtrn.exe File opened (read-only) \??\e: adglqpaw.exe File opened (read-only) \??\i: adglqpaw.exe File opened (read-only) \??\g: adglqpaw.exe File opened (read-only) \??\h: pmnzmbqtrn.exe File opened (read-only) \??\i: pmnzmbqtrn.exe File opened (read-only) \??\u: pmnzmbqtrn.exe File opened (read-only) \??\k: adglqpaw.exe File opened (read-only) \??\t: pmnzmbqtrn.exe File opened (read-only) \??\w: pmnzmbqtrn.exe File opened (read-only) \??\q: adglqpaw.exe File opened (read-only) \??\s: adglqpaw.exe File opened (read-only) \??\x: adglqpaw.exe File opened (read-only) \??\m: pmnzmbqtrn.exe File opened (read-only) \??\b: adglqpaw.exe File opened (read-only) \??\g: adglqpaw.exe File opened (read-only) \??\h: adglqpaw.exe File opened (read-only) \??\x: adglqpaw.exe File opened (read-only) \??\n: adglqpaw.exe File opened (read-only) \??\e: pmnzmbqtrn.exe File opened (read-only) \??\x: pmnzmbqtrn.exe File opened (read-only) \??\y: pmnzmbqtrn.exe File opened (read-only) \??\k: adglqpaw.exe File opened (read-only) \??\i: adglqpaw.exe File opened (read-only) \??\f: pmnzmbqtrn.exe -
Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" pmnzmbqtrn.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" pmnzmbqtrn.exe -
AutoIT Executable 12 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/660-132-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3208-145-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/820-146-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/5084-147-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4292-148-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/660-152-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4900-153-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3208-162-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/820-163-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/5084-164-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4292-165-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4900-166-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe -
Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\msvbvm60.dll pmnzmbqtrn.exe File opened for modification C:\Windows\SysWOW64\pmnzmbqtrn.exe 8c8f0dac5b4b18f8004c348b3e76199be88367c31e28cffcf13e41885f88bf56.exe File created C:\Windows\SysWOW64\adglqpaw.exe 8c8f0dac5b4b18f8004c348b3e76199be88367c31e28cffcf13e41885f88bf56.exe File created C:\Windows\SysWOW64\xkiscybwgaspv.exe 8c8f0dac5b4b18f8004c348b3e76199be88367c31e28cffcf13e41885f88bf56.exe File opened for modification C:\Windows\SysWOW64\adglqpaw.exe 8c8f0dac5b4b18f8004c348b3e76199be88367c31e28cffcf13e41885f88bf56.exe File opened for modification C:\Windows\SysWOW64\xkiscybwgaspv.exe 8c8f0dac5b4b18f8004c348b3e76199be88367c31e28cffcf13e41885f88bf56.exe File created C:\Windows\SysWOW64\pmnzmbqtrn.exe 8c8f0dac5b4b18f8004c348b3e76199be88367c31e28cffcf13e41885f88bf56.exe File created C:\Windows\SysWOW64\jdabzoxdbtufhav.exe 8c8f0dac5b4b18f8004c348b3e76199be88367c31e28cffcf13e41885f88bf56.exe File opened for modification C:\Windows\SysWOW64\jdabzoxdbtufhav.exe 8c8f0dac5b4b18f8004c348b3e76199be88367c31e28cffcf13e41885f88bf56.exe -
Drops file in Program Files directory 15 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal adglqpaw.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe adglqpaw.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe adglqpaw.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe adglqpaw.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe adglqpaw.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal adglqpaw.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal adglqpaw.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe adglqpaw.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe adglqpaw.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal adglqpaw.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe adglqpaw.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe adglqpaw.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe adglqpaw.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe adglqpaw.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe adglqpaw.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\mydoc.rtf 8c8f0dac5b4b18f8004c348b3e76199be88367c31e28cffcf13e41885f88bf56.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Modifies registry class 20 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" pmnzmbqtrn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" pmnzmbqtrn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat pmnzmbqtrn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh pmnzmbqtrn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs pmnzmbqtrn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" pmnzmbqtrn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "32432C0C9C2782556A3176D277272DDA7CF564D7" 8c8f0dac5b4b18f8004c348b3e76199be88367c31e28cffcf13e41885f88bf56.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E08668B0FE6B22D1D27BD1D48A74916B" 8c8f0dac5b4b18f8004c348b3e76199be88367c31e28cffcf13e41885f88bf56.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FCAB12E479039EE52CFB9D232EDD4BE" 8c8f0dac5b4b18f8004c348b3e76199be88367c31e28cffcf13e41885f88bf56.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc pmnzmbqtrn.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 8c8f0dac5b4b18f8004c348b3e76199be88367c31e28cffcf13e41885f88bf56.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6ABFFAB0F917F1E0847A3B3781EC3995B08D03F04214033FE1BD429A09D3" 8c8f0dac5b4b18f8004c348b3e76199be88367c31e28cffcf13e41885f88bf56.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" pmnzmbqtrn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" pmnzmbqtrn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf pmnzmbqtrn.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" pmnzmbqtrn.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg pmnzmbqtrn.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings 8c8f0dac5b4b18f8004c348b3e76199be88367c31e28cffcf13e41885f88bf56.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7FF9FF8C482982129142D62E7D97BC95E13559466644623ED6E9" 8c8f0dac5b4b18f8004c348b3e76199be88367c31e28cffcf13e41885f88bf56.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1848C67515E5DAC5B9C07CE7ECE737B9" 8c8f0dac5b4b18f8004c348b3e76199be88367c31e28cffcf13e41885f88bf56.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 1740 WINWORD.EXE 1740 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 660 8c8f0dac5b4b18f8004c348b3e76199be88367c31e28cffcf13e41885f88bf56.exe 660 8c8f0dac5b4b18f8004c348b3e76199be88367c31e28cffcf13e41885f88bf56.exe 660 8c8f0dac5b4b18f8004c348b3e76199be88367c31e28cffcf13e41885f88bf56.exe 660 8c8f0dac5b4b18f8004c348b3e76199be88367c31e28cffcf13e41885f88bf56.exe 660 8c8f0dac5b4b18f8004c348b3e76199be88367c31e28cffcf13e41885f88bf56.exe 660 8c8f0dac5b4b18f8004c348b3e76199be88367c31e28cffcf13e41885f88bf56.exe 660 8c8f0dac5b4b18f8004c348b3e76199be88367c31e28cffcf13e41885f88bf56.exe 660 8c8f0dac5b4b18f8004c348b3e76199be88367c31e28cffcf13e41885f88bf56.exe 660 8c8f0dac5b4b18f8004c348b3e76199be88367c31e28cffcf13e41885f88bf56.exe 660 8c8f0dac5b4b18f8004c348b3e76199be88367c31e28cffcf13e41885f88bf56.exe 660 8c8f0dac5b4b18f8004c348b3e76199be88367c31e28cffcf13e41885f88bf56.exe 660 8c8f0dac5b4b18f8004c348b3e76199be88367c31e28cffcf13e41885f88bf56.exe 660 8c8f0dac5b4b18f8004c348b3e76199be88367c31e28cffcf13e41885f88bf56.exe 660 8c8f0dac5b4b18f8004c348b3e76199be88367c31e28cffcf13e41885f88bf56.exe 660 8c8f0dac5b4b18f8004c348b3e76199be88367c31e28cffcf13e41885f88bf56.exe 660 8c8f0dac5b4b18f8004c348b3e76199be88367c31e28cffcf13e41885f88bf56.exe 3208 pmnzmbqtrn.exe 3208 pmnzmbqtrn.exe 3208 pmnzmbqtrn.exe 3208 pmnzmbqtrn.exe 3208 pmnzmbqtrn.exe 3208 pmnzmbqtrn.exe 3208 pmnzmbqtrn.exe 3208 pmnzmbqtrn.exe 3208 pmnzmbqtrn.exe 3208 pmnzmbqtrn.exe 820 jdabzoxdbtufhav.exe 820 jdabzoxdbtufhav.exe 820 jdabzoxdbtufhav.exe 820 jdabzoxdbtufhav.exe 820 jdabzoxdbtufhav.exe 820 jdabzoxdbtufhav.exe 5084 adglqpaw.exe 820 jdabzoxdbtufhav.exe 820 jdabzoxdbtufhav.exe 5084 adglqpaw.exe 5084 adglqpaw.exe 5084 adglqpaw.exe 5084 adglqpaw.exe 5084 adglqpaw.exe 5084 adglqpaw.exe 5084 adglqpaw.exe 820 jdabzoxdbtufhav.exe 820 jdabzoxdbtufhav.exe 4292 xkiscybwgaspv.exe 4292 xkiscybwgaspv.exe 4292 xkiscybwgaspv.exe 4292 xkiscybwgaspv.exe 4292 xkiscybwgaspv.exe 4292 xkiscybwgaspv.exe 4292 xkiscybwgaspv.exe 4292 xkiscybwgaspv.exe 4292 xkiscybwgaspv.exe 4292 xkiscybwgaspv.exe 4292 xkiscybwgaspv.exe 4292 xkiscybwgaspv.exe 4900 adglqpaw.exe 4900 adglqpaw.exe 4900 adglqpaw.exe 4900 adglqpaw.exe 4900 adglqpaw.exe 4900 adglqpaw.exe 4900 adglqpaw.exe 4900 adglqpaw.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
pid Process 660 8c8f0dac5b4b18f8004c348b3e76199be88367c31e28cffcf13e41885f88bf56.exe 660 8c8f0dac5b4b18f8004c348b3e76199be88367c31e28cffcf13e41885f88bf56.exe 660 8c8f0dac5b4b18f8004c348b3e76199be88367c31e28cffcf13e41885f88bf56.exe 3208 pmnzmbqtrn.exe 3208 pmnzmbqtrn.exe 3208 pmnzmbqtrn.exe 820 jdabzoxdbtufhav.exe 820 jdabzoxdbtufhav.exe 820 jdabzoxdbtufhav.exe 5084 adglqpaw.exe 5084 adglqpaw.exe 5084 adglqpaw.exe 4292 xkiscybwgaspv.exe 4292 xkiscybwgaspv.exe 4292 xkiscybwgaspv.exe 4900 adglqpaw.exe 4900 adglqpaw.exe 4900 adglqpaw.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 660 8c8f0dac5b4b18f8004c348b3e76199be88367c31e28cffcf13e41885f88bf56.exe 660 8c8f0dac5b4b18f8004c348b3e76199be88367c31e28cffcf13e41885f88bf56.exe 660 8c8f0dac5b4b18f8004c348b3e76199be88367c31e28cffcf13e41885f88bf56.exe 3208 pmnzmbqtrn.exe 3208 pmnzmbqtrn.exe 3208 pmnzmbqtrn.exe 820 jdabzoxdbtufhav.exe 820 jdabzoxdbtufhav.exe 820 jdabzoxdbtufhav.exe 5084 adglqpaw.exe 5084 adglqpaw.exe 5084 adglqpaw.exe 4292 xkiscybwgaspv.exe 4292 xkiscybwgaspv.exe 4292 xkiscybwgaspv.exe 4900 adglqpaw.exe 4900 adglqpaw.exe 4900 adglqpaw.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 1740 WINWORD.EXE 1740 WINWORD.EXE 1740 WINWORD.EXE 1740 WINWORD.EXE 1740 WINWORD.EXE 1740 WINWORD.EXE 1740 WINWORD.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 660 wrote to memory of 3208 660 8c8f0dac5b4b18f8004c348b3e76199be88367c31e28cffcf13e41885f88bf56.exe 79 PID 660 wrote to memory of 3208 660 8c8f0dac5b4b18f8004c348b3e76199be88367c31e28cffcf13e41885f88bf56.exe 79 PID 660 wrote to memory of 3208 660 8c8f0dac5b4b18f8004c348b3e76199be88367c31e28cffcf13e41885f88bf56.exe 79 PID 660 wrote to memory of 820 660 8c8f0dac5b4b18f8004c348b3e76199be88367c31e28cffcf13e41885f88bf56.exe 80 PID 660 wrote to memory of 820 660 8c8f0dac5b4b18f8004c348b3e76199be88367c31e28cffcf13e41885f88bf56.exe 80 PID 660 wrote to memory of 820 660 8c8f0dac5b4b18f8004c348b3e76199be88367c31e28cffcf13e41885f88bf56.exe 80 PID 660 wrote to memory of 5084 660 8c8f0dac5b4b18f8004c348b3e76199be88367c31e28cffcf13e41885f88bf56.exe 81 PID 660 wrote to memory of 5084 660 8c8f0dac5b4b18f8004c348b3e76199be88367c31e28cffcf13e41885f88bf56.exe 81 PID 660 wrote to memory of 5084 660 8c8f0dac5b4b18f8004c348b3e76199be88367c31e28cffcf13e41885f88bf56.exe 81 PID 660 wrote to memory of 4292 660 8c8f0dac5b4b18f8004c348b3e76199be88367c31e28cffcf13e41885f88bf56.exe 82 PID 660 wrote to memory of 4292 660 8c8f0dac5b4b18f8004c348b3e76199be88367c31e28cffcf13e41885f88bf56.exe 82 PID 660 wrote to memory of 4292 660 8c8f0dac5b4b18f8004c348b3e76199be88367c31e28cffcf13e41885f88bf56.exe 82 PID 3208 wrote to memory of 4900 3208 pmnzmbqtrn.exe 85 PID 3208 wrote to memory of 4900 3208 pmnzmbqtrn.exe 85 PID 3208 wrote to memory of 4900 3208 pmnzmbqtrn.exe 85 PID 660 wrote to memory of 1740 660 8c8f0dac5b4b18f8004c348b3e76199be88367c31e28cffcf13e41885f88bf56.exe 83 PID 660 wrote to memory of 1740 660 8c8f0dac5b4b18f8004c348b3e76199be88367c31e28cffcf13e41885f88bf56.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\8c8f0dac5b4b18f8004c348b3e76199be88367c31e28cffcf13e41885f88bf56.exe"C:\Users\Admin\AppData\Local\Temp\8c8f0dac5b4b18f8004c348b3e76199be88367c31e28cffcf13e41885f88bf56.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:660 -
C:\Windows\SysWOW64\pmnzmbqtrn.exepmnzmbqtrn.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Windows\SysWOW64\adglqpaw.exeC:\Windows\system32\adglqpaw.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4900
-
-
-
C:\Windows\SysWOW64\jdabzoxdbtufhav.exejdabzoxdbtufhav.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:820
-
-
C:\Windows\SysWOW64\adglqpaw.exeadglqpaw.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5084
-
-
C:\Windows\SysWOW64\xkiscybwgaspv.exexkiscybwgaspv.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4292
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:1740
-
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Disabling Security Tools
2Hidden Files and Directories
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
256KB
MD58253be5aaeddc5dea6427d986d141acb
SHA13170a09eb5d4fabd1348d8e61a94a16d3fefdc19
SHA256325cde9103ea94731c6150a3dbf7878be21e245781fe2801ffc9854b8a938dea
SHA512636dabee49a6c51ee15c27978924024e877ca185f8129da954ed2d95180051af19de4cd6f46e156153c8b05abdc74a79840fd3a422e67276b482806f8a897834
-
Filesize
256KB
MD5dd5c5563f85932672d7ffc5177f5b90f
SHA1292aac15745521354634a839613fab5ebbf1ef6e
SHA2565696d374f3747c8b64abbefb3c1992cec954b101f8cae89dc39df289513367af
SHA5124bc66cd4840312efc87565b2fc079c164843d7965a322753acac4e5ca0b78e7ecaa50660710faea598bc7a2935ad4e13322044df075e45826306dcac45376560
-
Filesize
256KB
MD57a51b51985e8d207361a37d1976e0122
SHA1ba3902459fe4df5f090562b067196990460c1352
SHA256cf951a3c64e19da470d29020a9d79d578dd0cd044e3d796042322fbd758526f1
SHA512a94f91b3ba3fa3598eb868e8ca051880a00570013bd4f5310c9a25f44866803914ffc8230ddfb07ff1b8ef6d73a84df60295230b97c669fcbf11d4a26204241c
-
Filesize
256KB
MD52af03a0810c3d61e7d02743f8f2fc55e
SHA1949f90cb6b4061e58bb63f31e2a32fdab5b3c998
SHA2563841f42bf86c43f2661545379ae4ec1348b62678b24f64ec66d980266767569e
SHA51201b2fd2614fd59280c8b6a6b6e139d5ca56b2db7d1377386b9e18c3f4b918c0d2b1f0087e56c101f3e03e877af5cf9150ea77d9eac2d7c988d637a6b8cf02c82
-
Filesize
256KB
MD5fef52678fdfd646666f0cf2741d8f6c4
SHA1a86d6a4d21fb3630818c666c48b1af267683a322
SHA256a5eeadffb8b0745383c841b85cdb730a236df416ffbdfd6a077e1f0843ad3473
SHA5127d81d9407fd2052259a9b1c7982bcc2dfe337da9de8490186a0afcb587afdb46838f81a2e1aae9e6abf734732236010747005e27b1e336647b32d3bb4251480e
-
Filesize
256KB
MD5fef52678fdfd646666f0cf2741d8f6c4
SHA1a86d6a4d21fb3630818c666c48b1af267683a322
SHA256a5eeadffb8b0745383c841b85cdb730a236df416ffbdfd6a077e1f0843ad3473
SHA5127d81d9407fd2052259a9b1c7982bcc2dfe337da9de8490186a0afcb587afdb46838f81a2e1aae9e6abf734732236010747005e27b1e336647b32d3bb4251480e
-
Filesize
256KB
MD5fef52678fdfd646666f0cf2741d8f6c4
SHA1a86d6a4d21fb3630818c666c48b1af267683a322
SHA256a5eeadffb8b0745383c841b85cdb730a236df416ffbdfd6a077e1f0843ad3473
SHA5127d81d9407fd2052259a9b1c7982bcc2dfe337da9de8490186a0afcb587afdb46838f81a2e1aae9e6abf734732236010747005e27b1e336647b32d3bb4251480e
-
Filesize
256KB
MD559b5a7d3b404711bc160b165f319e1b5
SHA1e84ca9dd467f272268203c33bb54f051ebfc0f9b
SHA256840523c27bbacccbc0f3c6ba003b760362e3c167f9c0693f863c014bdb5b6c02
SHA5123dbe50ad091463d12188151b5d4332a077e200d5e6990ca00c64e435cf31b5fe04f05ed969a58773d27aa42c3437417084a062b873bf0a5d8696dc90870db14e
-
Filesize
256KB
MD559b5a7d3b404711bc160b165f319e1b5
SHA1e84ca9dd467f272268203c33bb54f051ebfc0f9b
SHA256840523c27bbacccbc0f3c6ba003b760362e3c167f9c0693f863c014bdb5b6c02
SHA5123dbe50ad091463d12188151b5d4332a077e200d5e6990ca00c64e435cf31b5fe04f05ed969a58773d27aa42c3437417084a062b873bf0a5d8696dc90870db14e
-
Filesize
256KB
MD5edddb9fe58d0962136215a6a6843a9ba
SHA1dadfa5e17fcae236d937eaee682f8d3cff7757d7
SHA2569362b61b095d1275fe3bf82a4a307d1540cc0752a7595a033de63c8a909b4169
SHA51252be0bc08d7cbefccf80d9deea02b2b00574e0ef3208ab97883cc1714d29933f25e2ceefd781aa6988ca33d74f0de56f37821f8d3e3dd380870a052ba303afd1
-
Filesize
256KB
MD5edddb9fe58d0962136215a6a6843a9ba
SHA1dadfa5e17fcae236d937eaee682f8d3cff7757d7
SHA2569362b61b095d1275fe3bf82a4a307d1540cc0752a7595a033de63c8a909b4169
SHA51252be0bc08d7cbefccf80d9deea02b2b00574e0ef3208ab97883cc1714d29933f25e2ceefd781aa6988ca33d74f0de56f37821f8d3e3dd380870a052ba303afd1
-
Filesize
256KB
MD571023c7ee69970fb9dddcb0f24a95b2b
SHA17de6e3021a957ae7c32cd9047d629ee8fbea70b0
SHA25608c14f28b63472b2134cd569f2c9ba8301b00206a4c3f9e9ae5e20e64d6a4314
SHA51251a17d454349d85713ab8dbd12a0734d87bccc0ee364b434a97371b8d088e5b4dadb6f263917c199df70904b2db985d10550fec3dc3269c06d93a8f9fbe92769
-
Filesize
256KB
MD571023c7ee69970fb9dddcb0f24a95b2b
SHA17de6e3021a957ae7c32cd9047d629ee8fbea70b0
SHA25608c14f28b63472b2134cd569f2c9ba8301b00206a4c3f9e9ae5e20e64d6a4314
SHA51251a17d454349d85713ab8dbd12a0734d87bccc0ee364b434a97371b8d088e5b4dadb6f263917c199df70904b2db985d10550fec3dc3269c06d93a8f9fbe92769
-
Filesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7