e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71

Analysis

max time kernel
330s
max time network
442s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
23-11-2022 21:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71.exe
Size

255KB
MD5

809f9ad224cc4d065c270fdc7496b06f
SHA1

93ce9c90badf1d29b3097d5200b1cbb581462ead
SHA256

e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71
SHA512

01383f4a6014f0f080181384d938dbdedbb2a2d8c061d4f65c474f177079f128f2ab28af9e86595fd376cf0301ed48b055560616298d8af9de5192ed9a643874
SSDEEP

3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJL:1xlZam+akqx6YQJXcNlEHUIQeE3mmBI+

Score

10^/10

evasion persistence trojan upx

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

dowlljwlxt.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	dowlljwlxt.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

dowlljwlxt.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	dowlljwlxt.exe

Windows security bypass 2 TTPs 5 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

dowlljwlxt.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	dowlljwlxt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	dowlljwlxt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	dowlljwlxt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	dowlljwlxt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	dowlljwlxt.exe

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

dowlljwlxt.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	dowlljwlxt.exe

Executes dropped EXE 5 IoCs

Processes:

dowlljwlxt.exewcyqpezrmzsiqcs.exebiqydchu.exeggtghcohwsobb.exebiqydchu.exe

pid process

4424 dowlljwlxt.exe
1388 wcyqpezrmzsiqcs.exe
3020 biqydchu.exe
3972 ggtghcohwsobb.exe
4232 biqydchu.exe

pid	process
4424	dowlljwlxt.exe
1388	wcyqpezrmzsiqcs.exe
3020	biqydchu.exe
3972	ggtghcohwsobb.exe
4232	biqydchu.exe

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2700-132-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
C:\Windows\SysWOW64\dowlljwlxt.exe	upx
C:\Windows\SysWOW64\dowlljwlxt.exe	upx
behavioral2/memory/4424-136-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
C:\Windows\SysWOW64\wcyqpezrmzsiqcs.exe	upx
C:\Windows\SysWOW64\wcyqpezrmzsiqcs.exe	upx
behavioral2/memory/1388-140-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
C:\Windows\SysWOW64\biqydchu.exe	upx
C:\Windows\SysWOW64\biqydchu.exe	upx
behavioral2/memory/3020-144-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
C:\Windows\SysWOW64\ggtghcohwsobb.exe	upx
behavioral2/memory/3020-147-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
C:\Windows\SysWOW64\ggtghcohwsobb.exe	upx
C:\Windows\SysWOW64\biqydchu.exe	upx
behavioral2/memory/2700-153-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral2/memory/4232-154-0x0000000000400000-0x00000000004A0000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71.exe

Windows security modification 2 TTPs 6 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

dowlljwlxt.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	dowlljwlxt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	dowlljwlxt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	dowlljwlxt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1"	dowlljwlxt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	dowlljwlxt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	dowlljwlxt.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

wcyqpezrmzsiqcs.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\jqptmgpi = "dowlljwlxt.exe"	wcyqpezrmzsiqcs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kozjknqs = "wcyqpezrmzsiqcs.exe"	wcyqpezrmzsiqcs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "ggtghcohwsobb.exe"	wcyqpezrmzsiqcs.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	wcyqpezrmzsiqcs.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

biqydchu.exedowlljwlxt.exebiqydchu.exe

description	ioc	process
File opened (read-only)	\??\e:	biqydchu.exe
File opened (read-only)	\??\r:	biqydchu.exe
File opened (read-only)	\??\x:	dowlljwlxt.exe
File opened (read-only)	\??\i:	dowlljwlxt.exe
File opened (read-only)	\??\p:	biqydchu.exe
File opened (read-only)	\??\u:	biqydchu.exe
File opened (read-only)	\??\x:	biqydchu.exe
File opened (read-only)	\??\l:	biqydchu.exe
File opened (read-only)	\??\g:	biqydchu.exe
File opened (read-only)	\??\p:	biqydchu.exe
File opened (read-only)	\??\k:	dowlljwlxt.exe
File opened (read-only)	\??\m:	biqydchu.exe
File opened (read-only)	\??\m:	biqydchu.exe
File opened (read-only)	\??\x:	biqydchu.exe
File opened (read-only)	\??\h:	dowlljwlxt.exe
File opened (read-only)	\??\l:	dowlljwlxt.exe
File opened (read-only)	\??\a:	biqydchu.exe
File opened (read-only)	\??\h:	biqydchu.exe
File opened (read-only)	\??\t:	biqydchu.exe
File opened (read-only)	\??\u:	dowlljwlxt.exe
File opened (read-only)	\??\v:	dowlljwlxt.exe
File opened (read-only)	\??\w:	dowlljwlxt.exe
File opened (read-only)	\??\j:	biqydchu.exe
File opened (read-only)	\??\w:	biqydchu.exe
File opened (read-only)	\??\l:	biqydchu.exe
File opened (read-only)	\??\a:	dowlljwlxt.exe
File opened (read-only)	\??\g:	dowlljwlxt.exe
File opened (read-only)	\??\w:	biqydchu.exe
File opened (read-only)	\??\s:	dowlljwlxt.exe
File opened (read-only)	\??\i:	biqydchu.exe
File opened (read-only)	\??\o:	biqydchu.exe
File opened (read-only)	\??\t:	biqydchu.exe
File opened (read-only)	\??\y:	biqydchu.exe
File opened (read-only)	\??\z:	biqydchu.exe
File opened (read-only)	\??\n:	dowlljwlxt.exe
File opened (read-only)	\??\u:	biqydchu.exe
File opened (read-only)	\??\z:	biqydchu.exe
File opened (read-only)	\??\e:	dowlljwlxt.exe
File opened (read-only)	\??\m:	dowlljwlxt.exe
File opened (read-only)	\??\t:	dowlljwlxt.exe
File opened (read-only)	\??\b:	biqydchu.exe
File opened (read-only)	\??\i:	biqydchu.exe
File opened (read-only)	\??\n:	biqydchu.exe
File opened (read-only)	\??\q:	biqydchu.exe
File opened (read-only)	\??\f:	dowlljwlxt.exe
File opened (read-only)	\??\p:	dowlljwlxt.exe
File opened (read-only)	\??\k:	biqydchu.exe
File opened (read-only)	\??\a:	biqydchu.exe
File opened (read-only)	\??\r:	biqydchu.exe
File opened (read-only)	\??\v:	biqydchu.exe
File opened (read-only)	\??\q:	dowlljwlxt.exe
File opened (read-only)	\??\s:	biqydchu.exe
File opened (read-only)	\??\f:	biqydchu.exe
File opened (read-only)	\??\b:	dowlljwlxt.exe
File opened (read-only)	\??\y:	dowlljwlxt.exe
File opened (read-only)	\??\f:	biqydchu.exe
File opened (read-only)	\??\n:	biqydchu.exe
File opened (read-only)	\??\v:	biqydchu.exe
File opened (read-only)	\??\k:	biqydchu.exe
File opened (read-only)	\??\g:	biqydchu.exe
File opened (read-only)	\??\j:	biqydchu.exe
File opened (read-only)	\??\s:	biqydchu.exe
File opened (read-only)	\??\j:	dowlljwlxt.exe
File opened (read-only)	\??\o:	dowlljwlxt.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

dowlljwlxt.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0"	dowlljwlxt.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197"	dowlljwlxt.exe

AutoIT Executable 6 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral2/memory/4424-136-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral2/memory/1388-140-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral2/memory/3020-144-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral2/memory/3020-147-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral2/memory/2700-153-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral2/memory/4232-154-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe

Drops file in System32 directory 9 IoCs

Processes:

e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71.exedowlljwlxt.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\dowlljwlxt.exe	e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71.exe
File opened for modification	C:\Windows\SysWOW64\wcyqpezrmzsiqcs.exe	e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71.exe
File created	C:\Windows\SysWOW64\biqydchu.exe	e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71.exe
File created	C:\Windows\SysWOW64\ggtghcohwsobb.exe	e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	dowlljwlxt.exe
File created	C:\Windows\SysWOW64\dowlljwlxt.exe	e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71.exe
File created	C:\Windows\SysWOW64\wcyqpezrmzsiqcs.exe	e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71.exe
File opened for modification	C:\Windows\SysWOW64\biqydchu.exe	e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71.exe
File opened for modification	C:\Windows\SysWOW64\ggtghcohwsobb.exe	e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71.exe

Drops file in Windows directory 1 IoCs

Processes:

e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71.exe

description ioc process

File opened for modification C:\Windows\mydoc.rtf e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\mydoc.rtf	e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71.exe

Modifies registry class 20 IoCs

Processes:

e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71.exedowlljwlxt.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E78068B4FF1F22DCD27DD0A98B799163"	e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile"	dowlljwlxt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs	dowlljwlxt.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings	e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "184BC67E1491DAB1B8CF7C93EC9F37CA"	e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile"	dowlljwlxt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsf	dowlljwlxt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile"	dowlljwlxt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile"	dowlljwlxt.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLV.Classes	e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BC9FACEFE64F29884093B4481EA3E93B0F903FE4212034BE2CF429C09A9"	e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7E8FFFFB4F5F856F9130D75D7DE1BDE5E635584467316345D7ED"	e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat	dowlljwlxt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile"	dowlljwlxt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsc	dowlljwlxt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33472C779D5583536A3076A177212CAB7C8665DD"	e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FB2B15844EF38EB53CABAD1329DD4B8"	e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsh	dowlljwlxt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile"	dowlljwlxt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.reg	dowlljwlxt.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71.exedowlljwlxt.exebiqydchu.exewcyqpezrmzsiqcs.exe

pid	process
2700	e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71.exe
2700	e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71.exe
2700	e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71.exe
2700	e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71.exe
2700	e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71.exe
2700	e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71.exe
2700	e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71.exe
2700	e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71.exe
2700	e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71.exe
2700	e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71.exe
2700	e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71.exe
2700	e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71.exe
4424	dowlljwlxt.exe
4424	dowlljwlxt.exe
4424	dowlljwlxt.exe
4424	dowlljwlxt.exe
4424	dowlljwlxt.exe
4424	dowlljwlxt.exe
4424	dowlljwlxt.exe
4424	dowlljwlxt.exe
4424	dowlljwlxt.exe
4424	dowlljwlxt.exe
2700	e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71.exe
2700	e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71.exe
2700	e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71.exe
2700	e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71.exe
3020	biqydchu.exe
3020	biqydchu.exe
3020	biqydchu.exe
3020	biqydchu.exe
3020	biqydchu.exe
3020	biqydchu.exe
3020	biqydchu.exe
3020	biqydchu.exe
1388	wcyqpezrmzsiqcs.exe
1388	wcyqpezrmzsiqcs.exe
1388	wcyqpezrmzsiqcs.exe
1388	wcyqpezrmzsiqcs.exe
1388	wcyqpezrmzsiqcs.exe
1388	wcyqpezrmzsiqcs.exe
1388	wcyqpezrmzsiqcs.exe
1388	wcyqpezrmzsiqcs.exe
1388	wcyqpezrmzsiqcs.exe
1388	wcyqpezrmzsiqcs.exe
1388	wcyqpezrmzsiqcs.exe
1388	wcyqpezrmzsiqcs.exe
1388	wcyqpezrmzsiqcs.exe
1388	wcyqpezrmzsiqcs.exe
1388	wcyqpezrmzsiqcs.exe
1388	wcyqpezrmzsiqcs.exe
1388	wcyqpezrmzsiqcs.exe
1388	wcyqpezrmzsiqcs.exe
1388	wcyqpezrmzsiqcs.exe
1388	wcyqpezrmzsiqcs.exe
1388	wcyqpezrmzsiqcs.exe
1388	wcyqpezrmzsiqcs.exe
1388	wcyqpezrmzsiqcs.exe
1388	wcyqpezrmzsiqcs.exe
1388	wcyqpezrmzsiqcs.exe
1388	wcyqpezrmzsiqcs.exe
1388	wcyqpezrmzsiqcs.exe
1388	wcyqpezrmzsiqcs.exe
1388	wcyqpezrmzsiqcs.exe
1388	wcyqpezrmzsiqcs.exe

Suspicious use of FindShellTrayWindow 18 IoCs

Processes:

e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71.exedowlljwlxt.exebiqydchu.exewcyqpezrmzsiqcs.exeggtghcohwsobb.exebiqydchu.exe

pid	process
2700	e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71.exe
2700	e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71.exe
2700	e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71.exe
4424	dowlljwlxt.exe
4424	dowlljwlxt.exe
4424	dowlljwlxt.exe
3020	biqydchu.exe
1388	wcyqpezrmzsiqcs.exe
3020	biqydchu.exe
1388	wcyqpezrmzsiqcs.exe
3020	biqydchu.exe
1388	wcyqpezrmzsiqcs.exe
3972	ggtghcohwsobb.exe
3972	ggtghcohwsobb.exe
3972	ggtghcohwsobb.exe
4232	biqydchu.exe
4232	biqydchu.exe
4232	biqydchu.exe

Suspicious use of SendNotifyMessage 18 IoCs

Processes:

e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71.exedowlljwlxt.exebiqydchu.exewcyqpezrmzsiqcs.exeggtghcohwsobb.exebiqydchu.exe

pid	process
2700	e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71.exe
2700	e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71.exe
2700	e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71.exe
4424	dowlljwlxt.exe
4424	dowlljwlxt.exe
4424	dowlljwlxt.exe
3020	biqydchu.exe
1388	wcyqpezrmzsiqcs.exe
3020	biqydchu.exe
1388	wcyqpezrmzsiqcs.exe
3020	biqydchu.exe
1388	wcyqpezrmzsiqcs.exe
3972	ggtghcohwsobb.exe
3972	ggtghcohwsobb.exe
3972	ggtghcohwsobb.exe
4232	biqydchu.exe
4232	biqydchu.exe
4232	biqydchu.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71.exewcyqpezrmzsiqcs.exedowlljwlxt.exe

description	pid	process	target process
PID 2700 wrote to memory of 4424	2700	e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71.exe	dowlljwlxt.exe
PID 2700 wrote to memory of 4424	2700	e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71.exe	dowlljwlxt.exe
PID 2700 wrote to memory of 4424	2700	e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71.exe	dowlljwlxt.exe
PID 2700 wrote to memory of 1388	2700	e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71.exe	wcyqpezrmzsiqcs.exe
PID 2700 wrote to memory of 1388	2700	e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71.exe	wcyqpezrmzsiqcs.exe
PID 2700 wrote to memory of 1388	2700	e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71.exe	wcyqpezrmzsiqcs.exe
PID 2700 wrote to memory of 3020	2700	e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71.exe	biqydchu.exe
PID 2700 wrote to memory of 3020	2700	e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71.exe	biqydchu.exe
PID 2700 wrote to memory of 3020	2700	e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71.exe	biqydchu.exe
PID 2700 wrote to memory of 3972	2700	e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71.exe	ggtghcohwsobb.exe
PID 2700 wrote to memory of 3972	2700	e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71.exe	ggtghcohwsobb.exe
PID 2700 wrote to memory of 3972	2700	e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71.exe	ggtghcohwsobb.exe
PID 1388 wrote to memory of 4460	1388	wcyqpezrmzsiqcs.exe	cmd.exe
PID 1388 wrote to memory of 4460	1388	wcyqpezrmzsiqcs.exe	cmd.exe
PID 1388 wrote to memory of 4460	1388	wcyqpezrmzsiqcs.exe	cmd.exe
PID 4424 wrote to memory of 4232	4424	dowlljwlxt.exe	biqydchu.exe
PID 4424 wrote to memory of 4232	4424	dowlljwlxt.exe	biqydchu.exe
PID 4424 wrote to memory of 4232	4424	dowlljwlxt.exe	biqydchu.exe
PID 2700 wrote to memory of 3884	2700	e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71.exe	WINWORD.EXE
PID 2700 wrote to memory of 3884	2700	e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71.exe	WINWORD.EXE

C:\Users\Admin\AppData\Local\Temp\e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71.exe
"C:\Users\Admin\AppData\Local\Temp\e3c0754440d86429974d0752c96ce52ef76f30f05dc3bdcf10897d6d05409d71.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2700

C:\Windows\SysWOW64\dowlljwlxt.exe
dowlljwlxt.exe
2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4424

C:\Windows\SysWOW64\biqydchu.exe
C:\Windows\system32\biqydchu.exe
3⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4232

C:\Windows\SysWOW64\wcyqpezrmzsiqcs.exe
wcyqpezrmzsiqcs.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1388

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c ggtghcohwsobb.exe
3⤵
PID:4460

C:\Windows\SysWOW64\biqydchu.exe
biqydchu.exe
2⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3020

C:\Windows\SysWOW64\ggtghcohwsobb.exe
ggtghcohwsobb.exe
2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3972

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""
2⤵
PID:3884

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\biqydchu.exe

Filesize
255KB

MD5
453ab9ebabe310654f64261c00f5d2cf

SHA1
e06dbfa4e47bb5720c259542dbd8ac4e5ca147a6

SHA256
2131fe7840a414480191632d188f4919ac97ec12fbcc86e291b0656fd406b74c

SHA512
d951af7c461f6a2e92f88d9f6824a1829816cfd9d20c93b5bc73e0c42950827b06eb8ab6700975ee3090c4cc4b7f33d7292f87f41a4ece091d21cfa39d1a2d90

Download Submit
C:\Windows\SysWOW64\biqydchu.exe

Filesize
255KB

MD5
453ab9ebabe310654f64261c00f5d2cf

SHA1
e06dbfa4e47bb5720c259542dbd8ac4e5ca147a6

SHA256
2131fe7840a414480191632d188f4919ac97ec12fbcc86e291b0656fd406b74c

SHA512
d951af7c461f6a2e92f88d9f6824a1829816cfd9d20c93b5bc73e0c42950827b06eb8ab6700975ee3090c4cc4b7f33d7292f87f41a4ece091d21cfa39d1a2d90

Download Submit
C:\Windows\SysWOW64\biqydchu.exe

Filesize
255KB

MD5
453ab9ebabe310654f64261c00f5d2cf

SHA1
e06dbfa4e47bb5720c259542dbd8ac4e5ca147a6

SHA256
2131fe7840a414480191632d188f4919ac97ec12fbcc86e291b0656fd406b74c

SHA512
d951af7c461f6a2e92f88d9f6824a1829816cfd9d20c93b5bc73e0c42950827b06eb8ab6700975ee3090c4cc4b7f33d7292f87f41a4ece091d21cfa39d1a2d90

Download Submit
C:\Windows\SysWOW64\dowlljwlxt.exe

Filesize
255KB

MD5
ddb251a12a2003028f1773ce6261287c

SHA1
7a125489bba52643255c4970db9f301c221375e7

SHA256
20ef28738fddc0c7765b65ad216210c8d0ead7167169a7247bb27df0b3595e07

SHA512
7d3efa1fa27773d970095e7a3c94a2a2a7f301fcd60ba50e9dda288a4a29c253772eb1bd7d8e397325d6a7bbe8142d12d656d02b082bb0013da9d91fa47a7609

Download Submit
C:\Windows\SysWOW64\dowlljwlxt.exe

Filesize
255KB

MD5
ddb251a12a2003028f1773ce6261287c

SHA1
7a125489bba52643255c4970db9f301c221375e7

SHA256
20ef28738fddc0c7765b65ad216210c8d0ead7167169a7247bb27df0b3595e07

SHA512
7d3efa1fa27773d970095e7a3c94a2a2a7f301fcd60ba50e9dda288a4a29c253772eb1bd7d8e397325d6a7bbe8142d12d656d02b082bb0013da9d91fa47a7609

Download Submit
C:\Windows\SysWOW64\ggtghcohwsobb.exe

Filesize
255KB

MD5
e4567db4c32c16d9e7ed498ccf7fb5f5

SHA1
4a84fe336f15738e4b6796cd4c60a573bff88373

SHA256
c7422feac11ce3a06b162dba024783936b1ef5593247b5bfbf42c8e0152ff5ca

SHA512
3f0f0085c05e4d7fc069665f1dff078f103e011df4aa5da1179ac6235aa03e36c736956d723edf2010a0348186236c6920af88fc8b26363dcd1aadc92bd5d323

Download Submit
C:\Windows\SysWOW64\ggtghcohwsobb.exe

Filesize
255KB

MD5
e4567db4c32c16d9e7ed498ccf7fb5f5

SHA1
4a84fe336f15738e4b6796cd4c60a573bff88373

SHA256
c7422feac11ce3a06b162dba024783936b1ef5593247b5bfbf42c8e0152ff5ca

SHA512
3f0f0085c05e4d7fc069665f1dff078f103e011df4aa5da1179ac6235aa03e36c736956d723edf2010a0348186236c6920af88fc8b26363dcd1aadc92bd5d323

Download Submit
C:\Windows\SysWOW64\wcyqpezrmzsiqcs.exe

Filesize
255KB

MD5
713a0681200f00fe498abc6415ad35bc

SHA1
e50254b1eef48158d74213a46588a9382bcb3d9f

SHA256
8edde9e6d27e274d0497396d2319b0ed6431fcbb7ff4266b14eec31df812e916

SHA512
23a4aed87b416422fb394c42a5dc1871c755791eaf9d2b39446815254bdc7478067b1c43b9deaa6ebb7e9f8186a63c352be08b70166b18ad471f0cf79f6992de

Download Submit
C:\Windows\SysWOW64\wcyqpezrmzsiqcs.exe

Filesize
255KB

MD5
713a0681200f00fe498abc6415ad35bc

SHA1
e50254b1eef48158d74213a46588a9382bcb3d9f

SHA256
8edde9e6d27e274d0497396d2319b0ed6431fcbb7ff4266b14eec31df812e916

SHA512
23a4aed87b416422fb394c42a5dc1871c755791eaf9d2b39446815254bdc7478067b1c43b9deaa6ebb7e9f8186a63c352be08b70166b18ad471f0cf79f6992de

Download Submit
memory/1388-137-0x0000000000000000-mapping.dmp

Download
memory/1388-140-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2700-132-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/2700-153-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/3020-144-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/3020-147-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/3020-141-0x0000000000000000-mapping.dmp

Download
memory/3884-152-0x0000000000000000-mapping.dmp

Download
memory/3972-145-0x0000000000000000-mapping.dmp

Download
memory/4232-154-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/4232-150-0x0000000000000000-mapping.dmp

Download
memory/4424-133-0x0000000000000000-mapping.dmp

Download
memory/4424-136-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/4460-148-0x0000000000000000-mapping.dmp

Download