Analysis
-
max time kernel
153s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 21:04
Behavioral task
behavioral1
Sample
55f9badb3207ed1867a1da4721c65f4dc284cd4a49968266e530e52b84b2ef21.exe
Resource
win7-20220812-en
General
-
Target
55f9badb3207ed1867a1da4721c65f4dc284cd4a49968266e530e52b84b2ef21.exe
-
Size
255KB
-
MD5
7918565ccd637d96a24b00726bd7646f
-
SHA1
c5f3ee09d8365c5be1609f61c6c4b6f7627ddbf8
-
SHA256
55f9badb3207ed1867a1da4721c65f4dc284cd4a49968266e530e52b84b2ef21
-
SHA512
4ac7823e403a117bf37ba563bf0fdcc091a9d7a8568f7df3a5e983f3fcff2c90ac0a6f4d5cc1837fe8eca75ce6050e77f7a160632e4fc9564e1c0d27693dffde
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJg:1xlZam+akqx6YQJXcNlEHUIQeE3mmBI1
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
Processes:
dowlljwlxt.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" dowlljwlxt.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
dowlljwlxt.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" dowlljwlxt.exe -
Processes:
dowlljwlxt.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" dowlljwlxt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" dowlljwlxt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" dowlljwlxt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" dowlljwlxt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" dowlljwlxt.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
dowlljwlxt.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" dowlljwlxt.exe -
Executes dropped EXE 5 IoCs
Processes:
dowlljwlxt.exewcyqpezrmzsiqcs.exebiqydchu.exeggtghcohwsobb.exebiqydchu.exepid process 3376 dowlljwlxt.exe 4844 wcyqpezrmzsiqcs.exe 2424 biqydchu.exe 2900 ggtghcohwsobb.exe 1048 biqydchu.exe -
Processes:
resource yara_rule behavioral2/memory/2276-132-0x0000000000400000-0x00000000004A0000-memory.dmp upx C:\Windows\SysWOW64\dowlljwlxt.exe upx C:\Windows\SysWOW64\dowlljwlxt.exe upx C:\Windows\SysWOW64\wcyqpezrmzsiqcs.exe upx C:\Windows\SysWOW64\biqydchu.exe upx C:\Windows\SysWOW64\ggtghcohwsobb.exe upx C:\Windows\SysWOW64\ggtghcohwsobb.exe upx C:\Windows\SysWOW64\biqydchu.exe upx C:\Windows\SysWOW64\wcyqpezrmzsiqcs.exe upx behavioral2/memory/3376-145-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4844-146-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2424-147-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2900-148-0x0000000000400000-0x00000000004A0000-memory.dmp upx C:\Windows\SysWOW64\biqydchu.exe upx behavioral2/memory/2276-152-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1048-153-0x0000000000400000-0x00000000004A0000-memory.dmp upx \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe upx C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe upx behavioral2/memory/3376-163-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4844-164-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2424-165-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2900-166-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/1048-167-0x0000000000400000-0x00000000004A0000-memory.dmp upx \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe upx \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
55f9badb3207ed1867a1da4721c65f4dc284cd4a49968266e530e52b84b2ef21.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 55f9badb3207ed1867a1da4721c65f4dc284cd4a49968266e530e52b84b2ef21.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
dowlljwlxt.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" dowlljwlxt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" dowlljwlxt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" dowlljwlxt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" dowlljwlxt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" dowlljwlxt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" dowlljwlxt.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
wcyqpezrmzsiqcs.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kozjknqs = "wcyqpezrmzsiqcs.exe" wcyqpezrmzsiqcs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "ggtghcohwsobb.exe" wcyqpezrmzsiqcs.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run wcyqpezrmzsiqcs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\jqptmgpi = "dowlljwlxt.exe" wcyqpezrmzsiqcs.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
dowlljwlxt.exebiqydchu.exebiqydchu.exedescription ioc process File opened (read-only) \??\f: dowlljwlxt.exe File opened (read-only) \??\r: dowlljwlxt.exe File opened (read-only) \??\p: biqydchu.exe File opened (read-only) \??\k: biqydchu.exe File opened (read-only) \??\v: biqydchu.exe File opened (read-only) \??\y: biqydchu.exe File opened (read-only) \??\e: biqydchu.exe File opened (read-only) \??\f: biqydchu.exe File opened (read-only) \??\w: biqydchu.exe File opened (read-only) \??\s: biqydchu.exe File opened (read-only) \??\x: biqydchu.exe File opened (read-only) \??\a: dowlljwlxt.exe File opened (read-only) \??\n: dowlljwlxt.exe File opened (read-only) \??\o: dowlljwlxt.exe File opened (read-only) \??\u: biqydchu.exe File opened (read-only) \??\v: biqydchu.exe File opened (read-only) \??\g: biqydchu.exe File opened (read-only) \??\n: biqydchu.exe File opened (read-only) \??\p: biqydchu.exe File opened (read-only) \??\u: biqydchu.exe File opened (read-only) \??\m: dowlljwlxt.exe File opened (read-only) \??\p: dowlljwlxt.exe File opened (read-only) \??\z: biqydchu.exe File opened (read-only) \??\a: biqydchu.exe File opened (read-only) \??\r: biqydchu.exe File opened (read-only) \??\b: biqydchu.exe File opened (read-only) \??\q: biqydchu.exe File opened (read-only) \??\t: dowlljwlxt.exe File opened (read-only) \??\h: biqydchu.exe File opened (read-only) \??\h: dowlljwlxt.exe File opened (read-only) \??\b: biqydchu.exe File opened (read-only) \??\k: biqydchu.exe File opened (read-only) \??\i: biqydchu.exe File opened (read-only) \??\k: dowlljwlxt.exe File opened (read-only) \??\l: dowlljwlxt.exe File opened (read-only) \??\u: dowlljwlxt.exe File opened (read-only) \??\g: biqydchu.exe File opened (read-only) \??\e: biqydchu.exe File opened (read-only) \??\s: dowlljwlxt.exe File opened (read-only) \??\x: dowlljwlxt.exe File opened (read-only) \??\m: biqydchu.exe File opened (read-only) \??\a: biqydchu.exe File opened (read-only) \??\r: biqydchu.exe File opened (read-only) \??\t: biqydchu.exe File opened (read-only) \??\z: biqydchu.exe File opened (read-only) \??\v: dowlljwlxt.exe File opened (read-only) \??\t: biqydchu.exe File opened (read-only) \??\w: dowlljwlxt.exe File opened (read-only) \??\j: biqydchu.exe File opened (read-only) \??\f: biqydchu.exe File opened (read-only) \??\o: biqydchu.exe File opened (read-only) \??\w: biqydchu.exe File opened (read-only) \??\j: dowlljwlxt.exe File opened (read-only) \??\y: dowlljwlxt.exe File opened (read-only) \??\x: biqydchu.exe File opened (read-only) \??\g: dowlljwlxt.exe File opened (read-only) \??\z: dowlljwlxt.exe File opened (read-only) \??\j: biqydchu.exe File opened (read-only) \??\b: dowlljwlxt.exe File opened (read-only) \??\q: dowlljwlxt.exe File opened (read-only) \??\q: biqydchu.exe File opened (read-only) \??\m: biqydchu.exe File opened (read-only) \??\l: biqydchu.exe File opened (read-only) \??\n: biqydchu.exe -
Modifies WinLogon 2 TTPs 2 IoCs
Processes:
dowlljwlxt.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" dowlljwlxt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" dowlljwlxt.exe -
AutoIT Executable 12 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/memory/2276-132-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3376-145-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4844-146-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2424-147-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2900-148-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2276-152-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1048-153-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3376-163-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4844-164-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2424-165-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2900-166-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/1048-167-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe -
Drops file in System32 directory 13 IoCs
Processes:
55f9badb3207ed1867a1da4721c65f4dc284cd4a49968266e530e52b84b2ef21.exedowlljwlxt.exebiqydchu.exebiqydchu.exedescription ioc process File created C:\Windows\SysWOW64\biqydchu.exe 55f9badb3207ed1867a1da4721c65f4dc284cd4a49968266e530e52b84b2ef21.exe File opened for modification C:\Windows\SysWOW64\biqydchu.exe 55f9badb3207ed1867a1da4721c65f4dc284cd4a49968266e530e52b84b2ef21.exe File created C:\Windows\SysWOW64\ggtghcohwsobb.exe 55f9badb3207ed1867a1da4721c65f4dc284cd4a49968266e530e52b84b2ef21.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll dowlljwlxt.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe biqydchu.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe biqydchu.exe File created C:\Windows\SysWOW64\dowlljwlxt.exe 55f9badb3207ed1867a1da4721c65f4dc284cd4a49968266e530e52b84b2ef21.exe File opened for modification C:\Windows\SysWOW64\dowlljwlxt.exe 55f9badb3207ed1867a1da4721c65f4dc284cd4a49968266e530e52b84b2ef21.exe File opened for modification C:\Windows\SysWOW64\ggtghcohwsobb.exe 55f9badb3207ed1867a1da4721c65f4dc284cd4a49968266e530e52b84b2ef21.exe File created \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe biqydchu.exe File opened for modification \??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exe biqydchu.exe File created C:\Windows\SysWOW64\wcyqpezrmzsiqcs.exe 55f9badb3207ed1867a1da4721c65f4dc284cd4a49968266e530e52b84b2ef21.exe File opened for modification C:\Windows\SysWOW64\wcyqpezrmzsiqcs.exe 55f9badb3207ed1867a1da4721c65f4dc284cd4a49968266e530e52b84b2ef21.exe -
Drops file in Program Files directory 15 IoCs
Processes:
biqydchu.exebiqydchu.exedescription ioc process File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe biqydchu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe biqydchu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal biqydchu.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe biqydchu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe biqydchu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal biqydchu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal biqydchu.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe biqydchu.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe biqydchu.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe biqydchu.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe biqydchu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe biqydchu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal biqydchu.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe biqydchu.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe biqydchu.exe -
Drops file in Windows directory 3 IoCs
Processes:
55f9badb3207ed1867a1da4721c65f4dc284cd4a49968266e530e52b84b2ef21.exeWINWORD.EXEdescription ioc process File opened for modification C:\Windows\mydoc.rtf 55f9badb3207ed1867a1da4721c65f4dc284cd4a49968266e530e52b84b2ef21.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
WINWORD.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE -
Modifies registry class 20 IoCs
Processes:
dowlljwlxt.exe55f9badb3207ed1867a1da4721c65f4dc284cd4a49968266e530e52b84b2ef21.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" dowlljwlxt.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings 55f9badb3207ed1867a1da4721c65f4dc284cd4a49968266e530e52b84b2ef21.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33472C779D5583536A3076A177212CAB7C8665DD" 55f9badb3207ed1867a1da4721c65f4dc284cd4a49968266e530e52b84b2ef21.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7E8FFFFB4F5F856F9130D75D7DE1BDE5E635584467316345D7ED" 55f9badb3207ed1867a1da4721c65f4dc284cd4a49968266e530e52b84b2ef21.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" dowlljwlxt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf dowlljwlxt.exe Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 55f9badb3207ed1867a1da4721c65f4dc284cd4a49968266e530e52b84b2ef21.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BC9FACEFE64F29884093B4481EA3E93B0F903FE4212034BE2CF429C09A9" 55f9badb3207ed1867a1da4721c65f4dc284cd4a49968266e530e52b84b2ef21.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2FB2B15844EF38EB53CABAD1329DD4B8" 55f9badb3207ed1867a1da4721c65f4dc284cd4a49968266e530e52b84b2ef21.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E78068B4FF1F22DCD27DD0A98B799163" 55f9badb3207ed1867a1da4721c65f4dc284cd4a49968266e530e52b84b2ef21.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "184BC67E1491DAB1B8CF7C93EC9F37CA" 55f9badb3207ed1867a1da4721c65f4dc284cd4a49968266e530e52b84b2ef21.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh dowlljwlxt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" dowlljwlxt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs dowlljwlxt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" dowlljwlxt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg dowlljwlxt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat dowlljwlxt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" dowlljwlxt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc dowlljwlxt.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" dowlljwlxt.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 4864 WINWORD.EXE 4864 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
55f9badb3207ed1867a1da4721c65f4dc284cd4a49968266e530e52b84b2ef21.exedowlljwlxt.exewcyqpezrmzsiqcs.exebiqydchu.exeggtghcohwsobb.exebiqydchu.exepid process 2276 55f9badb3207ed1867a1da4721c65f4dc284cd4a49968266e530e52b84b2ef21.exe 2276 55f9badb3207ed1867a1da4721c65f4dc284cd4a49968266e530e52b84b2ef21.exe 2276 55f9badb3207ed1867a1da4721c65f4dc284cd4a49968266e530e52b84b2ef21.exe 2276 55f9badb3207ed1867a1da4721c65f4dc284cd4a49968266e530e52b84b2ef21.exe 2276 55f9badb3207ed1867a1da4721c65f4dc284cd4a49968266e530e52b84b2ef21.exe 2276 55f9badb3207ed1867a1da4721c65f4dc284cd4a49968266e530e52b84b2ef21.exe 2276 55f9badb3207ed1867a1da4721c65f4dc284cd4a49968266e530e52b84b2ef21.exe 2276 55f9badb3207ed1867a1da4721c65f4dc284cd4a49968266e530e52b84b2ef21.exe 2276 55f9badb3207ed1867a1da4721c65f4dc284cd4a49968266e530e52b84b2ef21.exe 2276 55f9badb3207ed1867a1da4721c65f4dc284cd4a49968266e530e52b84b2ef21.exe 2276 55f9badb3207ed1867a1da4721c65f4dc284cd4a49968266e530e52b84b2ef21.exe 2276 55f9badb3207ed1867a1da4721c65f4dc284cd4a49968266e530e52b84b2ef21.exe 2276 55f9badb3207ed1867a1da4721c65f4dc284cd4a49968266e530e52b84b2ef21.exe 2276 55f9badb3207ed1867a1da4721c65f4dc284cd4a49968266e530e52b84b2ef21.exe 2276 55f9badb3207ed1867a1da4721c65f4dc284cd4a49968266e530e52b84b2ef21.exe 2276 55f9badb3207ed1867a1da4721c65f4dc284cd4a49968266e530e52b84b2ef21.exe 3376 dowlljwlxt.exe 3376 dowlljwlxt.exe 3376 dowlljwlxt.exe 3376 dowlljwlxt.exe 3376 dowlljwlxt.exe 3376 dowlljwlxt.exe 3376 dowlljwlxt.exe 3376 dowlljwlxt.exe 4844 wcyqpezrmzsiqcs.exe 4844 wcyqpezrmzsiqcs.exe 3376 dowlljwlxt.exe 3376 dowlljwlxt.exe 4844 wcyqpezrmzsiqcs.exe 4844 wcyqpezrmzsiqcs.exe 4844 wcyqpezrmzsiqcs.exe 4844 wcyqpezrmzsiqcs.exe 4844 wcyqpezrmzsiqcs.exe 4844 wcyqpezrmzsiqcs.exe 2424 biqydchu.exe 2424 biqydchu.exe 2424 biqydchu.exe 2424 biqydchu.exe 2424 biqydchu.exe 2424 biqydchu.exe 2424 biqydchu.exe 2424 biqydchu.exe 4844 wcyqpezrmzsiqcs.exe 4844 wcyqpezrmzsiqcs.exe 2900 ggtghcohwsobb.exe 2900 ggtghcohwsobb.exe 2900 ggtghcohwsobb.exe 2900 ggtghcohwsobb.exe 2900 ggtghcohwsobb.exe 2900 ggtghcohwsobb.exe 2900 ggtghcohwsobb.exe 2900 ggtghcohwsobb.exe 2900 ggtghcohwsobb.exe 2900 ggtghcohwsobb.exe 2900 ggtghcohwsobb.exe 2900 ggtghcohwsobb.exe 4844 wcyqpezrmzsiqcs.exe 4844 wcyqpezrmzsiqcs.exe 1048 biqydchu.exe 1048 biqydchu.exe 1048 biqydchu.exe 1048 biqydchu.exe 1048 biqydchu.exe 1048 biqydchu.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
Processes:
55f9badb3207ed1867a1da4721c65f4dc284cd4a49968266e530e52b84b2ef21.exedowlljwlxt.exewcyqpezrmzsiqcs.exebiqydchu.exeggtghcohwsobb.exebiqydchu.exepid process 2276 55f9badb3207ed1867a1da4721c65f4dc284cd4a49968266e530e52b84b2ef21.exe 2276 55f9badb3207ed1867a1da4721c65f4dc284cd4a49968266e530e52b84b2ef21.exe 2276 55f9badb3207ed1867a1da4721c65f4dc284cd4a49968266e530e52b84b2ef21.exe 3376 dowlljwlxt.exe 3376 dowlljwlxt.exe 3376 dowlljwlxt.exe 4844 wcyqpezrmzsiqcs.exe 4844 wcyqpezrmzsiqcs.exe 4844 wcyqpezrmzsiqcs.exe 2424 biqydchu.exe 2424 biqydchu.exe 2424 biqydchu.exe 2900 ggtghcohwsobb.exe 2900 ggtghcohwsobb.exe 2900 ggtghcohwsobb.exe 1048 biqydchu.exe 1048 biqydchu.exe 1048 biqydchu.exe -
Suspicious use of SendNotifyMessage 18 IoCs
Processes:
55f9badb3207ed1867a1da4721c65f4dc284cd4a49968266e530e52b84b2ef21.exedowlljwlxt.exewcyqpezrmzsiqcs.exebiqydchu.exeggtghcohwsobb.exebiqydchu.exepid process 2276 55f9badb3207ed1867a1da4721c65f4dc284cd4a49968266e530e52b84b2ef21.exe 2276 55f9badb3207ed1867a1da4721c65f4dc284cd4a49968266e530e52b84b2ef21.exe 2276 55f9badb3207ed1867a1da4721c65f4dc284cd4a49968266e530e52b84b2ef21.exe 3376 dowlljwlxt.exe 3376 dowlljwlxt.exe 3376 dowlljwlxt.exe 4844 wcyqpezrmzsiqcs.exe 4844 wcyqpezrmzsiqcs.exe 4844 wcyqpezrmzsiqcs.exe 2424 biqydchu.exe 2424 biqydchu.exe 2424 biqydchu.exe 2900 ggtghcohwsobb.exe 2900 ggtghcohwsobb.exe 2900 ggtghcohwsobb.exe 1048 biqydchu.exe 1048 biqydchu.exe 1048 biqydchu.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
Processes:
WINWORD.EXEpid process 4864 WINWORD.EXE 4864 WINWORD.EXE 4864 WINWORD.EXE 4864 WINWORD.EXE 4864 WINWORD.EXE 4864 WINWORD.EXE 4864 WINWORD.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
55f9badb3207ed1867a1da4721c65f4dc284cd4a49968266e530e52b84b2ef21.exedowlljwlxt.exedescription pid process target process PID 2276 wrote to memory of 3376 2276 55f9badb3207ed1867a1da4721c65f4dc284cd4a49968266e530e52b84b2ef21.exe dowlljwlxt.exe PID 2276 wrote to memory of 3376 2276 55f9badb3207ed1867a1da4721c65f4dc284cd4a49968266e530e52b84b2ef21.exe dowlljwlxt.exe PID 2276 wrote to memory of 3376 2276 55f9badb3207ed1867a1da4721c65f4dc284cd4a49968266e530e52b84b2ef21.exe dowlljwlxt.exe PID 2276 wrote to memory of 4844 2276 55f9badb3207ed1867a1da4721c65f4dc284cd4a49968266e530e52b84b2ef21.exe wcyqpezrmzsiqcs.exe PID 2276 wrote to memory of 4844 2276 55f9badb3207ed1867a1da4721c65f4dc284cd4a49968266e530e52b84b2ef21.exe wcyqpezrmzsiqcs.exe PID 2276 wrote to memory of 4844 2276 55f9badb3207ed1867a1da4721c65f4dc284cd4a49968266e530e52b84b2ef21.exe wcyqpezrmzsiqcs.exe PID 2276 wrote to memory of 2424 2276 55f9badb3207ed1867a1da4721c65f4dc284cd4a49968266e530e52b84b2ef21.exe biqydchu.exe PID 2276 wrote to memory of 2424 2276 55f9badb3207ed1867a1da4721c65f4dc284cd4a49968266e530e52b84b2ef21.exe biqydchu.exe PID 2276 wrote to memory of 2424 2276 55f9badb3207ed1867a1da4721c65f4dc284cd4a49968266e530e52b84b2ef21.exe biqydchu.exe PID 2276 wrote to memory of 2900 2276 55f9badb3207ed1867a1da4721c65f4dc284cd4a49968266e530e52b84b2ef21.exe ggtghcohwsobb.exe PID 2276 wrote to memory of 2900 2276 55f9badb3207ed1867a1da4721c65f4dc284cd4a49968266e530e52b84b2ef21.exe ggtghcohwsobb.exe PID 2276 wrote to memory of 2900 2276 55f9badb3207ed1867a1da4721c65f4dc284cd4a49968266e530e52b84b2ef21.exe ggtghcohwsobb.exe PID 3376 wrote to memory of 1048 3376 dowlljwlxt.exe biqydchu.exe PID 3376 wrote to memory of 1048 3376 dowlljwlxt.exe biqydchu.exe PID 3376 wrote to memory of 1048 3376 dowlljwlxt.exe biqydchu.exe PID 2276 wrote to memory of 4864 2276 55f9badb3207ed1867a1da4721c65f4dc284cd4a49968266e530e52b84b2ef21.exe WINWORD.EXE PID 2276 wrote to memory of 4864 2276 55f9badb3207ed1867a1da4721c65f4dc284cd4a49968266e530e52b84b2ef21.exe WINWORD.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\55f9badb3207ed1867a1da4721c65f4dc284cd4a49968266e530e52b84b2ef21.exe"C:\Users\Admin\AppData\Local\Temp\55f9badb3207ed1867a1da4721c65f4dc284cd4a49968266e530e52b84b2ef21.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\dowlljwlxt.exedowlljwlxt.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\biqydchu.exeC:\Windows\system32\biqydchu.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\wcyqpezrmzsiqcs.exewcyqpezrmzsiqcs.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\biqydchu.exebiqydchu.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\SysWOW64\ggtghcohwsobb.exeggtghcohwsobb.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hidden Files and Directories
2Modify Registry
6Disabling Security Tools
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exeFilesize
255KB
MD5c8ed1ee997f335048814a452b5e59b33
SHA1dcb2c5f831fd6c9dffac99b987e1fe5d720322e8
SHA256d642a076b36fd860cfa28e41e5b1afaed17a7e0e587f24818ea40b4e34088cd3
SHA5123df732575051e7886311436a7c4a92df6694b8444edd0862b8b5048ca77d3160d52d96e846214464a236745dc29eb962b8dba6eea176b9a1ecc885f96f7dae5b
-
C:\Windows\SysWOW64\biqydchu.exeFilesize
255KB
MD598cfc3300db0b040b6a3d071610e15f4
SHA106cd9ac4ed41d37ad8b639faaf1d542d654f4243
SHA256fc7128d214c3a7923fefc195a8613d2deb43aeff927a1cb30fa8fde017e48bd3
SHA51297d61ebd6d83541b1bd97444ad18fca5c2b6ec4ebeb48745a1bf18fa6bfbd734cc9c21f327e42023d2ce9c99a9183d6a6c1aa311cdafde74e24b8a67b69b3eb7
-
C:\Windows\SysWOW64\biqydchu.exeFilesize
255KB
MD598cfc3300db0b040b6a3d071610e15f4
SHA106cd9ac4ed41d37ad8b639faaf1d542d654f4243
SHA256fc7128d214c3a7923fefc195a8613d2deb43aeff927a1cb30fa8fde017e48bd3
SHA51297d61ebd6d83541b1bd97444ad18fca5c2b6ec4ebeb48745a1bf18fa6bfbd734cc9c21f327e42023d2ce9c99a9183d6a6c1aa311cdafde74e24b8a67b69b3eb7
-
C:\Windows\SysWOW64\biqydchu.exeFilesize
255KB
MD598cfc3300db0b040b6a3d071610e15f4
SHA106cd9ac4ed41d37ad8b639faaf1d542d654f4243
SHA256fc7128d214c3a7923fefc195a8613d2deb43aeff927a1cb30fa8fde017e48bd3
SHA51297d61ebd6d83541b1bd97444ad18fca5c2b6ec4ebeb48745a1bf18fa6bfbd734cc9c21f327e42023d2ce9c99a9183d6a6c1aa311cdafde74e24b8a67b69b3eb7
-
C:\Windows\SysWOW64\dowlljwlxt.exeFilesize
255KB
MD526eb5f457d0ad0dcb7c28814122b0347
SHA167cef1aa0c81e6ace5d8a3cc824808c811f9af71
SHA256d2500ec2e12767ccbc42413f8f379d605e93a8d2c3c401c0ffe7de280f77a9d5
SHA512fdc7a426bf68c3bfd33487f9587f60fc45d496c9cd189c23cf63d745c7ce817109caff50671475c6697c3dfe1544c7b740f25db1e02563e81c5dfed22a511687
-
C:\Windows\SysWOW64\dowlljwlxt.exeFilesize
255KB
MD526eb5f457d0ad0dcb7c28814122b0347
SHA167cef1aa0c81e6ace5d8a3cc824808c811f9af71
SHA256d2500ec2e12767ccbc42413f8f379d605e93a8d2c3c401c0ffe7de280f77a9d5
SHA512fdc7a426bf68c3bfd33487f9587f60fc45d496c9cd189c23cf63d745c7ce817109caff50671475c6697c3dfe1544c7b740f25db1e02563e81c5dfed22a511687
-
C:\Windows\SysWOW64\ggtghcohwsobb.exeFilesize
255KB
MD5d87c4bb3817dab0b2a57fecdbc1bbdfe
SHA1aa0473e338ee5e8f078f8608f6dc18dc986d0409
SHA25608dc403bcb321cf70a82cf0f7a0a9c596d20fba2a4c58821d83d32b2364024d0
SHA51244727eee7fc1670ee8e2e0a0545eb54b01eb5558fe0a737402f3bdcc00f176c37eb2f32a5f559f2ff568949374b845e57d4e945f749f8892c35d681e3c74771e
-
C:\Windows\SysWOW64\ggtghcohwsobb.exeFilesize
255KB
MD5d87c4bb3817dab0b2a57fecdbc1bbdfe
SHA1aa0473e338ee5e8f078f8608f6dc18dc986d0409
SHA25608dc403bcb321cf70a82cf0f7a0a9c596d20fba2a4c58821d83d32b2364024d0
SHA51244727eee7fc1670ee8e2e0a0545eb54b01eb5558fe0a737402f3bdcc00f176c37eb2f32a5f559f2ff568949374b845e57d4e945f749f8892c35d681e3c74771e
-
C:\Windows\SysWOW64\wcyqpezrmzsiqcs.exeFilesize
255KB
MD5446a60af8c4efb79822366917bd05ad4
SHA17a4684515d5fcc1504c07def4489bce89711d8cb
SHA256dc6d43cb709defee5218730dff7d0840bb486a074c751caeab684e9f19918add
SHA5121da1b61480f4cb70094b1bcd6da4208036fa27933e8fe615ae95d8151f290f38133f65b8196ac3db6e0176e69a194361a75e4c3c87e1819f5e01d66f8889d872
-
C:\Windows\SysWOW64\wcyqpezrmzsiqcs.exeFilesize
255KB
MD5446a60af8c4efb79822366917bd05ad4
SHA17a4684515d5fcc1504c07def4489bce89711d8cb
SHA256dc6d43cb709defee5218730dff7d0840bb486a074c751caeab684e9f19918add
SHA5121da1b61480f4cb70094b1bcd6da4208036fa27933e8fe615ae95d8151f290f38133f65b8196ac3db6e0176e69a194361a75e4c3c87e1819f5e01d66f8889d872
-
C:\Windows\mydoc.rtfFilesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
\??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exeFilesize
255KB
MD51c1d99e8487018f427b996826d74febd
SHA183c7ea450371a608af5d30632ac9ee93abbe0270
SHA2564b1e9db2c735a68eed1d902eb586e1f587cbd0289304090ece05e7eea303deb6
SHA5124a0685e22204e341ad2609e83687c9b47e62e0eab346b5774ad5929d16e4c74d4a8d4fd8e9fd9df89b4d51aaae5930c9c0b7a027e57859e8809cb3d6710f84a6
-
\??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exeFilesize
255KB
MD5f3f516dff2ecdcf07536dc421caf5a2a
SHA18103b9b5ffeef7c7e38e4e13488b7562b1c896da
SHA256a29d809e0c7f6c29690e2f934d4d33faa6a77dc7ff2958e8a6f4e007055eab72
SHA512e3006544d29544bbff08bf29a5fb82c47ee4889ad3d006308756842572bd19e08c7f67dd4274040e8598547a3984fe537e0a42139f61677c0f75fc183d1cfee1
-
\??\c:\Windows\SysWOW64\MSDRM\MsoIrmProtector.doc.exeFilesize
255KB
MD5ae2c47066856a3aac1348d03a436c656
SHA15d6088af1709bc7a28d192514c653d3c43515c6c
SHA25641dbd270411a8c23254b5a2f7b6c2c67feb8db44434b7096f63f20a83208c922
SHA5122f859f28e3cf2c571df12cae05b405d5810304e2af4099f50395b3822a5d936b186101c6c0613a317b635402b7ce05486a7ca3e1e33ed46bc46596218c151f2b
-
memory/1048-167-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1048-153-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/1048-149-0x0000000000000000-mapping.dmp
-
memory/2276-132-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/2276-152-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/2424-139-0x0000000000000000-mapping.dmp
-
memory/2424-147-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/2424-165-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/2900-148-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/2900-142-0x0000000000000000-mapping.dmp
-
memory/2900-166-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/3376-163-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/3376-145-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/3376-133-0x0000000000000000-mapping.dmp
-
memory/4844-146-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/4844-136-0x0000000000000000-mapping.dmp
-
memory/4844-164-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/4864-154-0x00007FF8E3A30000-0x00007FF8E3A40000-memory.dmpFilesize
64KB
-
memory/4864-162-0x00007FF8E1100000-0x00007FF8E1110000-memory.dmpFilesize
64KB
-
memory/4864-161-0x00007FF8E1100000-0x00007FF8E1110000-memory.dmpFilesize
64KB
-
memory/4864-158-0x00007FF8E3A30000-0x00007FF8E3A40000-memory.dmpFilesize
64KB
-
memory/4864-157-0x00007FF8E3A30000-0x00007FF8E3A40000-memory.dmpFilesize
64KB
-
memory/4864-156-0x00007FF8E3A30000-0x00007FF8E3A40000-memory.dmpFilesize
64KB
-
memory/4864-155-0x00007FF8E3A30000-0x00007FF8E3A40000-memory.dmpFilesize
64KB
-
memory/4864-151-0x0000000000000000-mapping.dmp