Analysis
-
max time kernel
193s -
max time network
204s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 21:05
Behavioral task
behavioral1
Sample
4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de.exe
Resource
win10v2004-20221111-en
General
-
Target
4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de.exe
-
Size
255KB
-
MD5
a9d7cbb5181378efc439ff9b2119c7ec
-
SHA1
9bc8b8bf39e1132d075421c3af939bb9e7f476f4
-
SHA256
4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de
-
SHA512
61281358f96e9e8bbfdf4844a095facfe26e0082beb83f90b7b61b86cfae9f82ce428b2d9ff35ff96d5caea253fddc52a2b1fd292f6bca5e30794230c2c7027a
-
SSDEEP
3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJv:1xlZam+akqx6YQJXcNlEHUIQeE3mmBI2
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
Processes:
ddxtndgbnb.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" ddxtndgbnb.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
Processes:
ddxtndgbnb.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" ddxtndgbnb.exe -
Processes:
ddxtndgbnb.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ddxtndgbnb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ddxtndgbnb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ddxtndgbnb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ddxtndgbnb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" ddxtndgbnb.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
ddxtndgbnb.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" ddxtndgbnb.exe -
Executes dropped EXE 5 IoCs
Processes:
ddxtndgbnb.exezfxnwyxfladgbhy.exeuxbpgqez.exexfvxcrzzpcuuq.exeuxbpgqez.exepid process 4316 ddxtndgbnb.exe 3068 zfxnwyxfladgbhy.exe 4808 uxbpgqez.exe 2592 xfvxcrzzpcuuq.exe 5028 uxbpgqez.exe -
Processes:
resource yara_rule behavioral2/memory/4376-132-0x0000000000400000-0x00000000004A0000-memory.dmp upx C:\Windows\SysWOW64\ddxtndgbnb.exe upx C:\Windows\SysWOW64\ddxtndgbnb.exe upx C:\Windows\SysWOW64\zfxnwyxfladgbhy.exe upx C:\Windows\SysWOW64\zfxnwyxfladgbhy.exe upx C:\Windows\SysWOW64\uxbpgqez.exe upx C:\Windows\SysWOW64\xfvxcrzzpcuuq.exe upx C:\Windows\SysWOW64\xfvxcrzzpcuuq.exe upx C:\Windows\SysWOW64\uxbpgqez.exe upx behavioral2/memory/4316-145-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3068-146-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4808-147-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2592-148-0x0000000000400000-0x00000000004A0000-memory.dmp upx C:\Windows\SysWOW64\uxbpgqez.exe upx behavioral2/memory/4376-152-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/5028-153-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4316-154-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/3068-155-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/4808-156-0x0000000000400000-0x00000000004A0000-memory.dmp upx behavioral2/memory/2592-157-0x0000000000400000-0x00000000004A0000-memory.dmp upx C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\Control Panel\International\Geo\Nation 4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de.exe -
Processes:
ddxtndgbnb.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" ddxtndgbnb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" ddxtndgbnb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" ddxtndgbnb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" ddxtndgbnb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirstRunDisabled = "1" ddxtndgbnb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" ddxtndgbnb.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
zfxnwyxfladgbhy.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run zfxnwyxfladgbhy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\iorgreah = "ddxtndgbnb.exe" zfxnwyxfladgbhy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ytvjapdb = "zfxnwyxfladgbhy.exe" zfxnwyxfladgbhy.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "xfvxcrzzpcuuq.exe" zfxnwyxfladgbhy.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
ddxtndgbnb.exeuxbpgqez.exeuxbpgqez.exedescription ioc process File opened (read-only) \??\y: ddxtndgbnb.exe File opened (read-only) \??\e: uxbpgqez.exe File opened (read-only) \??\f: uxbpgqez.exe File opened (read-only) \??\l: uxbpgqez.exe File opened (read-only) \??\v: ddxtndgbnb.exe File opened (read-only) \??\a: ddxtndgbnb.exe File opened (read-only) \??\l: uxbpgqez.exe File opened (read-only) \??\g: uxbpgqez.exe File opened (read-only) \??\k: uxbpgqez.exe File opened (read-only) \??\v: uxbpgqez.exe File opened (read-only) \??\l: ddxtndgbnb.exe File opened (read-only) \??\o: uxbpgqez.exe File opened (read-only) \??\s: uxbpgqez.exe File opened (read-only) \??\m: ddxtndgbnb.exe File opened (read-only) \??\s: ddxtndgbnb.exe File opened (read-only) \??\b: uxbpgqez.exe File opened (read-only) \??\s: uxbpgqez.exe File opened (read-only) \??\p: ddxtndgbnb.exe File opened (read-only) \??\v: uxbpgqez.exe File opened (read-only) \??\w: uxbpgqez.exe File opened (read-only) \??\i: ddxtndgbnb.exe File opened (read-only) \??\g: uxbpgqez.exe File opened (read-only) \??\h: uxbpgqez.exe File opened (read-only) \??\j: uxbpgqez.exe File opened (read-only) \??\h: uxbpgqez.exe File opened (read-only) \??\j: uxbpgqez.exe File opened (read-only) \??\o: ddxtndgbnb.exe File opened (read-only) \??\r: ddxtndgbnb.exe File opened (read-only) \??\x: ddxtndgbnb.exe File opened (read-only) \??\i: uxbpgqez.exe File opened (read-only) \??\e: uxbpgqez.exe File opened (read-only) \??\t: uxbpgqez.exe File opened (read-only) \??\h: ddxtndgbnb.exe File opened (read-only) \??\z: ddxtndgbnb.exe File opened (read-only) \??\m: uxbpgqez.exe File opened (read-only) \??\i: uxbpgqez.exe File opened (read-only) \??\z: uxbpgqez.exe File opened (read-only) \??\r: uxbpgqez.exe File opened (read-only) \??\n: uxbpgqez.exe File opened (read-only) \??\r: uxbpgqez.exe File opened (read-only) \??\n: ddxtndgbnb.exe File opened (read-only) \??\u: ddxtndgbnb.exe File opened (read-only) \??\w: uxbpgqez.exe File opened (read-only) \??\p: uxbpgqez.exe File opened (read-only) \??\x: uxbpgqez.exe File opened (read-only) \??\k: ddxtndgbnb.exe File opened (read-only) \??\q: ddxtndgbnb.exe File opened (read-only) \??\a: uxbpgqez.exe File opened (read-only) \??\t: uxbpgqez.exe File opened (read-only) \??\a: uxbpgqez.exe File opened (read-only) \??\e: ddxtndgbnb.exe File opened (read-only) \??\n: uxbpgqez.exe File opened (read-only) \??\f: ddxtndgbnb.exe File opened (read-only) \??\g: ddxtndgbnb.exe File opened (read-only) \??\t: ddxtndgbnb.exe File opened (read-only) \??\w: ddxtndgbnb.exe File opened (read-only) \??\q: uxbpgqez.exe File opened (read-only) \??\f: uxbpgqez.exe File opened (read-only) \??\b: ddxtndgbnb.exe File opened (read-only) \??\p: uxbpgqez.exe File opened (read-only) \??\u: uxbpgqez.exe File opened (read-only) \??\m: uxbpgqez.exe File opened (read-only) \??\k: uxbpgqez.exe File opened (read-only) \??\u: uxbpgqez.exe -
Modifies WinLogon 2 TTPs 2 IoCs
Processes:
ddxtndgbnb.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0" ddxtndgbnb.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197" ddxtndgbnb.exe -
AutoIT Executable 10 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule behavioral2/memory/4316-145-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3068-146-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4808-147-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2592-148-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4376-152-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/5028-153-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4316-154-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/3068-155-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/4808-156-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe behavioral2/memory/2592-157-0x0000000000400000-0x00000000004A0000-memory.dmp autoit_exe -
Drops file in System32 directory 9 IoCs
Processes:
4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de.exeddxtndgbnb.exedescription ioc process File opened for modification C:\Windows\SysWOW64\zfxnwyxfladgbhy.exe 4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de.exe File created C:\Windows\SysWOW64\xfvxcrzzpcuuq.exe 4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de.exe File opened for modification C:\Windows\SysWOW64\ddxtndgbnb.exe 4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de.exe File created C:\Windows\SysWOW64\zfxnwyxfladgbhy.exe 4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de.exe File created C:\Windows\SysWOW64\uxbpgqez.exe 4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de.exe File opened for modification C:\Windows\SysWOW64\uxbpgqez.exe 4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de.exe File opened for modification C:\Windows\SysWOW64\xfvxcrzzpcuuq.exe 4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de.exe File opened for modification C:\Windows\SysWOW64\msvbvm60.dll ddxtndgbnb.exe File created C:\Windows\SysWOW64\ddxtndgbnb.exe 4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de.exe -
Drops file in Program Files directory 14 IoCs
Processes:
uxbpgqez.exeuxbpgqez.exedescription ioc process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe uxbpgqez.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal uxbpgqez.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe uxbpgqez.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe uxbpgqez.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe uxbpgqez.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal uxbpgqez.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.nal uxbpgqez.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.nal uxbpgqez.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe uxbpgqez.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe uxbpgqez.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe uxbpgqez.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe uxbpgqez.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exe uxbpgqez.exe File created \??\c:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.DOC.exe uxbpgqez.exe -
Drops file in Windows directory 3 IoCs
Processes:
4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de.exeWINWORD.EXEdescription ioc process File opened for modification C:\Windows\mydoc.rtf 4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de.exe File opened for modification C:\Windows\mydoc.rtf WINWORD.EXE File created C:\Windows\~$mydoc.rtf WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WINWORD.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WINWORD.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WINWORD.EXE -
Enumerates system info in registry 2 TTPs 5 IoCs
Processes:
WINWORD.EXESearchApp.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily WINWORD.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WINWORD.EXE Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchApp.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchApp.exe -
Modifies registry class 21 IoCs
Processes:
4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de.exeddxtndgbnb.exeSearchApp.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Classes\CLV.Classes 4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com1 = "33472C7C9D2182206A3276D470212CDC7D8064DB" 4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com4 = "7FF9FFF84F2682199142D65A7EE6BCE7E632594466426244D6EC" 4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat ddxtndgbnb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile" ddxtndgbnb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile" ddxtndgbnb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "txtfile" ddxtndgbnb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2EB7B05B479738E253C9B9D332E9D4CC" 4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsh ddxtndgbnb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile" ddxtndgbnb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs ddxtndgbnb.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom1 = "E7816BC1FF6621DFD172D0D28A789162" 4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile" ddxtndgbnb.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings\MuiCache SearchApp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com2 = "6BBFFAC9FE65F197840C3A3181EC3997B0FA028A4313033EE1CC42E809A3" 4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\StartCom2 = "1949C77514E4DAB1B8BC7FE4EDE534CB" 4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.WSH\ = "txtfile" ddxtndgbnb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsc ddxtndgbnb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.wsf ddxtndgbnb.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg ddxtndgbnb.exe Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000_Classes\Local Settings 4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
WINWORD.EXEpid process 4724 WINWORD.EXE 4724 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de.exeddxtndgbnb.exezfxnwyxfladgbhy.exeuxbpgqez.exexfvxcrzzpcuuq.exeuxbpgqez.exepid process 4376 4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de.exe 4376 4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de.exe 4376 4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de.exe 4376 4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de.exe 4376 4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de.exe 4376 4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de.exe 4376 4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de.exe 4376 4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de.exe 4376 4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de.exe 4376 4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de.exe 4376 4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de.exe 4376 4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de.exe 4376 4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de.exe 4376 4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de.exe 4376 4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de.exe 4376 4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de.exe 4316 ddxtndgbnb.exe 4316 ddxtndgbnb.exe 4316 ddxtndgbnb.exe 4316 ddxtndgbnb.exe 4316 ddxtndgbnb.exe 4316 ddxtndgbnb.exe 4316 ddxtndgbnb.exe 4316 ddxtndgbnb.exe 3068 zfxnwyxfladgbhy.exe 3068 zfxnwyxfladgbhy.exe 4316 ddxtndgbnb.exe 4316 ddxtndgbnb.exe 3068 zfxnwyxfladgbhy.exe 3068 zfxnwyxfladgbhy.exe 3068 zfxnwyxfladgbhy.exe 3068 zfxnwyxfladgbhy.exe 3068 zfxnwyxfladgbhy.exe 3068 zfxnwyxfladgbhy.exe 4808 uxbpgqez.exe 4808 uxbpgqez.exe 4808 uxbpgqez.exe 4808 uxbpgqez.exe 3068 zfxnwyxfladgbhy.exe 3068 zfxnwyxfladgbhy.exe 4808 uxbpgqez.exe 4808 uxbpgqez.exe 4808 uxbpgqez.exe 4808 uxbpgqez.exe 2592 xfvxcrzzpcuuq.exe 2592 xfvxcrzzpcuuq.exe 2592 xfvxcrzzpcuuq.exe 2592 xfvxcrzzpcuuq.exe 2592 xfvxcrzzpcuuq.exe 2592 xfvxcrzzpcuuq.exe 2592 xfvxcrzzpcuuq.exe 2592 xfvxcrzzpcuuq.exe 2592 xfvxcrzzpcuuq.exe 2592 xfvxcrzzpcuuq.exe 2592 xfvxcrzzpcuuq.exe 2592 xfvxcrzzpcuuq.exe 5028 uxbpgqez.exe 5028 uxbpgqez.exe 5028 uxbpgqez.exe 5028 uxbpgqez.exe 5028 uxbpgqez.exe 5028 uxbpgqez.exe 5028 uxbpgqez.exe 5028 uxbpgqez.exe -
Suspicious use of FindShellTrayWindow 18 IoCs
Processes:
4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de.exeddxtndgbnb.exezfxnwyxfladgbhy.exeuxbpgqez.exexfvxcrzzpcuuq.exeuxbpgqez.exepid process 4376 4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de.exe 4376 4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de.exe 4376 4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de.exe 4316 ddxtndgbnb.exe 4316 ddxtndgbnb.exe 4316 ddxtndgbnb.exe 3068 zfxnwyxfladgbhy.exe 3068 zfxnwyxfladgbhy.exe 3068 zfxnwyxfladgbhy.exe 4808 uxbpgqez.exe 4808 uxbpgqez.exe 4808 uxbpgqez.exe 2592 xfvxcrzzpcuuq.exe 2592 xfvxcrzzpcuuq.exe 2592 xfvxcrzzpcuuq.exe 5028 uxbpgqez.exe 5028 uxbpgqez.exe 5028 uxbpgqez.exe -
Suspicious use of SendNotifyMessage 18 IoCs
Processes:
4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de.exeddxtndgbnb.exezfxnwyxfladgbhy.exeuxbpgqez.exexfvxcrzzpcuuq.exeuxbpgqez.exepid process 4376 4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de.exe 4376 4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de.exe 4376 4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de.exe 4316 ddxtndgbnb.exe 4316 ddxtndgbnb.exe 4316 ddxtndgbnb.exe 3068 zfxnwyxfladgbhy.exe 3068 zfxnwyxfladgbhy.exe 3068 zfxnwyxfladgbhy.exe 4808 uxbpgqez.exe 4808 uxbpgqez.exe 4808 uxbpgqez.exe 2592 xfvxcrzzpcuuq.exe 2592 xfvxcrzzpcuuq.exe 2592 xfvxcrzzpcuuq.exe 5028 uxbpgqez.exe 5028 uxbpgqez.exe 5028 uxbpgqez.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
WINWORD.EXESearchApp.exepid process 4724 WINWORD.EXE 4724 WINWORD.EXE 4724 WINWORD.EXE 4724 WINWORD.EXE 4724 WINWORD.EXE 4724 WINWORD.EXE 4724 WINWORD.EXE 4236 SearchApp.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de.exeddxtndgbnb.exedescription pid process target process PID 4376 wrote to memory of 4316 4376 4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de.exe ddxtndgbnb.exe PID 4376 wrote to memory of 4316 4376 4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de.exe ddxtndgbnb.exe PID 4376 wrote to memory of 4316 4376 4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de.exe ddxtndgbnb.exe PID 4376 wrote to memory of 3068 4376 4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de.exe zfxnwyxfladgbhy.exe PID 4376 wrote to memory of 3068 4376 4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de.exe zfxnwyxfladgbhy.exe PID 4376 wrote to memory of 3068 4376 4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de.exe zfxnwyxfladgbhy.exe PID 4376 wrote to memory of 4808 4376 4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de.exe uxbpgqez.exe PID 4376 wrote to memory of 4808 4376 4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de.exe uxbpgqez.exe PID 4376 wrote to memory of 4808 4376 4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de.exe uxbpgqez.exe PID 4376 wrote to memory of 2592 4376 4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de.exe xfvxcrzzpcuuq.exe PID 4376 wrote to memory of 2592 4376 4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de.exe xfvxcrzzpcuuq.exe PID 4376 wrote to memory of 2592 4376 4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de.exe xfvxcrzzpcuuq.exe PID 4376 wrote to memory of 4724 4376 4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de.exe WINWORD.EXE PID 4376 wrote to memory of 4724 4376 4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de.exe WINWORD.EXE PID 4316 wrote to memory of 5028 4316 ddxtndgbnb.exe uxbpgqez.exe PID 4316 wrote to memory of 5028 4316 ddxtndgbnb.exe uxbpgqez.exe PID 4316 wrote to memory of 5028 4316 ddxtndgbnb.exe uxbpgqez.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de.exe"C:\Users\Admin\AppData\Local\Temp\4fc362a942b27468efc2c852cacc200952b5f7a170928fa4036900c657d5b4de.exe"1⤵
- Checks computer location settings
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Windows\SysWOW64\ddxtndgbnb.exeddxtndgbnb.exe2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Windows security modification
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Windows\SysWOW64\uxbpgqez.exeC:\Windows\system32\uxbpgqez.exe3⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5028 -
C:\Windows\SysWOW64\zfxnwyxfladgbhy.exezfxnwyxfladgbhy.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3068 -
C:\Windows\SysWOW64\uxbpgqez.exeuxbpgqez.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4808 -
C:\Windows\SysWOW64\xfvxcrzzpcuuq.exexfvxcrzzpcuuq.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2592 -
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Windows\mydoc.rtf" /o ""2⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4724
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4236
Network
MITRE ATT&CK Enterprise v6
Persistence
Hidden Files and Directories
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Disabling Security Tools
2Hidden Files and Directories
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC.exeFilesize
255KB
MD58f938afc49bf784830a1c84ffb757e65
SHA18cd0181e1b63b13566e16e5fcbf134ae67d75154
SHA25632d6b7363d0234d755c2223c3af30b7bad57c72c3ddaa195332034c0e1d926a9
SHA512950f1b91df0e22eeedba45131a75462fae7327890c802de4b7471d9ad5e99cba39736cb4a36c0a89f8829aab8ff5157dc82209c87b902c4678bdd29862b7e6d0
-
C:\Windows\SysWOW64\ddxtndgbnb.exeFilesize
255KB
MD5d9567990931aefcf0ae72b4eede2c5e2
SHA1dae3d183d533a7ef7d1057a16ac0d8db5c64e282
SHA256799124facd4fdfa44a98ac9c06f26fb0bbbb50b28e0553fa06db06bdaecab54b
SHA51222b431eb4e701e1e13e6bfc595a505aac3a05cb4d2147f69f9afa6d6774223037c59c0a49bf082c730db20c827a78bf2fd61b85e8aaff734c2deba605c585f1c
-
C:\Windows\SysWOW64\ddxtndgbnb.exeFilesize
255KB
MD5d9567990931aefcf0ae72b4eede2c5e2
SHA1dae3d183d533a7ef7d1057a16ac0d8db5c64e282
SHA256799124facd4fdfa44a98ac9c06f26fb0bbbb50b28e0553fa06db06bdaecab54b
SHA51222b431eb4e701e1e13e6bfc595a505aac3a05cb4d2147f69f9afa6d6774223037c59c0a49bf082c730db20c827a78bf2fd61b85e8aaff734c2deba605c585f1c
-
C:\Windows\SysWOW64\uxbpgqez.exeFilesize
255KB
MD56aed1669dee0b5844c5c27b747e6e5f6
SHA100d7d677ba3c6f2ae274ebddb9911e79018f8408
SHA2560ef6c79ed9fa7615494c15e45711fa6e1f5c58f080ea28830655e01e8fdd745f
SHA512191afb526bc8119b312773e40db21f529b6b6baf9929f09877671c8cd0a50da76b4b653da8553ef5989e4aa9df3a18aed224603ee4827fb9e4d60ceeeb7bdfea
-
C:\Windows\SysWOW64\uxbpgqez.exeFilesize
255KB
MD56aed1669dee0b5844c5c27b747e6e5f6
SHA100d7d677ba3c6f2ae274ebddb9911e79018f8408
SHA2560ef6c79ed9fa7615494c15e45711fa6e1f5c58f080ea28830655e01e8fdd745f
SHA512191afb526bc8119b312773e40db21f529b6b6baf9929f09877671c8cd0a50da76b4b653da8553ef5989e4aa9df3a18aed224603ee4827fb9e4d60ceeeb7bdfea
-
C:\Windows\SysWOW64\uxbpgqez.exeFilesize
255KB
MD56aed1669dee0b5844c5c27b747e6e5f6
SHA100d7d677ba3c6f2ae274ebddb9911e79018f8408
SHA2560ef6c79ed9fa7615494c15e45711fa6e1f5c58f080ea28830655e01e8fdd745f
SHA512191afb526bc8119b312773e40db21f529b6b6baf9929f09877671c8cd0a50da76b4b653da8553ef5989e4aa9df3a18aed224603ee4827fb9e4d60ceeeb7bdfea
-
C:\Windows\SysWOW64\xfvxcrzzpcuuq.exeFilesize
255KB
MD5fe122e8b7ec7b9407a3f482985563a0b
SHA102d45fb8ee3cafc01e8c560f8b327f65d525e809
SHA2568ad4ad6c99f6e45f405e33b01cc65c90a8ddba1ee0d34e6121be9df909fe40b8
SHA5123c9a6efaa750a06d68062ef45381cba5323478458b29530fa4d8b8b3768957041a7d22d55fc7db7c28aeac6d06485e117a9fed18d7e7bcad74f03a4c92dee557
-
C:\Windows\SysWOW64\xfvxcrzzpcuuq.exeFilesize
255KB
MD5fe122e8b7ec7b9407a3f482985563a0b
SHA102d45fb8ee3cafc01e8c560f8b327f65d525e809
SHA2568ad4ad6c99f6e45f405e33b01cc65c90a8ddba1ee0d34e6121be9df909fe40b8
SHA5123c9a6efaa750a06d68062ef45381cba5323478458b29530fa4d8b8b3768957041a7d22d55fc7db7c28aeac6d06485e117a9fed18d7e7bcad74f03a4c92dee557
-
C:\Windows\SysWOW64\zfxnwyxfladgbhy.exeFilesize
255KB
MD58835b75f6d2a61fadc521ff7665c8866
SHA1bb86bb391f8d27c6c7190628ef53917d7e9ece72
SHA2565789424fa5dd847b2c53865551008afcf45474f27112d2bfd3e8d0507915bfc5
SHA512e79a7fe6c29fb1b600f02dee110a83179d759c3b0fafe63fdba51c2361f367c2259c4c56c7cf56eafd4b32eb6331452b14ddf8c4b4b39714d921d98f490b7406
-
C:\Windows\SysWOW64\zfxnwyxfladgbhy.exeFilesize
255KB
MD58835b75f6d2a61fadc521ff7665c8866
SHA1bb86bb391f8d27c6c7190628ef53917d7e9ece72
SHA2565789424fa5dd847b2c53865551008afcf45474f27112d2bfd3e8d0507915bfc5
SHA512e79a7fe6c29fb1b600f02dee110a83179d759c3b0fafe63fdba51c2361f367c2259c4c56c7cf56eafd4b32eb6331452b14ddf8c4b4b39714d921d98f490b7406
-
C:\Windows\mydoc.rtfFilesize
223B
MD506604e5941c126e2e7be02c5cd9f62ec
SHA14eb9fdf8ff4e1e539236002bd363b82c8f8930e1
SHA25685f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2
SHA512803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7
-
memory/2592-148-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/2592-142-0x0000000000000000-mapping.dmp
-
memory/2592-157-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/3068-146-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/3068-136-0x0000000000000000-mapping.dmp
-
memory/3068-155-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/4316-154-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/4316-145-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/4316-133-0x0000000000000000-mapping.dmp
-
memory/4376-132-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/4376-152-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/4724-159-0x00007FF885A70000-0x00007FF885A80000-memory.dmpFilesize
64KB
-
memory/4724-158-0x00007FF885A70000-0x00007FF885A80000-memory.dmpFilesize
64KB
-
memory/4724-150-0x0000000000000000-mapping.dmp
-
memory/4724-160-0x00007FF885A70000-0x00007FF885A80000-memory.dmpFilesize
64KB
-
memory/4724-161-0x00007FF885A70000-0x00007FF885A80000-memory.dmpFilesize
64KB
-
memory/4724-162-0x00007FF885A70000-0x00007FF885A80000-memory.dmpFilesize
64KB
-
memory/4724-163-0x00007FF8838B0000-0x00007FF8838C0000-memory.dmpFilesize
64KB
-
memory/4724-164-0x00007FF8838B0000-0x00007FF8838C0000-memory.dmpFilesize
64KB
-
memory/4808-156-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/4808-139-0x0000000000000000-mapping.dmp
-
memory/4808-147-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/5028-153-0x0000000000400000-0x00000000004A0000-memory.dmpFilesize
640KB
-
memory/5028-149-0x0000000000000000-mapping.dmp